The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

5
votes
2answers
424 views

Sony Attacks, what would you do?

If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?
5
votes
1answer
221 views

xml library vulnerabilities, regarding post-exploitation

there was some arbitrary code execution that occurred on my os x 10.5 system. this came as a result of opening an xls file with excel for mac. the vnc type program that came with office for mac was ...
5
votes
4answers
564 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
5
votes
1answer
129 views

Modeling vectors of an unknown exploit

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
5
votes
2answers
306 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
5
votes
2answers
882 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
5
votes
2answers
431 views

Enterprise security incident response and detection

I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different ...
5
votes
1answer
485 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
5
votes
1answer
349 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
4
votes
2answers
639 views

How can I find the malicious/backdoor codes without knowing the last modified date?

Last night my website got hacked and attacker edited the main index.php. I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor ...
4
votes
2answers
718 views

Found some malicious Javascript - how did it get there?

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
4
votes
1answer
889 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
4
votes
2answers
232 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
4
votes
3answers
1k views

What are the risks of posting my email address to pwnedlist.com?

pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database. Are the people ...
4
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
4
votes
0answers
74 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
3
votes
2answers
432 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
3
votes
3answers
316 views

Gmail account hacked - what was it used for?

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some ...
3
votes
4answers
4k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
232 views

What goes into an average incident response process for a corporate network?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
3
votes
2answers
230 views

Ftp constantly asked for a .exe file, what can i do?

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
3
votes
2answers
134 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
3
votes
3answers
480 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
3
votes
2answers
3k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
1answer
241 views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
3
votes
1answer
345 views

What is the definition of “multi-failure” disaster recovery?

There are several compliance and certification criteria that mention "multi-failure" disaster recovery. What exactly is the definition of this? A google search did not turn up a clear answer for me.
3
votes
1answer
245 views

eBay account compromised/Credit Card used/Hosts files changed

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
2answers
318 views

Automatic harvesting of hacked hosts and reporting to domain/site admin

With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet ...
3
votes
0answers
112 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul ...
2
votes
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
2
votes
1answer
138 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
1answer
222 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
2answers
76 views

ISO27001 Certification - Business Incident

We have a defined and certified scope. If we have a business event that impacts the services or a building that is "in" scope and we have to shut that building down and recover services to another ...
2
votes
1answer
100 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
1
vote
3answers
265 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
1
vote
2answers
75 views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
1
vote
1answer
124 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
1
vote
2answers
3k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
1
vote
1answer
322 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
1
vote
2answers
305 views

What are the most relevant security events/incidents any company should monitor? [closed]

What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
1
vote
1answer
39 views

Incident isolation and containment approach

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported. Compromised systems are disabled or disconnected but operations carries on ...
1
vote
1answer
66 views

Security server log review [closed]

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
1
vote
1answer
487 views

Incident database? [duplicate]

Possible Duplicate: Resources for data on security incidents Do you know any websites where they put Information about Security Incidents that happened to organizations/people (e.g. ...
1
vote
2answers
230 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
0
votes
2answers
484 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
0
votes
2answers
2k views

What is the incident Plan and Disaster recovery plan for Fire

My boss is asking me to prepare the fire incident Plan(IR) and Disaster recovery plan(DR), and how can we determine it is IR / DR. I am no clue on those issue. What should I do?
0
votes
3answers
1k views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
0
votes
1answer
988 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
0
votes
2answers
348 views

Unexplained downloading

I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark. The ...
0
votes
1answer
450 views

IR Jump Bag - What kind of bag/container to use?

I am working on putting together an Incident Response Jump Bag (detailed here). Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...