The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

6
votes
1answer
120 views

How do I protect myself from the aftermath of the OPM hack?

As a federal employee, I, along with some 4 million other Americans had our information compromised in the recent OPM (office of personal management) hack. Former and current addresses, names of ...
6
votes
1answer
728 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
5
votes
2answers
427 views

Sony Attacks, what would you do?

If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?
5
votes
1answer
228 views

xml library vulnerabilities, regarding post-exploitation

there was some arbitrary code execution that occurred on my os x 10.5 system. this came as a result of opening an xls file with excel for mac. the vnc type program that came with office for mac was ...
5
votes
4answers
578 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
5
votes
1answer
130 views

Modeling vectors of an unknown exploit

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
5
votes
2answers
346 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
5
votes
2answers
884 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
5
votes
2answers
451 views

Enterprise security incident response and detection

I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different ...
5
votes
2answers
87 views

Server Compromised. Steps to determine further damage on the network? [closed]

So one of your servers is compromised. You determine this because you notice a weird process running (as root, unfortunately). No helpful information about this process from Googling around. First ...
5
votes
1answer
372 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
5
votes
1answer
512 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
4
votes
2answers
669 views

How can I find the malicious/backdoor codes without knowing the last modified date?

Last night my website got hacked and attacker edited the main index.php. I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor ...
4
votes
2answers
725 views

Found some malicious Javascript - how did it get there?

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're curious,...
4
votes
1answer
985 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
4
votes
2answers
245 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
4
votes
3answers
1k views

What are the risks of posting my email address to pwnedlist.com?

pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database. Are the people ...
4
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
4
votes
0answers
80 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
3
votes
2answers
437 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
3
votes
3answers
400 views

Gmail account hacked - what was it used for?

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some ...
3
votes
4answers
4k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
257 views

What goes into an average incident response process for a corporate network?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
3
votes
2answers
245 views

Ftp constantly asked for a .exe file, what can i do?

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
3
votes
2answers
147 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
3
votes
3answers
521 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
3
votes
2answers
4k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
123 views

Need some recommendations on good IR hands-on training

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
3
votes
1answer
301 views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
3
votes
1answer
418 views

What is the definition of “multi-failure” disaster recovery?

There are several compliance and certification criteria that mention "multi-failure" disaster recovery. What exactly is the definition of this? A google search did not turn up a clear answer for me.
3
votes
1answer
252 views

eBay account compromised/Credit Card used/Hosts files changed

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
3
votes
2answers
346 views

Automatic harvesting of hacked hosts and reporting to domain/site admin

With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet attacks/...
3
votes
1answer
50 views

Planning Incident Response / Business Continuity

An IT company has already most of the standard procedures / precautions in place to do day-to-day business in a secure way e.g. policies for users what to do and what not to do, technical solutions ...
3
votes
0answers
116 views

attack on Unix procmail analysis

2 days ago I received the following E-mail (this is its original format not the one of any mailer, but where sensitive information is replaced by ••field_name••): From qqqqqq@freemail.net Thu Jul ...
2
votes
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
2
votes
1answer
101 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
2
votes
1answer
50 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
2
votes
1answer
74 views

Incident isolation and containment approach

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported. Compromised systems are disabled or disconnected but operations carries on ...
2
votes
1answer
183 views

Data collection when responding to malware alerts

When investigating malware alerts I would like to collect some information from the system before the decision gets made to take the system off of the network and re-imaged, or if further forensics is ...
2
votes
2answers
50 views

The impact of 'hacking insurance' on the information security industry

I recently attended a general IT conference and saw some interesting vendors of various products and services. One of them was a company providing hacking insurance, and they said that there were two ...
2
votes
1answer
283 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
2
votes
1answer
83 views

Response on targeted attacks against an individual

I'm now an aim for a targeted attack. Someone tries to gather information about me and tries to get access to my accounts. Some time before he/they've managed to succeed (got all the info from my ...
2
votes
1answer
100 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
1
vote
3answers
274 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
1
vote
2answers
1k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
1
vote
2answers
327 views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
1
vote
2answers
4k views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
1
vote
1answer
126 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
1
vote
1answer
339 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
1
vote
2answers
340 views

What are the most relevant security events/incidents any company should monitor? [closed]

What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.