The art of responding to incidents in an organized and thoughtful manner.
4
votes
2answers
265 views
How can I find the malicious/backdoor codes without knowing the last modified date?
Last night my website got hacked and attacker edited the main index.php.
I was wondering even he edited that file, the last modified date did not change.
so I just worry if he would put the backdoor ...
2
votes
3answers
83 views
Responsible Disclosures and Getting Sued
Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
1
vote
2answers
73 views
Is it advisable to fully record terminal interaction for incident response?
We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
7
votes
3answers
726 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
5
votes
2answers
3k views
How can I detect/withstand DNS amplification attack?
I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
4
votes
2answers
57 views
Incident Reporting or Notification Policy domain?
I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization.
...
0
votes
0answers
40 views
Where can I obtain publicly available data about security attacks in Asia and Pacific? [closed]
I am trying to run an analysis of trends of security attacks with respect to world events (i.e. oil price hike induces an increased amount of attacks on oil companies).
The scope of my project is ...
17
votes
6answers
963 views
Best practices for handling computer viruses
I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.
In a small-to-medium ...
0
votes
1answer
374 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
1
vote
1answer
79 views
Compromised server with psyBNC - what are our next steps?
One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
0
votes
3answers
123 views
If my server was compromised, is my database safe?
I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
8
votes
4answers
291 views
Next steps after webmail account was compromised
John Doe told me the following story:
I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
1
vote
4answers
526 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
3
votes
2answers
196 views
How to satisfy requirement 10.6 of PCI DSS?
The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
102 views
What goes into an average incident response process for a corporate network?
I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
2
votes
1answer
81 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
16
votes
5answers
465 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
6
votes
2answers
248 views
Will reporting phishing emails cause problems for the victim?
On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
1answer
106 views
How to know what's the type of an attack and from whom is sent?
I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.
How do I know what kind of attack it is and from whom is sent?
When he attacks, the RDP freezes and the ...
17
votes
10answers
1k views
Is it ever appropriate to fight back?
When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
5
votes
1answer
142 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
1answer
2k views
Wireless Adapters for Testing with BackTrack
I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
0
votes
0answers
64 views
Handler's log solution for incident response [closed]
I am looking for a incident response handler's log solution that would scale well to record up to 1000 incidents/yr.
What do people use? Any good templates out there? Any software, preferably open ...
-1
votes
1answer
248 views
Extremely suspicious phone call — what to do? [closed]
Two days ago, I received a call. Someone with a female, possibly asian voice asked "are you using your computer in internet right now." I said "yes", then asked "who are you?". At this point, they ...
31
votes
5answers
772 views
How do I respond to a published security vulnerability in my application?
In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity.
On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
0
votes
0answers
69 views
How to decode this runforestrun gootkit [closed]
Infected site is hxxp://www.infraredpsi.com/Pluginlab/Scripts/menuscript.js
online scan result:
http://urlquery.net/report.php?id=141893
I can de-obfuscate the first layer of the code that use the ...
23
votes
7answers
599 views
Fostering an environment where honesty and disclosure are valued
UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
0
votes
0answers
79 views
What is the future of SOC? [closed]
Hi can anyone says working in security operation center (incident response) would be challenging and career growth. i am currently working in application security domain. comparing app security vs soc ...
3
votes
2answers
425 views
How do I run a security check on my WordPress server?
I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.
But I don't know how ...
3
votes
2answers
147 views
Ftp constantly asked for a .exe file, what can i do?
I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
4
votes
3answers
262 views
What are the risks of posting my email address to pwnedlist.com?
pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.
Are the people ...
4
votes
1answer
256 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
3
votes
4answers
891 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
-2
votes
3answers
328 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
8
votes
4answers
502 views
How to track a laptop after theft?
Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.
...
0
votes
1answer
257 views
IR Jump Bag - What kind of bag/container to use?
I am working on putting together an Incident Response Jump Bag (detailed here).
Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...
8
votes
4answers
2k views
IIS logs show someone is trying to hack my site, what should I do?
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: ...
3
votes
1answer
165 views
eBay account compromised/Credit Card used/Hosts files changed
To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
2answers
240 views
Unexplained downloading
I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark.
The ...
1
vote
1answer
152 views
What are the most relevant security events/incidents any company should monitor?
What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
11
votes
1answer
712 views
How to make a report after a ddos attack? what information do I need to write on the report?
In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.
What do you think I need to write down in my report?
Is there any ...
3
votes
2answers
132 views
Automatic harvesting of hacked hosts and reporting to domain/site admin
With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet ...
1
vote
1answer
172 views
Incident database? [duplicate]
Possible Duplicate:
Resources for data on security incidents
Do you know any websites where they put Information about Security Incidents that happened to organizations/people (e.g. ...
4
votes
3answers
281 views
Is it harmful to redirect web bugs to localhost on hosts file?
I was checking the article hosts file on Wikipedia, and I found this:
Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
7
votes
4answers
565 views
Gmail account hack prevention and recovery
I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back.
The associated phone number and recovery email can be changed, in fact I ...
9
votes
2answers
107 views
Encouraging security researchers to disclose vulnerabilities
What are approaches to forming solid relationships with security researchers?
For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
6
votes
3answers
605 views
How should a web page respond to a CSRF attack?
I know that you use tokens to prevent CSRF, but how should the receiving page respond when it is attacked? Should it fail silently, pretending the transaction was successful? Display an error message? ...
5
votes
3answers
208 views
Disclosing security vulnerabilities to paying customers first
Particular case
An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
0
votes
1answer
170 views
System image that does not allow for recovery of deleted files?
We are working with an contractor regarding a compromised computer. The contractor has asked for a dd dump of the drive. However, my understanding is that dd would allow the contractor to recover ...
