The art of responding to incidents in an organized and thoughtful manner.
8
votes
4answers
2k views
IIS logs show someone is trying to hack my site, what should I do?
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: ...
11
votes
2answers
780 views
What should be included in a jump bag and how often should it be reviewed?
What items should be included in a jump bag? How often do you review your jump bag?
17
votes
2answers
430 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
6
votes
7answers
549 views
If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?
According to Mandiant, you should not:
Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole”
... as described here: http://blog.mandiant.com/archives/1525
...
3
votes
2answers
417 views
How do I run a security check on my WordPress server?
I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.
But I don't know how ...
13
votes
4answers
253 views
What should I look at in the event of a major vendor suffering compromise with unspecified impact?
The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
9
votes
2answers
107 views
Encouraging security researchers to disclose vulnerabilities
What are approaches to forming solid relationships with security researchers?
For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
8
votes
3answers
804 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
7
votes
4answers
559 views
Gmail account hack prevention and recovery
I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back.
The associated phone number and recovery email can be changed, in fact I ...
3
votes
2answers
513 views
Found some malicious Javascript - how did it get there?
Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
3
votes
4answers
875 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
