Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

learn more… | top users | synonyms

1
vote
2answers
164 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
1
vote
0answers
38 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
1
vote
0answers
102 views

Browser version 0.0 in visitor logs [closed]

I am seeing quite a few browser "version 0.0" in visitor log. Can anyone explain the significance of this? Please see examples below. Thanks. Safari version 0.0 running on ChromeOS Chrome version ...
1
vote
1answer
439 views

Intrusions attempt monitoring (on MacOS X) [closed]

I know utilities such as last exist - but not sure if it's applicable for my needs - I'd like a system to notify me of any login attempts on any of my macs (home, work or remote). Attempts from a ...
1
vote
0answers
121 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
0
votes
1answer
190 views

What defines a 'defense contractor' and what is required to be reported in new US law? [closed]

According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a ...
0
votes
2answers
284 views

Easy way to analyse my netstats for intrusions?

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway. When I issue a netstat -a, I see various ...
0
votes
3answers
739 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
433 views

My cookies have been stolen. What to do?

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in ...
0
votes
2answers
217 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to ...
0
votes
3answers
582 views

Why there are uninvited incoming packets to my ADSL connection?

To verify this, I boot my PC from Kali Linux live distro. Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device. Then I create the connection to ISP network. ...
0
votes
1answer
52 views

What to do when a Linux account gets owned?

What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections? For ...
0
votes
2answers
100 views

Statistics about Significant security breaches in 2013 [closed]

I am curious in general if there are any reporting that collects statistics about the security breaches? like per country per industry and revenue losses? I am not interested in anonymized breaches ...
0
votes
1answer
273 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
135 views

Puzzle: network intrusion or OpenDNS/Disconnect.me collision?

My home / home-office network uses OpenDNS as a content filter. As the OpenDNS admin, I received a "User wants access to..." email indicating that someone tried to access a blocked site and requested ...
0
votes
1answer
51 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by ...
0
votes
2answers
1k views

Could my computer be infiltrated if someone knows my external IP? [closed]

Could my computer be compromised if someone knew my external IP? I know that when you type that in it just goes into the router page, but my computer is connected to said router. If so, what is the ...
0
votes
1answer
448 views

Rules for log analysis in an IDS

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...
-1
votes
2answers
160 views

What are security risks of connecting to my home vpn from my work?

I connected to my home-made VPN, which uses OpenVPN and 2048bits encryption keys, from my work. What are the security risks of doing so, given the fact that the servers are in the same network my ...
-1
votes
1answer
271 views

Can we identify if someone is keeping an eye on our computer usage?

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was ...
-1
votes
1answer
467 views

When I open my gmail account,this shows,does this mean my account is hacked? [closed]

When I open my gmail acccount I see a dialogue box that reads like shown in the image?Does it mean my account is hacked?
-1
votes
3answers
530 views

How information in an access log could be used to identify the true identity of an impostor?

Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different ...
-1
votes
2answers
3k views

How could the hacker tamper with the 'configuration.php' file in my Joomla web server?

I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so? Note that the file has 777 permission. Also, ...
-1
votes
3answers
205 views

Activity's history to suspect an intrusion

I was hacked one month ago - a person who borrowed my device installed a key logger. Now, I have a new issue, sometimes when I open my computer in the morning, it is totally low battery, though it ...
-1
votes
1answer
841 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
-1
votes
1answer
71 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
-2
votes
1answer
151 views

What do I need to worry about when moving from a compromised system to a clean one?

As a result of a targeted attack, my computer was compromised? What should I be worried about when trying to move to a new system and prevent reinfection? I purchased a new clean computer and am ...
-2
votes
2answers
90 views

Block all kind of querys from ip [closed]

I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
-4
votes
1answer
192 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...