Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

learn more… | top users | synonyms

14
votes
7answers
778 views

Defence Against Keyboard Keylogger

I am wondering whether there is a way to defend against USB Keyboard Keylogger (obviously other than physically checking the keyboard every time after leaving my computer unattended). These days, ...
12
votes
7answers
404 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...
12
votes
4answers
549 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related ...
11
votes
4answers
292 views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
9
votes
1answer
523 views

Cracking PCI terminal using a trojan based on the card

I have come across an article which states the following: According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN ...
8
votes
5answers
355 views

How would you detect whether customer data has been leaked?

I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average ...
8
votes
2answers
196 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
6
votes
3answers
352 views

Firewall says that a program that I'm developing is trying to connect to the Internet

I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever. I'm a software engineer but not ...
6
votes
4answers
548 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
4
votes
5answers
328 views

What would you define as an “advanced” hacker attempt?

This subject might just barely be a programming topic. Though, in my point of view, it is of great concern to programmers because of our responsibility to develop secure code. Recently, there has ...
4
votes
3answers
351 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
4
votes
2answers
290 views

Site listed as hacked by a hacking group

I was Googling one of my domains (hosted on shared hosting) and found a webpage where it was list as Hacked Site, the list belonging to a certain national hacking group (the country they claim to ...
4
votes
1answer
106 views

Security / logging on a Xen-based VPS instance?

Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
4
votes
3answers
3k views

Books to study for GCIA (GIAC Certified Intrusion Analyst)

What set of books would you recommend to study for the GCIA certification without buying official study material? Also, please tell whether your suggestions are based on having completed GCIA ...
3
votes
4answers
237 views

To disconnect or not disconnect an intruder?

Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected. What are the benefits of not disconnecting the ...
3
votes
2answers
388 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
3
votes
3answers
706 views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
3
votes
1answer
770 views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
3
votes
2answers
2k views

When is it posible to sniff VPN traffic?

I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of ...
3
votes
2answers
4k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
2
votes
4answers
867 views

What are the chances of a database being hacked?

How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database. I'm talking about e-commerce websites, and ...
2
votes
3answers
173 views

Avoid third party access to system

I need to go through airport security and customs, and its known that at least the German customs (http://en.wiktionary.org/wiki/Bundestrojaner) (and I suspect others as well) try to upload software ...
2
votes
2answers
315 views

Why superuser or administrator account should never locked?

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made? What should be done instead to alert the staff to the attempted instrusion?
2
votes
2answers
345 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
2
votes
2answers
473 views

How are signatures for IPS determined

For example , how do Snort's VRT team or some one who gives us the signatures, determine them at all ? I would be more interested to know , how are the traffic patterns analyzed against some known ...
2
votes
3answers
320 views

Implementation of an IDS

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the ...
2
votes
3answers
300 views

How to lure a Hacker?

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while ...
2
votes
2answers
105 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
1
vote
2answers
137 views

Identify users accessing hidden link in a website

Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it). Any way, I found that there were plenty of ...
1
vote
3answers
205 views

How to check if our clients were compromised by security breaches in other web applications?

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media. In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) ...
1
vote
2answers
742 views

How to Secure My DropBox Installation?

I am sharing a DropBox Folder with by Friends for a project so that we can be updated with each other progress. But i was not very convince after reading the How secure is Dropbox?. What if one of my ...
1
vote
1answer
127 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
1
vote
2answers
540 views

Where can I find worm traffic sample?

I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
1
vote
1answer
430 views

types of intrusions on host [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
1
vote
1answer
88 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
1
vote
0answers
53 views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
1
vote
1answer
112 views

Intrusions attempt monitoring (on MacOS X) [closed]

I know utilities such as last exist - but not sure if it's applicable for my needs - I'd like a system to notify me of any login attempts on any of my macs (home, work or remote). Attempts from a ...
1
vote
0answers
60 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
0
votes
3answers
227 views

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
0
votes
1answer
163 views

What defines a 'defense contractor' and what is required to be reported in new US law? [closed]

According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a ...
0
votes
2answers
230 views

Easy way to analyse my netstats for intrusions?

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway. When I issue a netstat -a, I see various ...
0
votes
3answers
255 views

Why there are uninvited incoming packets to my ADSL connection?

To verify this, I boot my PC from Kali Linux live distro. Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device. Then I create the connection to ISP network. ...
0
votes
2answers
59 views

Statistics about Significant security breaches in 2013 [closed]

I am curious in general if there are any reporting that collects statistics about the security breaches? like per country per industry and revenue losses? I am not interested in anonymized breaches ...
0
votes
1answer
78 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
2answers
164 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to ...
0
votes
2answers
404 views

Could my computer be infiltrated if someone knows my external IP? [closed]

Could my computer be compromised if someone knew my external IP? I know that when you type that in it just goes into the router page, but my computer is connected to said router. If so, what is the ...
0
votes
1answer
285 views

What are the most sophisticated techniques used by intruders you have found in the wild?

I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat). Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the ...
0
votes
1answer
311 views

Rules for log analysis in an IDS

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...
-1
votes
1answer
138 views

Can we identify if someone is keeping an eye on our computer usage?

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was ...
-1
votes
1answer
331 views

When I open my gmail account,this shows,does this mean my account is hacked? [closed]

When I open my gmail acccount I see a dialogue box that reads like shown in the image?Does it mean my account is hacked?