Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

learn more… | top users | synonyms

23
votes
2answers
11k views

How does WiFi password cracking work?

Let's say I have a wireless network that is password protected. What procedures can an intruder take to gain access to my wireless network, or at least be able to decipher the packets I am sending ...
18
votes
7answers
2k views

Defence Against Keyboard Keylogger

I am wondering whether there is a way to defend against USB Keyboard Keylogger (obviously other than physically checking the keyboard every time after leaving my computer unattended). These days, ...
15
votes
4answers
694 views

what to do after suspected intrusion on hobby webserver

I maintain a server to host my files and a number of websites for hobbies and friends. I just noticed that the site summary being returned in google for one of my domains were all porn related (...
13
votes
3answers
808 views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
12
votes
7answers
583 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...
11
votes
3answers
2k views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
10
votes
1answer
752 views

Cracking PCI terminal using a trojan based on the card

I have come across an article which states the following: According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN ...
9
votes
5answers
685 views

How would you detect whether customer data has been leaked?

I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average ...
8
votes
3answers
333 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
7
votes
3answers
704 views

Firewall says that a program that I'm developing is trying to connect to the Internet

I'm seriously confused about this, since the program is entirely developed by myself and has no means/functionality to connect to any network/the internet whatsoever. I'm a software engineer but not ...
7
votes
4answers
2k views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
7
votes
2answers
557 views

How exactly was Sony Pictures hacked November 2014? [closed]

There is lots of media coverage like this one but I have not yet been able to find details on how the hackers got into the network, the servers and the users' systems. So what vulnerabilities / zero-...
6
votes
4answers
2k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until today,...
5
votes
5answers
444 views

What would you define as an “advanced” hacker attempt?

This subject might just barely be a programming topic. Though, in my point of view, it is of great concern to programmers because of our responsibility to develop secure code. Recently, there has ...
5
votes
4answers
2k views

What are the chances of a database being hacked?

How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database. I'm talking about e-commerce websites, and ...
5
votes
2answers
6k views

When is it posible to sniff VPN traffic?

I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of ...
4
votes
3answers
468 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
4
votes
2answers
151 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
4
votes
1answer
73 views

Detect PC Boot from Live CD

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained? I suspect my PC has been booted through a ...
4
votes
2answers
318 views

Site listed as hacked by a hacking group

I was Googling one of my domains (hosted on shared hosting) and found a webpage where it was list as Hacked Site, the list belonging to a certain national hacking group (the country they claim to ...
4
votes
1answer
3k views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
4
votes
1answer
134 views

Security / logging on a Xen-based VPS instance?

Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
4
votes
3answers
7k views

Books to study for GCIA (GIAC Certified Intrusion Analyst) [closed]

What set of books would you recommend to study for the GCIA certification without buying official study material? Also, please tell whether your suggestions are based on having completed GCIA ...
4
votes
2answers
17k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
4answers
283 views

To disconnect or not disconnect an intruder?

Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected. What are the benefits of not disconnecting the ...
3
votes
1answer
195 views

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
3
votes
3answers
208 views

Can closed, sleeping MacBook send network data?

I would think the answer is unequivocally, "No." But... My MacBook Pro logged "Diagnostic and Usage Messages" in the Console, at 4:19am, while it was physically closed and (therefore) sleeping. I was ...
3
votes
2answers
994 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
3
votes
3answers
1k views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
3
votes
4answers
99 views

What kinds of attacks would be missed if we don't look at both host and network activity

Suppose I have both network based IDS and host based IDS installed in my environment, will I miss any security attacks if I don't correlate the information from these sources? If so, what are they? It ...
3
votes
1answer
2k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
3
votes
1answer
140 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
3
votes
0answers
180 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
2
votes
3answers
204 views

Avoid third party access to system

I need to go through airport security and customs, and its known that at least the German customs (http://en.wiktionary.org/wiki/Bundestrojaner) (and I suspect others as well) try to upload software ...
2
votes
2answers
410 views

Why superuser or administrator account should never locked?

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made? What should be done instead to alert the staff to the attempted instrusion?
2
votes
2answers
699 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
2
votes
2answers
1k views

How are signatures for IPS determined

For example , how do Snort's VRT team or some one who gives us the signatures, determine them at all ? I would be more interested to know , how are the traffic patterns analyzed against some known ...
2
votes
3answers
521 views

Implementation of an IDS

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the ...
2
votes
3answers
369 views

How to lure a Hacker?

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while ...
2
votes
2answers
427 views

What are the most sophisticated techniques used by intruders you have found in the wild?

I am beginning to get involved in incidents, some of them are APT (Advanced Persistent Threat). Despite the complexity available in the 'bibliography' and in the conferences or security e-zine, the ...
2
votes
1answer
53 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
2
votes
2answers
268 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: http://www.symantec.com/security_response/attacksignatures/...
2
votes
1answer
77 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
2
votes
1answer
128 views

How easily will the vBulleting data from vBulletin and Foxit be cracked? What data is at risk? How was it encryted?

vBulletin Solutions and Foxit Software were breached. The culprit (ColdZer0 or Coldroot) claims to have data from 479,895 vBulletin Service and Foxit Software accounts that include identifiers, ...
2
votes
1answer
633 views

kernel: Intrusion IN=ppp0 on my Fairpoint assigned router from IP in China

I'm getting these user alerts: kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=115.230.125.147 DST=xx.xxx.xxx.xxx LEN=40 TOS=0x08 PREC=0x20 TTL=107 ID=256 PROTO=TCP SPT=64316 DPT=9064 WINDOW=15500 RES=...
2
votes
2answers
313 views

Domain and IP scoring

What kind of things would you check in a domain and IP scoring system? Which things are the most important? If I have a web site or web service, I would like to figure out a score for my visitor. If ...
2
votes
0answers
42 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
1
vote
3answers
65 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
1
vote
3answers
424 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...