Tagged Questions
-4
votes
1answer
99 views
Am I part of a botnet or hack?
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
-2
votes
0answers
73 views
History of RAT + Strange networking recently… was I hacked again?
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
2
votes
2answers
128 views
How can I find the source of traffic allegedly originating from my IP address?
I have a problem that has been going on for at least 6 weeks.
I have Time Warner for my Internet provider and some websites hosted at GoDaddy.
From what GoDaddy tells me the reason I can not view ...
6
votes
4answers
310 views
Has my network/computer been breached?
I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes.
A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
2
votes
2answers
155 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
2
votes
1answer
72 views
Seeing outboud connections to random domains, how do I isolate the app responsible?
Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like
hghefhhig
How can I go about isolating the application responsible?
I was thinking possibly ...
5
votes
2answers
124 views
How serious is a local virus in terms of network security
I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the ...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
4
votes
4answers
292 views
Malware that uses http as a covert channel
I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.
Is there any database of malware, ...
1
vote
1answer
240 views
DNS query through squid? [closed]
My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?
Snort Alert:
ET POLICY ...
0
votes
1answer
2k views
In Metasploit, how to use a custom exe as payload?
Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
2
votes
1answer
138 views
Can a bad guy be judged for gaining access to sensitive information?
Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
13
votes
3answers
2k views
Recommendations for honeypot software
A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
4
votes
2answers
382 views
Has anyone else seen commands embedded in an ICMP echo request?
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
7
votes
2answers
583 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
