Hot answers tagged

74

Given that your laptop was in possession of a government entity with unknown intentions towards you for an extended duration, there's really no way you can restore it to a fully trustworthy state. If you assume the U.S. DHS to be hostile, then the only secure process to move forward with includes: Assume all data on the laptop, and all other confiscated ...


44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


33

This is a great question. Basically, once a device has been seized by an adversary with the level of sophistication as a nation-state, especially the United States, that device and all data contained cannot be trusted. The only safe approach is to not trust that device and destroy it. The Snowden leaks have exposed the various methods in which the ...


30

UPDATED I would check the following: Logs. If you have root access you should check things like history which will give you command history and log files in /var/logs. Baseline. If you have a baseline like file hashes to work with for application and system files this will help a lot. You can also use backups to compare a previous state. If using a backup ...


27

If a website does not use a custom built server to modify the HTTP headers, you can try by examining the order of arrangement in the HTTP response fields. From OWASP: Apache 1.3.23 server: HTTP/1.1 200 OK Date: ... Server: ... Last-Modified: ... ETag: ... Accept-Ranges: bytes Content-Length: ... Connection: ... Content-Type: text/HTML Microsoft IIS ...


25

Depending on your level of paranoia about this and the amount of your code, at the extreme you can move to a LOW-TECH method to circumvent anything that has been done. Buy a cheap printer. Connect it to your laptop. Print out your source code as reams and reams of text. Print out any graphics, layouts etc. Print out any needed user settings. Destroy the ...


15

I believe the term you're looking for is "honeypot".


15

1) So there's no way of knowing they haven't. I feel like that's a bit above their paygrade (and would they have the time to?). It depends on your paranoia level. If your thoughts flow like a tranquil stream after the first spring day, then copy the data to a new machine and move on with life. If you wonder if the dogs howling in your thoughts are messengers ...


14

Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by encrypting the payload against a value that could only be derived by a valid target system - it didn't appear to do anything particularly malicious outside of that ...


13

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


13

Passive detection is called "passive" exactly for that reason: it is not detectable. That's by definition. Now your question might be: is there a way to "emit a signal" (i.e. convey information) that cannot be passively detected ? In fact physicist have found a method, called quantum key distribution. This requires sending photons one by one, and security ...


12

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


11

In some circles, "crypter" and "packer" are synonymous to mean binaries or programs which are self-checking and/or self-modifying. Crypters may, more specifically, mean self-modification that includes encryption and/or code scrambling (see more below). I suggest that you read Chris Eagle's The IDA Pro Book for an introductory understanding of packers and ...


11

Yes, consistently. Viruses must be used and found before a definition is created. APT (Advanced Persistent Threats) are a huge deal in recent times where people will spend years developing viruses, called 0 day threats, for specific targets that will remain undetected for very long periods of time. Viruses like these are usually a product of nation states as ...


11

Creating a honeypot is a common used technique in information security, though probably not the best of ideas for a production environment. Apart from the fact that you add potentially new risks to your application, there may not be much need for such a trap. Failed logins can be monitored by most applications (and/or server daemons) which should give you ...


10

A proxy will by default tell the destination the IP address of the original requester by adding a X-Forwarded-For HTTP header to the original HTTP request. This make it obviously easy for the server, not only to know that you are using a proxy, but also to know your actual IP address, effectively dropping your anonymity. Then you have what is called an ...


9

You could give some of the encoders in the metasploit framework a look. In particular the Polymorphic XOR Additive Feedback Encoder ( Shikata Ga Nai ) might be worth a look, as it is dicussed in the Metasploit Unleashed documentation in regards to bypassing antivirus detection.


9

Those DDOS attacks were performed using a botnet. A botnet is a network of consumer PCs infected with malware. Such botnets are routinely used for a lot of activities, most of them illegal or at least ethically questionable. For that reason the people who control a botnet do their best not to get found. They usually control their botnets using obscure ...


9

It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the data then you might be able to detect it depending on the kind of access and knowledge you have. Some typical examples on how active DPI devices change ...


8

Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...


8

Finding out that a user is using a VPN service provider isn't that difficult. Most of them have static IP addresses for their exit gateways, so it could just be using a list of known IP addresses to identify VPNs. And even when they don't have a list, a simple reverse DNS lookup might tell them that the IP has a hostname which is obviously a VPN provider and ...


7

The best thing you can do is have a known clean copy of your site that you can compare the server's files against. Most hacked webservers that serve virus infections come from changing the content of scripting files that server is offering to clients. Look for files with different checksums or new files. There are also cases with forums type sites where the ...


7

You would be surprised how common it is to detect an attack, send an attack report to the company whose IP address the attack comes from, and get a response back reporting that the compromised machine has been quarantined thanks to your report. Part of being a good network citizen is helping other administrators to detect and respond to compromised systems ...


7

It sounds like you want a tamper-evident security seal. There are many commercial offerings. You can look at tamper-evident tape, cable seals, padlock seals, and many other options. I recommend that you read background information from Argonne National Laboratory, which has done some of the best research on the security of these seals. Let me warn you of ...


7

Why do you assume the user would notice? Starting a program takes a bit of CPU, a bit of RAM, causes a few disk accesses, but that's pretty low-key. Even geeks who have a CPU meter or other common system monitor in their task bar will probably assume it's just some Javascript on a timer in an opened web page, or a garbage collector, or a scheduled task in ...


7

There are many known ways to identify packers. The 'most common' packer UPX and its variations are usually flagged as 'suspicious' by Anti-virus engines due to a signature detection in the EXe. There's a couple of handy tools called: RDG Packer Detector which detects specific packers based on signature checking (presumably the same way AV does it PEiD ...


7

You can try looking if you can get the server to display a native error page. Error pages can be customized by a web developer, but when they aren't, they often reveal a lot of information about the web server. For example, this is the 404 Not Found error page of Apache 2.2.4 running on Unix: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> ...


7

Any one with sufficient access to the network traffic can detect this, All you need is the capability to see all traffic and how its routed (to what TCP Port and IP). The trick is to detect the 'unusual' signature of a port scan over the rest of the traffic (like sequential trying of random ports / specific well-known ports). This can be quite tricky for ...



Only top voted, non community-wiki answers of a minimum length are eligible