Hot answers tagged detection
20
Is there any documented malicious API calls somewhere.. I couldn't find one in paper.
No, because all API calls can be both valid and malicious, depending on context. In terms of analysing a piece of malware, this is something you normally do by hand.
A quick primer on Windows executables looks like this: All windows executables that make API calls ...
17
UPDATED
I would check the following:
Logs. If you have root access you should check things like history which will give you command history and log files in /var/logs.
Baseline. If you have a baseline like file hashes to work with for application and system files this will help a lot. You can also use backups to compare a previous state. If using a backup ...
15
Yes there is, the suckit rootkit as featured in Phrack is one such example, which modifies the linux kernel via /dev/kmem. Essentially, the goals remain the same - replace entries in the system call table to do what we want them to do. The difference here being that the modification is done via /dev/kmem.
The grsecurity/PaX patches for the kernel include ...
13
If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting.
If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting.
You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...
12
The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own.
However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).
7
The best thing you can do is have a known clean copy of your site that you can compare the server's files against. Most hacked webservers that serve virus infections come from changing the content of scripting files that server is offering to clients. Look for files with different checksums or new files.
There are also cases with forums type sites where the ...
7
It sounds like you want a tamper-evident security seal. There are many commercial offerings. You can look at tamper-evident tape, cable seals, padlock seals, and many other options. I recommend that you read background information from Argonne National Laboratory, which has done some of the best research on the security of these seals.
Let me warn you of ...
7
Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...
6
Why do you assume the user would notice? Starting a program takes a bit of CPU, a bit of RAM, causes a few disk accesses, but that's pretty low-key. Even geeks who have a CPU meter or other common system monitor in their task bar will probably assume it's just some Javascript on a timer in an opened web page, or a garbage collector, or a scheduled task in ...
6
you can check the following links NMap OS Detection
and Paper About Nmap Detection
you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon.
From NMap OS Detection:
...dozens of tests such as TCP ISN sampling, TCP options support and
ordering, IP ID ...
5
You would be surprised how common it is to detect an attack, send an attack report to the company whose IP address the attack comes from, and get a response back reporting that the compromised machine has been quarantined thanks to your report. Part of being a good network citizen is helping other administrators to detect and respond to compromised systems ...
4
There are entire labs of people at antivirus vendors doing this. Easiest would be to submit it it one. Sophos, McAfee, Symantec etc
From a number of presentations I have seen, analysis typically involves looking for unusual behaviour or content in the binary. Behaviour ironically looks like AV behaviour. Hooks into system calls, hyjacking browser objects, ...
4
As @Dgarcia said, a quick method is to use something like Tripwire or other tool which monitors files or the hashes of files to check for changes. This works to identify servers compromised by many types of attack.
It may not work for ones where a rootkit has been installed that counteracts this process.
It will not work for servers which have fallen prey ...
4
Disclaimer. IBM Site Protector is proprietary, so I cannot answer specific questions about it. But I'll share my impression of network-based IDS/IPS systems, in general.
Effectiveness at detecting certain attacks. You asked about how effective IDSs are at detecting certain specific kinds of attacks:
Port scans. I'd expect IDS systems to be pretty ...
4
IDSs will probably be about as effective at detecting targeted attacks as non-targeted attacks.
I wonder if there might be some misunderstanding about what a "targeted attack" is. The difference between a targeted attack and a non-targeted attack is in whether the attacker tries hacking everyone or hacking just you. Targeted vs non-targeted is orthogonal ...
4
This is a tough question to answer because it is so broad. There are two categories of "hacks" in my book - minor and serious. I would class a rootkit in the serious category and your average script injection attack as minor. While with minor attacks you can clean them up, you can't be 100% certain you've removed them or closed all access to repeat the ...
4
What the article says is that the virus contains a lot of specific code aimed at defeating anti-virus -- both the AV software itself, and the analysis techniques used by AV developers to figure out what the virus does. In the specific paragraph you quote, that's the latter which is discussed: the virus code alters its behaviour when it detects that it is ...
4
By definition, that is a NIDS. That may or may not be enough for your project.
What is possibly more important for a real world NIDS is how it is updated, how is is tuned, how it is managed, how it reports on exceptions or alerts etc. Any of the following would be useful in a NIDS.
Updates - using Snort signatures is useful. Is there any ...
4
It depends what's in it. If it finds del /F /S /Q C:\* inside a Windows batch file, sure, some AVs might flag it up as suspicious. If it's a byte-for-byte copy of a known malicious script, sure, some AVs might catch it.
In general, batch scripts are too variable in order to write a working malicious script detector that catches new or "custom" malware ...
3
Terry Chia, we meet again xD. Simple put, although technologies to track hackers are present, there are a number of constraints on governments that prevent them from doing so. That said, a private individual working as a blackhat will probably have better chances to track a particular hacker.
To begin with, the main reason law enforcement agencies arrest ...
3
IP Blocking
Blocking an IP based on pattern may not be as bad as you think. You can block the pattern without blocking the IP, for instance (block xmas tree scans, invalid packets, invalid states), which a benign host would never be sending. These patterns would not affect normal traffic to a site from the same IP.
If an attacker is attacking your ...
3
If you have people connecting to mysql you have already seriously fucked up. You need to change your firewall settings to make sure that only trusted hosts can connect and no one else.
An attacker could easily summon a bot net of 1,000,000 in size to brute force your mysql server. You need a white list approach to this problem.
3
An option is to setup OSSEC (Host-Based Intrusion Detection System):
The default mysql ruleset includes checking for:
rule-id-50105
Database authentication success.
rule-id-50106
Database authentication failure.
rule-id-50107
Database query.
rule-id-50108
User disconnected from database.
rule-id-50120
Database ...
3
If you're worried about hardware theft, then get them to sign off on the inventory you have there. Make that list detailed and include serial numbers from everything such as the RAM etc.
HP has an inventory checker that will compare swapped out parts from a baseline. It only works with HP servers, but may be worth looking at.
3
My question then, is how does this
happen without users being aware? If
you spam PDF or Java or media player
exploits, surely the users would
notice these programs opening up?
Users need not be aware of it. If you browse to an exploit page made by a recent malware, it is going to exploit an unpatched or recently-patched flaw in your browser. ...
3
To statically analyse a program on the assembly level to figure out if it is malicious sounds very very difficult. If you could do that I imagine you would be able to find any bug in a executable also. If you would just search for dangerous calls, like file systems accesses, you'd find many many programs doing that without being malicious. Using the file ...
3
There is no one solution to this complex problem.
A client can enable the Do Not Track http header element. But there is no guarentee that the server will respect it. The PrivacySuite addon goes one step further to actively block tracking gadgets. There are *MANY* other anti-tracking addons for firefox as well as some for Chrome and I have no idea ...
3
Many P2P software will create hashes of each piece to prevent a malicious entity from modifying the pieces in-flight. When your P2P client gets a piece, it verifies it's hash. This will prevent one malicious entity modifying a piece of a valid file, but it won't help you if the file itself (qwerty.mp3) is malicious.
If the file itself is malicious, a simple ...
3
It can actually be quite difficult to do this, depending on the number of pieces of software that you've got installed and running on your system as a lot of legitimate software will make connections to the Internet without explicitly notifying you (everything from Dropbox to spotify to ...).
Also most websites these days use CDNs for content so will make ...
3
Netstat isn't the tool to use to find malicious traffic. The reasons are:
It's done by machine. You'd have to be constantly checking every single system's netstat output to find anything. The more systems you have the harder it is to accomplish
If your machine has been hacked you may not see all traffic. Some malware is able to prevent connections from ...
Only top voted, non community-wiki answers of a minimum length are eligible
