Tag Info

Hot answers tagged

18

UPDATED I would check the following: Logs. If you have root access you should check things like history which will give you command history and log files in /var/logs. Baseline. If you have a baseline like file hashes to work with for application and system files this will help a lot. You can also use backups to compare a previous state. If using a backup ...


13

If you can send packets to the target machine, use nmap -O, which provides OS fingerprinting. If you can eavesdrop/intercept network traffic with the target machine, use pof, a tool for passive OS fingerprinting. You didn't provide much information about what are your constraints or why the standard tools (like nmap or pof) didn't work for you. Therefore, ...


12

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


10

In some circles, "crypter" and "packer" are synonymous to mean binaries or programs which are self-checking and/or self-modifying. Crypters may, more specifically, mean self-modification that includes encryption and/or code scrambling (see more below). I suggest that you read Chris Eagle's The IDA Pro Book for an introductory understanding of packers and ...


8

You could give some of the encoders in the metasploit framework a look. In particular the Polymorphic XOR Additive Feedback Encoder ( Shikata Ga Nai ) might be worth a look, as it is dicussed in the Metasploit Unleashed documentation in regards to bypassing antivirus detection.


8

Those DDOS attacks were performed using a botnet. A botnet is a network of consumer PCs infected with malware. Such botnets are routinely used for a lot of activities, most of them illegal or at least ethically questionable. For that reason the people who control a botnet do their best not to get found. They usually control their botnets using obscure ...


7

It sounds like you want a tamper-evident security seal. There are many commercial offerings. You can look at tamper-evident tape, cable seals, padlock seals, and many other options. I recommend that you read background information from Argonne National Laboratory, which has done some of the best research on the security of these seals. Let me warn you of ...


7

The best thing you can do is have a known clean copy of your site that you can compare the server's files against. Most hacked webservers that serve virus infections come from changing the content of scripting files that server is offering to clients. Look for files with different checksums or new files. There are also cases with forums type sites where the ...


7

Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...


6

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon. From NMap OS Detection: ...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID ...


6

Why do you assume the user would notice? Starting a program takes a bit of CPU, a bit of RAM, causes a few disk accesses, but that's pretty low-key. Even geeks who have a CPU meter or other common system monitor in their task bar will probably assume it's just some Javascript on a timer in an opened web page, or a garbage collector, or a scheduled task in ...


6

There are many known ways to identify packers. The 'most common' packer UPX and its variations are usually flagged as 'suspicious' by Anti-virus engines due to a signature detection in the EXe. There's a couple of handy tools called: RDG Packer Detector which detects specific packers based on signature checking (presumably the same way AV does it PEiD ...


6

I can think of some ways: Malware connect to C&C server. if you monitor your traffic (as sensitive system should be monitored) - than you find unusual traffic that can be sign (and should be investigated) If the malware uses USB flash drives to spread itself, and you have different computer platforms in your environment (e,g: windows, mac, linux and ...


5

As @Dgarcia said, a quick method is to use something like Tripwire or other tool which monitors files or the hashes of files to check for changes. This works to identify servers compromised by many types of attack. It may not work for ones where a rootkit has been installed that counteracts this process. It will not work for servers which have fallen prey ...


5

You would be surprised how common it is to detect an attack, send an attack report to the company whose IP address the attack comes from, and get a response back reporting that the compromised machine has been quarantined thanks to your report. Part of being a good network citizen is helping other administrators to detect and respond to compromised systems ...


5

Disclaimer. IBM Site Protector is proprietary, so I cannot answer specific questions about it. But I'll share my impression of network-based IDS/IPS systems, in general. Effectiveness at detecting certain attacks. You asked about how effective IDSs are at detecting certain specific kinds of attacks: Port scans. I'd expect IDS systems to be pretty ...


5

This is a tough question to answer because it is so broad. There are two categories of "hacks" in my book - minor and serious. I would class a rootkit in the serious category and your average script injection attack as minor. While with minor attacks you can clean them up, you can't be 100% certain you've removed them or closed all access to repeat the ...


5

By definition, that is a NIDS. That may or may not be enough for your project. What is possibly more important for a real world NIDS is how it is updated, how is is tuned, how it is managed, how it reports on exceptions or alerts etc. Any of the following would be useful in a NIDS. Updates - using Snort signatures is useful. Is there any ...


5

In addition to the verification methods you've provided, Web services keep track of users using the following methods. Usually a failure in any of these services can cause a site to block access or lock an account. Cookies These are text files that a website will send to your browser when you access a site or service. These files contain information ...


5

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to ...


4

Terry Chia, we meet again xD. Simple put, although technologies to track hackers are present, there are a number of constraints on governments that prevent them from doing so. That said, a private individual working as a blackhat will probably have better chances to track a particular hacker. To begin with, the main reason law enforcement agencies arrest ...


4

IDSs will probably be about as effective at detecting targeted attacks as non-targeted attacks. I wonder if there might be some misunderstanding about what a "targeted attack" is. The difference between a targeted attack and a non-targeted attack is in whether the attacker tries hacking everyone or hacking just you. Targeted vs non-targeted is orthogonal ...


4

What the article says is that the virus contains a lot of specific code aimed at defeating anti-virus -- both the AV software itself, and the analysis techniques used by AV developers to figure out what the virus does. In the specific paragraph you quote, that's the latter which is discussed: the virus code alters its behaviour when it detects that it is ...


4

It depends what's in it. If it finds del /F /S /Q C:\* inside a Windows batch file, sure, some AVs might flag it up as suspicious. If it's a byte-for-byte copy of a known malicious script, sure, some AVs might catch it. In general, batch scripts are too variable in order to write a working malicious script detector that catches new or "custom" malware ...


4

Reliably detecting Cross-Site Scripting is a relatively complex task, just inserting a string with no control characters and looking for it in the response, is a very bad idea as you'll be swamped by false positives. What most scanners to is take a series of standard vectors (e.g. ">< script >alert(1)< /script ><") and then look at the response ...


4

For every file format a program meant to process is associated. For e.g a PDF can be processed by a program capable of parsing pdf format. While processing each format, certain parsing and processing of data is involved. Malwares are crafted to exploit the vulnerabilities of these processing programs. By assigning an extension, the file format is easily ...


4

You are approaching the problem from an entirely wrong perspective. Whatever is on the client-side is out of your control. Any determined enough person will be able to bypass whatever measures you employ. Instead, have your server control and validate the important data. There's no reason for game money to be controlled by the client unless it is a ...


4

You can never fully protect the client from tampering. If you're dealing with in-game money, it's one thing to deal with cheaters. They can unbalance the game and spoil it for everyone. But when you're dealing with actual, paid-for-with-hard-currency real-world U.S. Dollar money, it's another problem entirely. Your first concern will be risk ...



Only top voted, non community-wiki answers of a minimum length are eligible