New answers tagged

1

Without checking too deep, I would say WP is the top risk in that list. I assume its updated, so you should check its settings and the plugins you have installed. Check this article: https://isc.sans.edu/forums/diary/Wordpress+Pingback+DDoS+Attacks/17801 Sucuri detected an interesting "reflective" attack using the Wordpress Pingback feature to attack ...


0

user2765654's answer covers most of your question, but its worth pointing out that a sniffer does not install malware. Further if you have "reinstalled Windows to factory settings" then you've made your system to a whole lot of attacks - you need to install all the patches (and preferably without connecting to the internet). You should also be changing all ...


0

Which apps within Parrot will identify a packet sniffer on the network? As long as there is just sniffing going on, you're out of luck, because that happens passively. The way sniffing works, is by showing you all the packages going through the network, not just those directed at you. So what normally happens is that your device actively filters out all ...


0

Can multiple transactions of the same amount in a short time be considered fraud/corruption? Yes, its something I monitor (or rather an agent I built monitors). a transaction for the same amount with the same cellphone number within 5 days of a previous transaction erk? Personally I'm looking for multiple events occurring within a timescale of up to ...


1

That highly depends on the complexity of the attack. If it's a simple backdoor, you have a chance of finding/eliminating the backdoor with the following method: 1. netstat -antp search for the sending port/program and remember the pid + ip. 2. lsof -p <the pid> look up the dies which are showing up. (These are the files used by the sending ...


4

To expand on @tlng05's point, rootkit authors are professionals, often with decades of experience. Unless you have decades of experience fighting rootkits, then they'll know about more hiding places than you do :P If you suspect there's a rootkit, then your only choice is to wipe the system. This is a classic example of Ken Thompson's reflection on ...


0

To detect processing hollowing , you can use compare PE header disk vs memory since it will be executed on a normal thread http://www.adlice.com/runpe-hide-code-behind-legit-process/ To detect dll injection you can do a vad walking, or stack tracing: Look for article called : "Walking the VAD Tree" & "Scanning Process Memory for Injected Code"



Top 50 recent answers are included