New answers tagged

1

It's a good method of detection, to repeat: Memory check for hidden processes Network traffic check Filesystem check The above solution is flexible, scalable and secure, however it's not your average scripting if large scale is involved, for which this is best suitable solution. But this doesn't mean it would not work on smaller scales, however effort ...


1

Trustwave SpiderLabs wrote up a blog on analyzing malware with hollow processes -- https://www.trustwave.com/Resources/SpiderLabs-Blog/Analyzing-Malware-Hollow-Processes/ Cuckoo Sandbox, a popular and free, open-source software (FOSS) automated malware analysis engine can also be leveraged for working with hollowed processes -- http://journeyintoir.blogspot....


0

Besides the standard ways (checking headers, broken clients, spam filters, etc) of detecting spammers, and depending on how strict your settings are, you can try to limit your emails only to fully qualified domains and ignore any "Unknown" sources (that is what I do). I personally believe that all emails should be sent from mail servers and not directly ...


2

Being a mail system administrator, I suppose you know that email messages do not contain anything that would allow you to identify whether they are sent by a human or a machine. The BOT will certainly not indicates that it's a BOT in the message or even the headers. Common SPAM detection methods apply to any messages whether sent by a BOT or not. I ...


1

First, control which scripts are loaded The most important reason to block ads is to protect yourself from malicious, dangerous and incompetent code delivered through these ads. Accordingly, script blocking is a far better method than ad blocking (alone). Once you do that, you can leverage that tool for fine-grained control. Let's first assume that you ...


1

The way these scripts work is by trying to detect if a HTML element that is supposed to be holding the ad exists or is empty since adblocks methods are to remove the content from the page. Adblocker's don't have much to do about it since they remove the elements/empty them which can be easily detect by Javascript with some code as the following: if (...


1

Try looking into Scanlogd http://www.openwall.com/scanlogd/ Also look into psad (Port Scan Attack detector) http://cipherdyne.org/psad/ I havent tried using either of them. Though I am not sure how much better than Snort these will be, I am sure these allow for much higher degree of customization, which may help.


1

Without checking too deep, I would say WP is the top risk in that list. I assume its updated, so you should check its settings and the plugins you have installed. Check this article: https://isc.sans.edu/forums/diary/Wordpress+Pingback+DDoS+Attacks/17801 Sucuri detected an interesting "reflective" attack using the Wordpress Pingback feature to attack ...



Top 50 recent answers are included