Hot answers tagged

180

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history. (Paint doesn't.) There are some things to watch out for, though: The width of the blanked region places an upper bound on the length of the secret data The height of ...


49

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not ...


48

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


45

Change all your passwords! (no one had mentioned this) This is assuming that you're going to take an open approach to this problem rather than engage in counter-spying or image manipulation of your own. It's fairly basic advice, but do this on a computer you trust (this one cleaned or at work), and don't re-use any of your old passwords. Personally, I like ...


44

Normally, I'd just parrot the "nuke it from orbit and start from the beginning" line. However, information security is also about understanding your adversary, the practical risk, and the assets you're trying to protect. In this case, I think situation is a bit different; your spouse clearly just Googled for "free key logger" and downloaded the first one or ...


39

To detect Steganography it really comes down to statistical analysis (not a subject I know very well). But here are a few pages that may help you out. Steganography Countermeasures and detection - Wikipedia page worth a read to cover the basics. An Overview of Steganography for the Computer Forensics Examiner - Has quite a long list of tools and some ...


37

Because normal read operation on a disk presenting error (physical or logical) may cause data corruption, destruction and even writing to recover bad blocks. You have to keep in mind that even the read operation may lead to physical damage or data modification.


35

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention... If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet ...


28

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is ...


22

It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all. Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...


21

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


19

The only reliable evidence of an internal person attacking your systems is if you catch them with their fingers on the keyboard. People often suspect insiders because they have spent an extraordinary amount of money building extremely sophisticated defenses, and they simply cannot imagine a hacker being able to navigate them. They have grandiose releasing ...


18

When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If someone removes the black cover they can see the pixels. The same applies to things like Foxit Reader (I almost sent a document with sensitive information which had ...


17

1: The ISP only knows the MAC addresses for the address of the hotel's router. It may store that, but who cares. The hotel could store mac addresses for connected devices, and many do for captive portal use, but that history is typically forgotten after only a couple of days. The only way to know is to ask the hotel. (they probably won't know how to access ...


16

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables (...


16

Have you seen the Tor document on how a Tor Hidden Service works? Essentially, in the same way that it's hard to find the source of traffic from a Tor exit node, it's hard to find the server operating a Tor Hidden Service. Authorities can't shut down the server, because they can't find out where it is. The .onion TLD is not really a TLD (so there is no ...


16

Like many others mentioned, there are trust issues here. thats needs sorting. the best way is a face to face discussion. an even better way to invite her is by typing out the invitation on your computer so that she sees your invitation and also comes to know of the keylogger in there. Now that you know your laptop is insecure, you should setup some admin ...


15

I believe the term you're looking for is "honeypot".


15

Disclaimer The approach I am about to describe might be unethical and perhaps even illegal. I am posting this for two main reasons: one I have no emotional attachment to your relationship; and two, because I like solving problems, the answer below is from a technical point of view: I am not really suggesting you do as I say below - the other answers that ...


13

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


13

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


13

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


12

I'll second the reccomendation for Stegdetect: here's another good source for information http://www.outguess.org/detection.php as well as downloads for stegbreak and XSteg You can go right to the source for the research on this if you're interested; Neil Provos's page is here http://www.citi.umich.edu/u/provos/stego/


12

The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete. And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly. What you ...


12

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


12

There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605 In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...


11

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


11

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen. First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies. You need to isolate access to the laptop. Shut it down completely, boot ...


11

Probably someone trying to create an account on your forum and proceed to spam it. I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43 When you URL decode the string two times and google the string you find a lot of spam on different forums. URL Decoded one time: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì ...



Only top voted, non community-wiki answers of a minimum length are eligible