Tag Info

Hot answers tagged

44

Normally, I'd just parrot the "nuke it from orbit and start from the beginning" line. However, information security is also about understanding your adversary, the practical risk, and the assets you're trying to protect. In this case, I think situation is a bit different; your spouse clearly just Googled for "free key logger" and downloaded the first one or ...


43

Change all your passwords! (no one had mentioned this) This is assuming that you're going to take an open approach to this problem rather than engage in counter-spying or image manipulation of your own. It's fairly basic advice, but do this on a computer you trust (this one cleaned or at work), and don't re-use any of your old passwords. Personally, I like ...


31

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention... If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet ...


30

To detect Steganography it really comes down to statistical analysis (not a subject I know very well). But here are a few pages that may help you out. Steganography Countermeasures and detection - Wikipedia page worth a read to cover the basics. An Overview of Steganography for the Computer Forensics Examiner - Has quite a long list of tools and some ...


28

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


18

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


18

The only reliable evidence of an internal person attacking your systems is if you catch them with their fingers on the keyboard. People often suspect insiders because they have spent an extraordinary amount of money building extremely sophisticated defenses, and they simply cannot imagine a hacker being able to navigate them. They have grandiose releasing ...


17

1: The ISP only knows the MAC addresses for the address of the hotel's router. It may store that, but who cares. The hotel could store mac addresses for connected devices, and many do for captive portal use, but that history is typically forgotten after only a couple of days. The only way to know is to ask the hotel. (they probably won't know how to access ...


16

Like many others mentioned, there are trust issues here. thats needs sorting. the best way is a face to face discussion. an even better way to invite her is by typing out the invitation on your computer so that she sees your invitation and also comes to know of the keylogger in there. Now that you know your laptop is insecure, you should setup some admin ...


15

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables ...


14

I believe the term you're looking for is "honeypot".


14

It depends on how smart the thief is. We work with police to catch criminals based on their IP address on a regular basis. We've got a high success rate, but we can't catch them all. Usually, the IP address is enough to trace the connection back to the ISP (Internet Service Provider). Generally, ISPs will work with law enforcement in cased of known fraud ...


13

Disclaimer The approach I am about to describe might be unethical and perhaps even illegal. I am posting this for two main reasons: one I have no emotional attachment to your relationship; and two, because I like solving problems, the answer below is from a technical point of view: I am not really suggesting you do as I say below - the other answers that ...


12

The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete. And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly. What you ...


12

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


12

Have you seen the Tor document on how a Tor Hidden Service works? Essentially, in the same way that it's hard to find the source of traffic from a Tor exit node, it's hard to find the server operating a Tor Hidden Service. Authorities can't shut down the server, because they can't find out where it is. The .onion TLD is not really a TLD (so there is no ...


12

There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605 In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...


12

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


11

Probably someone trying to create an account on your forum and proceed to spam it. I read about it here: http://www.projecthoneypot.org/ip_95.168.162.43 When you URL decode the string two times and google the string you find a lot of spam on different forums. URL Decoded one time: èñïîëüçîâàí íèêíåéì "immultusa"; çàðåãèñòðèðîâàëèñü (âêëþ÷åí ðåæèì ...


11

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


11

I'll second the reccomendation for Stegdetect: here's another good source for information http://www.outguess.org/detection.php as well as downloads for stegbreak and XSteg You can go right to the source for the research on this if you're interested; Neil Provos's page is here http://www.citi.umich.edu/u/provos/stego/


11

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


10

The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis. Historically I would use EnCase Helix LiveCD Argus Recently I have started moving away from that combination and on to Argus Autopsy - For aquisition and system analysis BackTrack (Forensics ...


10

This is pretty well the background noise of the Internet. Since phpMyAdmin had such a poor security history it is not uncommon to see systems looking for instances of it running on the network. Chances are, that is exactly what is happening. There are a few things you could do to take action on such an activity, though which one, or ones, you choose will ...


10

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen. First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies. You need to isolate access to the laptop. Shut it down completely, boot ...


10

There's some great general references in the other answers here, so I'll just give some input specific to your situation: When hiding data in pictures without changing the file size, you put it in the low-order bits; this can be detected by opening in an editor with a histogram and looking for jagged edges. But this sounds like a concantenation of a file ...


10

As tempting as it may be to try to use tools to defend herself (i.e. using personal equipment) or to catch the rogue admin in the act (logging, file integrity monitoring, etc.) many organizations have policies prohibiting these activities. Your friend should be careful not to compromise her own integrity in response to this individual's actions. This is ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


10

how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap? There are three basic methods: multiple copies, error correction, and enhanced detection. A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...


10

I love to answer these questions, and I feel a bit excited/proud that you'd choose Security.StackExchange to ask this question. According to The Data Retention (EC Directive) Regulations of 2009, Internet Service Providers (ISP) are required to keep some data for 12 months. This includes which IP address people have been assigned, plus log-in and log-off ...



Only top voted, non community-wiki answers of a minimum length are eligible