New answers tagged forensics
Those DDOS attacks were performed using a botnet. A botnet is a network of consumer PCs infected with malware. Such botnets are routinely used for a lot of activities, most of them illegal or at least ethically questionable. For that reason the people who control a botnet do their best not to get found. They usually control their botnets using obscure ...
A DDOS-attach is typically executed by sending UDP-messages with a spoofed source-IP to a service which will send a reply to the source-IP given in the incoming message. For example: if IP 220.127.116.11 is running a DNS-server, sending a DNS-query to 18.104.22.168 as an UDP-packet with source-IP set to 22.214.171.124, will result in the DNS-server sending a reply to 126.96.36.199. ...
One reason is that the attackers are using bots which are victims PCs so there is no one source of the attack. Those bots are usually controlled using a Command & Control server, or simple IRC rooms, private Twitter feeds, etc.
Please note that my comment below is regarding LSB (Least Significant Bit) steganography and not jpeg (DCT) or appended data steganography. "Steganography doesn't modify the file size significantly" this is incorrect. If I take a jpeg compressed image and apply LSB steganography then the resultant image size on disk will increase 'significantly' since ...
One arrives at a very weird interpretation of a question when it sounds like a cyberpunk plot point and appears next to a tiny icon which most strongly evokes a Transformers symbol. I thought this must be a gaming question before I followed the link. Consider that an insider by definition already has legitimate access to many assets; is known and probably ...
The only reliable evidence of an internal person attacking your systems is if you catch them with their fingers on the keyboard. People often suspect insiders because they have spent an extraordinary amount of money building extremely sophisticated defenses, and they simply cannot imagine a hacker being able to navigate them. They have grandiose releasing ...
0x9fe513a40a2e169f9930d21b6b0a669d looks an awful lot like the output of MD5, but you can't be sure since the point of cryptography is to have random-looking output. Basically, the length and the characters look like the output of MD5, and MD5 is one of the more common algorithms, so that's why I'd guess that. MD5("udg47cj6"), however, does not output your ...
If you're comfortable with Linux, consider using Caine or Deft. Both are distroes meant for forensics use, which means that by default they don't do anything that may modify the data, such as automatically mounting filesystems or activating swaps. They also contain a lot of useful tools for the job.
It depends on the tool you choose. Forensic tools like Autopsy can run on several different operating systems. They can parse the filesystem of the image you've been given, and show you the contents of the files. If such a tool is written in Java, you can run it on Windows, Mac, or Linux. In forensic work, you are not necessarily trying to "run" the ...
You only REALLY need to destroy things that actually hold data, but it's often easier to destroy the devices that these are part of. The platters of an HDD are a pain to access: certainly it can be done by someone being paid to, but it's a lot quicker to just incinerate the drive. Similar stories hold for the flash chips of an SSD, and for any caching ...
When I was at university I used Backtrack Linux a LOT. It has a lot of forensics (and live forensics) tools preinstalled and it is designed to be used for these purposes - (albeit it is probably most famous for nefarious hacking and spying on suspected cow tippers etc)
The sans sift kit/workstation (http://digital-forensics.sans.org/community/downloads) is very good if your looking to learn about forensics, as it comprises of things like autopsy and other open source tools which are commonly used. Little extra http://www.forensicswiki.org/wiki/Main_Page this page helps ALOT when your getting used to things
I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.
Top 50 recent answers are included