New answers tagged forensics
1
I am just a developer with a security interest, but:
It seems like one way to answer your question is the technique of File / Memory Carving.
Looking through the raw memory or disk for content (such as images or documents etc).
It is a forensics technique, sort of like brute force searching memory for documents.
File Carving - Includes a lot of related ...
5
The attacker was trying to exploit the CVE-1999-0081 vulnerability of unpatched WU-FTPD installations, where a software bug allows RNFR Rename From commands to overwrite or rename files, even if these commands are violating file permissions and when an unescaped input parameter using relative path pointing to directory root (././) is used. The following ...
4
The most important thing to realize is that your server is compromised through and through. While the attacker may not have installed any rootkits or the like, you have no way of knowing. Your only options is to take the system offline and analyze it using an external source. The sooner the better, as otherwise you'll be trampling over any evidence yourself ...
2
Try setting up Snorby or some other variation of Snort and listen for the network activity on the subnet or network segments in question. You will probably be able to have a pretty good start on some decent network forensics and figure out if it is one or more backdoors and the source/destinations of your ingress/egress.
8
Additionally to Adnan and AndyMac's answers, which focus mostly on access to logs, if the police decide to monitor an individual that has a high enough profile (think terrorists etc) then they can explicitly request a wiretap - which in this day and age is a little more advanced than the old line tap.
The wiretap can be set up to pass every piece of traffic ...
7
I love to answer these questions, and I feel a bit excited/proud that you'd choose Security.StackExchange to ask this question.
According to The Data Retention (EC Directive) Regulations of 2009, Internet Service Providers (ISP) are required to keep some data for 12 months. This includes which IP address people have been assigned, plus log-in and log-off ...
12
There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605
In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...
2
There has been research done on the ability to recover data from an Android device that issuing the stock Android encryption. There was a similar question that you could peruse. You could also check out the Frost ROM. Which was a recovery ROM built to demonstrate the potential for using a cold boot attack to recovery key data from an encrypted device, their ...
2
At best, this question is asking us to Google a specific research for you. So I flagged it as "Not Constructive".
First I'd start with checking the implementation notes, a quick look can tell you many things. They're using 128-bit AES-CBC ESSIV:SHA256, which seems top-notch to me.
A closer look would tell you that they're not encrypting the SD card. They ...
4
The principle is the same whether Apple or Google does it. Most of the data stored on the device (including all user data — everything but some startup code and of course the encryption key) is encrypted, and the only way to decrypt it is with a key that is stored on the device. (The key may be itself encrypted with the unlock passcode, but that's a separate ...
1
This might be a bit after the fact given the date of the original post, but you could always download FTK Imager or ProDiscover Basic from TechPathways.com. These allow you to convert and split the images into several smaller, acceptable images. Then you get all the files. You'll just have to examine them individually. But, hey...it all lends itself to ...
0
The best advice I could give is to leave everything online and Internet-connected, and have Wireshark running on all of your devices for a good many hours. Then do a search for packets that have the IP addresses of the FTP servers as source or destination address.
How many devices are on your network? It sounds like you properly cleared your own computer, ...
2
First and foremost FTP is very insecure and must never be used for authenticated file access. It is in your best interest to never use ftp and always use SFTP or FTPS. If a service provider only offers FTP, use a service provider that actually cares about their customers.
Malware will attack FTP by sniffing the network looking for authentication requests ...
Top 50 recent answers are included
