Hot answers tagged

3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


1

The problem IDSes face today is encryption. Once you receive a stream of encrypted information, you can only try to make sense of its behaviour. They rely on defaults (a default port or protocol for a service), on well-known endpoints and on some pre-encryption activities (handshakes for instance). So I would say that it is more one of the few ...


1

Trustwave SpiderLabs wrote up a blog on analyzing malware with hollow processes -- https://www.trustwave.com/Resources/SpiderLabs-Blog/Analyzing-Malware-Hollow-Processes/ Cuckoo Sandbox, a popular and free, open-source software (FOSS) automated malware analysis engine can also be leveraged for working with hollowed processes -- http://journeyintoir.blogspot....



Only top voted, non community-wiki answers of a minimum length are eligible