Hot answers tagged

164

In a word: Forensics. Computer forensics is the art of examining a system and determining what happened upon it previously. The examination of file and memory artifacts, especially file timelines, can paint a very clear picture of what the attacker did, when they did it, and what they took. Just as an example - given a memory dump of a Windows system, it ...


135

Fortunately, almost all PHP scripts can be deobfuscated with 4 simple methods. We're going to use these four methods to create a canonical answer. Before we begin, let's collect a list of common tools that assist in deobfuscating these malicious files so we can do the work ourselves. Common tools that aid in deobfuscation UnPHP. This greatly aids in de-...


49

This is an absolute breach of security. Even if their policy was somehow sound, sending the password in plaintext to you in an email means that the reset is useless, and as you said, if the attacker had access to your email the security questions wouldn't do squat. They should have done nothing as the security question answered was invalid. The best thing ...


45

Change all your passwords! (no one had mentioned this) This is assuming that you're going to take an open approach to this problem rather than engage in counter-spying or image manipulation of your own. It's fairly basic advice, but do this on a computer you trust (this one cleaned or at work), and don't re-use any of your old passwords. Personally, I like ...


44

Normally, I'd just parrot the "nuke it from orbit and start from the beginning" line. However, information security is also about understanding your adversary, the practical risk, and the assets you're trying to protect. In this case, I think situation is a bit different; your spouse clearly just Googled for "free key logger" and downloaded the first one or ...


37

Once your information is made public, you cannot make it private again. That is unfortunately one of the things the Internet gives us. You can make formal complaints to sites hosting the information, but assume it will be there, available in large stores of PII, for bad guys to do with as they will. So all you can do is decide which of those things you need ...


30

Nuke it from orbit. The only way to be sure it is gone once it is compromised is to blow it away entirely. Restore checkpoints only help for configuration issues, a virus can alter the previous configurations or install itself in such a way it survives a restore. If it's just adware, then removal may be sufficient, but viruses can be very sneaky. It ...


30

As for how it may happen that reflashing the BIOS does not eradicate the malware, we can hazard a few guesses: The reflash operation is under control of... the BIOS, so the infected BIOS only pretends to do the reflash (or reinfects the new BIOS immediately afterwards). Another flashable firmware in the machine is also infected, and when either it or the ...


27

For the future, there is one critical thing you should be doing: Provide an easy way for people to report security bugs to you. I took a look at the web page for your application, and I noticed it doesn't seem to list any way for a security researcher to contact you with a report of a security vulnerability. There is no email address to report security ...


20

Passive scanning such as determining geo location, IP address, network routes is probably a good idea (to give you an understanding of where attacks are originating from). Update: Actually for larger institutions this is kind of essential in determining whether the attack is a large scale organised attack or simply a lone hacker testing out the defences. ...


20

Working within the technology sector, how I would do it would be as follows: Find the hack, the hole, the weak spot. Check the syslog, dmesg, access.log and error.log to confirm the thesis. (when hacking in to a network you normally have the break the system in the case of TalkTalk it was a MySQL injection, doing this would have left errors in the mysql....


19

Sorry not to have a good link, but my thought is you want to cover: What happened? When did it happen, and for how long did it continue? Who did it and how? What was affected - what sites, what servers, how many servers, what part of the business? What customers? Root Cause Analysis What was the impact? Damage to servers Damage/exposure of ...


19

I downloaded the first URL (http://something.example.com/xx) and ran $ file xx xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped So, it's an executable program meant to run on a Linux machine. I assume you are running a Linux server. Next, we want to see what the program does, but of ...


18

Nuking is mandatory. That being said, I don't erase the old image; I keep the data files somewhere, to be resurrected after due inspection. For instance, I don't destroy mailboxes; I scan them for attached files which look like executable files, and, when found clean, I put them back on line. For the base OS and all its binaries, cleansing flame is the rule....


17

No, it is not an appropriate response from the ISP. The attacker tried to reset the password, which shows that the attacker does not know the current password, and actually does not even try to guess it. Forcing a reset of that password cannot bring any good: it tries to fix exactly the part of the authentication system which was not broken. If resetting ...


17

Mark's excellent answer deals with the case where the obfuscation is relatively straightforward. This addresses 99% of cases, but once in a while you may come across something a bit more malicious, e.g. using encryption of the source code too. Executing the code (or at least part of it) can be a much quicker way to find out what the code is doing than ...


16

Fighting back is what the cool kids do! >:) Regarding law, I grabbed this snippet from http://lawmeme.law.yale.edu/static/pastevents/digitalcops/papers/karnow_newcops.pdf (2005) "CONCLUSION Even under nuisance law, not every counterstrike – or “self help” effort – is automatically immune. It has to be reasonable, and proportional to the nuisance, ...


16

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables (...


16

Like many others mentioned, there are trust issues here. thats needs sorting. the best way is a face to face discussion. an even better way to invite her is by typing out the invitation on your computer so that she sees your invitation and also comes to know of the keylogger in there. Now that you know your laptop is insecure, you should setup some admin ...


15

I suggest to just ignore it, it's not worth the trouble. There are way too many infected machines out there. If you have too much time at hand, you can do a whois query on the ip-address. Then contact the ISP, telling them that they have an infected customer. The email address to contact is usually "abuse@" domain. In this case whois 83.140.8.18 even ...


15

Disclaimer The approach I am about to describe might be unethical and perhaps even illegal. I am posting this for two main reasons: one I have no emotional attachment to your relationship; and two, because I like solving problems, the answer below is from a technical point of view: I am not really suggesting you do as I say below - the other answers that ...


13

For legal advice you need to seek a lawyer. In some countries it is already illegal to do a "test" login with an account that does not belong to you. What I would do? If the IT-department does not answer and does not fix the issue, you should try to reach other people at the company, especially upper management, public relation, customer relation, high ...


12

@ChrisAD From personal experience: Key prerequisite is an effective asset register. Otherwise you wont even know if it is one of your laptops / pc's that is missing or that turns up on the front page of the daily mail (well ok they may help in letting you know it was your device!). Secondly - Establish a clear requirement and ability for your staff to ...


12

The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete. And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly. What you ...


12

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


11

The #1 Question for me is: what do you hope to achieve in "fighting back"? If I get stung by a mosquito, I'll kill it, but if it gets away I won't chase it across the field. If I get attacked by a swarm of bees defending their hive, I won't swat them - I'll protect myself by running away. The dangers of fighting back are well presented in the other ...


11

The hack preventing side is pretty much covered by the dual factor authentication that was recently introduced and the use of the "Always use HTTPS" setting (on by default in gmail) for accessing google, to avoid ssl-stripping attacks. Now, when you have a compromised account and want to claim it back, Google has a structured procedure to verify you are the ...


11

It's very likely that the person who owns the account uses a Facebook App that has malicious code in it, as all these issues here can be cause by said malicious Facebook app. (Note: this was stated in comments several times, so I posted this as an answer). To fix this, the user should remove all access for apps to his/her Facebook account. Then ...


11

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen. First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies. You need to isolate access to the laptop. Shut it down completely, boot ...


11

Detection The goal of a reflected DNS attack is to send large volumes of network traffic at a host in order to cause legitimate traffic to be dropped. It is chosen when the attacker doesn't control enough bandwidth himself to exceed the target's bandwidth. It is largely irrelevant whether the target is running a DNS server or not as the damage is usually ...



Only top voted, non community-wiki answers of a minimum length are eligible