Tag Info

Hot answers tagged

48

This is an absolute breach of security. Even if their policy was somehow sound, sending the password in plaintext to you in an email means that the reset is useless, and as you said, if the attacker had access to your email the security questions wouldn't do squat. They should have done nothing as the security question answered was invalid. The best thing ...


44

Normally, I'd just parrot the "nuke it from orbit and start from the beginning" line. However, information security is also about understanding your adversary, the practical risk, and the assets you're trying to protect. In this case, I think situation is a bit different; your spouse clearly just Googled for "free key logger" and downloaded the first one or ...


41

Change all your passwords! (no one had mentioned this) This is assuming that you're going to take an open approach to this problem rather than engage in counter-spying or image manipulation of your own. It's fairly basic advice, but do this on a computer you trust (this one cleaned or at work), and don't re-use any of your old passwords. Personally, I like ...


29

Nuke it from orbit. The only way to be sure it is gone once it is compromised is to blow it away entirely. Restore checkpoints only help for configuration issues, a virus can alter the previous configurations or install itself in such a way it survives a restore. If it's just adware, then removal may be sufficient, but viruses can be very sneaky. It ...


26

For the future, there is one critical thing you should be doing: Provide an easy way for people to report security bugs to you. I took a look at the web page for your application, and I noticed it doesn't seem to list any way for a security researcher to contact you with a report of a security vulnerability. There is no email address to report security ...


21

As for how it may happen that reflashing the BIOS does not eradicate the malware, we can hazard a few guesses: The reflash operation is under control of... the BIOS, so the infected BIOS only pretends to do the reflash (or reinfects the new BIOS immediately afterwards). Another flashable firmware in the machine is also infected, and when either it or the ...


19

Passive scanning such as determining geo location, IP address, network routes is probably a good idea (to give you an understanding of where attacks are originating from). Update: Actually for larger institutions this is kind of essential in determining whether the attack is a large scale organised attack or simply a lone hacker testing out the defences. ...


18

Sorry not to have a good link, but my thought is you want to cover: What happened? When did it happen, and for how long did it continue? Who did it and how? What was affected - what sites, what servers, how many servers, what part of the business? What customers? Root Cause Analysis What was the impact? Damage to servers Damage/exposure of ...


17

Nuking is mandatory. That being said, I don't erase the old image; I keep the data files somewhere, to be resurrected after due inspection. For instance, I don't destroy mailboxes; I scan them for attached files which look like executable files, and, when found clean, I put them back on line. For the base OS and all its binaries, cleansing flame is the ...


17

No, it is not an appropriate response from the ISP. The attacker tried to reset the password, which shows that the attacker does not know the current password, and actually does not even try to guess it. Forcing a reset of that password cannot bring any good: it tries to fix exactly the part of the authentication system which was not broken. If resetting ...


16

Like many others mentioned, there are trust issues here. thats needs sorting. the best way is a face to face discussion. an even better way to invite her is by typing out the invitation on your computer so that she sees your invitation and also comes to know of the keylogger in there. Now that you know your laptop is insecure, you should setup some admin ...


15

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables ...


15

Fighting back is what the cool kids do! >:) Regarding law, I grabbed this snippet from http://lawmeme.law.yale.edu/static/pastevents/digitalcops/papers/karnow_newcops.pdf (2005) "CONCLUSION Even under nuisance law, not every counterstrike – or “self help” effort – is automatically immune. It has to be reasonable, and proportional to the nuisance, ...


15

Analysis I downloaded the first URL (http://something.example.com/xx) and ran $ file xx xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped So, it's an executable program meant to run on a Linux machine. I assume you are running a Linux server. Next, we want to see what the program does, ...


14

Disclaimer The approach I am about to describe might be unethical and perhaps even illegal. I am posting this for two main reasons: one I have no emotional attachment to your relationship; and two, because I like solving problems, the answer below is from a technical point of view: I am not really suggesting you do as I say below - the other answers that ...


12

For legal advice you need to seek a lawyer. In some countries it is already illegal to do a "test" login with an account that does not belong to you. What I would do? If the IT-department does not answer and does not fix the issue, you should try to reach other people at the company, especially upper management, public relation, customer relation, high ...


12

The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete. And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly. What you ...


12

@ChrisAD From personal experience: Key prerequisite is an effective asset register. Otherwise you wont even know if it is one of your laptops / pc's that is missing or that turns up on the front page of the daily mail (well ok they may help in letting you know it was your device!). Secondly - Establish a clear requirement and ability for your staff to ...


11

I suggest to just ignore it, it's not worth the trouble. There are way too many infected machines out there. If you have too much time at hand, you can do a whois query on the ip-address. Then contact the ISP, telling them that they have an infected customer. The email address to contact is usually "abuse@" domain. In this case whois 83.140.8.18 even ...


11

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation. Realize that your system is malfunctioning. It is not operating the the way it was intended to. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care ...


11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed. Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...


10

The #1 Question for me is: what do you hope to achieve in "fighting back"? If I get stung by a mosquito, I'll kill it, but if it gets away I won't chase it across the field. If I get attacked by a swarm of bees defending their hive, I won't swat them - I'll protect myself by running away. The dangers of fighting back are well presented in the other ...


10

I think the fact that your security vendor is being far from transparent, is already a pretty bad case scenario. When the vendor is being secretive wrt security details - be it specifics of an incident, or the security internals of the product itself (or at least proof of security, e.g. crypto algos) - this is an inherent risk, to the entire security posture ...


10

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen. First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies. You need to isolate access to the laptop. Shut it down completely, boot ...


10

Detection The goal of a reflected DNS attack is to send large volumes of network traffic at a host in order to cause legitimate traffic to be dropped. It is chosen when the attacker doesn't control enough bandwidth himself to exceed the target's bandwidth. It is largely irrelevant whether the target is running a DNS server or not as the damage is usually ...


9

The answer depends on your level of sophistication, the level of sophistication of the attacker, and your goals. The Mandiant blog post, from one of the leading providers of incident response and computer forensics services, is intended for sophisticated organizations responding to an Advanced Persistent Threat (APT). One of their concerns is that you ...


9

If a vendor suffers a compromise on a system which you use, and refuses to give you satisfactorily details on the impact of the compromise on your systems, then what you should look for is... a new vendor. Worst case scenario is complete breakdown of whatever the security system was used for. E.g. in an authentication system, attackers know enough to ...


9

If you're truly paranoid, extract only data and completely reload the server. In most cases, I find it satisfactory to boot the server from a bootable anti-virus rescue disk and run a full scan. Kaspersky's free bootable, updatable rescue disk is a good choice. ftp://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/ It is important to use a bootable ...


9

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you: Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just ...


9

I liked D.W.'s answer so much I'm loathe to write another, but I had some points that were big enough that I'm unfortunately repeating here: How do I - find out about a zero-day vulnerability against my application as soon as possible, without having to receive irrelevant notifications? Get as close to the source of vulnerability disclosure as you can, and ...



Only top voted, non community-wiki answers of a minimum length are eligible