Hot answers tagged intrusion
10
Even if such a statistic existed, it would be meaningless because these attacks don't occur as a result of random chance.
Your chances of being "hacked" rise dramatically if:
You don't secure the application properly (SQL Injection being the most obvious, and sadly still commonplace vulnerability; others include plain-text passwords, XSS/XSRF, and not ...
10
Regardless of whether this should apply specifically to Unix, I would say that it is not safe to assume no access just because there are no open ports.
To wit, ICMP is usually listened to, even if no TCP or UDP ports are available.
And before you say, "But ICMP is just a simple Ping! It's irrelevant to attack using that!" check these out:
Ping of Death
...
9
Basic: using off the shelf tools, scripts, exploits, etc. to compromise systems. No deeper knowledge of what you are exploiting or how. Limited to public-facing internet attacks. Commonly referred to as script kiddies.
Advanced: creating your own tools to exploit holes you have discovered and/or bought. Understanding exactly how you are overflowing those ...
9
what defines a advanced kind of attack? Advanced for who and how?
Ultimately, an attack is an attack. It doesn't matter if they used social engineering techniques to get an unsuspecting user to divulge their credentials, brute-force methods, obtained a copy of the software and performed reverse engineering or used the system in methods other than ...
9
PHP:
allow_url_fopen needs to be Off. I think this is how you got owned. A big mistake!
display_errors needs to be Off. I use these all of the time to find path disclosures.
file_uploads needs to be Off. This could have been another way you got owned.
expose_php needs to be Off
safe_mode needs to be On
magic_quotes_gpc should probably be set to On
These ...
9
The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.
7
What type of attacks are there that do not use open TCP or open UDP ports?
This is way too general of a question. I'm answering this very literally, not to be a jerk, but because in security it's best to assume nothing. Here are some classes of attacks that do not use open TCP or UDP ports:
Social engineering: get someone to connect outbound from the ...
6
The fundamental problem of these classes of attacks is not within TCP or UDP protocols themselves, it is with the requirement of applications to process data from an untrusted (or less trusted) source, and faulty design and/or QA within said applications.
If your server is running any applications which process input from a source which does not have the ...
6
Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect.
I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in.
To prevent from locking yourself out you can ...
6
For a definitive answer, you'll want to look at three sources.
This is all set out in the act itself.
The Defence Department will be in touch with cleared defence contractors to provide their detailed requirements.
As ever, if you need to know if something is legal or not, don't ask random people on the Internet: ask a suitably qualified lawyer who ...
5
Even if your operating system is completely secure, your hardware may be vulnerable. Many network cards respond to various remote administration protocols (Wake-on-LAN, Alert-on-LAN, ASF, …).
In practice, an actual vulnerability has many requirements:
at least one of these features must be supported;
the feature must be enabled at least at some level ...
5
In the ideal situation you would put together a list of all assets and threat vectors on your network, including but not limited to:
Operating system flavors and versions
Applications
Network infrastructure
Anything else plugged into the network
With that you could plow through all of the signatures that are available and include only the ones that apply ...
5
First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file.
A hacker can compromise your server and get system access simply by exploiting a ...
5
Here are some research papers that tackle this sort of problem and might interest you:
Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009.
Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...
5
This occurs because you're viewing an email that contains images and other resources served over HTTP, whilst the connection to the gmail site itself is HTTPS. This is known as mixed-mode, and it's risky in cases where an attacker can perform a man-in-the-middle attack. In this case, I don't think you should worry about it - it's completely normal to get ...
5
Monitoring for records from the DB to be posted are really all you can do without direct access to the server. You could try penetration testing the site yourself to look for holes, but that is probably unwise and possibly illegal depending on jurisdiction and the Terms of Use of the site and any contractual obligations you might have from when you wrote ...
4
After experiencing a similar (but more serious) compromise myself, I can tell you that atdre is exactly right. There are four basic steps to handling any security compromise:
Shut down: Shut down all compromised systems. Do not wipe them at this point.
Analyze: Use data from the compromised systems in a sterile environment to try to determine proximate ...
4
A successful attack by definition will not be detected by IPS or IDS.
What IPSs and IDSs are good for is weeding out script kiddies, worms and similar attackers.
If you want to have a relatively secure web application you need to use a web application firewall with a default deny rule set. Yes, it hurts to configure it this way and it will take a bit of ...
4
How often do websites (and their databases) get hacked?
It is generally unknown, and potentially unknowable.
Many countries do not have computer crime laws[1]. In the United States the laws vary from state to state. 48 states have passed computer crime legislation.[2] Even in locations that have computer crime law, the victims don't often report it.
...
4
It could very easily be a false claim - and it sounds like you have done the right things regarding checking logs, database etc - and you can perform in-depth forensic analysis (either yourself or contract one of the many companies that do this) but if you are in any doubt you should plan for the worst - a rootkit.
If you have a well concealed rootkit, the ...
4
If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network.
Do they know the IP ranges for HR, finance, data storage systems etc?
Do they have access to your change management system and would spot a new addition to the network?
Have they already backdoored the servers ...
4
I'll answer this as best I can, since some of it is subjective or subject to change.
As I mentioned in a comment, the barrier to entry in terms of development is higher for layer 2 than it is layer 3, and cables are easier to interface with than radio waves. Most wireless technology involves firmware on a hardware device in order to translate the RF signals ...
4
While I haven't done it - haven't been contracting as much as I used to - I was planning to get a bunch of small $25 - $50 prepaid visa cards and use them on sites I was involved with. One card per site.
Keep the card number and if it gets used you know with reasonable certainty that there has been a breach on their system.
3
A couple questions first:
what do you mean by "the same big internet company"?
Is it MyProgram.exe or MyProgram.vshost.exe trying to connect?
What happens when you run the application in release mode without the debugger?
It could be that the Visual Studio debugger is trying to download debug files for CLR assemblies and the firewall is mistaking the ...
3
SQL injection is not advanced. It's probably the reason for the loss of those 200,000 passwords you are talking about.
The problem with hacking is that truly "advanced" techniques can suddenly become "simple" if somebody writes a tool for it. A good example of this is the Metasploit tool. When people find advanced new techniques, they add them to ...
3
If you can ensure that your network hardware has no open ports for any protocol then it will not be able to receive packets - this will make it very unlikely to be attacked through the network, however if you were wanting all ports closed, I would advise unplugging the network cable because I can think of a potential issue:
you could have a rootkit which ...
3
I just saw a talk at Shmoocon about the YaF and SiLK tools that looked really good. YaF is a flow collector (which can collect other interesting data as well), and SiLK is an analysis package for them. There's even a nice GUI called iSiLK.
3
It depends on the product. Some products have the ability to capture the response packet(s) as well as the attack packet(s). Some products, notable IBM Proventia, will annotate the original event with a success/failure notification, which you can see if you open up the details of the event. For example, all HTTP events in Proventia will include not only the ...
3
In addition to Scott's post which has excellent technical guidance, on the policy side ensure you have a risk register or at least some type of risk classification for each of the assets on your network. This will be invaluable when it comes to defining the protection needed, and may make management simpler by requiring the IPS to monitor less traffic, or by ...
3
Replacing 'signature' with 'rule'.
Sometimes it's a simple task, other times not so.
Rules are generally created (afaik) by examining packet captures of attacks/exploits and then creating rules that match that traffic pattern. The skill is creating a rule that is as precise as possible in order to limit false-positives but generic enough to ensure you ...
Only top voted, non community-wiki answers of a minimum length are eligible
