Tag Info

New answers tagged

4

Keeping complete traffic information and giving it to customers is expensive for ISP, and there is not a lot of money to do out of embarrassing teenagers (understandably, the teenagers won't pay for it; but their parents won't pay either for obtaining that information, their offspring being already quite expensive to maintain). Consequence is that ISP don't ...


4

Many ISP's log DNS requests, so could have a record of what sites you have browsed to. This is mostly for law enforcement requirements, not generally for giving back to customers, as they should be expected to do their own logging if they want it. That said - if you are concerned, have you checked to see if your mother is logging all DNS requests? Your ...


-1

So far, I am aware of the following, but am not familiar with how good they are: Splunk Plaso log2timeline (deprecated, better to use Plaso) http://security.stackexchange.com/a/3491/47692 points out the following tools: arcsight loglogic alienvult/ossim logrhythm I look forward to further input.


0

Look at Ossec. It's a monitoring system you can configure to watch different logs on multiple clients. Rules can be defined for active response and email logging. It's free and open source.


0

Mark answered your question on the 400 so I will answer your other question: I'm wondering if there is a way to whitelist all the pages of my website and reject all the others requests. It would be a painful task. Unless your website if ALWAYS going to consist or one static page, every time you add an additional page, you would need to whitelist that ...


0

Okay just for the sake of clarity, in the line below it says the request from the client (the first part in quotes) and then the code 400. A 404 means not found, and 400 means bad request, so there is no unauthorized access on your machince. Please refer to this link for more information on http error codes. "GET /tmUnblock.cgi HTTP/1.1" 400 172 "-" "-"


0

Except for the log cleaning the other answers mentioned, there shouldn't be any danger from having a writable log file. A readable log file on the other hand can lead to log poisoning, which can turn a local file inclusion into a code execution vulnerability. The attack might look like this: An attacker visits example.com/<?php // code you want to ...


2

Servers need to save their activities and performance on specific files. ErrorLog is the file where Apache saves its errors defined by their name and location. So by understadning the role of this file you can guess that only the server itself must be allowed to write on this file otherwise miscreants will write anything else to mislead you to take actions ...


4

Log files are often used to detect suspicious activities, like attacks. But, if the log file can be modified by the attacker itself, (s)he can clean up the logs after the attack or plant false information which confuse the after-attack analysis.



Top 50 recent answers are included