Tag Info

Hot answers tagged

11

There are all sorts of security risks - the ones I tend to highlight are: The big social networking sites are a wonderful target for attackers. Imagine a group of over a billion users, most of whom are not technically savvy, that all use the same web app (eg Facebook) and have personal data, links to others etc. So take it as read that these sites are ...


10

The built in windows auditing can do this if you're running a domain, or at least windows 2003/Vista and are willing to set it up in group policy. Enable object access auditing and then set up the files and folders you want to audit. There are a large nunber of tools that can then read and sort/filter the windows logs ... I'm a fan of GFI EventsManager, but ...


10

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...


10

connections dropping frequently, rate limiting occuring, and packet loss Without knowing whether your connection resets are injected TCP reset packets or a result of dropped packets, it's hard to say whether you're actually having your data acted on or just having connection issues. It is entirely conceivable that your line or equipment aren't working ...


9

What do we look for? -- A Security Expert. To Hire. That is a 100% serious answer -- If you are asking this question you need someone in house who can answer it. Selling a "security monitoring service" without an expert on staff is a Bad Idea. You will make a mistake, it may result in a client being compromised, and you won't have the expertise on hand to ...


8

If he was a sysadmin, you can no longer rely on anything on that box, as he may have had the capability to change anything. You should escalate this to your IT or incident response team - the damage may not be confined to them just deleting evidence, a sensible precaution may be to wipe and rebuild the box, depending on its sensitivity. If you have backups ...


8

You could detect some of them (the simple ones) using Process Explorer, but it would be a really time-consuming way to detect viruses and should be paired with other monitoring tools like FileMon. You probably would be much better off with installing an antivirus like Microsoft Security Essentials if that's an option. While there are still multiple malware ...


8

Assumptions. As I understand it, you are only concerned about eavesdropping: e.g., that the folks who are monitoring you might record everything you do, and fail to adequately secure those records. You are not worried that they will be actively malicious. For instance, they won't mount a man-in-the-middle attack on you. Advice. Given this threat model, I ...


8

In order to trace back the source you first need to figure out which device is generating the traffic. The best, in my opinion, would be to set up a flow collector of some sort. There are generally two ways to do this, Exporting flows from the device Software analysis to generate flows Most high end network gear will generate some kind of flow record, ...


8

A keylogger can use literally any form of communication to send its data back to the attacker. Common methods: FTP upload Email IRC HTTP POST Connect-back (i.e. attacker connects to a service listening on your machine) P2P network (e.g. Gnutella or BitTorrent) Custom protocol running over TCP or UDP, directly to the attacker. Note that any of these ...


8

Since you do not state what kind of "help" you want, I will have to guess. So I suggest the following: Talk to your father. With "talk" as in "talking", not "shouting reproaches". Your father installed this monitoring system for a reason, probably a mixture of making him less worried about your well-being, and a safety feature against the re-enacting of ...


7

Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account Classification level of monitored resource Network design System throughput Personnel time (for management and analysis) Resource availability Throwing all of those into a blender and turning on high for a few minutes will give you ...


7

The simple answer is that you can't. The tracking and tapping is done transparently at the service provider. Only ways I can think of: Breach the service provider's network and find out for yourself. Bribe a service provider employee to give you a list of taps.


6

Have a look at tshark. It's like wireshark, but then for commandline. Just install it with apt-get. A tutorial on how to use it can be found here. You can easily filter for http with it. To capture http traffic: tshark -R "tcp.port == 80" -r /tmp/capture.cap If port 80 is your http port. If you don't know the port just capture everything and you can ...


6

Number 1 - as others have mentioned - is control: you should be working, not playing on facebook, or telling your dog on twitter that you just got yelled at by your boss (for playing on facebook). Number 2 - is bandwidth. Even if there is plenty of bandwith available, there is no reason to waste it on, well, sites that you shouldnt be using when you're ...


5

In the ideal situation you would put together a list of all assets and threat vectors on your network, including but not limited to: Operating system flavors and versions Applications Network infrastructure Anything else plugged into the network With that you could plow through all of the signatures that are available and include only the ones that apply ...


5

My question: where do I go to get more info on this user account? Is there a log kept that shows the user and what action was taken? My thought - what is your purpose in collecting the information? How and what you do next, has a lot to do with what you want to have happen. Here's my thoughts of optional outcomes: Prosecute him - at this point, he is an ...


5

You've got most of the likely approaches mentioned in your question but here's a couple of points on them. Usage. This is the easiest way to start blocking traffic, and what the a lot of ISPs seem to go with most. Have a "fair use" policy which is based on bandwidth and then start taking action against users to go significantly over it. Unfortunately in ...


5

I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine. Big Man in the Middle (Between your target and the servers ...


5

This can't be done simply on your computer. You will need an SSH server which you will use to establish an encrypted tunnel: Because your traffic is encrypted, the provider will not be able to view and thus not block your traffic. Note that the provider might still try to block you on DNS level. To bypass such a protection you should use public DNS ...


4

You should monitor (nearly) all the files. Assuming that this system is just a hash database, then there are some files you should skip: everything in /proc (there's a lot of useful stuff in here for root kit hunters though) log files (there are tools will will do heuristic analysis of these files) files which contain filesystems (this would include ...


4

The problem with ML is with the training. Over-training leads to matching the exact training set, making the learning non-generic. Since my current employer develops scientific computing libraries for Python, I can point you to map-reduce on Disco for finding common clusters in log files: https://github.com/JensRantil/disco-slct That's not a NN, but it ...


4

There has been an enormous amount of research into using machine learning techniques for anomaly detection, i.e., to scan network traffic and detect intrusions. However, this research has had very little practical impact. These techniques have seen little deployment and are rarely used in practice. Why not? There are a number of reasons. First, these ...


4

You have three options: install wireshark or similar on the target monitor traffic through the network device add your own network device that is in a position to detect the target traffic From your own comments, options 1 and 2 are ruled out already. It may be, though, that you are precluded from the final option by your contract. In my opinion you ...


4

I'd recommend using a FIM (File Integrity Monitoring) tool. This will let you take a snapshot of your system before you make changes, and then another snapshot after you make changes - then you can to see what files and registry entries have changed inbetween snapshots. OSSEC is an Open Source system that can monitor files for changes. I'm not sure if it ...


4

Your best bet is to install a HIPS (Host Intrusion Prevention Application) such as Samhain or AIDE. There are far too many files to monitor and an attacker can (and usually will) try to modify whatever they can. Not to mention there are plenty of people who play/tinker with Linux/BSD/OSX viruses, exploits, and proofs of concepts EDITED FOR AN EXPLANATION AS ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


3

Sniffers For commandline sniffers, run tcpdump. You can run this from the server itself or from another computer in the same network segment. Capture packets. Ctrl-C to stop the capture (remember to stop the capture at some point ...): tcpdump -w test.pcap -i eth0 Then to read the file: tcpdump -r test.pcap Wireshark will provide a nice GUI and ...


3

If you have Cisco networking equipment you can use Catalyst Switched Port Analyzer (SPAN) to mirror traffic from a port to another one which you have your snort sensor on. Their is a Cisco SPAN Configuration example at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml. Other networking equipment has similar ...



Only top voted, non community-wiki answers of a minimum length are eligible