Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
221
questions
2
votes
1answer
59 views
Can an ISP redirecting DNS traffic be detected by the end user?
If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers.
How could this be detected by the end ...
0
votes
0answers
49 views
What to look for in potentially compromised computer? [on hold]
This morning, before sunrise, I was woken up by my laptop beeping. I opened the lid and it was in the BIOS, trying to boot from an external drive. It could not find a drive to boot from, so it would ...
1
vote
4answers
188 views
Ransomware aversion and identification techniques
I don't think there's a need to go into the background here, but identification of the process may be better explored.
From a developer pov, at a high level, the files are modified, by virtue of the ...
2
votes
1answer
90 views
How can I as middleman verify whether a phishing site is valid if the scam listens only on the referrer link and blocks any other access methods?
How can I as a trusted user of a middleman company (such as PhishTank) verify whether a phishing site is valid if the scam listens only on a unique referrer link(randomly created) and is blocking any ...
-1
votes
1answer
46 views
Does the term “malware signature” always refer to a pattern of bytes? [duplicate]
I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
0
votes
1answer
64 views
Yara condition count operator with wildcard [closed]
I have a yara rule that looks for multiple strings in a file and fires if the count is greater than 3. But how would I change the condition statement to only fire if greater than 3 but less than 5?
...
0
votes
1answer
90 views
What is “rule-based” analysis in malware detection?
I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
0
votes
0answers
25 views
Snort rules to detect metasploit's trojan [duplicate]
I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ...
Does anyone know snort rules in order to detect this? Despite my research, I found ...
0
votes
0answers
46 views
Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]
A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
0
votes
0answers
47 views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
0answers
52 views
Detecting cracked Themida packed malware
I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida ...
0
votes
1answer
113 views
What are the heuristic detection techniques most often used in modern AVs? [closed]
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
2
votes
1answer
345 views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
0
votes
0answers
40 views
Assess anti-malware detection techniques
Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ?
I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
1
vote
1answer
745 views
Can my father's smartphone be compromised?
My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing).
In ...
4
votes
2answers
198 views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
0
votes
1answer
1k views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
2
votes
1answer
152 views
What features would you use to detect a backdoor or a bot installation?
I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
36
votes
6answers
17k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
148
votes
19answers
40k views
Has it been mathematically proven that antivirus can't detect all viruses?
What analysis was Bruce Schneier referencing when he wrote:
Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
0
votes
1answer
75 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
46 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
2
votes
2answers
247 views
Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?
An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?
For example, let ...
1
vote
1answer
107 views
100% detectable backdoor attacks on network
Every article I have read on backdoor attack prevention says pretty much this:
Protecting against them may be difficult.
I am tired of reading how it can be ~difficult~ to protect against. ...
0
votes
0answers
153 views
Heuristics-based vs behavioral malware detection
I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
59 views
Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?
When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
63 views
Detecting if an agent is listening to specific messages
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
303 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
1
vote
0answers
41 views
Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]
I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
64
votes
5answers
17k views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
0
votes
2answers
166 views
If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if ...
0
votes
1answer
56 views
How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?
It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
0
votes
0answers
51 views
Detecting network attacks by processing individual or multiple network packets?
I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
5
votes
1answer
77 views
Can I use `lsof` to reliably determine which local process has connected to my open port?
Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run
lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
1
vote
2answers
292 views
Datasets dedicated for SIEM systems
I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
35
votes
5answers
21k views
How to detect when files from my USB were copied to another PC?
I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
0
votes
1answer
53 views
How to restrict plugins/tools like Netcraft and Builtwith to detect server side technologies?
My organization wants to restrict all the plugins/tools like Netcraft and Builtwith to detect all the server side technologies for security reason like platform, operating system name and version, web ...
2
votes
1answer
495 views
Why dont anti-viruses detect encrypted viruses in decryption?
Some viruses are encrypted so that the anti-virus cant identify them, but what i dont understand is, why wouldnt the anti-virus doesnt detect them, considering they have to decrypt themselves before ...
4
votes
2answers
275 views
How to find what files in a zip are malware using Virustotal
I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
1
vote
0answers
144 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
2answers
97 views
Is there an easy way to detect clients that ignore certificate validation errors (in production)?
I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
0answers
23 views
How can identify potential malware from the list of sessions established between my PC with devices on the internet [closed]
I wish to know if there are any software tool(s) that allow me see all established sessions from my PC and flag those connections that are potentially malware.
I prefer GUI type tool but will also ...
-1
votes
1answer
139 views
Audio steganography and DRM
I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
1
vote
1answer
371 views
How to create a proxy so that no website or web service can know that I am connecting through a proxy?
I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
0answers
141 views
Which Anti-Virus companies share their signature databases?
I recently heard that AVG and AVAST shared their malware signature databases (avast forum)
Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
1
vote
0answers
256 views
How can XML External Entity attacks be detected?
XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
1answer
300 views
MITM based on ARP spoofing
I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it?
if he listen to ...
3
votes
0answers
63 views
What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?
Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
0
votes
1answer
63 views
Motion sensors - detectable when using mobile network?
Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
0answers
221 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
