Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

0
votes
1answer
42 views

Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?

When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
57 views

Detecting if an agent is listening to specific messages

Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
94 views

Error detection capability of SHA-256

If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors? For example, reading the page about error correction and detection here, under the ...
1
vote
0answers
38 views

Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]

I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
60
votes
5answers
16k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
0
votes
2answers
31 views

If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?

If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not. Can it be checked if ...
0
votes
1answer
49 views

How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?

It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
0
votes
0answers
44 views

Detecting network attacks by processing individual or multiple network packets?

I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
5
votes
1answer
72 views

Can I use `lsof` to reliably determine which local process has connected to my open port?

Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
0
votes
0answers
27 views

Can someone tell by looking at USB drive whether those files have been copied to elsewhere from USB or if some files on USB were deleted? [duplicate]

I was wondering if one can find if files were copied from the USB drive to a PC or something, and also if any and which files were recently deleted from the USB.
1
vote
1answer
48 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
35
votes
5answers
16k views

How to detect when files from my USB were copied to another PC?

I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
0
votes
1answer
38 views

How to restrict plugins/tools like Netcraft and Builtwith to detect server side technologies?

My organization wants to restrict all the plugins/tools like Netcraft and Builtwith to detect all the server side technologies for security reason like platform, operating system name and version, web ...
2
votes
1answer
70 views

Why dont anti-viruses detect encrypted viruses in decryption?

Some viruses are encrypted so that the anti-virus cant identify them, but what i dont understand is, why wouldnt the anti-virus doesnt detect them, considering they have to decrypt themselves before ...
4
votes
2answers
90 views

How to find what files in a zip are malware using Virustotal

I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
1
vote
0answers
49 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
2answers
93 views

Is there an easy way to detect clients that ignore certificate validation errors (in production)?

I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
0answers
22 views

How can identify potential malware from the list of sessions established between my PC with devices on the internet [closed]

I wish to know if there are any software tool(s) that allow me see all established sessions from my PC and flag those connections that are potentially malware. I prefer GUI type tool but will also ...
-1
votes
1answer
80 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
1
vote
1answer
176 views

How to create a proxy so that no website or web service can know that I am connecting through a proxy?

I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
0answers
90 views

Which Anti-Virus companies share their signature databases?

I recently heard that AVG and AVAST shared their malware signature databases (avast forum) Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
0
votes
0answers
84 views

If I'm using private mode for google chrome and a free web proxy, is it still possible for the school to monitor what I'm looking up on my macbook? [duplicate]

A quick question just be safe, is it still possible for a school to monitor what I'm looking up and what websites I'm accessing if I'm in private mode on google chrome canary while also using ...
1
vote
0answers
197 views

How can XML External Entity attacks be detected?

XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
1answer
232 views

MITM based on ARP spoofing

I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it? if he listen to ...
2
votes
0answers
55 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
0
votes
1answer
55 views

Motion sensors - detectable when using mobile network?

Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
0answers
128 views

What is the best way to test my anomaly detection system?

I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first. The IDS that I built ...
-2
votes
1answer
130 views

Why arent all hackers traced ? ( network based attackers or malware which communicate with CNC servers)

When hackers use tor or irc or proxies to attack or use CNC servers behind these to evade. Why can't they be traced? For example, something like wanna cry or any other known malware, when something ...
-3
votes
2answers
102 views

Impossible VM-detection countermeasures

Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm? If yes, which?
4
votes
2answers
694 views

Detecting C2 traffic over DNS?

Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
7
votes
1answer
333 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
6
votes
2answers
285 views

AVG detects Kaspersky update files as infected (trojan, infected, malware)

(Note: update at end of Q) On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
2
votes
1answer
2k views

How to detect malicious fb2 & epub file?

Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ? Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS. Malicious PDF files via peepdf, ...
4
votes
1answer
643 views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
-2
votes
1answer
54 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
3
votes
1answer
417 views

What is good metric for detecting data exfiltration on covert channel?

Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the ...
-1
votes
2answers
76 views

WAF/IDS detection question

I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT. The HTML always looks like this: <title>403 Forbidden</title> </head><...
0
votes
1answer
483 views

Combine SNORT detection and log with active response OSSEC

As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
4
votes
1answer
302 views

Drawbacks of ML in cyber security?

I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats ...
4
votes
3answers
2k views

Does nmap trace back to you?

I just got certified in CEH and learned A LOT about nmap and how it really manipulates the three-way-handshake to get some cool information. I have a question about possible detection problems. ...
0
votes
1answer
194 views

How to efficiently locate malware on an endpoint? [closed]

I have a question from one of the interviews I had, I have no knowledge in system security and so I didn't know how to approach each. The question was: A customer suspects that one of his endpoints ...
1
vote
1answer
365 views

Shadowsocks: Doesn't communication with just one server look suspicious to the GFW?

From what I understand, Shadowsocks masks SOCKS5 traffic as HTTPS traffic, so that the GFW cannot detect it by packet inspection. Shadowsocks can be installed on my own server, naturally. For usage, I ...
24
votes
4answers
3k views

Reduce Noise when Penetration Testing

Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic. There we were told that many tools were very noisy. Eg Sqlmap which has ...
1
vote
1answer
342 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
2
votes
2answers
138 views

Is there a way to prevent comments from being abused for command and control?

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
0
votes
2answers
150 views

PDF parser and OPcodeExtraction [closed]

I'm performing an university project on malware detection. Specifically I need: - extract javascript from a PDF, ...
-1
votes
2answers
220 views

famous anti virus fail to detect simple malicious software (detection problems) [closed]

I am a master student and I am working on a mini-project on virus recognition and how to get rid of the virus. I had to infect my virtual machine and then clean the virus or Trojan using various ...
1
vote
0answers
221 views

Heuristic Malware Detection Methods

I would like to know some basic heuristic detection methods in detail because when I do research there is only a general overview of heuristics and not what methods are used to achieve it. I would ...
1
vote
1answer
196 views

What would be an example of 'AI' in your average security appliance?

It seems that more and more Anti-Virus and other security related business solutions are adding the 'AI' and 'machine learning' buzzwords to their marketing repertoire. However, the only 'AI' I ever ...
0
votes
0answers
22 views

Can a single breach detection product include more than one of these approaches?

Can a single breach detection system include more than one of these approaches? UBEA which looks at user behavior Network Traffic Analytics (NTA) which focuses on network traffic Threat Intelligence ...