Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
0
votes
0answers
25 views
What features would you use to detect a backdoor or a bot installation?
I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
17
votes
6answers
7k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
146
votes
20answers
37k views
Has it been mathematically proven that antivirus can't detect all viruses?
What analysis was Bruce Schneier referencing when he wrote:
Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
0
votes
1answer
57 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
41 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
2
votes
2answers
200 views
Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?
An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?
For example, let ...
1
vote
1answer
84 views
100% detectable backdoor attacks on network
Every article I have read on backdoor attack prevention says pretty much this:
Protecting against them may be difficult.
I am tired of reading how it can be ~difficult~ to protect against. ...
0
votes
0answers
46 views
Heuristics-based vs behavioral malware detection
I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
52 views
Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?
When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
59 views
Detecting if an agent is listening to specific messages
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
114 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
1
vote
0answers
38 views
Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]
I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
61
votes
5answers
16k views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
0
votes
2answers
46 views
If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if ...
0
votes
1answer
50 views
How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?
It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
0
votes
0answers
44 views
Detecting network attacks by processing individual or multiple network packets?
I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
5
votes
1answer
73 views
Can I use `lsof` to reliably determine which local process has connected to my open port?
Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run
lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
1
vote
1answer
80 views
Datasets dedicated for SIEM systems
I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
35
votes
5answers
16k views
How to detect when files from my USB were copied to another PC?
I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
0
votes
1answer
39 views
How to restrict plugins/tools like Netcraft and Builtwith to detect server side technologies?
My organization wants to restrict all the plugins/tools like Netcraft and Builtwith to detect all the server side technologies for security reason like platform, operating system name and version, web ...
2
votes
1answer
109 views
Why dont anti-viruses detect encrypted viruses in decryption?
Some viruses are encrypted so that the anti-virus cant identify them, but what i dont understand is, why wouldnt the anti-virus doesnt detect them, considering they have to decrypt themselves before ...
4
votes
2answers
126 views
How to find what files in a zip are malware using Virustotal
I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
1
vote
0answers
76 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
2answers
94 views
Is there an easy way to detect clients that ignore certificate validation errors (in production)?
I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
0answers
22 views
How can identify potential malware from the list of sessions established between my PC with devices on the internet [closed]
I wish to know if there are any software tool(s) that allow me see all established sessions from my PC and flag those connections that are potentially malware.
I prefer GUI type tool but will also ...
-1
votes
1answer
91 views
Audio steganography and DRM
I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
1
vote
1answer
216 views
How to create a proxy so that no website or web service can know that I am connecting through a proxy?
I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
0answers
95 views
Which Anti-Virus companies share their signature databases?
I recently heard that AVG and AVAST shared their malware signature databases (avast forum)
Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
0
votes
0answers
84 views
If I'm using private mode for google chrome and a free web proxy, is it still possible for the school to monitor what I'm looking up on my macbook? [duplicate]
A quick question just be safe, is it still possible for a school to monitor what I'm looking up and what websites I'm accessing if I'm in private mode on google chrome canary while also using ...
1
vote
0answers
211 views
How can XML External Entity attacks be detected?
XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
1answer
240 views
MITM based on ARP spoofing
I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it?
if he listen to ...
2
votes
0answers
55 views
What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?
Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
0
votes
1answer
56 views
Motion sensors - detectable when using mobile network?
Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
0answers
137 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
138 views
Why arent all hackers traced ? ( network based attackers or malware which communicate with CNC servers)
When hackers use tor or irc or proxies to attack or use CNC servers behind these to evade. Why can't they be traced?
For example, something like wanna cry or any other known malware, when something ...
-3
votes
2answers
106 views
Impossible VM-detection countermeasures
Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm?
If yes, which?
4
votes
2answers
892 views
Detecting C2 traffic over DNS?
Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
8
votes
1answer
341 views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
6
votes
2answers
307 views
AVG detects Kaspersky update files as infected (trojan, infected, malware)
(Note: update at end of Q)
On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
2
votes
1answer
2k views
How to detect malicious fb2 & epub file?
Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?
Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS.
Malicious PDF files via peepdf, ...
4
votes
1answer
746 views
How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
-2
votes
1answer
60 views
Trying to detect a firewall
I have some HTML that was detected by one of my scripts firewall detections, it looks like this:
<!---
HTTP 1.1
Status Code: 403
HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
3
votes
1answer
507 views
What is good metric for detecting data exfiltration on covert channel?
Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the ...
-1
votes
2answers
92 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
1answer
542 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
4
votes
1answer
317 views
Drawbacks of ML in cyber security?
I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats ...
4
votes
3answers
2k views
Does nmap trace back to you?
I just got certified in CEH and learned A LOT about nmap and how it really manipulates the three-way-handshake to get some cool information.
I have a question about possible detection problems.
...
0
votes
1answer
200 views
How to efficiently locate malware on an endpoint? [closed]
I have a question from one of the interviews I had, I have no knowledge in system security and so I didn't know how to approach each. The question was:
A customer suspects that one of his endpoints ...
2
votes
1answer
416 views
Shadowsocks: Doesn't communication with just one server look suspicious to the GFW?
From what I understand, Shadowsocks masks SOCKS5 traffic as HTTPS traffic, so that the GFW cannot detect it by packet inspection. Shadowsocks can be installed on my own server, naturally. For usage, I ...
25
votes
4answers
3k views
Reduce Noise when Penetration Testing
Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic.
There we were told that many tools were very noisy. Eg Sqlmap which has ...
