Questions tagged [detection]
Detection is the act of discovering and/or determining the existence, presence, or fact of something.
212
questions
0
votes
0answers
45 views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
0answers
51 views
Detecting cracked Themida packed malware
I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida ...
0
votes
1answer
101 views
What are the heuristic detection techniques most often used in modern AVs? [closed]
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
2
votes
1answer
159 views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
0
votes
0answers
37 views
Assess anti-malware detection techniques
Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ?
I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
1
vote
1answer
364 views
Can my father's smartphone be compromised?
My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing).
In ...
4
votes
2answers
192 views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
0
votes
1answer
677 views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
2
votes
1answer
122 views
What features would you use to detect a backdoor or a bot installation?
I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
35
votes
6answers
16k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
147
votes
20answers
39k views
Has it been mathematically proven that antivirus can't detect all viruses?
What analysis was Bruce Schneier referencing when he wrote:
Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
0
votes
1answer
65 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
44 views
What makes detection of optimized-away memory clearing non-trivial?
In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
2
votes
2answers
236 views
Should you consider a system compromised if someone could have physically accessed it, but you have no evidence they did?
An old adage is that if an adversary physically accessed your system, you should consider it compromised. My question is, what if they could have, but you have no evidence they did?
For example, let ...
1
vote
1answer
102 views
100% detectable backdoor attacks on network
Every article I have read on backdoor attack prevention says pretty much this:
Protecting against them may be difficult.
I am tired of reading how it can be ~difficult~ to protect against. ...
0
votes
0answers
119 views
Heuristics-based vs behavioral malware detection
I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection.
Does heuristics-based detection rely only on statically examining ...
0
votes
1answer
54 views
Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods?
When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the ...
1
vote
1answer
63 views
Detecting if an agent is listening to specific messages
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting ...
1
vote
1answer
195 views
Error detection capability of SHA-256
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the ...
1
vote
0answers
41 views
Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [closed]
I have some data that needs to be handed to a friend. I don't want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show ...
62
votes
5answers
17k views
Can Beehive detect a Snowden-like actor?
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their ...
0
votes
2answers
72 views
If a file on USB drive shows a certain “date modified” time in the windows explorer, can the correct added date/time be checked for the file?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if ...
0
votes
1answer
55 views
How can one make sure that some specific directories are fully deleted (without any record of their deletion) from a USB/flash drive?
It seems data resides in USB somewhere until it's completely overwritten. But is there a way to delete big directories 10-100GB or so without zero-filling the remaining space and only eradicating ...
0
votes
0answers
48 views
Detecting network attacks by processing individual or multiple network packets?
I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
5
votes
1answer
76 views
Can I use `lsof` to reliably determine which local process has connected to my open port?
Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run
lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
1
vote
2answers
199 views
Datasets dedicated for SIEM systems
I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
35
votes
5answers
18k views
How to detect when files from my USB were copied to another PC?
I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
0
votes
1answer
45 views
How to restrict plugins/tools like Netcraft and Builtwith to detect server side technologies?
My organization wants to restrict all the plugins/tools like Netcraft and Builtwith to detect all the server side technologies for security reason like platform, operating system name and version, web ...
2
votes
1answer
333 views
Why dont anti-viruses detect encrypted viruses in decryption?
Some viruses are encrypted so that the anti-virus cant identify them, but what i dont understand is, why wouldnt the anti-virus doesnt detect them, considering they have to decrypt themselves before ...
4
votes
2answers
207 views
How to find what files in a zip are malware using Virustotal
I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
1
vote
0answers
123 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
2answers
94 views
Is there an easy way to detect clients that ignore certificate validation errors (in production)?
I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
0answers
23 views
How can identify potential malware from the list of sessions established between my PC with devices on the internet [closed]
I wish to know if there are any software tool(s) that allow me see all established sessions from my PC and flag those connections that are potentially malware.
I prefer GUI type tool but will also ...
-1
votes
1answer
117 views
Audio steganography and DRM
I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
1
vote
1answer
295 views
How to create a proxy so that no website or web service can know that I am connecting through a proxy?
I want a proxy, preferably my own but I would be glad if there is a reliable service already, that is undetectable. Obviously, it does not send X-Forwarded-For. But it has to be much more than that to ...
1
vote
0answers
114 views
Which Anti-Virus companies share their signature databases?
I recently heard that AVG and AVAST shared their malware signature databases (avast forum)
Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
1
vote
0answers
245 views
How can XML External Entity attacks be detected?
XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
1answer
275 views
MITM based on ARP spoofing
I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it?
if he listen to ...
2
votes
0answers
56 views
What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?
Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
0
votes
1answer
58 views
Motion sensors - detectable when using mobile network?
Motion sensors are a good way to be informed of any activity at our house. Many modern motion sensors have the possibility to notify the user using an internet connection using Wi-Fi or even mobile ...
2
votes
0answers
189 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
152 views
Why arent all hackers traced ? ( network based attackers or malware which communicate with CNC servers)
When hackers use tor or irc or proxies to attack or use CNC servers behind these to evade. Why can't they be traced?
For example, something like wanna cry or any other known malware, when something ...
-3
votes
2answers
154 views
Impossible VM-detection countermeasures [on hold]
Are there any vm-detection techniques (of malware) which are impossible to mitigate in your vm?
If yes, which?
4
votes
2answers
1k views
Detecting C2 traffic over DNS?
Let's assume I have a large enterprise network (thousands of nodes) and somewhere on that network there is malware communicating over DNS for C2. Let's assume the requests are designed such that the ...
8
votes
1answer
391 views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
6
votes
2answers
372 views
AVG detects Kaspersky update files as infected (trojan, infected, malware)
(Note: update at end of Q)
On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
2
votes
1answer
3k views
How to detect malicious fb2 & epub file?
Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ?
Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS.
Malicious PDF files via peepdf, ...
4
votes
1answer
1k views
How can you detect kernel exploits?
Is there something that all kernel exploits have in common?
Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
-2
votes
1answer
72 views
Trying to detect a firewall
I have some HTML that was detected by one of my scripts firewall detections, it looks like this:
<!---
HTTP 1.1
Status Code: 403
HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...
3
votes
1answer
682 views
What is good metric for detecting data exfiltration on covert channel?
Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the ...
