Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

Filter by
Sorted by
Tagged with
148
votes
19answers
40k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
73
votes
11answers
7k views

Sanitize computer after Homeland Security seizure [closed]

I flew from overseas back to the USA and all my electronic equipment was seized by Homeland Security, including my laptop computer, external hard drives, flash drives, etc. After more than a month I ...
64
votes
5answers
17k views

Can Beehive detect a Snowden-like actor?

In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did. From their ...
44
votes
4answers
62k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
36
votes
6answers
18k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
36
votes
3answers
29k views

Is it possible to tell if hard drive is encrypted?

Is it possible to tell if a hard drive is encrypted, regardless of what software was used, i.e., Truecrypt / VeraCrypt / Bitlocker for AES-256? Just the other day, I thought it could be possible to ...
35
votes
5answers
21k views

How to detect when files from my USB were copied to another PC?

I accidentally gave my USB to my friend and then I realized it had some important files of mine. Is there any way I can know if he got something from the USB?
30
votes
4answers
3k views

Fake users in database for compromise detection

I have read of sites* adding fake users to their databases and then monitoring their usage. One of these fake users being used or even attempted login may mean database compromise etc. This sounds ...
29
votes
3answers
3k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
25
votes
4answers
4k views

Reduce Noise when Penetration Testing

Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic. There we were told that many tools were very noisy. Eg Sqlmap which has ...
23
votes
2answers
7k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
22
votes
2answers
6k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
21
votes
3answers
3k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
14
votes
1answer
1k views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
13
votes
4answers
14k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
13
votes
2answers
528 views

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data ...
12
votes
5answers
2k views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
12
votes
2answers
2k views

Are there / have there ever been viruses that completely evade virus scanners for very long?

Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)
12
votes
2answers
32k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
11
votes
2answers
10k views

HIDS - Choosing between regular OSSEC or Wazuh fork

I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork. From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
10
votes
1answer
679 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
10
votes
1answer
33k views

How does a website detect proxy? [duplicate]

How can a specific website detect that I'm surfing via proxy? Is there a way to use proxy and not get detected? If so, how?
9
votes
3answers
41k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
9
votes
4answers
14k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
9
votes
1answer
665 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
8
votes
6answers
3k views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
8
votes
2answers
476 views

What is the proliferation of IMSI Catchers?

We know that IMSI-catcher detectors such as the Android-IMSI-Catcher-Detector project exist, but has anyone done a field study across various parts of the world as to how many there are and where? ...
8
votes
1answer
417 views

Mitigating Meltdown by checking the faulting address in every page fault?

Short question Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
8
votes
3answers
10k views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
7
votes
1answer
3k views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
7
votes
4answers
11k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
7
votes
2answers
1k views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
6
votes
1answer
6k views

What is TTP hunting?

What is "TTP hunting" in terms of network security research? I came across this term, but do not know what this is . Tried to google it, but TTP seem to stand for many different things, but none of ...
6
votes
1answer
3k views

How does OS detection work in practice?

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them. But what kind of probes would distinguish a ...
6
votes
3answers
299 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
6
votes
2answers
2k views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
6
votes
4answers
5k views

Is plausible deniability actually feasible for encrypted volumes/disks?

Based on Is it possible to tell if hard drive is encrypted?, is it actually possible to hide a volume in practice? According to this answer TrueCrypt is the only well-known disk encryption software ...
6
votes
1answer
803 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
6
votes
2answers
1k views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
6
votes
2answers
416 views

AVG detects Kaspersky update files as infected (trojan, infected, malware)

(Note: update at end of Q) On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
6
votes
1answer
1k views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
5
votes
2answers
179k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?
5
votes
1answer
1k views

How can you detect kernel exploits?

Is there something that all kernel exploits have in common? Sure, they all exploit the kernel, but I'm more interested in the underlying mechanisms or the result. At the moment my interest goes ...
5
votes
3answers
11k views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
5
votes
1answer
365 views

Drawbacks of ML in cyber security?

I did some research on the topic (as I'm new to it) and it frankly seems too good to be true. A company called Darktrace for instance, makes use of AI algorithms and ML to autonomously detect threats ...
5
votes
2answers
365 views

Why some antiviruses detect viruses and some not?

I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
5
votes
1answer
695 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
5
votes
1answer
4k views

How to detect malicious fb2 & epub file?

Is fb2 & epub files can be malicious like pdf? If yes, so how I can detect it manually ? Malicious RTF, doc, docx, xls, ppt files can be detected via OLETOOLS. Malicious PDF files via peepdf, ...
5
votes
3answers
470 views

Importance of Tool-Stealth for Red Team Internal Audit

When it comes time for the internal phase of a white box or red-team audit, where you've locked yourself in a mop-closet in an office building of a Fortune 500 company, I would think that the last ...
5
votes
2answers
1k views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...