Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

0
votes
1answer
67 views

Does this evidence seem consistent with an intrusion via the VNC server?

I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long: On two occasions over the past ~3 weeks, a hacker gained remote ...
1
vote
0answers
25 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
3
votes
1answer
86 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
2
votes
0answers
120 views

What is the best way to test my anomaly detection system?

I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first. The IDS that I built ...
-2
votes
1answer
98 views

Anomaly based IDS Vs Protocol state based IDS

Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
1
vote
1answer
181 views

Potential intrusion on home network?

I was browsing through my home network linksys router logs today and noticed an incoming connection from 41.212.36.114 to port 44543. I checked out this IP address at it's coming from Kenya. I'm in ...
-2
votes
1answer
72 views

Difficulty of accessing a physically connected Windows computer with disabled network adapter

Please consider the following setup: A computer running a non-deprecated and up-to-date version of Windows (e.g. 7/8/10) is physically connected to a LAN or WAN network by means of a plugged-in ...
0
votes
0answers
3k views

Is this event a security concern: Windows 10: Event 360, User Device Registration?

My computer just froze, and I ended up having to reboot. It appears Windows Defender was coming up with a notification, but that froze as well. I was trying to see what went wrong in the event ...
3
votes
1answer
119 views

How would an external attacker utilise universal plug and play to bypass a firewall?

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there ...
0
votes
3answers
146 views

What kind of damage controls should an online banking web application implement?

Considering an online banking or paypal-type web application with username/password login and two factor authentication (2FA) for transactions What are best practice security measures for damage ...
1
vote
0answers
45 views

Can using simultaneous intrusion detection systems (IDS) create conflicts?

Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ? Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
-1
votes
2answers
769 views

Popup window stating computer is hacked [duplicate]

I recently got a message on my laptop screen that someone is stealing: my credit card info my pictures facebook info However, nothing seems wrong with my facebook and I have all my pictures and apps....
1
vote
3answers
614 views

Are these log entries normal?

I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top. User dinko was just some random user that I created and had a Ruby application ...
4
votes
1answer
3k views

HIDS - Choosing between regular OSSEC or Wazuh fork

I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork. From what I've been able to gather (from Wazuh's website and documentation), the main advantages ...
1
vote
1answer
98 views

non-rfc1918 address appeared on router dashboard

Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the ...
3
votes
2answers
83 views

WireShark tried to load a suspicious system.dll

When starting Wireshark (v1.12.2, using runas /user:administrator) on an old Windows XP SP3 system, Privacyware Privatefirewall alerted me that Wireshark was trying to load c:\docume~1\admini~1\locals~...
1
vote
0answers
57 views

Intrusion detection - curating misuse/signature based detection data

I have been researching intrusion detection for a class I am taking and I have come to a certain point where after reading so many articles the difference between the two seems blurry. Anomaly ...
2
votes
0answers
2k views

Anyone can identify tool used to perform this attack?

recently I've identified that some hack attempt was performed at one of my servers. I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this ...
2
votes
0answers
198 views

What attack can be detected from SDN controller-flow information? [closed]

Edited. Sorry for my "too broad question" previously. Suppose that kinds of attack that I want to generate are these 4 big types of attack, DoS, R2L, U2R and Probe or scan attack by using appropriate ...
0
votes
0answers
244 views

How can I track down the origin of an intrusion attempt?

Norton Internet Security Consumer keeps showing an intrusion alert when IE users (with the software installed) try to access the site. The severity is high. "An intrusion attempt by ...
3
votes
1answer
288 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
2
votes
1answer
733 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
3answers
686 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
2
votes
1answer
70 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
-4
votes
3answers
169 views

Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]

And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc... I want to be able to give a client a machine with a service running, but ...
4
votes
1answer
146 views

Detect PC Boot from Live CD

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained? I suspect my PC has been booted through a ...
1
vote
2answers
142 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
-1
votes
1answer
75 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
1
vote
0answers
407 views

SSH intrusion suspected: Logwatch report versus SSH log file entries

My Web server's Logwatch report shows ssh and su activity that should not be there: sshd: Sessions Opened: deployer: 45 Time(s) su: Sessions Opened: root -> deployer: 8 Time(s) ...
2
votes
1answer
455 views

How easily will the vBulleting data from vBulletin and Foxit be cracked? What data is at risk? How was it encryted?

vBulletin Solutions and Foxit Software were breached. The culprit (ColdZer0 or Coldroot) claims to have data from 479,895 vBulletin Service and Foxit Software accounts that include identifiers, ...
1
vote
0answers
54 views

How many accounts are affected by the vBulletin breach? At risk? [closed]

vBulletin hack(s) have affected vBulletin, itself (security questions and answers, salts, and hashes of more than 300,000 users of the 345k known to be registered), and Foxit Software (some data for ...
1
vote
2answers
68 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
2
votes
0answers
58 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
4
votes
2answers
203 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
0
votes
1answer
227 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
1
vote
1answer
584 views

kernel: Intrusion disconnecting me

I've read about it a little but I'm concerned. It never happened before and for last 5 hours my router gets kernel: Intrusion alerts similar to these: As soon as the kernel: Intrusion is detected, it ...
3
votes
0answers
431 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
3answers
2k views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
0answers
385 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
1
vote
2answers
4k views

What are security risks of connecting to my home vpn from my work?

I connected to my home-made VPN, which uses OpenVPN and 2048bits encryption keys, from my work. What are the security risks of doing so, given the fact that the servers are in the same network my ...
14
votes
3answers
1k views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
3
votes
1answer
294 views

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
6
votes
1answer
2k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
2
votes
1answer
1k views

kernel: Intrusion IN=ppp0 on my Fairpoint assigned router from IP in China

I'm getting these user alerts: kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=115.230.125.147 DST=xx.xxx.xxx.xxx LEN=40 TOS=0x08 PREC=0x20 TTL=107 ID=256 PROTO=TCP SPT=64316 DPT=9064 WINDOW=15500 RES=...
0
votes
1answer
373 views

Puzzle: network intrusion or OpenDNS/Disconnect.me collision?

My home / home-office network uses OpenDNS as a content filter. As the OpenDNS admin, I received a "User wants access to..." email indicating that someone tried to access a blocked site and requested ...
7
votes
2answers
697 views

How exactly was Sony Pictures hacked November 2014? [closed]

There is lots of media coverage like this one but I have not yet been able to find details on how the hackers got into the network, the servers and the users' systems. So what vulnerabilities / zero-...
0
votes
3answers
5k views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
68 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by safe,...
0
votes
1answer
59 views

What to do when a Linux account gets owned?

What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections? For ...
3
votes
3answers
249 views

Can closed, sleeping MacBook send network data?

I would think the answer is unequivocally, "No." But... My MacBook Pro logged "Diagnostic and Usage Messages" in the Console, at 4:19am, while it was physically closed and (therefore) sleeping. I was ...