Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
0
votes
2answers
35 views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
0
votes
1answer
71 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
0
votes
1answer
118 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
0
votes
2answers
47 views

Definition of what is log data in context of VPN

Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) ...
0
votes
1answer
23 views

Synology logs SMB “Read” event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
1
vote
2answers
115 views

Does Windows log desktop application passwords?

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
-1
votes
1answer
88 views

What stops a nation state starting a “VPN service” to view its customers' logs? [closed]

I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy,...
1
vote
3answers
101 views

In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?

I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
6
votes
2answers
236 views

Do external harddrives keep track of the computers they're plugged in to?

I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever ...
1
vote
1answer
134 views

Does Windscribe VPN keep logs even when disconnected?

I am using (have installed) this VPN on an Android Smart TV. Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
0
votes
0answers
86 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
0
votes
2answers
137 views

If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers. Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
0
votes
0answers
52 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0
votes
1answer
58 views

What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint?

The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational ...
0
votes
1answer
276 views

Log poisoning prevention in the context of LFI

Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more. Techniques like these have been used for years and, ...
22
votes
5answers
10k views

Does Google collect and store data about activity done in Incognito mode?

Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode. Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
0
votes
2answers
2k views

What information do ISPs delete after retention period?

Whenever I read something like "ISPs store your data" or "ISPs delete your data after 6 months" or anything like that, I imagine data to be the following things: (1) At what time I ...
0
votes
0answers
8 views

Is there a utility that identifies attack footprints in HTTPD log files? [duplicate]

We're manually reading HTTPD log files and taking note of service abuse. Example: 10.0.0.1 - - [01/Jan/1970:00:01:01 -0100] "GET /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media ...
0
votes
2answers
236 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
0
votes
2answers
76 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
0
votes
0answers
76 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
1
vote
0answers
70 views

Detecting changes in surrounding WiFi networks [closed]

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
0
votes
1answer
229 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
0
votes
0answers
58 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
2
votes
2answers
108 views

What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]

As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1
vote
0answers
27 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
2
votes
1answer
102 views

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
3
votes
4answers
949 views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
3
votes
3answers
154 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
1
vote
3answers
73 views

Securing SMTP server and its logs [closed]

Looking for general mail server security best practices here. I did some research and it's really hard to find the information out there. How do you safeguard a smtp server log? Are there any ...
0
votes
1answer
4k views

IP retrieval without visiting the site or clicking the link

There are sites like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a message via Twitter, ...
0
votes
3answers
384 views

How do I immediately block IPs once they do a single malicious act?

I get this in logwatch A total of 21 sites probed the server 1.144.111.208 123.31.43.40 174.216.5.13 185.156.177.234 188.175.196.105 188.71.236.121 197.229.2.33 197....
-2
votes
1answer
68 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
1
vote
1answer
85 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
26
votes
2answers
16k views

How are full URLs exposed when they are encrypted by HTTPS?

As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture: If HTTPS URLs are encrypted then how did the ...
-2
votes
1answer
59 views

Do large companies keep a detailed “company log” book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
1
vote
0answers
95 views

What does Telegram store (or potentially forward to 3rd parties)? [closed]

The Telegram messaging application apparently stores messages on its servers (at least - that's what it says in answers to this question here on the site). Is that everything it stores or forwards to ...
1
vote
0answers
40 views

What relative functionality needs to be implemented when users click an “Accept Cookies” button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
1
vote
1answer
89 views

Logging new network connections without TCP Wrappers

My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address ...
0
votes
1answer
85 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
0
votes
1answer
93 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log? I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
1
vote
2answers
1k views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
1
vote
0answers
119 views

Application Security - Security Testing Log files?

As per latest OWASP Guidelines (2019) - a security assessor has to test against application platform configuration dubbed as OTG-CONFIG-002 in OWASP Testing Guide v4. Since OWASP is a Security ...
2
votes
2answers
96 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
1
vote
1answer
279 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
0
votes
1answer
91 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
1
vote
0answers
46 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
1
vote
0answers
119 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
2
votes
1answer
146 views

Is a good idea to have security logs stored in the cloud?

I was discussing with my friend the topic of the importance of log analytics/correlation and real-time response for an organization. Then, he mentioned that some people consider sending logs (...
1
vote
0answers
78 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...

1
2 3 4 5
8