Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

Detecting what used bandwidth retroactively [migrated]

I've got 2 unexplained network spikes. They are both short duration but one of them has appeared on my private IP instead of my public IP and this was unexpected. Both are very short duration. Are ...
  • 335
0 votes
0 answers
9 views

How do I track all the different types of event logs exclusive to an antimalware software or pc recovery software? [migrated]

I recently found out that my pc has been infected by some serious spyware and while I did successfully remove them, I’m afraid that that malware affected the antimalware and management solutions I ...
0 votes
0 answers
35 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED) [duplicate]

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
  • 1
0 votes
2 answers
111 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop

Can my employer see my private google history/”google activity” if I didn’t do anything on my work pc? For some context I logged in to my private google account on my work computer just to send a pdf ...
  • 1
0 votes
0 answers
35 views

OSSIM logs and disk space?

I've installed OSSIM (no USM) on a VM and am trying to figure out how much disk space I need to give this VM. Basically does anyone know: How can I estimate how much disk the logs are using each day? ...
1 vote
1 answer
75 views

Guardrails Around Logs For Devs

Are there good ways to put guardrails on not logging sensitive information? For example, passwords If there isn't a guardrails approach, is there a way to help make the easy thing the right thing like ...
  • 142
0 votes
0 answers
83 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
0 votes
0 answers
22 views

Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?

When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase). But I've just realised that there are tons of kindergarten level exploits. For ...
  • 123
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0 votes
0 answers
64 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
0 votes
0 answers
257 views

lsass.exe spawning lsass.exe

In logs, I found lsass.exe spawning lsass.exe. C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\...
0 votes
0 answers
275 views

Is there any way to find out if a Logitech Unifying Receiver vulnerability was exploited?

Is there any way to find out if any of the vulnerabilities of older Logitech Unifying Receiver firmware was exploited? I'm referring to the vulnerabilities listed here including these. On GNU/Linux/...
1 vote
0 answers
97 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
0 votes
1 answer
93 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
1 vote
2 answers
123 views

Logging docker container logins, EC2 Host

I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx. I have an rsyslog setup that successfully captures the auth....
  • 11
1 vote
1 answer
340 views

How to do ADB and user activity logging on Android?

My question is how to detect ADB connection or unusual user activity in shell on the Android devices. I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
0 votes
1 answer
283 views

Why am I seeing this in /var/log?

I've noticed a lot of weird logs in /var/log on my server. For example: cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 ...
  • 101
1 vote
1 answer
123 views

When typing something in the URL bar in Safari with google as my default search engine without pressing "enter", does google log what I've typed?

When typing in the URL bar in safari with google as my default search engine without pressing enter (i.e not actually searching), does the text I've typed or my IP get logged to google?
0 votes
2 answers
510 views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
0 votes
2 answers
1k views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
  • 103
1 vote
1 answer
1k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
0 votes
2 answers
96 views

Definition of what is log data in context of VPN

Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) ...
  • 230
0 votes
1 answer
168 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
  • 225
1 vote
2 answers
166 views

Does Windows log desktop application passwords?

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
  • 13
-1 votes
1 answer
137 views

What stops a nation state starting a "VPN service" to view its customers' logs? [closed]

I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy,...
  • 1,214
1 vote
3 answers
169 views

In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?

I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
  • 113
6 votes
2 answers
708 views

Do external harddrives keep track of the computers they're plugged in to?

I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever ...
1 vote
1 answer
341 views

Does Windscribe VPN keep logs even when disconnected?

I am using (have installed) this VPN on an Android Smart TV. Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
  • 121
0 votes
0 answers
145 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
0 votes
2 answers
218 views

If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers. Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
0 votes
0 answers
59 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0 votes
1 answer
92 views

What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint?

The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational ...
  • 3
0 votes
1 answer
531 views

Log poisoning prevention in the context of LFI

Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more. Techniques like these have been used for years and, ...
  • 1,518
22 votes
5 answers
13k views

Does Google collect and store data about activity done in Incognito mode?

Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode. Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
  • 339
0 votes
2 answers
11k views

What information do ISPs delete after retention period?

Whenever I read something like "ISPs store your data" or "ISPs delete your data after 6 months" or anything like that, I imagine data to be the following things: (1) At what time I ...
  • 339
0 votes
2 answers
406 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
0 votes
2 answers
125 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
  • 3,086
0 votes
0 answers
135 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
1 vote
0 answers
118 views

Detecting changes in surrounding WiFi networks [closed]

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
0 votes
1 answer
632 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
  • 105
0 votes
0 answers
107 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
  • 141
3 votes
2 answers
349 views

What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]

As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1 vote
0 answers
73 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
  • 11
2 votes
1 answer
148 views

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
3 votes
4 answers
2k views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
  • 458
3 votes
3 answers
239 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
1 vote
3 answers
133 views

Securing SMTP server and its logs [closed]

Looking for general mail server security best practices here. I did some research and it's really hard to find the information out there. How do you safeguard a smtp server log? Are there any ...
  • 13
0 votes
1 answer
5k views

IP retrieval without visiting the site or clicking the link

There are sites like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a message via Twitter, ...
  • 3
0 votes
3 answers
475 views

How do I immediately block IPs once they do a single malicious act?

I get this in logwatch A total of 21 sites probed the server 1.144.111.208 123.31.43.40 174.216.5.13 185.156.177.234 188.175.196.105 188.71.236.121 197.229.2.33 197....
-2 votes
1 answer
104 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
  • 71

1
2 3 4 5
8