Questions tagged [logging]
Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.
383
questions
0
votes
0
answers
36
views
Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?
I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
0
votes
0
answers
27
views
Configured KQL not working properly - CiscoISE event 60095 and 60098
I have a default KQL below which is used to detect when Cisco ISE failed backup, it fires an alert in Sentinel.
But it is not working as expected - it does fire an alert, but returning a timestamp ...
- 11
0
votes
3
answers
162
views
Is it a security issue to include postcode and/or last name in a GET request query string?
I'm currently designing an API endpoint to validate a customer, and they can either pass in their postcode or their last name, as well as their customer ID (plus some other irrelevant data).
I've ...
- 1
0
votes
0
answers
50
views
Detect tscon execution from event logs
Is it possible to determine whether someone has hijacked a RDP session with tscon?
I tried to look into TerminalService-LocalSessionManager logs, the EventID 25 looks much like it, but a normal ...
- 2,057
0
votes
0
answers
57
views
How to write separate log files for separate services in dionaea honeypot
I am trying to set up a honeypot service on the network and I installed dionaea honeypot. I figured out that each service is being controlled by yaml files present in /opt/dionaea/etc/dionaea/services-...
0
votes
0
answers
78
views
Unexpected drop in UFW noise, should I be worried?
I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet.
I have ...
- 1
1
vote
1
answer
71
views
Logging secrets in the user agent (browser)
There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7).
But should the same rule apply on the client side? Is there a ...
- 395
3
votes
2
answers
182
views
Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?
Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text?
I always wonder if seeing one that is unread could queue me in to something bad happening ...
- 133
0
votes
0
answers
55
views
Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED) [duplicate]
So I did this post before on a guest account but I had further questions so now I'm posing it on a real one.
Can my employer see my private google history/”google activity” if I didn’t do anything on ...
- 1
0
votes
2
answers
4k
views
Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop
Can my employer see my private google history/”google activity” if I didn’t do anything on my work pc?
For some context I logged in to my private google account on my work computer just to send a pdf ...
- 1
0
votes
0
answers
172
views
OSSIM logs and disk space?
I've installed OSSIM (no USM) on a VM and am trying to figure out how much disk space I need to give this VM. Basically does anyone know:
How can I estimate how much disk the logs are using each day? ...
1
vote
1
answer
93
views
Guardrails Around Logs For Devs
Are there good ways to put guardrails on not logging sensitive information? For example, passwords
If there isn't a guardrails approach, is there a way to help make the easy thing the right thing like ...
- 202
0
votes
0
answers
496
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 1
0
votes
0
answers
30
views
Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?
When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase).
But I've just realised that there are tons of kindergarten level exploits. For ...
- 123
0
votes
0
answers
15
views
Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]
I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0
votes
0
answers
84
views
Secure logs on an embedded IoT device
I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development.
Since logs will be primarily event & data logs, the size of the log ...
- 173
0
votes
0
answers
843
views
lsass.exe spawning lsass.exe
In logs, I found lsass.exe spawning lsass.exe.
C:\Windows\System32\smss.exe
C:\Windows\System32\smss.exe
C:\Windows\System32\wininit.exe
C:\Windows\System32\lsass.exe
C:\WINDOWS\system32\...
1
vote
0
answers
156
views
Does Windows 10 log network activity?
I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about:
Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
0
votes
1
answer
117
views
Securing and storing Active Directory logs
If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
- 21
1
vote
2
answers
151
views
Logging docker container logins, EC2 Host
I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx.
I have an rsyslog setup that successfully captures the auth....
- 11
1
vote
1
answer
626
views
How to do ADB and user activity logging on Android?
My question is how to detect ADB connection or unusual user activity in shell on the Android devices.
I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
- 260
1
vote
1
answer
369
views
Why am I seeing this in /var/log? [closed]
I've noticed a lot of weird logs in /var/log on my server.
For example:
cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000
...
- 111
1
vote
1
answer
140
views
When typing something in the URL bar in Safari with google as my default search engine without pressing "enter", does google log what I've typed?
When typing in the URL bar in safari with google as my default search engine without pressing enter (i.e not actually searching), does the text I've typed or my IP get logged to google?
- 11
0
votes
2
answers
878
views
Is Output Neutralization required when logging C# exception messages to log files?
CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
- 103
1
vote
2
answers
3k
views
Storing Session Id in application logs
Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId?
...
- 113
1
vote
1
answer
2k
views
Spam GET And POST Requests - Are They Dangerous?
I am getting a lot of spam GET and POST requests lately which some of them look like this:
"GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user257368
0
votes
2
answers
119
views
Definition of what is log data in context of VPN
Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) ...
- 335
0
votes
1
answer
244
views
Synology logs SMB "Read" event false positives
We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
- 225
1
vote
2
answers
183
views
Does Windows log desktop application passwords?
The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
- 13
-1
votes
1
answer
147
views
What stops a nation state starting a "VPN service" to view its customers' logs? [closed]
I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy,...
- 1,250
1
vote
3
answers
392
views
In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?
I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
- 113
6
votes
2
answers
2k
views
Do external harddrives keep track of the computers they're plugged in to?
I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever ...
- 63
1
vote
1
answer
445
views
Does Windscribe VPN keep logs even when disconnected?
I am using (have installed) this VPN on an Android Smart TV.
Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
- 121
0
votes
0
answers
157
views
How to Minimize Risk of Remote Access from Potential Job Scam?
Question resolved: no reason at this time to assume the remote access was with any malicious intent.
[skip this beginning if you want]
My partner was offered a job with a real estate listing company ...
0
votes
2
answers
297
views
If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]
Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers.
Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
- 536
0
votes
0
answers
60
views
Trace Unauthorized login into My Gmail and Facebook Account [duplicate]
I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0
votes
1
answer
98
views
What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint?
The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational ...
- 3
0
votes
1
answer
876
views
Log poisoning prevention in the context of LFI
Back in the day, mostly, such injections were taking place over the
server log files. Such files are the Apache error log, the Access log
and more. Techniques like these have been used for years and,
...
- 1,558
22
votes
5
answers
17k
views
Does Google collect and store data about activity done in Incognito mode?
Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode.
Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
- 339
0
votes
2
answers
20k
views
What information do ISPs delete after retention period?
Whenever I read something like "ISPs store your data" or "ISPs delete your data after 6 months" or anything like that, I imagine data to be the following things:
(1) At what time I ...
- 339
0
votes
2
answers
546
views
How do you find an attacker if he immediately cleans after himself?
Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch.
I search the logs for his ip and it doesn't show up.
He is ...
0
votes
2
answers
175
views
Logging SSH commands on Linux - is custom kernel the only way?
I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user.
Even after making changes to instantly log the command and ...
- 3,096
0
votes
0
answers
225
views
Does Windows log the movement of files?
If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
1
vote
0
answers
133
views
Detecting changes in surrounding WiFi networks [closed]
I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
- 111
0
votes
1
answer
1k
views
Is it okay to log sql queries for debugging
I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
- 115
0
votes
0
answers
140
views
Hard Wired Man in the Middle Logging
I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity.
I was thinking of setting up a computer between the cable modem ...
- 141
3
votes
2
answers
678
views
What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]
As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
1
vote
0
answers
172
views
Detecting multiple active login sessions to AD with workstation/DC event logs
I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
- 11
2
votes
1
answer
159
views
Is logging number of special characters in password a bad idea?
Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password.
...
- 258
3
votes
4
answers
3k
views
Logging access tokens
In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
- 478