Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
41 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
user avatar
0 votes
1 answer
15 views

Need help configuring SOF-ELK Sans to parse IIS W3C logs

How can I get the SOF-ELK VM to inject the IIS logs like the httpd logs. Here are my filebeats yml configs: /etc/filebeat/filebeat.yml filebeat.config.inputs: enabled: true path: /usr/local/sof-...
user avatar
  • 1
0 votes
0 answers
21 views

Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?

When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase). But I've just realised that there are tons of kindergarten level exploits. For ...
user avatar
  • 123
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
user avatar
0 votes
0 answers
59 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
user avatar
0 votes
0 answers
96 views

lsass.exe spawning lsass.exe

In logs, I found lsass.exe spawning lsass.exe. C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\...
user avatar
0 votes
0 answers
126 views

Is there any way to find out if a Logitech Unifying Receiver vulnerability was exploited?

Is there any way to find out if any of the vulnerabilities of older Logitech Unifying Receiver firmware was exploited? I'm referring to the vulnerabilities listed here including these. On GNU/Linux/...
user avatar
1 vote
0 answers
91 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
user avatar
0 votes
1 answer
89 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
user avatar
1 vote
2 answers
117 views

Logging docker container logins, EC2 Host

I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx. I have an rsyslog setup that successfully captures the auth....
user avatar
  • 11
1 vote
1 answer
257 views

How to do ADB and user activity logging on Android?

My question is how to detect ADB connection or unusual user activity in shell on the Android devices. I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
user avatar
0 votes
1 answer
260 views

Why am I seeing this in /var/log?

I've noticed a lot of weird logs in /var/log on my server. For example: cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 ...
user avatar
  • 101
1 vote
1 answer
121 views

When typing something in the URL bar in Safari with google as my default search engine without pressing "enter", does google log what I've typed?

When typing in the URL bar in safari with google as my default search engine without pressing enter (i.e not actually searching), does the text I've typed or my IP get logged to google?
user avatar
0 votes
2 answers
424 views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
user avatar
0 votes
2 answers
833 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
user avatar
  • 103
1 vote
1 answer
1k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
0 votes
2 answers
94 views

Definition of what is log data in context of VPN

Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) ...
user avatar
  • 230
0 votes
1 answer
144 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
user avatar
  • 225
1 vote
2 answers
163 views

Does Windows log desktop application passwords?

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
user avatar
  • 13
-1 votes
1 answer
137 views

What stops a nation state starting a "VPN service" to view its customers' logs? [closed]

I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy,...
user avatar
  • 1,224
1 vote
3 answers
157 views

In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?

I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
user avatar
  • 113
6 votes
2 answers
438 views

Do external harddrives keep track of the computers they're plugged in to?

I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever ...
user avatar
1 vote
1 answer
313 views

Does Windscribe VPN keep logs even when disconnected?

I am using (have installed) this VPN on an Android Smart TV. Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
user avatar
  • 121
0 votes
0 answers
140 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
user avatar
0 votes
2 answers
205 views

If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers. Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
user avatar
0 votes
0 answers
59 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
user avatar
0 votes
1 answer
92 views

What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint?

The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational ...
user avatar
  • 3
0 votes
1 answer
480 views

Log poisoning prevention in the context of LFI

Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more. Techniques like these have been used for years and, ...
user avatar
  • 1,498
22 votes
5 answers
13k views

Does Google collect and store data about activity done in Incognito mode?

Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode. Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
user avatar
  • 339
0 votes
2 answers
9k views

What information do ISPs delete after retention period?

Whenever I read something like "ISPs store your data" or "ISPs delete your data after 6 months" or anything like that, I imagine data to be the following things: (1) At what time I ...
user avatar
  • 339
0 votes
2 answers
372 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
user avatar
0 votes
2 answers
115 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
user avatar
  • 3,086
0 votes
0 answers
119 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
user avatar
1 vote
0 answers
115 views

Detecting changes in surrounding WiFi networks [closed]

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
user avatar
0 votes
1 answer
521 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
user avatar
  • 105
0 votes
0 answers
105 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
user avatar
  • 141
3 votes
2 answers
298 views

What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]

As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
user avatar
1 vote
0 answers
72 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
user avatar
  • 11
2 votes
1 answer
147 views

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
user avatar
3 votes
4 answers
2k views

Logging access tokens

In our REST API we write a log entry for every call made, including things like the query string, response code, duration etc... along with a SHA256 hash of the access token used. The thought process ...
user avatar
  • 428
3 votes
3 answers
225 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
user avatar
1 vote
3 answers
125 views

Securing SMTP server and its logs [closed]

Looking for general mail server security best practices here. I did some research and it's really hard to find the information out there. How do you safeguard a smtp server log? Are there any ...
user avatar
  • 13
0 votes
1 answer
5k views

IP retrieval without visiting the site or clicking the link

There are sites like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a message via Twitter, ...
user avatar
  • 3
0 votes
3 answers
463 views

How do I immediately block IPs once they do a single malicious act?

I get this in logwatch A total of 21 sites probed the server 1.144.111.208 123.31.43.40 174.216.5.13 185.156.177.234 188.175.196.105 188.71.236.121 197.229.2.33 197....
user avatar
-2 votes
1 answer
103 views

What part of this request can be logged? [closed]

While testing a website i noticed a weird behaviour. When resetting the password a POST request with empty body is generated. The request is the following: POST /reset/token/[token]/passwhord-hash ...
user avatar
  • 71
1 vote
1 answer
157 views

Local Scans initiated from a VLAN Broadcast IP address

Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255). I have checked the ...
user avatar
26 votes
2 answers
16k views

How are full URLs exposed when they are encrypted by HTTPS?

As far as I know, HTTPS URLs are encrypted (correct me if I'm wrong). There was a data leak recently and in one article about the leak I saw this picture: If HTTPS URLs are encrypted then how did the ...
user avatar
  • 271
-2 votes
1 answer
114 views

Do large companies keep a detailed "company log" book/database? [closed]

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a ...
user avatar
1 vote
0 answers
151 views

What does Telegram store (or potentially forward to 3rd parties)? [closed]

The Telegram messaging application apparently stores messages on its servers (at least - that's what it says in answers to this question here on the site). Is that everything it stores or forwards to ...
user avatar
  • 409
1 vote
0 answers
76 views

What relative functionality needs to be implemented when users click an "Accept Cookies" button? [closed]

As of 2018, a recent security measure was passed, called 'The Cookie Law'. It states that; if you have a website or blog with visitors from the EU (which is likely to happen), "you need a cookie ...
user avatar

1
2 3 4 5
8