Skip to main content

Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
1 vote
0 answers
36 views

Log REST API calls in the most auditable way

I am working on a data processing task in an enterprise environment with Python3 installed on a client-side Windows Jump server. The data, which I need to download regularly from a third-party ...
gale44's user avatar
  • 11
7 votes
1 answer
271 views

Odd repetitive 16character 404 web requests, with json "RefreshTTL" payload

A few weeks ago we had a single user's browser start hitting the server with a peculiar request (IP redacted for their privacy): 1.1.1.1 - - [21/May/2024:07:42:31 +0000] "POST /3kFtdvOkagEQbIxH ...
IncredibleHat's user avatar
11 votes
3 answers
3k views

What security risks do you see with wrong OTPs appearing in application logs?

An application is logging wrong OTPs (but not correct OTPs). I asked the application developers to not log wrong OTPs because I do not see any benefits. However, they do not want to modify the ...
King Lance's user avatar
0 votes
0 answers
79 views

Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?

I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
kurosakichigoo's user avatar
0 votes
0 answers
76 views

Configured KQL not working properly - CiscoISE event 60095 and 60098

I have a default KQL below which is used to detect when Cisco ISE failed backup, it fires an alert in Sentinel. But it is not working as expected - it does fire an alert, but returning a timestamp ...
Halooooo's user avatar
0 votes
3 answers
306 views

Is it a security issue to include postcode and/or last name in a GET request query string?

I'm currently designing an API endpoint to validate a customer, and they can either pass in their postcode or their last name, as well as their customer ID (plus some other irrelevant data). I've ...
HazNut's user avatar
  • 1
0 votes
0 answers
111 views

How to write separate log files for separate services in dionaea honeypot

I am trying to set up a honeypot service on the network and I installed dionaea honeypot. I figured out that each service is being controlled by yaml files present in /opt/dionaea/etc/dionaea/services-...
ranjit abraham's user avatar
0 votes
0 answers
120 views

Unexpected drop in UFW noise, should I be worried?

I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn't currently in production use, it is active and accessible over the public internet. I have ...
rdi_pck's user avatar
1 vote
1 answer
121 views

Logging secrets in the user agent (browser)

There are sound reasons not to put any secrets, PII or other sensitive information into the logs on the server side (see OWASP ASVS V7). But should the same rule apply on the client side? Is there a ...
Marek Puchalski's user avatar
3 votes
2 answers
219 views

Is there any Security Benefits (auditing) to keeping old emails/text that give 2FA account codes?

Is there any Security Benefits/Risk in keeping old "Here is your 2FA login code" in email and text? I always wonder if seeing one that is unread could queue me in to something bad happening ...
Mallow's user avatar
  • 133
0 votes
0 answers
71 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED) [duplicate]

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
Jack's user avatar
  • 1
0 votes
2 answers
9k views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop

Can my employer see my private google history/”google activity” if I didn’t do anything on my work pc? For some context I logged in to my private google account on my work computer just to send a pdf ...
Jack's user avatar
  • 1
1 vote
1 answer
129 views

Guardrails Around Logs For Devs

Are there good ways to put guardrails on not logging sensitive information? For example, passwords If there isn't a guardrails approach, is there a way to help make the easy thing the right thing like ...
stk1234's user avatar
  • 202
0 votes
0 answers
772 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
Jerry_D's user avatar
  • 101
0 votes
0 answers
66 views

Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?

When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase). But I've just realised that there are tons of kindergarten level exploits. For ...
Tudvari's user avatar
  • 123
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
ashdcodes's user avatar
0 votes
0 answers
117 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
Akhilesh Gupta's user avatar
0 votes
0 answers
1k views

lsass.exe spawning lsass.exe

In logs, I found lsass.exe spawning lsass.exe. C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\...
frankcolumbo's user avatar
1 vote
0 answers
213 views

Does Windows 10 log network activity?

I've been thinking a lot about private browsing recently. Here's a scenario I've been thinking about: Let's say I have a browser installed on my Windows 10 PC called "ChromeFox" (made up, it'...
alrightitsalright's user avatar
0 votes
1 answer
159 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
user211383's user avatar
1 vote
2 answers
199 views

Logging docker container logins, EC2 Host

I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx. I have an rsyslog setup that successfully captures the auth....
dzzl's user avatar
  • 11
1 vote
1 answer
753 views

How to do ADB and user activity logging on Android?

My question is how to detect ADB connection or unusual user activity in shell on the Android devices. I have an Android 5.1.1 device with Wi-Fi hotspot enabled and also with opened ADB port, similar ...
Andrey Sapegin's user avatar
1 vote
1 answer
411 views

Why am I seeing this in /var/log? [closed]

I've noticed a lot of weird logs in /var/log on my server. For example: cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 ...
Stiofán's user avatar
  • 111
1 vote
1 answer
177 views

When typing something in the URL bar in Safari with google as my default search engine without pressing "enter", does google log what I've typed?

When typing in the URL bar in safari with google as my default search engine without pressing enter (i.e not actually searching), does the text I've typed or my IP get logged to google?
svenpurple7's user avatar
0 votes
2 answers
1k views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
scott.korin's user avatar
1 vote
2 answers
3k views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
ramtech's user avatar
  • 113
1 vote
1 answer
3k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
0 votes
2 answers
145 views

Definition of what is log data in context of VPN

Does it make any sense that a VPN provider (in this case VyprVPN, but this does not matter I am asking how to understand privacy claims in general, and what is considered as "log" data) ...
Martin's user avatar
  • 335
0 votes
1 answer
282 views

Synology logs SMB "Read" event false positives

We recently switched to a Synology enterprise setup at work and we're hoping to benefit from the additional logging that comes with Synology software. In response to a security incident, I found log ...
jtlindsey's user avatar
  • 225
1 vote
2 answers
290 views

Does Windows log desktop application passwords?

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
lpk96's user avatar
  • 13
-1 votes
1 answer
177 views

What stops a nation state starting a "VPN service" to view its customers' logs? [closed]

I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy,...
stevec's user avatar
  • 1,310
1 vote
3 answers
525 views

In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers?

I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by ...
Tom's user avatar
  • 113
6 votes
2 answers
4k views

Do external harddrives keep track of the computers they're plugged in to?

I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever ...
jibarron64's user avatar
1 vote
1 answer
512 views

Does Windscribe VPN keep logs even when disconnected?

I am using (have installed) this VPN on an Android Smart TV. Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-...
sato's user avatar
  • 121
0 votes
0 answers
185 views

How to Minimize Risk of Remote Access from Potential Job Scam?

Question resolved: no reason at this time to assume the remote access was with any malicious intent. [skip this beginning if you want] My partner was offered a job with a real estate listing company ...
Rob Tango's user avatar
0 votes
2 answers
427 views

If an IP address is known, can all of its browsing activity be viewed by an outsider? [closed]

Internet service providers (ISP) can choose to have full information on the browsing activity of one of its subscribers. Can an outsider, who is not the ISP, but who simply knows someone's IP address, ...
user610620's user avatar
0 votes
0 answers
62 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
Saw Eh Doh Wah's user avatar
0 votes
1 answer
121 views

What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint?

The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational ...
David's user avatar
  • 3
0 votes
1 answer
1k views

Log poisoning prevention in the context of LFI

Back in the day, mostly, such injections were taking place over the server log files. Such files are the Apache error log, the Access log and more. Techniques like these have been used for years and, ...
cyzczy's user avatar
  • 1,588
22 votes
5 answers
19k views

Does Google collect and store data about activity done in Incognito mode?

Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode. Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
Jay Shah's user avatar
  • 339
0 votes
2 answers
27k views

What information do ISPs delete after retention period?

Whenever I read something like "ISPs store your data" or "ISPs delete your data after 6 months" or anything like that, I imagine data to be the following things: (1) At what time I ...
Jay Shah's user avatar
  • 339
0 votes
2 answers
627 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
Percival Junghans's user avatar
0 votes
2 answers
218 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
Jason's user avatar
  • 3,126
0 votes
0 answers
295 views

Does Windows log the movement of files?

If I move a file from a non-hidden encrypted drive to my main C drive, then move the original file to a hidden container on the encrypted drive, then wipe the original file with ccenhancer/secure ...
thatsmynickityname's user avatar
1 vote
0 answers
166 views

Detecting changes in surrounding WiFi networks [closed]

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...
Gerard de Jong's user avatar
0 votes
1 answer
1k views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
Hemil's user avatar
  • 115
0 votes
0 answers
179 views

Hard Wired Man in the Middle Logging

I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers... um... activity. I was thinking of setting up a computer between the cable modem ...
Alan's user avatar
  • 141
3 votes
2 answers
862 views

What kind of data can be monitored/intercepted/altered by the VPN service provider? [duplicate]

As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. ...
Tom Netherlands's user avatar
1 vote
0 answers
268 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
awk's user avatar
  • 11
2 votes
1 answer
183 views

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
user902383's user avatar

1
2 3 4 5
8