Questions tagged [system-compromise]
Dealing with a system compromise: your defenses failed, now what?
136
questions
0
votes
1answer
74 views
Why am I seeing this in /var/log?
I've noticed a lot of weird logs in /var/log on my server.
For example:
cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000
...
0
votes
1answer
64 views
Email server compromise?
My company sends around 1M emails per month through various providers (Sendgrid etc.). One of emails we send is a "sign up" email, which contains a link for a user to finish registering ...
1
vote
1answer
44 views
Is it called Drive-by Compromise if attacker provided his website for user to access?
If the website is legitimate and the attacker exploited that legitimate website, and the attacker gains access to a victim's system that visits the website, then it is a drive-by compromise.
However, ...
1
vote
0answers
58 views
Spawning child processes from root using runuser command
I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank).
The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
0
votes
1answer
87 views
Database password encryption compromised
A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.
In this situation does the company needs to change the encryption ...
1
vote
0answers
99 views
How can this “Jim Browning” YouTuber have access to all these scammers' PCs? [closed]
I've been watching these videos on YouTube about some British-sounding male (with millions of views) busting Indian scammers.
It is never explained how exactly he is able to do this, with him ...
1
vote
0answers
278 views
How did SolarWinds get hacked? And was the Orion update put out without human approval? [closed]
Obviously there is massive information about the SolarWinds Orion hack itself of the malicious DLL injected into the update: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-...
9
votes
0answers
332 views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
0
votes
0answers
63 views
Login from Ukraine hours after legitimate login attempt
Recently I had a strange thing happen. I tried logging into the control panel of a client's hosting from my computer. It didn't work because I most likely have the wrong password.
Days later the ...
0
votes
1answer
88 views
MacOS's Finder (and Xcode) accessing iDevices while network was off
I am trying to figure out what is wrong with my Mac.
Here are my devices:
iPad (7th generation, MW752LL/A) with iOS 14.01 (18A393),
iPad Air (MD788LL/A) with iOS 12.4.8 (16G201),
iPhone 6 Plus (...
0
votes
2answers
245 views
How do you find an attacker if he immediately cleans after himself?
Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch.
I search the logs for his ip and it doesn't show up.
He is ...
3
votes
4answers
216 views
How do I minimize the number of passwords leaked when a PC gets compromized?
For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
1
vote
0answers
52 views
Strange Proxy Application Behavior on iOS 13.5.1
Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
0
votes
1answer
59 views
How do maintainers calculate x number of accounts compromised by hack? [closed]
I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
1
vote
0answers
90 views
I've nuked it from orbit, now what?
Last night I was checking my router because I noticed some sluggishness with my connection. I opened a connections monitor and saw my computer was sending significant UDP traffic to an IP address on ...
-1
votes
3answers
91 views
DDoS: calculating server threshold for requests
There's a question on infosec stack exchange here that is similar but not the same as what I want to know:
Threshold for DDOS Attack
I want to know how to calculate the amount of requests, and/or ...
2
votes
2answers
130 views
Compromise of a Public JS Library
I was listening to a podcast about cybersecurity, and I heard that a public JavaScript library was compromised by attackers who injected a credit card scraper into the library, and then every site ...
0
votes
0answers
31 views
Wordpress m4shell Hack [duplicate]
I could not find any similar error after searching the web and struggling with the problem for around two weeks.
One of the Wordpress sites I'm managing keeps getting hacked. There has been no ...
1
vote
0answers
127 views
Help in understnading HIDS OSSEC traces
I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues.
When I ran dmesg, i found the following trace:
------------[ cut ...
0
votes
0answers
128 views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
0
votes
0answers
85 views
What authentication systems have been involved in data breaches?
Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
0
votes
0answers
79 views
What should I do next on my GPG key after my computer is seized by authority?
Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
0
votes
2answers
131 views
Differences between compromised shared hosting and dedicated/virtual hosting
My webspace has been compromised as explained on this answered question. While looking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
13
votes
3answers
3k views
Would encrypting a database protect against a compromised admin account?
I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
-1
votes
1answer
432 views
Received ransom email containing my password. How did they get my password?
Finally, even I got the fabled ransomware emails we've all heard about so much.
First, let's look at the facts before I get to my question:
I use Mozilla Thunderbird as my email client.
I was ...
8
votes
6answers
726 views
I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?
I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
0
votes
2answers
572 views
How to verify a private key has not been compromised?
I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
0
votes
1answer
108 views
What are the security implications if systemd is not restarted after it has been updated?
My understanding is that systemd is the parent process for all other processes running on Linux.
If systemd has been updated on production devices such as servers and the service is not restarted, ...
3
votes
1answer
341 views
Decrypting possibly compromised Veracrypt hard drive
I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system.
The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop I don't know ...
0
votes
0answers
47 views
IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]
I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
5
votes
1answer
572 views
How was IronChat compromised?
How was IronChat compromised?
https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html
Dutch police have ...
-1
votes
1answer
120 views
Are kernel mode drivers harder to compromise? [closed]
Of course the effects of a compromised kernel mode driver are more disastrous, but are they harder to compromise in the first place?
0
votes
2answers
212 views
Best Source of Security Configuration Guidance
Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example:
https://www.cisecurity.org/cis-benchmarks/
https://www....
-1
votes
2answers
167 views
Is it a good idea to have a new laptop just to generate 2FA keys?
I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
2
votes
1answer
302 views
Server protection measures from authorities
I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics.
I am running a server ...
2
votes
1answer
220 views
Port Knock logs suggest machine has been compromised?
On my CentOS machine, all my ports are filtered with the Iptables rule:
DROP all -- * * 0.0.0.0/0 0.0.0.0/0
So from the Internet, every port timeouts.
The only way to ...
3
votes
1answer
990 views
SSH Outbound. Tracking down the process
I was pulled up by my ISP in work for having a machine making dozens of outbound SSH connections. I tracked down the machine and took it off the network. Problem is there are several other machines ...
1
vote
0answers
125 views
Firefox directs me to strange chinese error page, is my security compromised?
Today I was working on a project on my localhost ( I'm a web developer ), when I noticed Firefox is showing a message that means I need to login to my ISP before I can start browsing ( The ...
1
vote
1answer
404 views
ROP Attack :Force the program to manipulate an instruction as a gadget
I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack.
To gather the available gadgets I use ...
1
vote
1answer
347 views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
73
votes
8answers
18k views
How can Twitter and GitHub be sure that they haven't been hacked?
Yesterday, Twitter anounced that they recently identified a bug that stored passwords unmasked in an internal log. Recently, Github also had a similar bug. In both cases, they claim that nobody had ...
4
votes
1answer
134 views
Being directed to hacked site only when searched through Yahoo
A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo.
I was ...
1
vote
0answers
102 views
How to forbid hackers on a Joomla website? [closed]
My Joomla website was the victim of a hacker attack recently.
Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
3
votes
1answer
181 views
My local machine was infected with malware from a clients web server
I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (...
3
votes
1answer
182 views
A bot edited all pages on my Wordpress installation
I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained.
Now the time has come ...
0
votes
1answer
391 views
PHP Backdoor on live server [duplicate]
Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
0
votes
1answer
143 views
How exactly can a public server be compromised? [closed]
I'm in the process of setting up a network and it needs a site for users to be accessible on the internet. I keep reading about not having a public server on a local network, domain etc etc. And that ...
2
votes
2answers
328 views
How to address application database compromise
I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really ...
2
votes
2answers
3k views
Weird URL showed when telnet to my server [closed]
I don't know how to ask this because this is something new for me, I try telnet to my server and the output was like this:
Trying <IP>...
Connected to www.tjto6u0e.site.
Escape character is '^]'...
2
votes
3answers
1k views
Improve RDP security: router with VPN or IP whitelist on firewall
I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
