Skip to main content

Questions tagged [system-compromise]

Dealing with a system compromise: your defenses failed, now what?

Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

Locating Spambot

My mail server (IP, not domains) was recently flagged as a spam source by Spamhaus and I'm looking for help at tracking down the source. First, I verified the forward and reverse DNS records, SPF ...
user1801810's user avatar
11 votes
1 answer
451 views

XZ compromise and consequences for people having used it

Here's a hot topic: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users https://lwn.net/Articles/967180/ https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@...
Artem S. Tashkinov's user avatar
1 vote
1 answer
164 views

Creating bootable USB from a compromised OS. Is it safe?

If we buy for instance a laptop with an OS pre-installed e.g. Ubuntu and but the original seller was not reputable and there are doubts with the preinstall. My question is: if we use the laptop to ...
Jim's user avatar
  • 183
1 vote
1 answer
292 views

Examining linux memory dump with signs of compromise in yarascan

I have captured a memory dump of recent Ubuntu 22.04 kernel 6.2.0-39-generic. captured image with LiMe and analyzed with volatility3. did a yarascan against all known rules and found a suspicious ...
Zzgooloo's user avatar
0 votes
0 answers
286 views

Secure boot disabled for Potential BIOS compromise on Tails OS machine

I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled. This computer has secure boot enabled by ...
blacksangria's user avatar
1 vote
0 answers
137 views

Different types of USB charger attacks that work on Android phones

I'm wondering about different types of malicious USB charger attacks that work on Android devices when USB debugging option is disabled and if the USB option is set to "charge only". I'm not ...
Kurusakibill074's user avatar
1 vote
1 answer
193 views

What "indicators of compromise" are there that end users can diagnose themselves?

I'm responsible for the IT security of a small (~5 users) office, and I'm preparing training materials for our users. Obviously, the first step my users should do if anything seems suspicious is to ...
Heinzi's user avatar
  • 3,788
2 votes
1 answer
1k views

Windows Update installs yandex.ru browser hijacker

I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
curious_weather's user avatar
2 votes
1 answer
183 views

Is it possible for a hostname lookup to be temporarily lying (wrong ISP)?

In 2017, I was running a local website on my own dedicated server in a professional data center. FreeBSD. Installed by me remotely. Maintained carefully by me. No other human users than myself. I was ...
Cathan's user avatar
  • 21
1 vote
0 answers
107 views

How can I get & keep an unauthorized user out of my network? [closed]

I have replaced hardware, equipment, and passwords. I think they are in Yahoo, Microsoft, phone, and laptop. I have changed all with no success. They use my identity as the temporary ID from Microsoft ...
Kindrea Vance's user avatar
0 votes
1 answer
681 views

Can VPN protect me against MITM attacks if my device is already compromised by having a malicious root certificate installed?

Let's say my device is already compromised without my knowledge by my ISP, it has a malicious root certificate installed which allows my ISP to view all of my HTTPS traffic as plain text. now if I use ...
user avatar
0 votes
0 answers
140 views

How to fix deceptive site ahead warning on a wordpress site

I have an issue with my website, when visitors try to access it shows the deceptive site ahead warning I used google search console to try to fix it (as I successfully did it previously with some ...
Xsmael's user avatar
  • 103
0 votes
1 answer
224 views

OS on external drive -- is it safe?

So I'm installing macOS to my external hard drive partition, so I can have a 100% clean environment where I can engage with cryptocurrencies. (Exchanges, stable coins, protocols, putting actual money ...
user277849's user avatar
0 votes
0 answers
132 views

Compromised machine. Should I create a partition or volume to install a clean OS?

My goal is to create a 100% clean environment where I can interact with cryptocurrencies. For that, I can partition my disk or I can create a volume. Which one should I prefer? Some context about the ...
user277849's user avatar
-2 votes
1 answer
2k views

How can this Jim Browning YouTuber have access to so many scammers' computers/networks?

I'm frankly sick of these videos, and the only interesting part to me has nothing to do with the scam or the content of the video, but simply the fact that he is apparently somehow able to see exactly ...
B. Kinsman's user avatar
6 votes
3 answers
7k views

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
user275680's user avatar
1 vote
1 answer
171 views

Ability of an infected UEFI bios to store data on computer

Suppose the UEFI BIOS is infected. The storage device is encrypted, there is no network access to the system, and RAM is encrypted. Is there any writable storage that an infected UEFI can write to ...
Bob's user avatar
  • 35
0 votes
1 answer
374 views

Will secure boot prevent any non signed firmware from running?

Wonder if secure boot can protect my computer from usb drives with infected firmware after Debian os is booted ?
Rey's user avatar
  • 3
0 votes
1 answer
697 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
Manny's user avatar
  • 101
1 vote
1 answer
411 views

Why am I seeing this in /var/log? [closed]

I've noticed a lot of weird logs in /var/log on my server. For example: cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000 ...
Stiofán's user avatar
  • 111
1 vote
2 answers
339 views

Email server compromise?

My company sends around 1M emails per month through various providers (Sendgrid etc.). One of emails we send is a "sign up" email, which contains a link for a user to finish registering ...
Steve's user avatar
  • 111
1 vote
1 answer
131 views

Is it called Drive-by Compromise if attacker provided his website for user to access?

If the website is legitimate and the attacker exploited that legitimate website, and the attacker gains access to a victim's system that visits the website, then it is a drive-by compromise. However, ...
TIMOTHY LIM's user avatar
1 vote
0 answers
548 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
Algo7's user avatar
  • 113
0 votes
1 answer
184 views

Database password encryption compromised

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed. In this situation does the company needs to change the encryption ...
Rudra Sarkar's user avatar
1 vote
0 answers
249 views

How can this "Jim Browning" YouTuber have access to all these scammers' PCs? [closed]

I've been watching these videos on YouTube about some British-sounding male (with millions of views) busting Indian scammers. It is never explained how exactly he is able to do this, with him ...
M Gasowski's user avatar
1 vote
0 answers
393 views

How did SolarWinds get hacked? And was the Orion update put out without human approval? [closed]

Obviously there is massive information about the SolarWinds Orion hack itself of the malicious DLL injected into the update: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-...
Ethan Allen's user avatar
11 votes
1 answer
588 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
O. Jones's user avatar
  • 379
1 vote
1 answer
255 views

MacOS's Finder (and Xcode) accessing iDevices while network was off

I am trying to figure out what is wrong with my Mac. Here are my devices: iPad (7th generation, MW752LL/A) with iOS 14.01 (18A393), iPad Air (MD788LL/A) with iOS 12.4.8 (16G201), iPhone 6 Plus (...
com ter's user avatar
  • 11
0 votes
2 answers
626 views

How do you find an attacker if he immediately cleans after himself?

Having an Ubuntu server with current software, updated daily, every 5 days or so someone gains root access. I know that from log watch. I search the logs for his ip and it doesn't show up. He is ...
Percival Junghans's user avatar
3 votes
4 answers
291 views

How do I minimize the number of passwords leaked when a PC gets compromized?

For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
Heinzi's user avatar
  • 3,788
1 vote
0 answers
125 views

Strange Proxy Application Behavior on iOS 13.5.1

Background: My buddy is a freelance journalist working on a story on one of the bigger software companies (a household name, starts with an A). Anyway, he asked me to take a look at his iPad because ...
David's user avatar
  • 11
0 votes
1 answer
150 views

How do maintainers calculate x number of accounts compromised by hack? [closed]

I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
Martin Joiner's user avatar
1 vote
0 answers
165 views

I've nuked it from orbit, now what?

Last night I was checking my router because I noticed some sluggishness with my connection. I opened a connections monitor and saw my computer was sending significant UDP traffic to an IP address on ...
Davis's user avatar
  • 152
-1 votes
3 answers
377 views

DDoS: calculating server threshold for requests

There's a question on infosec stack exchange here that is similar but not the same as what I want to know: Threshold for DDOS Attack I want to know how to calculate the amount of requests, and/or ...
Novelty's user avatar
  • 11
1 vote
2 answers
269 views

Compromise of a Public JS Library

I was listening to a podcast about cybersecurity, and I heard that a public JavaScript library was compromised by attackers who injected a credit card scraper into the library, and then every site ...
Grant Davis's user avatar
0 votes
0 answers
32 views

Wordpress m4shell Hack [duplicate]

I could not find any similar error after searching the web and struggling with the problem for around two weeks. One of the Wordpress sites I'm managing keeps getting hacked. There has been no ...
Vincenz Mössenböck's user avatar
1 vote
0 answers
212 views

Help in understnading HIDS OSSEC traces

I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues. When I ran dmesg, i found the following trace: ------------[ cut ...
dawn's user avatar
  • 111
0 votes
0 answers
214 views

Logged in with a hacker's email address

I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US). Today I got a valid email from them that my email address was changed. On my mac, I opened up my ebay-kleinanzeigen ...
Rich Steinmetz's user avatar
0 votes
0 answers
151 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
gethopr's user avatar
  • 41
0 votes
0 answers
168 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
TRX's user avatar
  • 111
0 votes
2 answers
230 views

Differences between compromised shared hosting and dedicated/virtual hosting

My webspace has been compromised as explained on this answered question. While looking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
Jaume Mal's user avatar
  • 123
13 votes
3 answers
4k views

Would encrypting a database protect against a compromised admin account?

I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
Kevin Mirsky's user avatar
-1 votes
1 answer
566 views

Received ransom email containing my password. How did they get my password?

Finally, even I got the fabled ransomware emails we've all heard about so much. First, let's look at the facts before I get to my question: I use Mozilla Thunderbird as my email client. I was ...
ahron's user avatar
  • 423
8 votes
6 answers
1k views

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
Robby's user avatar
  • 81
0 votes
2 answers
2k views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
user8897013's user avatar
0 votes
1 answer
225 views

What are the security implications if systemd is not restarted after it has been updated?

My understanding is that systemd is the parent process for all other processes running on Linux. If systemd has been updated on production devices such as servers and the service is not restarted, ...
Motivated's user avatar
  • 1,513
3 votes
1 answer
520 views

Decrypting possibly compromised Veracrypt hard drive

I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system. The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop. I don't know ...
Bob's user avatar
  • 31
0 votes
0 answers
53 views

IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]

I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
a_at_cyber_dot_training's user avatar
5 votes
1 answer
776 views

How was IronChat compromised?

How was IronChat compromised? https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html Dutch police have ...
Chloe's user avatar
  • 1,758
-1 votes
1 answer
236 views

Are kernel mode drivers harder to compromise? [closed]

Of course the effects of a compromised kernel mode driver are more disastrous, but are they harder to compromise in the first place?
Jonathon Anderson's user avatar