96
votes
How and why is my site being abused?
Interesting problem. I wonder if a solution to this problem may be to force your users' web browsers to solve a cryptographic problem (using javascript running in their web browser) that is 'hard' to ...
- 24k
54
votes
Email Account under attack (really) - anything I can do?
A few thoughts:
Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.
If there is two factor authentication available, turn it on. If you ...
- 65.8k
54
votes
Accepted
How is Google abused for DDoS attacks?
Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
- 619
53
votes
Received email from ISP saying one of my devices has malware
Can an ISP really detect this?
The ISP can see all data your systems exchange with the internet (but not the plain text from encrypted data). Based on this he can detect botnets which often show ...
- 208k
34
votes
Email Account under attack (really) - anything I can do?
No. That's pretty much the background noise of being on the internet.
From a random server I have with e-mail:
$ sudo grep -c "auth failed" /var/log/mail.log
1109
That's today. It's with fail2ban ...
- 17.6k
34
votes
How and why is my site being abused?
How?
Rented botnet and captcha farms.
Why?
Someone wants your data. It's cheaper to steal it than buy it.
What to do?
Stealing it is cheaper, but not free. It costs "them" (whoever ...
26
votes
Email Account under attack (really) - anything I can do?
tl/dr: This is your hosting company's problem, not yours. You'll have
to contact them to get it fixed. Their security policies shouldn't
lock you out of your own account. They need to do ...
- 31.7k
22
votes
Should order numbers be guessable?
This led to curiosity, is an order number that important as it was years ago where it must be unique? What could be compromised and how? What could bots achieve as they can't make payments?
The ...
- 208k
19
votes
Accepted
Are HTTP brute-force password-guessing attacks common nowadays?
I prefer to call them "online password guessing attacks" since "brute force" has a specific meaning that may not always apply to these attacks. But yes, they do still happen and here are a few ...
- 8,466
19
votes
Received email from ISP saying one of my devices has malware
This looks like a legitimate email.
Someone detected that a computer with an Indian IP address was part of a botnet. This was shared with your National CERT (CERT-In). In turn, as they didn't know ...
- 19.1k
18
votes
Accepted
How does Mirai's C&C communicate with its bots?
I guess i'll answer direct to your question since you mentioned you've understood that 'a bot finds a C&C server with a DNS query after being infected. (i'll get back to this statement at the ...
- 1,293
18
votes
Email Account under attack (really) - anything I can do?
Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email ...
16
votes
Accepted
Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable?
Like your quote says; change the password. It would be much harder to fix if Mirai used 'actual' vulnerabilities (software bugs i.e. memory corruption). Then you'd have to hope there's an update ...
- 4,861
16
votes
Should order numbers be guessable?
It depends whether you're ever relying on the order number being secret. For instance, do you use it as part of the authentication process if a user contacts your customer service, or do you display ...
- 16.5k
14
votes
Accepted
How does Malware use Unregistered Domains
As the previous two mentioned the malware wasn't connecting to the unregistered domain name. The unregistered domain was a technique that was supposed to be used to prevent analysis of the malware.
...
- 301
14
votes
How and why is my site being abused?
If you can put up a simple "type the number in this picture" CAPTCHA and have that stick for 24 hours, you know your enemy is an amateur. You know this sort of primitive device involving ...
14
votes
Accepted
Should order numbers be guessable?
I would advise against your system, also.
The importance of unique order numbers in an e-commerce environment has not changed. I am no security expert but can spot several instances of where having ...
- 3,035
12
votes
How and why is my site being abused?
Why?
Data related to phone numbers, names and email addresses are extremely valuable, both in the legal and underground market.
How?
It sounds like someone is using a botnet to mine data from you. ...
- 221
11
votes
Received email from ISP saying one of my devices has malware
The email address from which you have received the mail seems genuine. The body of the mail also adds to the genuineness. However, senders email addresses can be spoofed by using open mail relays. As ...
- 186
8
votes
Are HTTP brute-force password-guessing attacks common nowadays?
Anecdotally, yes. WordPress sites are subject to straight-up password guessing attacks all the time. WordPress does allow user-name-enumeration by default, and there seem to be a few folks that use ...
- 4,582
8
votes
Accepted
Server getting probed: why can I see successful GET requests to other sites?
... GET /phpMyadmin_bak/index.php ... 404 ...
These are requests which look for vulnerable installations of typical software (phpMyAdmin in this case). Nothing to worry about if you don't run such ...
- 208k
7
votes
How does Malware use Unregistered Domains
In the case of WannaCry, the unregistered domain acted as a kill switch.
The code did the following:
Issue HTTP GET to unregistered domain
If the GET request fails (because it's unregistered) ...
- 219
7
votes
Accepted
Is there a way to prevent comments from being abused for command and control?
If you allow content generated by others at your site there is no way to detect if the content contains hidden messages in all cases because there are simply many ways such content could be embedded. ...
- 208k
7
votes
Accepted
How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?
and having To Re-infect again after every Reboot seems so inefficient
IoT devices like modems/routers, printers, smart TV, cameras, smart light bulbs, ... rarely restart. Most times they are running ...
- 208k
6
votes
Accepted
Unusual GET Request
This answer:
https://stackoverflow.com/questions/48512927/apache-random-ips-in-access-log-trying-to-execute-scripts
suggests it's a probe from the great firewall of china, looking for gateways that ...
- 3,577
6
votes
Received email from ISP saying one of my devices has malware
You should take this mail seriously.
There is no reason not to investigate your network for malware. (You don't need to click their links or download their tools for that, find your own from ...
- 161
5
votes
Accepted
How could ISPs "clean up their act" to protect against Mirai?
Blocking telnet to the routers. It should be blocked anyway as one of the most basic security configurations (hence the phrase, "cleaning up their act").
Telnet used to be the standard method to get ...
- 132k
5
votes
Accepted
How is the Mirai botnet directed?
Mirai uses a fairly standard Command and Control structure - the only real difference being that the code for the C&C was made public early on, so it can be updated and reused easily.
This ars ...
- 61.7k
5
votes
Risks of deploying MIRAI on my local network for testing?
Releasing known malware just doesn't seem like a good idea. A botnet's whole purpose is to engage massive numbers of devices in a coordinated attack - generally the perpetrators don't want it known ...
- 2,788
Only top scored, non community-wiki answers of a minimum length are eligible