77

You can use git reflog in a clone and checkout the last commit before this happened. It happened because .git/config on your webserver (in the directory of the cloned repo) includes the remote URLs and people added username:password in it which should never be the case - people should use SSH, deploy keys or authenticate on each pull. Never store your ...


49

I doubt that the hackers pushed a "delete all" commit, or else you could simply revert the last commit. Rather, they force-pushed a different commit with the note to the HEAD of the master branch, making it look like your entire commit history is gone. As others have pointed out, you can easily use a local repo to force push the correct code to the server. ...


42

First of all that would entirely depend on the encryption used by the access point. There are several types of possible encryption. Mostly on consumer wireless access points these are: WEP WPA WPA2 WPS WEP Let's first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some ...


20

These kinds of back-doors are polymorphic, that is they are designed to look different every time - in practice it's a waste of time trying to decipher them because they all do exactly the same thing. They take external input and they execute it. It might take input from a cookie or a post variable, and it might try and set some PHP options to prevent ...


12

I can understand why your IT Manager is upset. How would you feel if some one, without your consent, bridged an unknown network with your home network? You arguably bypassed any controls they had in place and bridged a completely foreign network with that of (what I can only assume is) a multi million dollar corporation. What are the security risks of ...


10

Using a laptop effectively prevents this. You could glue the keyboard into the USB socket. Not ideal, but hey :-) Another is to use a Bluetooth keyboard, with integrated Bluetooth on the computer. But these are all kludges really; in general I agree with the other comments that if an attacker has physical access, most bets are off. This is quite a good ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


7

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


7

Regarding Wazuh differences with OSSEC, the Wazuh team is working on updating the documentation to explain those better (and on a new release and installers). Wazuh new version (2.0, currently found under the master branch) highlights are: OpenSCAP integrated as part of the agent, allowing users to run OVAL checks. New WUI on top of Kibana 5, and ...


6

This occurs because you're viewing an email that contains images and other resources served over HTTP, whilst the connection to the gmail site itself is HTTPS. This is known as mixed-mode, and it's risky in cases where an attacker can perform a man-in-the-middle attack. In this case, I don't think you should worry about it - it's completely normal to get ...


6

For a definitive answer, you'll want to look at three sources. This is all set out in the act itself. The Defence Department will be in touch with cleared defence contractors to provide their detailed requirements. As ever, if you need to know if something is legal or not, don't ask random people on the Internet: ask a suitably qualified lawyer who ...


6

First of all, the 777 permission means that the configuration file you are talking about can be edited by any other user on the system. So basically, a hacker who compromises your server and gets operating system access has the required permissions to tamper that file. A hacker can compromise your server and get system access simply by exploiting a ...


6

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. For example, using TrueCrypt can't protect you from a determined attacker who has installed a hardware key logger and is reading everything you type.


6

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to ...


6

All defence against physical access requires you to use physical security. Consider locking your system and all interface peripherals in a secure hard-case, one that would need to be damaged/destroyed in order to physically access inside them. This way you at least know when something has been physically tampered with. Combine this with software security ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


6

In the context you provide, it has to do with a backdoor that changes or moves over time. There might be a backdoor on port 8000, then it switches to port 8001, etc. The idea is that once a backdoor is discovered, the hacker must re-discover it to use it again. See also the concept of "port knocking" in real life, where the backdoor only opens once you ...


6

In general, it's possible for a live CD to boot a computer without leaving any traces. In some cases, this is an important feature of them - forensic imaging discs, for example, could change evidence if they wrote anything to the internal drives (and even then, professional forensic investigators usually copy using a hardware write-blocker if at all possible)...


6

Someone downloaded a word document and they might have used it as a template for their report. The author you are seeing would then be first author of the word document.


6

If more branches are affected, you may need to checkout all branches first with the following command before performing git push -u --all -f for branch in `git branch -a | grep remotes | grep -v HEAD | grep -v master `; do git branch --track ${branch#remotes/origin/} $branch done https://gist.github.com/octasimo/66f3cc230725d1cf1421


5

Most of the time it does get blocked. Not in the sense of blocking off the account, but blocking the IP that tried to connect. I use OSSEC. If someone tries to log in on ANY account wrongly more than 5 times, the connecting IP will be blocked and I will get an email containing what IP tried to log in. To prevent from locking yourself out you can ...


5

Here are some research papers that tackle this sort of problem and might interest you: Ripley: automatically securing web 2.0 applications through replicated execution. K. Vikram, Abhishek Prateek, Benjamin Livshits. ACM CCS 2009. Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines. ...


5

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network. Do they know the IP ranges for HR, finance, data storage systems etc? Do they have access to your change management system and would spot a new addition to the network? Have they already backdoored the servers ...


5

Monitoring for records from the DB to be posted are really all you can do without direct access to the server. You could try penetration testing the site yourself to look for holes, but that is probably unwise and possibly illegal depending on jurisdiction and the Terms of Use of the site and any contractual obligations you might have from when you wrote it....


5

There are a number of layers at which IDS/IPS can come into play when dealing with Azure IaaS. First, without doing anything at all, you already have IDS/IPS in place, because it's a standard piece of the Azure network security infrastructure. Every packet that enters their networks is going to be subject to inspection by the systems that are already in ...


5

A cookie is tied to your session, so you need to make sure all your login sessions are invalidated (generally, log out). If you are having a problem invalidating your sessions, then you will need to contact the particular website for support as how to invalidate sessions on every website you may have been logged in is far too broad. I also recommend you ...


5

No, it is not possible. The hypervisor controls everything your VM does. The isolation between your VM and other people's VMs relies on the hypervisor. If the hypervisor maps the memory of your VM for its own use, or if it allows other VMs to map it, your VM won't know about it, because of the same isolation mechanisms that don't allow other VMs to access ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


5

Do normal people actually set up complex local networks in their homes where they have some kind of "trust anyone with an internal IP address" security scheme going on? They do. Many have a PC or notebook, mobile phone, a printer, smart speaker (Alexa etc), SmartTV, IP camera for surveillance, smart home devices ... and these are typically all connected to ...


5

Checking the screws and other physical marks of being opened might indicate if hardware was installed. If you had a strong enough password, they likely were not able to "install something" in 25 minutes. "Evil Maid" attacks have been mentioned, but, while possible, are not so probable given modern firmware. It depends on your laptop (and how old it is). ...


Only top voted, non community-wiki answers of a minimum length are eligible