295

An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address. For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0.113.130 to reverse-resolve to presidential-desktop.oval-office.whitehouse.gov. I don't need control of whitehouse.gov to do this, though it can help in some ...


151

Originally from serverfault. Thanks to Robert Moir (RobM) It's hard to give specific advice from what you've posted here but I do have some generic advice based on a post I wrote ages ago back when I could still be bothered to blog. Don't Panic First things first, there are no "quick fixes" other than restoring your system from a backup taken prior to the ...


151

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain: The actual bottom line is that a compromise of our data will cost the company approximately X dollars + Y hours to recover. This is Z% likely to happen given the malware ...


147

No, you are just being paranoid. You were probably already connected to him over WiFi. There are many attacks he could have run this way without additional devices. Also if he would have wanted to hack you, he would not have thrown his strange hacking device in your face. He would have hidden it below the table. Side note: I feel like most of the people ...


120

Most probably he was using one of these wireless chargers that are built into the tables. It certainly fits your description.


118

They can't be sure. In fact, you can never be sure you haven't been hacked. But a thorough examination can make you conclude that it is more or less likely. The Twitter statements only says that there is no indication of a hack. That doesn't exclude the possibility that they were hacked, and in urging their users to change their passwords they implicitly ...


58

It's extremely easy to fake email. If someone did fake this, I don't see how the agency would know about it. The concern is that the link they sent you was the attack itself. For example, this could be a CSRF attack: With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web ...


56

I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice. Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...


39

I think you MUST be concerned if anyone has unauthorized access to your server. As others mentioned there isn't much work for faking reverse DNS host name. Maybe they want you to believe it's okay for a government agency to have access to your server so you won't investigate the incident anymore. You should backup all your server logs for later analysis and ...


35

I don't know what that gizmo is, but unless you've got a really bizarre laptop, it wouldn't be useful for attacking your computer. Outside of a laboratory setting, attacking a computer means using its standard input or output capabilities. An ordinary wifi or Bluetooth antenna can reach your laptop from anywhere in the room; a directional antenna can ...


33

You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again. Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...


32

The author had made the mistake of being ambiguous and confused the readers a bit. I must admit, like you, I was confused at first, until I saw the PCAP dump. First of all, the box indeed doesn't have wget The attacker didn't use that one echo statement, he used a series of echo statements. I counted about 107 echo statements progressively building the ...


30

A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency. In the case of national CERTs like CERT-AU, they often care about everything hosted on their country, and if they are made aware of any issue, their task would be to contact with the affected owner so that he can fix the ...


28

Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software running, on a verified secure computer (e.g. no hardware keyloggers, no VMs, etc.) which would somewhat defeat the purpose of having passwords to hand. However, ...


26

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its firmware opening the possibility of a BadUSB type attack. When you need to transfer data in both directions, you may therefore prefer to use SD-Cards which are ...


26

is this normal [that the my server login reports a different domain] Of course not. I am using ubuntu and it was compromised before Well ... you shouldn't have continued using it. but I have scanned my server and delete all infected files Virus scanners on an already compromised machine are pretty useless. (Even more useless than at other times). ...


20

That's easy - just finish the quote in your question, from Aliens. It's the only way to be sure. That's really all there is to it. Nothing more, nothing less. Let them know that if you run the AV software on it and the software says it has found and removed the virus, then maybe they're ok. Maybe. If the virus was really removed. If that was really the ...


20

So should you be concerned if it was the FBI, or is it ok if it was just some casual hacker? From the logs, someone successfully logged onto a host you control. It should be assumed compromised regardless of who it was. Scrap it and rebuild. Also keep in mind that a reverse DNS entry can be created by anyone who has control of a specific IP block. It doesn'...


20

One more thing to note is that in both cases, the leak was in a purely internal logging system. There is no indication that 3rd party users ever had access to this system. Internal logging systems are rarely exposed externally, and only consulted internally when a system needs troubleshooting. That's also probably the reason why this bug went unnoticed for ...


19

I downloaded the first URL (http://something.example.com/xx) and ran $ file xx xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped So, it's an executable program meant to run on a Linux machine. I assume you are running a Linux server. Next, we want to see what the program does, but of ...


19

That Yahoo claims that the attack was state sponsored does not mean that it was state sponsored, or even that them themself believe it was. The reason for why they would claim this lies somewhere on a continium between two extremes: Yahoo were completely incompetent and vulnerable. There is no way they are going to admit to the world that the thief was a 15 ...


18

I'm the guy who wrote the code which compromises the dvrs, and as said above, there is a script which simply connects and "echo"s the binary into a file, where it can be executed. As we are only echoing the raw bytes into the file and also excluding any new lines (-n), the result is an identical file. You can generate a set of the echo lines yourself by ...


18

Yes, such a system exists; it's called Application-Level Encryption. Under that system the encryption keys (or at least the Key-Encrypting Key, or KEK) are only available to the application. Data is encrypted by the application before being stored in the database, and encrypted blobs are retrieved from the database to be decrypted by the application. The ...


17

It is not reasonable to ever assume data you receive (including your operating system, BTW) from an outside source can be made 100% secure. The most secure way to transfer something and all-but-guarantee no side-effects (e.g. the OS mounting an external drive) is to type in all the data by hand while you be sure you understand it all. Even then you still ...


17

When your computer is compromised, pretty much any defense on it should be considered broken. Security threat models consider this as an out-of-scope scenario - barring very few exceptions (e.g., the very purpose of your software is to be the last-line of defense). That said, password managers (like KeePass) that store the password database locally do ...


16

From reading the disclosure, it seems what happens is that the open port isn't actually just a random port, but rather it is a port where a certain internal service that had never been designed to be exposed directly to the external world was listening on. If there is a vulnerability in that internal service, that might have allowed a possible attacker to ...


14

Try spies. The last James Bond opus appears to make millions of entries, so the crowd at large is, for now, receptive to spy stories. Explain that once unreliable/hostile people are in charge (that's the "compromised" setup), there is no way to recover proper security by asking them to do it; and yet, that's what running an AV on an infected machine is about....


13

To be the devil's advocate, management has heard all of this. Security is risk management and they need to make the decision. Just remind them of the tools. Risk = Probability of occurance X impact of occurance 100% chance of production downtime during the rebuild and costs of rebuild vs. 0.01% chance of malicious software or backdoors remaining in ...


13

Making a file "undeletable" in Linux is done with attributes, specifically the "immutable" attribute. See lsattr to see attributes, chattr to change them. However, this only answers to the proximal cause. The important thing is that your machine was put through hostile control, and the hijacker installed things for his own devious goals. In particular, he ...


13

I would go for Kali Linux . This Linux distribution is made for pentesting and security analysis. It contains a great many analysis tools, right in your main menu. In general, I would use an Open Source OS for security-related work, because with Open Source there is public scrutiny that your tools themselves are not compromised.


Only top voted, non community-wiki answers of a minimum length are eligible