294
votes
Accepted
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address.
For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0....
- 7,815
115
votes
Accepted
How can Twitter and GitHub be sure that they haven't been hacked?
They can't be sure. In fact, you can never be sure you haven't been hacked. But a thorough examination can make you conclude that it is more or less likely.
The Twitter statements only says that ...
- 65.7k
57
votes
Accepted
A government agency sent our website admin an email that our website had been defaced
It's extremely easy to fake email. If someone did fake this, I don't see how the agency would know about it. The concern is that the link they sent you was the attack itself. For example, this ...
- 3,089
39
votes
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
I think you MUST be concerned if anyone has unauthorized access to your server. As others mentioned there isn't much work for faking reverse DNS host name. Maybe they want you to believe it's okay for ...
- 1,107
31
votes
A government agency sent our website admin an email that our website had been defaced
A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency.
In the case of national CERTs like CERT-AU, they often care ...
- 19k
27
votes
KeePass security local malware
Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
- 27.4k
26
votes
Accepted
Weird URL showed when telnet to my server
is this normal [that the my server login reports a different domain]
Of course not.
I am using ubuntu and it was compromised before
Well ... you shouldn't have continued using it.
but I ...
- 3,864
21
votes
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
So should you be concerned if it was the FBI, or is it ok if it was just some casual hacker? From the logs, someone successfully logged onto a host you control. It should be assumed compromised ...
- 311
19
votes
Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was "state-sponsored"?
That Yahoo claims that the attack was state sponsored does not mean that it was state sponsored, or even that them themself believe it was. The reason for why they would claim this lies somewhere on a ...
- 65.7k
19
votes
How can Twitter and GitHub be sure that they haven't been hacked?
One more thing to note is that in both cases, the leak was in a purely internal logging system. There is no indication that 3rd party users ever had access to this system. Internal logging systems are ...
- 7,563
18
votes
Accepted
Would encrypting a database protect against a compromised admin account?
Yes, such a system exists; it's called Application-Level Encryption. Under that system the encryption keys (or at least the Key-Encrypting Key, or KEK) are only available to the application. Data is ...
- 73.1k
16
votes
Accepted
KeePass security local malware
When your computer is compromised, pretty much any defense on it should be considered broken. Security threat models consider this as an out-of-scope scenario - barring very few exceptions (e.g., the ...
- 2,656
11
votes
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
Kill it with fire. Like yesterday.
The FBI DITU or any other cyber unit from any Alphabet Soup to include Army CYBERCOM is NOT in the business of simply accessing your system from fbi.gov, someone is ...
- 240
11
votes
A government agency sent our website admin an email that our website had been defaced
Unless they told you in the letter, there is no way of knowing how they were informed of the hack. The chances are that someone reported a problem, attack, or probe of some kind to CERT, and they ...
- 34.6k
10
votes
KeePass security local malware
It's worth mentioning that there are settings inside KeePass to help restrict what malware (and you) can do. This lets you, for instance, prevent malware from simply exporting your entire database by ...
- 201
10
votes
How can Twitter and GitHub be sure that they haven't been hacked?
It's hard to prove a negative.
So how do you prove a positive? In this case: how do you prove an attack from the outside? Typically there are several systems in place to monitor different forms of ...
- 8,001
9
votes
I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?
Tails is exactly what you want, being designed with activists in mind! It is a live Linux-based operating system that can run from a DVD or USB stick which is amnesic, meaning that any data that isn't ...
- 67.1k
8
votes
Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was "state-sponsored"?
First of all, what "state"?
When people say "state-sponsored" they are referring to a nation state, or a government-sponsored attack. State-sponsored attacks are typically considered at the height of ...
- 3,066
8
votes
XZ compromise and consequences for people having used it
If you're 100% sure your system has not been accessed, you may simply downgrade xz and sleep tight. There's nothing to worry about. The exploit only affects the sshd authentication mechanism. It has ...
- 3,445
7
votes
Accepted
How do I deal with a compromised network device?
This answer is based on How do I deal with a compromised server, but adapted for embedded devices and home/SoHo users. I still suggest you read that answer when you have time, but here's the (somewhat)...
- 12.9k
6
votes
Weird URL showed when telnet to my server
Trying <IP>...
Connected to www.tjto6u0e.site.
Escape character is '^]'.
The hostname given after Connected to is just the DNS resolution of the IP you gave telnet. The only thing it can really ...
- 161
5
votes
Accepted
Phishing e-mail replied to internal email. What is compromised?
Have you already considered that it might just be coincidence? If the subject was something common, it might not even be a compromise, just a lucky guess. If it wasn't something that obvious, how ...
- 3,404
5
votes
A government agency sent our website admin an email that our website had been defaced
Without seeing the email headers, there is no way for us to be sure, but it sounds more likely that the email notice was the phish, as Jimmy James above says. Much easier for the attacker who placed ...
- 1,962
5
votes
KeePass security local malware
Attacks on KeePass
Can a malware that infected your local computer compromise a KeePass database stored locally by any way?
If you don't open it, they can only snatch the database file and try to ...
- 2,786
5
votes
How exactly can a public server be compromised?
Assuming also that the web application code (PHP in this case) was also secure and all user passwords where secure [...]
That's like saying "assuming that the lock is unpickable and the house has no ...
- 65.7k
5
votes
Accepted
My local machine was infected with malware from a clients web server
With my developer hat on:
If the new site is "all new", including the OS, then I would not have investigated the hacked site. I would have chalked it up as a "past event".
If the new site was on the ...
- 132k
5
votes
Accepted
Being directed to hacked site only when searched through Yahoo
I have just verified this.
If the request header contains the Referer (which your browser adds after being refered by another site), you are redirected to the fake page.
This is the response, which ...
- 2,409
5
votes
How can Twitter and GitHub be sure that they haven't been hacked?
I assume they have access logs for just about anything happening on their servers, they can check whether someone accessed the file, when that was, what alias they logged in with, their source IP ...
- 151
5
votes
Server protection measures from authorities
The most important factor here is that seizure of the server does not result in your identity as the server's owner being revealed. This must be accomplished by both purchasing the server anonymously, ...
- 67.1k
5
votes
How to verify a private key has not been compromised?
You need a Hardware Security Module (HSM), as there's no reliable way to detect if someone else have your key. It's the same issue of knowing if someone have your password: you can only know if ...
- 55.1k
Only top scored, non community-wiki answers of a minimum length are eligible