295 votes
Accepted

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

An IP address can be set up in DNS to resolve to any host name, by whoever is in control of that IP address. For example, if I am in control of the netblock 203.0.113.128/28, then I can set up 203.0....
user's user avatar
  • 7,795
115 votes
Accepted

How can Twitter and GitHub be sure that they haven't been hacked?

They can't be sure. In fact, you can never be sure you haven't been hacked. But a thorough examination can make you conclude that it is more or less likely. The Twitter statements only says that ...
Anders's user avatar
  • 65.6k
57 votes
Accepted

A government agency sent our website admin an email that our website had been defaced

It's extremely easy to fake email. If someone did fake this, I don't see how the agency would know about it. The concern is that the link they sent you was the attack itself. For example, this ...
JimmyJames's user avatar
  • 3,049
39 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

I think you MUST be concerned if anyone has unauthorized access to your server. As others mentioned there isn't much work for faking reverse DNS host name. Maybe they want you to believe it's okay for ...
Koorosh Pasokhi's user avatar
31 votes

A government agency sent our website admin an email that our website had been defaced

A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency. In the case of national CERTs like CERT-AU, they often care ...
Ángel's user avatar
  • 18.8k
27 votes

KeePass security local malware

Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
Matthew's user avatar
  • 27.3k
26 votes
Accepted

Weird URL showed when telnet to my server

is this normal [that the my server login reports a different domain] Of course not. I am using ubuntu and it was compromised before Well ... you shouldn't have continued using it. but I ...
deviantfan's user avatar
  • 3,844
21 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

So should you be concerned if it was the FBI, or is it ok if it was just some casual hacker? From the logs, someone successfully logged onto a host you control. It should be assumed compromised ...
s3c's user avatar
  • 311
19 votes

Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was "state-sponsored"?

That Yahoo claims that the attack was state sponsored does not mean that it was state sponsored, or even that them themself believe it was. The reason for why they would claim this lies somewhere on a ...
Anders's user avatar
  • 65.6k
19 votes

How can Twitter and GitHub be sure that they haven't been hacked?

One more thing to note is that in both cases, the leak was in a purely internal logging system. There is no indication that 3rd party users ever had access to this system. Internal logging systems are ...
Nzall's user avatar
  • 7,433
18 votes
Accepted

Would encrypting a database protect against a compromised admin account?

Yes, such a system exists; it's called Application-Level Encryption. Under that system the encryption keys (or at least the Key-Encrypting Key, or KEK) are only available to the application. Data is ...
gowenfawr's user avatar
  • 72.9k
16 votes
Accepted

KeePass security local malware

When your computer is compromised, pretty much any defense on it should be considered broken. Security threat models consider this as an out-of-scope scenario - barring very few exceptions (e.g., the ...
Sas3's user avatar
  • 2,658
15 votes

How did hackers compromise my EC2 instance?

The stack used is Rails 4.2.4 + Postgresql 9.3 + Puma + Nginx 1.4.6. The server I'm running is Ubuntu 14.04.2 LTS on an AWS EC2 t2.micro instance. Ruby on Rails 4.2.4 is vulnerable to a directory ...
cremefraiche's user avatar
  • 2,163
11 votes

Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?

Kill it with fire. Like yesterday. The FBI DITU or any other cyber unit from any Alphabet Soup to include Army CYBERCOM is NOT in the business of simply accessing your system from fbi.gov, someone is ...
VaeInimicus's user avatar
11 votes

A government agency sent our website admin an email that our website had been defaced

Unless they told you in the letter, there is no way of knowing how they were informed of the hack. The chances are that someone reported a problem, attack, or probe of some kind to CERT, and they ...
John Deters's user avatar
  • 34.2k
10 votes

KeePass security local malware

It's worth mentioning that there are settings inside KeePass to help restrict what malware (and you) can do. This lets you, for instance, prevent malware from simply exporting your entire database by ...
Spacedog's user avatar
  • 201
10 votes

How can Twitter and GitHub be sure that they haven't been hacked?

It's hard to prove a negative. So how do you prove a positive? In this case: how do you prove an attack from the outside? Typically there are several systems in place to monitor different forms of ...
Tom K.'s user avatar
  • 7,976
9 votes

I am a political activist, its likely that my computer will be compromised in the future, how can I secure my data?

Tails is exactly what you want, being designed with activists in mind! It is a live Linux-based operating system that can run from a DVD or USB stick which is amnesic, meaning that any data that isn't ...
forest's user avatar
  • 66.7k
8 votes

Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was "state-sponsored"?

First of all, what "state"? When people say "state-sponsored" they are referring to a nation state, or a government-sponsored attack. State-sponsored attacks are typically considered at the height of ...
h4ckNinja's user avatar
  • 3,056
8 votes

XZ compromise and consequences for people having used it

If you're 100% sure your system has not been accessed, you may simply downgrade xz and sleep tight. There's nothing to worry about. The exploit only affects the sshd authentication mechanism. It has ...
Artem S. Tashkinov's user avatar
7 votes
Accepted

How do I deal with a compromised network device?

This answer is based on How do I deal with a compromised server, but adapted for embedded devices and home/SoHo users. I still suggest you read that answer when you have time, but here's the (somewhat)...
André Borie's user avatar
  • 12.8k
6 votes
Accepted

Are there any vulnerability differences between real-time systems and non-real-time systems?

Generally, if something is wrong with a real-time system, it'll go wrong upon a trigger event occurring. For example, Knight Capital had a stock trading system which responded to specific ...
Matthew's user avatar
  • 27.3k
6 votes

Weird URL showed when telnet to my server

Trying <IP>... Connected to www.tjto6u0e.site. Escape character is '^]'. The hostname given after Connected to is just the DNS resolution of the IP you gave telnet. The only thing it can really ...
user133831's user avatar
5 votes
Accepted

Received an email about an "Etsy" Password Reset due to the "Linkedin Breach...." is this a phishing attempt?

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which ...
Ben's user avatar
  • 4,032
5 votes
Accepted

Phishing e-mail replied to internal email. What is compromised?

Have you already considered that it might just be coincidence? If the subject was something common, it might not even be a compromise, just a lucky guess. If it wasn't something that obvious, how ...
thel3l's user avatar
  • 3,414
5 votes

A government agency sent our website admin an email that our website had been defaced

Without seeing the email headers, there is no way for us to be sure, but it sounds more likely that the email notice was the phish, as Jimmy James above says. Much easier for the attacker who placed ...
JesseM's user avatar
  • 1,942
5 votes

KeePass security local malware

Attacks on KeePass Can a malware that infected your local computer compromise a KeePass database stored locally by any way? If you don't open it, they can only snatch the database file and try to ...
user2428118's user avatar
  • 2,786
5 votes

How exactly can a public server be compromised?

Assuming also that the web application code (PHP in this case) was also secure and all user passwords where secure [...] That's like saying "assuming that the lock is unpickable and the house has no ...
Anders's user avatar
  • 65.6k
5 votes
Accepted

My local machine was infected with malware from a clients web server

With my developer hat on: If the new site is "all new", including the OS, then I would not have investigated the hacked site. I would have chalked it up as a "past event". If the new site was on the ...
schroeder's user avatar
  • 129k
5 votes
Accepted

Being directed to hacked site only when searched through Yahoo

I have just verified this. If the request header contains the Referer (which your browser adds after being refered by another site), you are redirected to the fake page. This is the response, which ...
Nomad's user avatar
  • 2,379

Only top scored, non community-wiki answers of a minimum length are eligible