Collaborate Disseminate
Is there a way to detect if an agent Z is listening to (and acting on) messages from Y? I can observe the messages that Y sends and the actions that Z takes, but I know Z is also listening (and acting on) other messages that … Continue reading Detecting if an agent is listening to specific messages
If we use SHA-256 checksum to detect corruptions to a file, what is its capability in terms of missed errors?
For example, reading the page about error correction and detection here, under the section of an CRC example it s… Continue reading Error detection capability of SHA-256
Avast says that the file for execution of the a program is malware, this file is infected by FileRepMalware. this mensaje wrong?
Continue reading Detection of FileRepMalware. Avast [on hold]
I have some data that needs to be handed to a friend. I don’t want to give the original drive (drive-1), so I plan to purchase a drive (drive-copy) and copy data to it. The data copied will still show last modified date for f… Continue reading Is it possible that a usb drive manufactured 3 months ago can have data copied to it that shows the file last modified date before manufacturing date? [on hold]
Here is a funny one: does pervasive traffic encryption KILL Network Traffic Analysis (NTA) dead? Well, OK, not truly “kill it dead,” but push it back to 2002 when it was called “N-BAD” [“a coincidence? I think not”] … Continue reading Is Encryption an NTA / NIDS / NFT Apocalypse?
If we email <username>@gmail.com and the address doesn’t exist (or is misspelled), our email provider will fail and return an “Undelivered Mail Returned to Sender” response.
Using a command line tool (preferably in Kal… Continue reading Email address enumeration tools? [on hold]
In a seminar, one of the Authors of Beehive: Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks said that this system can prevent actions like Snowden did.
From their articles’ conclusions;
An oscilloscope is a handy tool for measuring signals of all kinds, but it’s especially useful if you want to measure something with a periodic component. Modern oscilloscopes have all kinds of features built-in that allow you sample a wide range of signals in the hundreds of megahertz, and make finding and measuring your signal pretty easy, provided you know which buttons to push. There are some advanced oscilloscope methods that go beyond the built-in features of even the best oscilloscopes, and [AM] has a tutorial on one of them.
The method used here is called phase-senstitive detection, and allows …read more
This is a depressing post about security in the real world (what … another one?) In any case, we are having those enlightened debates about log analysis (via SIEM/UEBA), network security monitoring (via NTA or, if you’d like, NDR), endpoint… Continue reading Let’s Go Fight IT for Logs? Agents? Taps?
If someone copied files from a drive-1 to usb-drive-2, then it seems the directories and files get the original modified time from drive-1 in some cases and in some cases not.
Can it be checked if the file/directory was act… Continue reading If a file on USB drive shows a certain "date modified" time in the windows explorer, can the correct added date/time be checked for the file?