Collaborate Disseminate
Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including normal-looking communicatio… Continue reading Is there a way to prevent comments from being abused for command and control?
I am a master student and I am working on a mini-project on virus recognition and how to get rid of the virus.
I had to infect my virtual machine and then clean the virus or Trojan using various ways.
My question is about… Continue reading famous anti virus fail to detect simple malicious software (detection problems)
Ongoing campaign shows more hackers are adopting sneaky attack technique. Continue reading Fileless malware attack against US restaurants went undetected by most AV
It seems that more and more Anti-Virus and other security related business solutions are adding the ‘AI’ and ‘machine learning’ buzzwords to their marketing repertoire. However, the only ‘AI’ I ever saw working was the RITA p… Continue reading What would be an example of ‘AI’ in your average security appliance?
Can a single breach detection system include more than one of these approaches?
UBEA which looks at user behavior
Network Traffic Analytics (NTA) which focuses on network traffic
Threat Intelligence Platform (TIPS) that loo… Continue reading Can a single breach detection product include more than one of these approaches?
I was interested to lookup the traffic of an app and I installed MITM-proxy on my Mac and set up the connection to it on my iPhone.
Actually everything worked like it should, except that the main functions are kind of “block… Continue reading How does an iPhone app detect a proxy?
I’m struggling to see the difference as all papers and notes I’ve read seem to contradict each other.
Can someone please explain to me the difference between heuristic and behaviour based virus scanning techniques?
Continue reading What is the difference between Heuristic-based and Behaviour-based virus scanning?
Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ?
Talking about tools (as examples) such as but not limited to: tripwire, bro, aide, psad, rkhunter.
Th… Continue reading Can using simultaneous intrusion detection systems (IDS) create conflicts?
I want to develop a network IDS for a Wi-Fi network. For that I will be using Wireshark as packet capture tool and program logic will be written in Java. I want to develop an application for the same. how can I run Wireshark … Continue reading Use Wireshark in background of a Java Application
I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork.
From what I’ve been able to gather (from Wazuh’s website and documentation), the main advantages of Wazuh are:
its abili… Continue reading HIDS – Choosing between regular OSSEC or Wazuh fork