Category Archives: forensics

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

Posted on by

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so:
#define CONNECTIONS 1

They then attack with xerxes-executable mydomain 433.
Their strategy is to use eight time less connections from eac… Continue reading How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?→

Velociraptor & Loki

Posted on by

Velociraptor is a great DFIR tool that becomes more and more popular amongst Incident Handlers. Velociraptor works with agents that are deployed on endpoints. Once installed, the agent automatically “phones home” and keep s a connection with the server… exactly like a malware with it’s C2 server but this time

The post Velociraptor & Loki appeared first on /dev/random.

Continue reading Velociraptor & Loki→

Does my jailbroken with root access iPad store any forensic evidence for usage of the lightning connector?

Posted on by

I am willing to give my iPad for a repair shop, but I would like to know whether they tamper with the OS in any way.

Is there any way with or without special software to gather forensic evidence about whether the lightning port was used t… Continue reading Does my jailbroken with root access iPad store any forensic evidence for usage of the lightning connector?→

Any approach to copy the disk and take RAM shapshot of RouterOS (Mikrotik)?

Posted on by

everyone!
I have discovered suspicious activity on one of Mikrotik Routers. This device had an outdated version of RouterOS with open ports web, winbox, etc. I believe that it was infected by malware, and there is a need to analyze the con… Continue reading Any approach to copy the disk and take RAM shapshot of RouterOS (Mikrotik)?→

New technique excels at lifting fingerprints from shell casings

Posted on by

It would be great if forensics teams could easily lift fingerprints off of bullet casings left at crime scenes, but unfortunately doing so is often quite difficult. A new technique developed at the University of Nottingham could change that.Continue Re… Continue reading New technique excels at lifting fingerprints from shell casings→