Collaborate Disseminate
I want to develop a network IDS for a Wi-Fi network. For that I will be using Wireshark as packet capture tool and program logic will be written in Java. I want to develop an application for the same. how can I run Wireshark … Continue reading Use Wireshark in background of a Java Application
I have noticed high CPU usage, and noticed that user dinko had high CPU usage with the sshd process when I typed top.
User dinko was just some random user that I created and had a Ruby application running.
I have immediatel… Continue reading Are these log entries normal?
I intend to set up OSSEC and noticed there seem to be two main flavours: plain OSSEC and Wazuh fork.
From what I’ve been able to gather (from Wazuh’s website and documentation), the main advantages of Wazuh are:
its abili… Continue reading HIDS – Choosing between regular OSSEC or Wazuh fork
Experts say the country appears to be a “testbed” for cyber attacks that could be used around the world. Continue reading The Ukrainian Power Grid Was Hacked Again
Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the network yet, so I don’t have many logs… Continue reading non-rfc1918 address appeared on router dashboard
recently I’ve identified that some hack attempt was performed at one of my servers.
I have dumped nginx logs to github, please take a look and try to identify which tool was used to perform this attack.
Excerpt from log:
195.154.41.132 … Continue reading Anyone can identify tool used to perform this attack?
Is there a system which can put an IDS/IPS in “high alert” mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if this idea makes sense and which sorts of… Continue reading Priming an IDS/IPS for an impending attack
I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these automated scans, PC’s with malw… Continue reading Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?
I connected to my home-made VPN, which uses OpenVPN and 2048bits encryption keys, from my work.
What are the security risks of doing so, given the fact that the servers are in the same network my work’s PC is, and how can I … Continue reading What are security risks of connecting to my home vpn from my work?
OpenIOC.org has several schemas defining Indicators of Compromise.
The Schema is defined here:
http://schemas.mandiant.com/2010/ioc/ioc.xsd
While under IndicatorItemContext/search says it is xs:string, the actual list of search terms is… Continue reading Where can I find a list of Indicators of Compromise (IOC) conditions?