The compromise tag has no wiki summary.
0
votes
1answer
83 views
How are SMTP AUTH credentials stolen and how to prevent it?
We run a mail system for some thousands users and from time to time we get a spam flood from one of our users' account.
When that happens we see connections from multiple IP addresses of foreign ...
0
votes
2answers
230 views
Active directory auth to comprimised machine?
Let's say that I have a machine on my domain that has been compromised by an unknown attacker. If I use my domain credentials to log into that machine remotely, via RDP, does that expose my ...
0
votes
2answers
220 views
how to check if my root server was compromised
My provider sent me an email stating that my root server seems to have been misused for attacking other systems.
How do I check if this is true and my system is compromised?
I was told I have 4 days ...
2
votes
2answers
78 views
Disabling a compromised user account
I have a simple question for you, well, at least, much simpler than "How do I clean up a compromised user account?" The question is: "How do I disable a compromised user account?" There are some ...
3
votes
3answers
393 views
Amazon EC2 instance possibly Compromised
I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
1
vote
1answer
435 views
exploit.so dmesg errors
A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
0
votes
1answer
81 views
Openvpn Compromise scenario
Scenario :
2 Certification Authorities used for Openvpn - one CA for client certs and another CA for server certs.
Question :
Say the CA handing out client certificates is compromised - assuming a ...
1
vote
1answer
292 views
Our Server Rooted but exploit doesnt work?
My friend's hosting server got rooted and we have traced some of attacker's commands.. We've found some exploits under /tmp/.idc directory.. We've disconnected the server and are now testing some ...
1
vote
1answer
88 views
Windows Server 2008 Outbound problem
Our server was compromised a few days ago through a FTP server that we didn't update in time. I think I have it under control now but there's still one issue. Inbound connection are working fine but ...
36
votes
6answers
3k views
Reinstall after a Root Compromise?
After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
