With the news of Google and others getting hacked, I was wondering how companies find out, detect, and/or know they've been hacked in the first place?

Sure, if they find a virus/trojan on user's computers or see a very high access rate to parts of their system that don't usually see much, if any, traffic. But, from what I've see in articles, the attack was pretty 'sophisticated', so I wouldn't imagine the hackers would make it so obvious of their hacking in the first place.

Maybe someone can enlighten me on current detection schemes/heuristics. Thanks.


Generally they look for subtle forensic clues; such as their homepage being changed to a banner which reads "p0Wned by TeH L33t Krew!! haahah1h1!! u noobs"

  • LOL - nice way to start the day :)
    – Olaf
    Jan 20 '10 at 9:30
  • +1 this answer is win.
    – grufftech
    Apr 28 '10 at 18:22
  • +1 for making my day May 14 '10 at 1:30

A successful hack is one that goes undetected ;)

A sysadmin can set up honey pots, dummy computers to fool hackers into thinking that they're a real system with real data. In the honey pot all activity is monitored and the behaviour of the hacker is studied to help learn more about what a hacker or virus is trying to do to help security experts figure out how to prevent future intrusions.

They can also use automatic Intrusion detection systems to help them detect suspicious activity

  • 1
    Under a real attack scenario, hackers frequently use some decoys and flood to make the IDS report false alarms, and in the same time they performs their attack with a very much less aggressive timing, IDS needs experienced admins.
    – Maxwell
    Jan 20 '10 at 8:25

They won't know it if it is well done or if they have not the internals skills and practices. For discovering that a hack has been performed, some measures (i'm not exhaustive here) needs to be implemented such has auditing files change, collecting IDS logs and performing a deep analysis with multimple hosts correlations.

Furthermore, a determined person will certainly after gathering as much as possible informations about the target will try to use social engineering in the first place because users are generally the weakest link in the security chain.


I would guess that most of the high publicity hacks we hear about start with either the company, or the media, being tipped off by an end user that someone has messed with their account/stolen their identity/etc.

Then the company reacts to this, goes through their logs to try and discover the extent of the problem and what happened, patches the hole, etc. and then (probably) issues a press release and tries to contact affected customers.

But yeah, I would guess that it's often an affected end user that tips them off.


How to detect it depends a lot on what it is you're serving. As part of our backup system I have a script that mirrors the our company web sites to an internal server, transferring only what has changed. At the end of that the script parses the logs looking for any changes, additions or deletions and sends me an email if any are found. That way, even if there is a less than obvious change, I will (should?) find out about it. Of course the script lives on the internal server, not the web server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy