I started working for a company that fired a previous IT worker for leaking data.  I can only say the following things:  We use a Firebird DB with an application written by another company, Proxmox, for virtualization of Windows Server 2008 R2, SQL Server, cloud core Mikrotik router, and a few other Mikrotik devices.  I am not 100% sure, but is there some quick way to check if there are some backdoors left, without interrupting internal processes and reformatting everything?  This previous guy was really good, having written software in C++ and C#. I also know that he did some assembler and cracked a few programs in ollydbg.
121679
We all know it happens. A bitter old IT guy leaves a  into the system and network in order to have fun with the new guys and show the company how bad things are without him.  I've never personally experienced this. The most I've experienced is somebody who broke and stole stuff right before leaving. I'm sure this happens, though.  So, when taking over a network that can't quite be trusted, what steps should be taken to ensure everything is safe and secure?
43042
I accidentally left an open port on my router, leaving access to one of my computers via SSH, using a rather insecure password. I noticed because I checked /var/log/auth.log and there is just one entry from the outside. There's no bash history nor anything easily noticeable. What should I check to know my computer is not compromised?
110996
This next year, I am helping an effort to clean several SQL Server environments.    We have about 10,000 stored procedures and estimate that only about 1000 of them are used on a regular basis, and another 200 or so are used on a rare occasion, meaning we have a lot of work to do.    Since we have multiple departments and teams that can access these databases and procedures, we are not always the ones calling the procedures, meaning that we must determine what procedures are being called.  On top of that, we want to determine this over a few months, not in a few days (which eliminates some possibilities).  One approach to this is to use the SQL Server Profiler and track what procedures are being called and compare them to the list of what procedures we have, while marking whether the procedures are used or not.  From then, we could move the procedures to a different schema in case a department comes screaming.  Is using the Profiler the most effective approach here?  And/Or have any of you done something similar and found another way/better way to do this?
76969
I've been programming for 10+ years now for the same employer and only source code control we've ever used is VSS. (Sorry - That's what they had when I started). There's only ever been a few of us; two right now and we usually work alone, so VSS has worked ok for us. So, I have two questions: 1) Should we switch to something else like subversion, git, TFS, etc what exactly and why (please)? 2) Am I beyond all hope and destined to eternal damnation because VSS has corrupted me (as Jeff says) ?  Wow - thanks for all the great responses!   It sounds like I should clearify a few things. We are a MS shop (Gold parntner) and we mostly do VB, ASP.NET, SQL Server, sharepoint &amp; Biztalk work. I have CS degree so I've done x86 assembly C, C++ on DEC Unix and Slackware Linux in a "time out of mind" ...         My concern with VSS is that now I'm working over a VPN a lot more and VSS's performance sux and I'm afraid that our 10+ y/o version 5 VSS database is going to get hoosed... There's the LAN service that's supposed to speed things up, but Ive never used it and I'm not sure it helps with corruption - has anyone used the VSS LAN service? (new with VSS 2005)
31311
It's been a time I didn't follow the list of which Windows 7/8/8.1 KBs I must skip since I don't want the unfinished Windows 10 at all. Moreover, I will still consider Windows 10 unfinished (-> unstable) until they release Windows Server 2016  The KBs list up today is scattered all over the Internet, and I am fearing to miss a single one of those.  As far as I know, some of the newer KBs are even old rebranded ones or re-re-re-pushed again and again. The goal is also to not use any external software or post-installation removal tools since I also intend to deploy a script that will block those KBs.  So the question is: can you tell me all the KBs you know that I must avoid?  Any details that can prevent "Telemetry", the "Windows Customer Experience Improvement Program" or prevent the resetting of Windows' settings about updates and privacy concerns is good too ! (Since they are even linked)   In case some cumulative updates (updates that regroup a pack of old ones) contains one of the listed KB, this is still relevant for the question here.  Remarks  There is of course other ways to disable the updates, which are still appreciated here but do consider that they represent a secondary objective of this post. Same applies for saying it's not the correct method to do it, and I do know the list will endlessly get longer.  The reason is that I still prefer doing it manually since I don't even want the files at all in my system. Furthermore, some of these updates had been re-pushed again and again for at least six times ! This is in fact due to the problems that those updates had caused and I don't want any risks to jeopardize my systems because Microsoft have plans for users with our without their consent by doing "Betas To Manufacture".  related:
50173
I have an encryption/copy protection question.  I'm writing an application for a company that uses a dongle.  Please don't tell me that software protection is useless, or that I should just let it fly free into the air, or that any time I spend doing this is a waste; this isn't a philosophical question about the validity of software protection, more like a how-to.  As I understand it, the first step in cracking a dongle-protected piece of software is to remove all the calls to the dongle from the code (ie, patch the executable).  Also as I understand it, I can create 'strong names' in .NET in order to protect the application and the assembly, as explained .  Is strong naming enough to ensure that my application can't be easily patched?  Or do I need to use some sort of encryption library?  If I need to use a library, which one, or where can I get information about setting this up?  The next step, of course, is to put important algorithms on the dongle.  I realize that these are just speed bumps to the dedicated cracker, but as our market share grows, the speed bump will help us get to the point where the sting of piracy is not so keenly felt (I hope).  Thanks!
54103
I need to detect whether my application is running within a virtualized OS instance or not.  I've found an article with some useful information on the topic. The same article appears in multiple places, I'm unsure of the original source. VMware implements a particular invalid x86 instruction to return information about itself, while VirtualPC uses a magic number and I/O port with an IN instruction.  This is workable, but appears to be undocumented behavior in both cases. I suppose a future release of VMWare or VirtualPC might change the mechanism. Is there a better way? Is there a supported mechanism for either product?  Similarly, is there a way to detect Xen or VirtualBox?  I'm not concerned about cases where the platform is deliberately trying to hide itself. For example, honeypots use virtualization but sometimes obscure the mechanisms that malware would use to detect it. I don't care that my app would think it is not virtualized in these honeypots, I'm just looking for a "best effort" solution.  The application is mostly Java, though I'm expecting to use native code plus JNI for this particular function. Windows XP/Vista support is most important, though the mechanisms described in the referenced article are generic features of x86 and don't rely on any particular OS facility.
76421
I scheduled and ran CHKDSK after restart, but it took a long time, so I left it to run all night. In the morning, it had finished and the computer had logged in, but I had no way of knowing if it found bad sectors or anything.  Is there a log file I can look at?  This is what CHKDSK looks like when running before login:
27200
I find that at the end of a long day, I sometimes have a large number of programs running. All which I will need to use tomorrow. Normally, this isn't an issue, I can simply lock the machine and come back tomorrow. My problem arrises when windows update launches in the middle of the night and force restarts my computer. That in turns closes all my open software. I of course save everything regularly so I don't loose anything, but I waste time reopening all of those resources whenever there is a restart.   [EDIT]  I should clarify that I still want to be able to restart my computer when an update comes down. Preventing the restart only delays the problem until later. I should have been more specific in that I want to be able to recover my working environment after a restart for any reason. Things like scheduled maintence, power loss, updates, and software installs.  [EDIT]  I can't simply have them setup to launch at startup becasuse those files change from week to week. So I need something that monitors what I have open, and gives me the option to "recover" those software sessions when I log back in.  Anyone have any suggestions on what I can do? I'd even be willing to purchase software to do this for me if that is the only option.  Thanks
77297
Following up from my other , I would like to start thinking about what I should take a look at on daily/weekly/monthly bases in terms of alerts. I am hoping to be able to see problems coming before they happen (that is the plan)...  So far, I have made a start collecting scripts for the following (no order):  Daily   Check system uptime (just in case I need to check anything as a DBA) Check the last backup  Check the transaction log backups Check the status of SQL Jobs Check the average CPU usage for the last 24 hours (or 1140 mins)   Weekly   Check MSDB backup history Check to see when the last time CheckDB was run Check index fragmentation Check index stats (reads vs writes etc) Check for IO bottlenecks   Monthly   Check missing indexes Check indexes that are no longer used   Any other suggestions? (I am new to DBA so any help/advice is always welcome)
108812
I want to know if I can open a virtual machine (VMware , Virtual Box ...) and (for example) install windows 7 + some programs (chrome,Word,antivirus....) and then save the current stat (i don't have any idea how i can) then execute a malware after that i want to know if it's possible to know the modified files and the new registry keys that they've added to the VM (All the modifications) after the first saved stat (just for malware analysis) and then i want to be able to return the VM to the first stat (in some tutorials on youtube i saw them saving the new modification in files like "Virus.VMEM" )  How can i do that on linux (Debian) I've already installed VMware and  I'm ready to install any other tool could help me ?  I know it's difficult but please help with any idea :)
68618
I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting netstat and iptables but this seems terribly inefficient since if a process is only active for a small time-frame the script might miss it. Basically I want to enforce specific restrictions regarding port and dst on a process while leaving other processes unaffected. Any ideas?    For reference selinux can do exactly this and it works fairly well. Setup is a bit of a pain though.
1599
There have been reports yesterday about a new security vulnerablity:   Lucian Constantin (2015-12-16). .  CSO Online. Patrick Allan (2015-12-16). . Life Hacker. Swati Khandelwal (2015-12-16). . The Hacker News.   The news reports all say things like the vulnerability can "allow a hacker to install malware on a locked-down Linux system", can "bypass all security of a locked-down Linux machine", and can "bypass password protection on your computer".  The actual vulnerability itself is CVE-2015-8370, and has been written up by one of its discoverers:   Hector Marco and Ismael Ripoll (2015-12-14). . CVE-2015-8370.   Whilst the news reports are hyperbolic, talking of vulnerabilities in Linux, the report by Marco and Ripoll is very technical for the non-programmer to absorb, descending into colourized source code or GRUB2 and 40-character-long strings of numbers and letters within the first page.  I'm just an ordinary "security guy".  I keep my applications and operating systems up to date with security patches.  So, without the hyperbole from the news reports, and without baffling me with source code and hexddumps:   Is there any immediate action that I should take?  Is there any immediate action that I can take? What is the risk to my personal systems at home? What is the risk to my servers at work?  If someone had IPKVM or ILO access, for example, could this be exploited?
20251
Our DBA team doesn't verify the backups using the below TSQL (which can easily be done post-backup and takes almost no time, so I don't get why not):  RESTORE VERIFYONLY FROM DISK = 'D:\Backups\LOCATION'   They've had issues in the past, so even though we'd think they'd learn from it, they haven't.  I created a Powershell script to do this because we have about 100+ servers and I just want to run this script against all the backups just to ensure they're valid.  The below script runs correctly (in that it doesn't break or throw errors), I am curious if there's a way to get the printed message back in Powershell that we would normally get in SSMS where it states The backup set on file 1 is valid as verification.  $SqlCon = New-Object System.Data.SqlClient.SqlConnection $SqlCon.ConnectionString = "SERVER=SERV\INST;Integrated Security=true;DATABASE=master"  $baks = Get-ChildItem "D:\Backups\" -Filter *.BAK  foreach ($bak in $baks) {     $SqlCon.Open()     $cd = New-Object System.Data.SqlClient.SqlCommand     $cd.Connection = $SqlCon      $cd.CommandText = "RESTORE VERIFYONLY FROM DISK = @f"     $cd.Parameters.Add("@f", $bak.FullName)     $cd.ExecuteNonQuery()     $SqlCon.Close() }
12048
What are good methodologies for creating sprocs that reduce the pain of debugging? And what tools are out there for debugging stored procedures?  Perhaps most importantly, what are indications to look out for that errors are happening in a sproc and not in the code? I hope I'm not all over the board too terribly bad here. Votes for answers to any of the above. Thanks.  For what it's worth, I work in a .NET environment, SQL servers.
26336
As a small software development company, we run a few Windows production webservers and manually install Microsoft updates and security patches. Most of the time, a restart is required.   After the updates are installed and the server asks for a restart, is the server during the time between this message and the restart somehow more vulnerable, or is it perfectly in order to delay the restart (and the security level remains the same as before)?
17784
Not sure if this is actually desired, but  is currently showing me (a SE non-dev)  results, including all queries that are being run against the DB (not talking about data-explorer queries of course, talking about site rendering queries).    New feature of  or a deployment whoops?  Edit:  I didn't realize that data was .  With that in mind, this probably isn't a security problem after all, and is in fact more likely .