Subject: [saag] How to find out if you are really Hacked or not

From: Fahima Ahmed Khan Etha <[email-masked]>
Date: Thu, 16 Oct 2014 10:09:30 +0600

Dear All,

It might be an off topic. But I am seeking guidance from all of you.

If any hacker group claimed that you are hacked... How to proof or find out
its authenticity?

Please share your view.

Best regards,

Fahima

On 16 October 2014 01:00, <[email-masked]> wrote:

> Send saag mailing list submissions to
>         [email-masked]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://www.ietf.org/mailman/listinfo/saag
> or, via email, send a message with subject or body 'help' to
>         [email-masked]
>
> You can reach the person managing the list at
>         [email-masked]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of saag digest..."
>
>
> Today's Topics:
>
>    1. Re: getting rid of fairly old stuff (Kathleen Moriarty)
>    2. Re: POODLE avant le chein (Michael Richardson)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 15 Oct 2014 13:37:49 -0400
> From: Kathleen Moriarty <[email-masked]>
> To: Yoav Nir <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>
> Subject: Re: [saag] getting rid of fairly old stuff
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="utf-8"
>
>
>
> Sent from my iPhone
>
> > On Oct 15, 2014, at 1:29 PM, Yoav Nir <[email-masked]> wrote:
> >
> >
> >> On Oct 15, 2014, at 7:56 PM, ianG <[email-masked]> wrote:
> >>
> >>> On 15/10/2014 16:56 pm, Stephen Farrell wrote:
> >>>
> >>>
> >>>> On 15/10/14 16:46, Kathleen Moriarty wrote:
> >>>> Thanks for the article, it looks like the major browser vendors are
> already
> >>>> working together, no surprise there, but a big thanks to each of them
> as
> >>>> that's probably the best way to tackle this (from my experience).
> >>>
> >>> Hopefully so, and good to see the browsers and some large
> >>> server sites moving.
> >>>
> >>> If they can now get rid of SSLv3 within say a couple of months,
> >>> (and I hope they can), then we should maybe be asking ourselves
> >>> if we (the IETF) can help 'em somehow not let such stuff linger
> >>> for so long in future. Not sure how, but say if we'd published
> >>> an "SSLv3 considered possibly harmful" RFC about 8 years after
> >>> RFC 2246 was published, do we think that might have helped, or
> >>> might an equivalent help in future? Looking about randomly, I
> >>> see TLS1.1 is 8 years old now:-)
> >>
> >>
> >> Not sure where 8 years came from, but I'm fine with it because in my
> >> handwavy thinking, I settled on 7 years...
> >>
> >> So, let's say we settle on 8, either for all or independently negotiated
> >> per protocol.
> >>
> >> Perhaps a standard practice then in an RFC is that there should be a
> >> date by which the work is declared out-of-date.  A sunset clause in the
> >> Security section, mandatory, based on the best view of the authors of
> >> the time.
> >>
> >> Thereby forcing a reconvening at that time to either vote to move the
> >> sunset date forward another 8 years (well done, nice design!) or to
> >> prepare V2 for replacement.
> >>
> >>     This RFC will expire in 2022, by which time
> >>     a new generation protocol will be prepared and
> >>     all users encouraged to have transitioned, and/or
> >>     this current version will be marked abandoned.
> >>
> >> or words to effect.
> >
> > So are vendors supposed to ship products that just suddenly stop working
> in 2022? It?s hard to argue with the feeling of administrators that ?the
> product works now. Why should I upgrade??
> >
>
> +1
>
> I think there are enough issues that have been identified already that we
> could help fix and have a bigger impact.  Appreciate the continued
> discussion on what can we do.
>
> Thanks,
> Kathleen
>
>
> > Let?s keep picking on TLS. A TLS 1.3 specification is going to come out
> at some point. There?s dozens of implementations out there, and I?m sure
> all of those that are maintained will implement 1.3. Some will implement it
> with bugs. Some combinations of client and server implementations will not
> interoperate. Sure, OpenSSL and NSS and whatever Microsoft calls their
> library internally (SCHANNEL?) will work together. But it will be a good
> chance to remember that your firewall, your ERP and your home router also
> have their own TLS implementation. So the first administrators to upgrade
> their software *and* enable TLS 1.3 are going to be the early adopters who
> get hit with interop problems.
> >
> > Sure, if you have a modern code base, and you?re using SSLv3 and now
> enable TLS 1.0, you?re very likely safe. But there was a reason why
> Microsoft disabled TLS when XP first came out. And when Apple released TLS
> 1.2 in iOS (they were pretty early in doing so) they got hit with interop
> problems (which were in their code, but still?)
> >
> > It?s very tempting for administrators to wait until everyone does
> something. But if you?re waiting for ?everybody?, that likely means that
> you?re disabling SSLv3 in late 2014 or early 2015, not shortly after the
> publication of TLS 1.0 15 years earlier.
> >
> > Yoav
> >
> > _______________________________________________
> > saag mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/saag
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://www.ietf.org/mail-archive/web/saag/attachments/20141015/e0fbc344/attachment.html
> >
>
> ------------------------------
>
> Message: 2
> Date: Wed, 15 Oct 2014 14:33:22 -0400
> From: Michael Richardson <[email-masked]>
> To: Watson Ladd <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>
> Subject: Re: [saag] POODLE avant le chein
> Message-ID: <[email-masked]>
> Content-Type: text/plain; charset="us-ascii"
>
>
> Watson Ladd <[email-masked]> wrote:
>     > Now that we've all disabled SSLv3 on every machine in reach, let's
>     > review when this attack was discovered. Not in 2014, but in 2001:
> It's
>     > in Vaudenay, section 5, applied to randomized padding in SSHv2, where
>     > it was fixed. Credit belongs to Luca Bruno for pointing this out on
>     > Twitter.
>
> ...
>
>     > What other protocols have random padding in CBC mode after a MAC? Is
>     > there any way to determine this beyond asking everyone to help,
>
> IPsec ESP pads with sequential padding, encrypts, and then HMAC-x.
> So I think IPsec doesn't "CBC mode after a MAC" but rather, "CBC mode
> before
> a MAC".
>
> I haven't read the details of the attack yet; I figure I'll wait a day.
>
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: not available
> Type: application/pgp-signature
> Size: 481 bytes
> Desc: not available
> URL: <
> http://www.ietf.org/mail-archive/web/saag/attachments/20141015/ec97fdf2/attachment.sig
> >
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>
>
> ------------------------------
>
> End of saag Digest, Vol 76, Issue 5
> ***********************************
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 16 Oct 2014 12:06:50 +0300

“Hack” is kind of a meaningless term. People use it to describe anything from writing some piece of code in an interesting way, to writing the same piece of code quickly, to breaking through some defence.

The usual thing some “hacker group” might mean is either website defacement (that’s easy enough to check for) or stealing information out of a database (harder to detect) or changing information in a database (can maybe detected by comparing with backup copies). Rarely they manage to change code, but defacing and stealing information are the most common.

HTH

Yoav

On Oct 16, 2014, at 7:09 AM, Fahima Ahmed Khan Etha <[email-masked]> wrote:

> If any hacker group claimed that you are hacked... How to proof or find out its authenticity?
> 
> Please share your view.
> 
> Best regards,
> Fahima
>