Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-1
votes
0answers
28 views

Why does an exe's import Table have two refrences to kernel32.dll (or any other dll)? [on hold]

According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported. I have an exe ...
0
votes
1answer
33 views

Isn't reading authentication data from the browser's storage malware behavior? [on hold]

I mean, is it ethical? Isn't it a possible breach of security? How safe is the authentication data stored by the browser in a windows PC? Case study: The issue is Avast antivirus on PC reads ...
0
votes
0answers
13 views

Dropbox with Google url encoding for file download [on hold]

I have been working on a case trying to identify the vector for an infection that had occurred. I have found an e-mail msg that contained a link that did not trigger a blocking event. For obvious ...
18
votes
5answers
3k views

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer? [duplicate]

In testing suspicious files for malware, the typical method is to search for known malicious code. This is why zero-day malware attacks can be so dangerous — their malicious code is previously unknown ...
12
votes
2answers
3k views

Sites being redirected to adult site in all devices [on hold]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
1
vote
0answers
27 views

Extraneus message about security risk when I open a new Chrome tab [migrated]

Today I start getting in Chrome a message saying: "I SEE YOU ARE A XXXXX CUSTOMER are you concerned that your Linux computer may have a potential security risk.... Please call toll free for ...
3
votes
3answers
74 views

How do I check the hash of an ISO?

If I download the OS image from Ubuntu servers from a location where I can get the MITM attack and get a compromised image, then how I can check its hash to prove that its original image? Hashes may ...
1
vote
0answers
25 views

How to disable Symbolic link creation option to users in cPanel server? [closed]

In shared hosting server, one user is trying to upload 100s of symbolic link files and trying to access files out side. Mostly it is for malicious purpose. In this image, you can see 100s of symlink ...
7
votes
4answers
2k views

What does this malicious PHP script do? [closed]

Somebody hacked my site and uploaded this script (template46.php) to my webroot and its content is: <?php $vIIJ30Y = Array('1'=>'F', '0'=>'j', '3'=>'s', '2'=>'l', '5'=>'M', ...
2
votes
2answers
63 views

Malware analysis - Traffic Inspection

I am working on small project. There is an organization in which it has 100 around systems across the country. All of their machine's traffic goes through a single proxy monitored and maintained by ...
2
votes
0answers
59 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
0
votes
2answers
57 views

Is it possible to transfer digital malware over analog channels of communication? [closed]

I have come across the interesting concept of data transfer to an air-gapped computer that avoids even USB sticks (to avoid stuxnet e.g.), where the premise is basically that to avoid malware and ...
1
vote
2answers
92 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
3
votes
2answers
112 views

Is it possible for malware to be in the BIOS or in hardware?

Is it possible for malware to be written in the BIOS section and loaded on every fresh Windows Install? If it is possible, can this affect Linux (Ubuntu and others) operating systems as well?
-2
votes
1answer
59 views

Stuxnet - The background functions [closed]

Stuxnet was a clever worm that aimed to malfunction programmable logic controllers on nuclear networks (Iran was the most affected). Nuclear networks were private networks, not supported on Internet ...
0
votes
1answer
71 views

How to detect an image virus?

How can someone detect a malicious code, executable or not, inside an image file ? What techniques and what programs are out there that will help you for the detection procedure ? This question is a ...
1
vote
0answers
30 views

Can you get infected by viewing an image? [duplicate]

Lets say I have an infected image by some malware, I double-click it and that triggers the default program that handles images to open it for viewing. Will this also trigger the malware inside the ...
-1
votes
1answer
64 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
1
vote
2answers
143 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
-1
votes
2answers
53 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
0
votes
2answers
51 views

using html5 websockets to bypass firewall TCP policy

I've read that html5 enables opening tcp sockets from the client side in its "websocket" feature. Firewalls as I recollect may be configured to block tcp connections initiated from "the outside" by ...
2
votes
0answers
68 views

Is it necessary to protect ATM pins against malware that has no access to the physical card? [closed]

I understand that various types of malware attempt to steal ATM pins . Presumably the attackers have no access to the physical card, so what can they do with the pin? In this case, is it needed to ...
0
votes
1answer
158 views

Malicious JavaScript warning [closed]

I visited a site yesterday and received no malicious javascript warnngs. Today I visited that same site and got the warnings. Do I need to be worried about being infected with something?
1
vote
1answer
95 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
3
votes
2answers
111 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
0
votes
2answers
69 views

Researchers figured out how to transmit/exfiltrate data using heat

I read article about it here and it says: Researchers at Ben-Gurion University have created a new piece of malware called BitWhisper. Infected machines can transmit data using heat they ...
21
votes
2answers
2k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
1
vote
0answers
25 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
3
votes
1answer
152 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
-1
votes
2answers
40 views

How can I detect mode interface of other machine is promiscuous [closed]

I have a project that is to protect my box from attack man in the middle arp poison. I should detect if interface mode of other machine is promiscuous. I must write script python or command linux.
0
votes
1answer
39 views

Can standalone malware survive on current mobile devices? [closed]

Can malware run on mobile devices? I don't see how it would be able to (given that those devices have fine-grained permissions and sandboxing). Unlike on a desktop OS, malware cannot access registry ...
2
votes
1answer
38 views

Patching Mac DMA attack

I want to know a few things about the blackhat attack that attacks thunderbolt. Is there anyway to wipe or patch a currently infected computer? I am not versed per se in THAT level of security. I was ...
0
votes
0answers
132 views

Discovered unexplained large salted files in root folder on Linux, possible keylogger?

So I had Linux Mint running on my laptop, just installed it a month ago. It has a small hard drive, just 160gb, and I noticed shortly after installing the system, it ballooned to 80-some gigabytes ...
1
vote
0answers
38 views

Request for links to worm source code [closed]

From where can you download worm source code? Need it for a project i am doing on honeypots. It does not matter whether it is a windows or linux worm.
2
votes
2answers
162 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
0
votes
1answer
27 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
-4
votes
1answer
61 views

IP Adderss is Hi Jacked [closed]

I live in south Florida but my IP Address pings to Dallas Texas. my internet provider is ATT U- Versu and I use G-mail Google Chrome for browser. when I first opened the account my I.P> address was ...
7
votes
2answers
97 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
0
votes
0answers
63 views

Open source database of malware signatures

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
0
votes
1answer
84 views

Signature Based Malware Detection

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead. I found that the basic idea is to store the existing malware ...
3
votes
1answer
65 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
4
votes
1answer
26 views

What security problems does copying .Xauthority to another user present?

If I want to use a GUI application with another user (example: webbrowser), I can copy the .Xauthority file to that given user's home then I can "su - user" and start the GUI app. Question: but what ...
7
votes
1answer
1k views

Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use ...
1
vote
0answers
27 views

Unrestricted file upload on a cloud based platform [closed]

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs not as a traditional "file on disk". Could malicious code still ...
0
votes
3answers
128 views

How to make undetectable malware [closed]

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
0
votes
1answer
59 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
-3
votes
1answer
10k views

Malware encrypted my files with ecc [closed]

One of my office workers got malware on her computer that encrypted all her files with ecc. I say this because the new extension on the files is .ecc and that is what the ransomware states. I have ...
0
votes
2answers
124 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it most likely belong to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From ...
1
vote
1answer
46 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
9
votes
1answer
368 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...