Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms

1
vote
0answers
8 views

Unrestricted file upload on a cloud based platform

We have an unsecured file upload for the user to upload any file they want, our application is Azure based so they are stored as blobs. Could malicious code be executed from blob storage if the file ...
0
votes
3answers
42 views

How to make undetectable malware

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
0
votes
1answer
18 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
1
vote
0answers
14 views

Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
-3
votes
1answer
243 views

Malware encrypted my files with ecc [closed]

One of my office workers got malware on her computer that encrypted all her files with ecc. I say this because the new extension on the files is .ecc and that is what the ransomware states. I have ...
0
votes
2answers
72 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it most likely belong to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From ...
1
vote
1answer
42 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
9
votes
1answer
271 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
0
votes
1answer
64 views

How can the Equation Group HDD firmware malware help bypass FDE?

There is currently a lot of discussion going on across the Internet about the "Equation Group" family of malicious hard disk drive firmware. One thing that has me wondering is the claim that ...
2
votes
3answers
68 views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
12
votes
3answers
278 views
+100

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
2
votes
0answers
29 views

Rogue WPAD server attack

Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive ...
0
votes
0answers
32 views

List of Phishing, Virus(ed), Malware Sites For An Anti-Spam Site [closed]

I'm looking for a list or database of phishing, full of viruses and malware sites which I can use to test the credibility of my current project I'm working on. Any source where I can find bad, ...
1
vote
2answers
33 views

Determining safety of Android APK executable

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
1answer
264 views

Contents of Lenova/Superfish certificate

I would like to examine the Lenova/Superfish root certificate being used in the wild. I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, ...
40
votes
3answers
5k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
52
votes
4answers
4k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
1
vote
1answer
37 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
0
votes
1answer
129 views

How exactly do viruses get on computer when watching online porn? [duplicate]

I've been hearing that your computer could get infected when you visit porn sites, especially when watching videos. But how exactly do viruses get on client side? Is it by cache? Or maybe by ...
14
votes
7answers
692 views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
2answers
108 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
2
votes
1answer
179 views

ISP glitch or a malware? Has this ever happened to you?

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows7 machine. But what happened ...
7
votes
1answer
439 views

Can a malware steal the content of the clipboard? [duplicate]

Is there any malware that can steal the content of the clipboard?. E.g. say you have a text file with say private info or passwords, and you copy this data to paste on say another text file on a ...
1
vote
3answers
61 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
3
votes
1answer
43 views

Does it matter which platform a file is scanned on for malware?

Different operating systems use different file types and file systems. Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? I ask ...
19
votes
8answers
2k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
4
votes
2answers
101 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
1
vote
0answers
16 views

Conferences focusing on security threats posed by digital advertising [closed]

What are some conferences which address Security Threats posed by Digital Advertising?
2
votes
0answers
27 views

csrss.exe anomalies..is this a rootkit? [migrated]

I'm seeing a strange anomaly in some systems I support. GMER flags the cdd.dll thread in csrss.exe, and when I run Process Explorer with Elevated Admin rights, I am: unable to view any loaded DLLs ...
1
vote
2answers
156 views

How should I deal with adware in chrome on ubuntu?

I use chrome (but also have firefox) on ubuntu 14.04 32-bit. Recently I started getting popups from 'softwareupdaterlp.com'. I had the sense to realize it was not legitimate and I didn't click install ...
1
vote
3answers
228 views

Wife was conned into allowing her computer to be hacked, what do I do? [closed]

My wife had a popup on her old Windows Vista laptop (which I've been threatening to switch to Ubuntu Linux). It appeared to come from our ISP, and informed her that she was hacked, and to call a ...
-4
votes
1answer
61 views

How am I affected by malware? Malware transferred from service provider's base station or just port scan? [closed]

I need a malware expert here. I am being targeted by advanced hackers over the 4.5 years. So this is my situation: 1) My new phone: I just bought a new phone, with SIM card and mobile internet plan ...
8
votes
2answers
131 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
1
vote
1answer
38 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
0
votes
1answer
37 views

Segregating network systems and functions [closed]

I want to segregate network systems and functions so that if an attacker hacks in one area, he can't necessarily reach others. What should be the recommendation when information from one network is a ...
-1
votes
2answers
93 views

Fake Microsoft Security Department [duplicate]

some Indian man called home saying that he's calling from some Windows Security Department, and there are about 16 other people connected to my computer and the're doing illegal things on my computer. ...
1
vote
1answer
87 views

Is it “cross-platform attack” if first OS is not attacked at all?

I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver ...
1
vote
0answers
52 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
2
votes
2answers
74 views

Is it safe to store a file in a temporary folder before it has been scanned for a virus?

I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen ...
4
votes
2answers
92 views

Is there a way to check for “hollow” processes, or malware hidden within “normal” processes

I recently came across an article on the The Verge, which centers around the concept of commercial malware production and how it's used around the world. The article introduced me to a number of ...
4
votes
2answers
127 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
-1
votes
1answer
56 views

Can malware “upload” itself to the actual mobile base station and regain back to another phone?

My question is can a malware from my affected phone "upload" itself to the ACTUAL REAL mobile base station from the service provider, and regain back to my another phone with the same number (same ...
1
vote
1answer
54 views

Apps that require user to install advertised apps in order to get activated

I am analyzing a mobile application, and I am not sure if it is just an adware/greyware or does it enter the category of malwares. This app does not really do any harmful activity. But it forces user ...
0
votes
0answers
54 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
2answers
60 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
3
votes
1answer
71 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache ...
7
votes
5answers
416 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
5
votes
6answers
456 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
10
votes
5answers
257 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
4
votes
2answers
95 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...