Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

-5
votes
1answer
58 views

Is nobody else worried about the recent trend of graphical “noise” in GUIs? [on hold]

This is something that has been bugging me for a while. And "for a while" I mean years. Do you notice anything weird while looking at some recent closed source GUIs, for example OS X? Look closer… ...
3
votes
2answers
70 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
0
votes
1answer
26 views

Malware (internet connectivity) and defending against it

I was wondering whether anyone knew if malware could spread without internet connectivity? Also, can you defend against malware by releasing counter-malware that spreads exploiting the same ...
1
vote
2answers
1k views

CloudFlare - prompted for “attention required”

I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...
0
votes
2answers
103 views

How can the Equation Group HDD firmware malware help bypass FDE?

There is currently a lot of discussion going on across the Internet about the "Equation Group" family of malicious hard disk drive firmware. One thing that has me wondering is the claim that ...
-1
votes
0answers
52 views

Malware builder request [on hold]

I need the builder of some malware (only for study reason): for example dyre/dyreza/dridex. I would like to understand better how they interact with OS and websites that are affected from those ...
0
votes
2answers
50 views

Researchers figured out how to transmit/exfiltrate data using heat

I read article about it here and it says: Researchers at Ben-Gurion University have created a new piece of malware called BitWhisper. Infected machines can transmit data using heat they ...
4
votes
3answers
150 views

Besides MBR & BIOS, is it possible for a rootkit to stay persistant after a format of the harddrive?

If a system becomes infected and does not have any other storage units besides the one hard drive. Is it there any other way for a rootkit to stay on the system besides infecting the BIOS OR the MBR ...
21
votes
2answers
2k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
1
vote
2answers
185 views

Attacker able to install screen capturing software in Windows 7 guest account

I am operating in a guest account of Windows 7. Could an attacker that got onto my PC through malware I installed, install a video program that records everything I do and send the result back to his ...
1
vote
0answers
24 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
4
votes
3answers
74 views

Does it matter which platform a file is scanned on for malware?

Different operating systems use different file types and file systems. Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? I ask ...
2
votes
1answer
60 views

What method could a white-box attacker use to track the deletion of memory / files?

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory. If recognized, the ...
0
votes
0answers
16 views

Is there malware specific to Dropbox that blocks access and acts as a trojan? [closed]

A friend uses Dropbox to store and retrieve photos required to complete inspection reports. He is in the field daily and not near the office for months at a time. Recently, his dropbox account became ...
3
votes
1answer
146 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
-1
votes
2answers
32 views

How can I detect mode interface of other machine is promiscuous [closed]

I have a project that is to protect my box from attack man in the middle arp poison. I should detect if interface mode of other machine is promiscuous. I must write script python or command linux.
0
votes
1answer
35 views

Can standalone malware survive on current mobile devices? [closed]

Can malware run on mobile devices? I don't see how it would be able to (given that those devices have fine-grained permissions and sandboxing). Unlike on a desktop OS, malware cannot access registry ...
1
vote
1answer
19 views

Patching Mac DMA attack

I want to know a few things about the blackhat attack that attacks thunderbolt. Is there anyway to wipe or patch a currently infected computer? I am not versed per se in THAT level of security. I was ...
0
votes
0answers
123 views

Discovered unexplained large salted files in root folder on Linux, possible keylogger?

So I had Linux Mint running on my laptop, just installed it a month ago. It has a small hard drive, just 160gb, and I noticed shortly after installing the system, it ballooned to 80-some gigabytes ...
1
vote
0answers
30 views

Request for links to worm source code [closed]

From where can you download worm source code? Need it for a project i am doing on honeypots. It does not matter whether it is a windows or linux worm.
4
votes
2answers
106 views

Malware known for stealing private ssh keys

The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote ...
2
votes
2answers
138 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
7
votes
2answers
77 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
10
votes
3answers
371 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on. I ...
20
votes
8answers
2k views

Best practices for handling computer viruses

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware. In a small-to-medium ...
2
votes
1answer
132 views

Does malware which infects the BIOS/ Firmware always need 'root' access to do so?

There are very few hardend Operating Systems who restrict or totally disable Terminal 'root' access for the user. (1) Would this feature prevent persistant BIOS rootkits from writing into BIOS or ...
0
votes
1answer
25 views

uploading photos to cloud from an infected device [closed]

My computer is infected with Malware and (shame on me) of course I didn't back up my photos or word docs. I also happen to know almost NOTHING about computers. Is it possible to upload photos to cloud ...
-4
votes
1answer
58 views

IP Adderss is Hi Jacked [closed]

I live in south Florida but my IP Address pings to Dallas Texas. my internet provider is ATT U- Versu and I use G-mail Google Chrome for browser. when I first opened the account my I.P> address was ...
1
vote
1answer
358 views

Questions about the 2013 php.net malware

On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, ...
0
votes
4answers
428 views

What are JS malware attack techniques?

Malicious JavaScript (generated by malicious hosted PHP code for example) can lead to attacks. What are the types of attack that malicious javascript could perform? Are the drive-by download attacks ...
0
votes
0answers
23 views

How JavaScript malware targets browsers? [duplicate]

What are the main components that JavaScript malware targets on the browsers ? Which aspects of browsers on which JavaScript takes advantage to exploit them ? And which techniques are used by ...
0
votes
1answer
652 views

How can I detect whether a webshell exploit has been run?

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files ...
11
votes
2answers
2k views

Where do I find JavaScript malware?

I am looking for JavaScript malware. I need it just for local tests on my computer for a project I am working on. Are there any Internet resources where I could find this?
34
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
1
vote
1answer
75 views

Is this behavior the result of malware?

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it ...
0
votes
2answers
105 views

Where to find such URLs that attack their visitors? [closed]

Where can I find websites that perform drive-by dowload attacks ? I need such websites in order to test a software that prevents such attacks. I am in the testing phase but I do not see where I could ...
1
vote
1answer
58 views

blacklisted URLs: what to trust?

This website blacklists URLs: http://hosts-file.net/?s=54.244&view=history&direct=1 Its last database update has been today. When I check the last 5 URLs it published Firefox tells me they are ...
1
vote
1answer
77 views

using multiple Firefox profiles to increase security

I am wondering whether it would increase security in any significant way, if I would use two separate Firefox profiles, one for normal browsing and the other for private/secure websites, such as my ...
4
votes
1answer
339 views

Odd requests to health_check.js show up in Fiddler

I had Fiddler running and noticed that there are few calls made to following url: http://www.yimgr.com/health_check.js?ts=1412350007104 the content is just this JSON payload { "chance": 0.5, ...
3
votes
1answer
2k views

Is bit.ly a malware distributor?

I clicked this link http://girlsguidetosurvival.wordpress.com/ Chrome gave me this warning - Attackers currently on bit.ly might attempt to install dangerous programs on your computer that ...
0
votes
2answers
134 views

What are the security threats when Googling and surfing when my Gmail account is open?

Suppose I log to my Gmail account. After that, I use Google to search for random websites and visit some. Are there any security threats on my Gmail account when Googling and surfing the net while it ...
2
votes
2answers
204 views

Malware removal: Iframe injected javascript

My Joomla! website is infected by an iframe injected malware, according to Sucuri SiteCheck: To remove the malware, does it suffice to remove the infected file site/media/system/js/caption.js? Or ...
2
votes
4answers
299 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
2
votes
2answers
53 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
-1
votes
0answers
6 views

Problem with rebooting after rescue mode [migrated]

I recently went into rescue mode using bitdefender then I selected to reboot my computer. I am using windows 8 and bit defender total security. There is a black screen with text "reboot: Machine ...
13
votes
2answers
36k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
0
votes
0answers
47 views

Open source database of malware signatures

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
0
votes
1answer
71 views

Signature Based Malware Detection

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead. I found that the basic idea is to store the existing malware ...
0
votes
3answers
2k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
3
votes
1answer
63 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...