Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

3
votes
4answers
4k views

Writing malware in java?

To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++. But, I discovered that it can be done - ...
0
votes
3answers
99 views

How to make undetectable malware [closed]

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
0
votes
1answer
49 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
4
votes
2answers
105 views

Is there a way to check for “hollow” processes, or malware hidden within “normal” processes

I recently came across an article on the The Verge, which centers around the concept of commercial malware production and how it's used around the world. The article introduced me to a number of ...
13
votes
3answers
6k views

Do I really need an Anti-Virus software if I'm careful about where I browse?

A friend told to me the following: I don't use Anti-Virus software at all, I am just careful about where I go and what I click on. I've also heard this from other people as I've repaired their ...
13
votes
3answers
356 views

remote desktop connection to a potentially compromised machine

I am using rdesktop client on Linux to connect to windows machines. If some of these machines were compromised by some evil malware/virus/worm/trojan, is there any way for the malware to "jump" to my ...
2
votes
2answers
130 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
1
vote
0answers
14 views

Will this code run in real machine or is it some kind of Anti Reversing code? [migrated]

I am reversing a file which is not running properly in Vmware.The code from the AEP is as shown below : POP EDI ; value of edi is 0x7C816D4F kernel32.7C816D4F PUSH EAX ;value of eax is 0 INC ...
1
vote
2answers
1k views

CloudFlare - prompted for “attention required”

I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...
-3
votes
1answer
3k views

Malware encrypted my files with ecc [closed]

One of my office workers got malware on her computer that encrypted all her files with ecc. I say this because the new extension on the files is .ecc and that is what the ransomware states. I have ...
3
votes
2answers
247 views

How to deal with resistant malware

Everytime I visit Gmail, Facebook, YouTube, or Yahoo mail, I get a popup "Please update Internet Explorer" (while I'm using Chrome!). I don't have screenshots but this website describes the problem. ...
0
votes
2answers
95 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it most likely belong to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From ...
14
votes
7answers
753 views

How is it possible to embed executable code in an image

I was reading up on FireEye and came across this NYTimes article detailing a Skype chat where an image was sent that was laden with malware: Quote: To gain access to information on the ...
1
vote
1answer
44 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
9
votes
1answer
330 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
40
votes
3answers
5k views

How to detect if I am vulnerable to “Superfish,” and how to remove it?

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is ...
2
votes
3answers
93 views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
2
votes
1answer
274 views

Contents of Lenova/Superfish certificate

I would like to examine the Lenova/Superfish root certificate being used in the wild. I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, ...
52
votes
4answers
4k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
1
vote
1answer
79 views

How to analyze why Chrome downloaded a particular file?

I had a very few Chrome tabs open (see appendix) and other safe websites. Suddenly, without any prompt or action from me, chrome starts downloading the file "NEW!_iPhone7_LEAKED_PHOTO.JPG.exe" which ...
7
votes
4answers
917 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
2
votes
0answers
55 views

Rogue WPAD server attack

Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive ...
1
vote
1answer
42 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
0
votes
1answer
229 views

How exactly do viruses get on computer when watching online porn? [duplicate]

I've been hearing that your computer could get infected when you visit porn sites, especially when watching videos. But how exactly do viruses get on client side? Is it by cache? Or maybe by ...
4
votes
2answers
540 views

What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?

Supposing there is private/secret data on a machine (i.e a x86 arch) the most reasonable thing to me would be to encrypt this data, so to protect it. I understand that the purpose of ...
10
votes
2answers
4k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
2
votes
5answers
3k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
3
votes
4answers
10k views

How to check if computer is controlled remotely

My laptop has windows 7 installed. One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on ...
2
votes
1answer
217 views

ISP glitch or a malware? Has this ever happened to you?

Brief background: I consider myself a relatively paranoid power-user, if not an absolute pro. I regularly update my AV and keep up with all the latest updates on my Windows7 machine. But what happened ...
1
vote
2answers
120 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
7
votes
1answer
446 views

Can a malware steal the content of the clipboard? [duplicate]

Is there any malware that can steal the content of the clipboard?. E.g. say you have a text file with say private info or passwords, and you copy this data to paste on say another text file on a ...
1
vote
3answers
63 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
5
votes
4answers
618 views

How to keep Mac secure from viruses, malware and keyloggers?

How can I download and install software and make sure that it is not infected with viruses, malware or a keylogger? Also, I heard that Macs "don't get viruses". Is this true? Is it a good practice to ...
5
votes
2answers
110 views

Are malware detection rulesets publicly discoverable?

I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory ...
21
votes
3answers
2k views

Linux-based Turla trojan

There are several articles describing the newly discovered Linux-based Turla trojan. But basically, all these articles repeat the same, very limited, information. Can anybody provide more details, ...
2
votes
4answers
245 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
8
votes
2answers
147 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
19
votes
8answers
2k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
70
votes
10answers
6k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
22
votes
4answers
5k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
4
votes
2answers
109 views

find if 0-day flash bug was exploited (on a particular machine)

There have been several critical 0-day exploits in the past days/weeks in Flash alone. Nobody knows how long the 0-days have been exploited, and it is reasonable to expect that there are 0-days being ...
4
votes
2answers
5k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
1
vote
0answers
17 views

Conferences focusing on security threats posed by digital advertising [closed]

What are some conferences which address Security Threats posed by Digital Advertising?
3
votes
3answers
883 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
1
vote
3answers
457 views

Wife was conned into allowing her computer to be hacked, what do I do? [closed]

My wife had a popup on her old Windows Vista laptop (which I've been threatening to switch to Ubuntu Linux). It appeared to come from our ISP, and informed her that she was hacked, and to call a ...
6
votes
3answers
1k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
1
vote
2answers
185 views

How should I deal with adware in chrome on ubuntu?

I use chrome (but also have firefox) on ubuntu 14.04 32-bit. Recently I started getting popups from 'softwareupdaterlp.com'. I had the sense to realize it was not legitimate and I didn't click install ...
-4
votes
1answer
68 views

How am I affected by malware? Malware transferred from service provider's base station or just port scan? [closed]

I need a malware expert here. I am being targeted by advanced hackers over the 4.5 years. So this is my situation: 1) My new phone: I just bought a new phone, with SIM card and mobile internet plan ...
2
votes
3answers
164 views

Domain Name Thefts

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). ...
1
vote
1answer
38 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...