Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
7
votes
5answers
558 views
Detecting malware-infected USB drives
I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
7
votes
2answers
255 views
Are there any independent organizations doing (publicly available) IT security research?
When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
7
votes
4answers
296 views
What would happen if one of the popular Linux repositories is hacked?
Even though most people consider downloading your Linux software from you own distribution's repositories as safe, thinking about the scenario where a repository gets hacked sounds thrilling.
What ...
7
votes
1answer
365 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
7
votes
2answers
2k views
Advice on what to do after being hacked?
After running a system scan earlier today, I found that my computer had been infected by a trojan horse. My reason for running the scan was because Windows kept shutting down and then recovering.
...
7
votes
2answers
584 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
7
votes
3answers
222 views
How can I circumvent the lack of Java updates?
Just imagine you have a bunch of computers which need Java for some important software and you can't just switch to another vendor because all are using Java in this field of technology. If you start ...
7
votes
2answers
202 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
7
votes
3answers
1k views
How to manage admin rights for helpdesk staff?
My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting.
Helpdesk staff commonly require administrative rights to provide support for end users. I ...
7
votes
2answers
213 views
how do you visit a link without risking your computer
I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
7
votes
1answer
83 views
Is there a public database of mutex names that are associated with malware?
I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
6
votes
5answers
315 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
6
votes
3answers
138 views
Is it safe to attach a potentially malicious hard drive to a Solaris machine?
We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content.
What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
6
votes
1answer
415 views
Google showing spam links on my site
When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites.
But I have used many ...
6
votes
4answers
331 views
How can Antivirus differentiate between a Trojan and a normal remote desktop application software?
RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport ...
6
votes
3answers
493 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
6
votes
4answers
1k views
What are the best ways to fake a web server
I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
6
votes
2answers
173 views
Where to find papers / information about spyware, tracking and cookie problems?
I am right now working on a problem and looking for some papers / information about spyware, tracking and cookie problems. I am no expert in that area, so I lack the knowledge where to find material ...
6
votes
4answers
959 views
Pursuing a career in Malware Analysis
When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
6
votes
2answers
186 views
How do AV vendors choose malware names?
If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz, W32/Autorun.worm.bgh, ...
6
votes
5answers
788 views
Malware code added when site viewed externally
Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
6
votes
3answers
321 views
Malware nomenclature
If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like?
If one exists could someone explain it or ...
6
votes
2answers
209 views
Statistics on purposes of viruses/malware
Are there any resources that analyze the purpose or goal or the major viruses/malware out in the wild today? For example, what percentage are used to construct botnets (for DDoS or something else)? ...
6
votes
2answers
152 views
Where can I find good resources on reversing web malware?
I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients.
Does anyone have any ...
6
votes
4answers
269 views
Finding spam sending scripts?
What are the tips for finding email spam sending scripts? I ask because usually I hit a wall in shared hosting environments, so I ask this question as a way to get some insight from others.
What I ...
6
votes
4answers
311 views
Has my network/computer been breached?
I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes.
A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
6
votes
2answers
113 views
Process authentication for Linux
Is there any possibility to authenticate a running process in Linux to be sure that this is the original/right one?
I know that an Linux operating system is only that secure like the way you use it. ...
6
votes
2answers
176 views
Example of malware in the wild?
I'd like to test an application that detects malware on my network. In order to do that, I have a Windows VM set up that I'd like to infect with malware. But for the life of me, I can't seem to find ...
6
votes
3answers
845 views
Can malware read keychain entries on iOS devices?
Keychain entries of a 3rd party app are protected according their 'protection class'. For example, assigning the class 'kSecAttrAccessibleWhenUnlocked' to a keychain entry means that the entry is only ...
5
votes
4answers
520 views
Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?
If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?
Or are there known vulnerabilities that may cause infection?
5
votes
4answers
344 views
Would running VMs inside of VMs be a more secure way to study viruses, etc?
I was reading this post on SuperUser, and it made me wonder about security. I've read somewhere else that some viruses/malware/whatever CAN break outside of a VM... and then infect the host OS. BUT, ...
5
votes
7answers
830 views
How to safely view a malicious PDF?
I have a PDF with important information that may contain malware. What would be the best way to view it?
5
votes
4answers
317 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
5
votes
6answers
577 views
Using linux to combat windows flash drive malware?
I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
5
votes
2answers
5k views
Is Buzzdocks a security threat?
A BuzzDock toolbar suddenly appeared in my Chrome browser. I definitely did not install it nor do I remember installing any crapware.
It is not unknown to the internet community (Example 1, Example ...
5
votes
2answers
491 views
Why should I restrict the content type of files be uploaded to my site?
We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
5
votes
4answers
233 views
Can malware hide their network activity from Resource Monitor (perfmon)?
Is it possible for malware to hide their network activity from tools like the Resource Monitor that ships with windows?
How much effort is it for a malware developer to implement such functionality? ...
5
votes
3answers
164 views
Spamming exploits without user detection
So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
5
votes
3answers
469 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
5
votes
2answers
2k views
Can Keyloggers get passwords from Windows 7/8 Logon Screen?
If yes, do you know some examples of Keyloggers capable of perform this?
EDIT: I mean when logon in the windows right after power on the PC and/or when locked with Win+L.
5
votes
2answers
385 views
Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?
With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/ in the wild are we now actually in the age of Advanced ...
5
votes
1answer
212 views
Downloading suspect files into quarantine?
Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?
5
votes
2answers
124 views
How serious is a local virus in terms of network security
I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the ...
5
votes
2answers
204 views
What applications are at risk from “Backwards Unicode Names” and what are the mitigations?
There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
5
votes
2answers
161 views
How does the predator network prevent outside control by an attacker?
I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus.
Does this command and control system communicate with the ...
5
votes
1answer
417 views
When and Why does Chrome display malware detection warning?
Google Chrome contains malware detection feature. When user visits some site, browser may display warning that site contains malware.
What does it mean that site contains malware? Does it mean that ...
5
votes
3answers
312 views
What methodologies are useful when reverse-engineering malware / shellcode?
Whilst I'm familiar with reverse engineering techniques from a technical standpoint, I've never found a good methodology for approaching and dissecting malware / shellcode. I've found hundreds of ...
5
votes
6answers
208 views
Safe to connect to external drive?
A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer ...
5
votes
4answers
799 views
weird visitors to my website
For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake:
...
5
votes
1answer
276 views
How to detect infected machines on my wifi?
I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
