Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
4
votes
5answers
3k views
How can I prevent viruses/malware from infecting my flash drive?
I've a pen drive that I carry to the college lab . It seems all the systems in lab is infected. I need to be able to write to the drive, so I can't simply write protect it.
Everytime I insert a ...
4
votes
5answers
326 views
Why wasn't the flame malware flagged by firewalls?
Why didn't any firewalls catch the flame malware siphoning out all of that data? I thought there was firewall software that looks for "suspicious" activity?
4
votes
6answers
1k views
Can i get 100% protection from virus by using Deep Freeze?
I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to ...
4
votes
5answers
457 views
How will microvirtualisation change the security field, if at all?
I'm interested in what Bromium has been working on. I don't understand how this will affect computer security. Will this reduce the number of exploitable vulnerabilities in common operating systems? ...
4
votes
3answers
125 views
Duqu and other reference material for security people
I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen.
Isn't there a reference website or... that reports on these ...
4
votes
4answers
314 views
Site constantly getting infected
I am the webmaster of some websites running Typo3, 2 of which are getting infected constantly. These 2 sites are being owned by the same client.
Something happens on those 2 sites that causes ...
4
votes
4answers
292 views
Malware that uses http as a covert channel
I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.
Is there any database of malware, ...
4
votes
3answers
381 views
Malware infections from visiting or using YouTube
Is it possible to be infected by viruses or other malware while visiting YouTube?
What kind of measures do the YouTube staff take to prevent viruses and malware?
4
votes
3answers
1k views
What programming language is Stuxnet written in?
I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?
Is the source code for Stuxnet available anywhere?
4
votes
2answers
406 views
How would I go about rebuilding the IAT of a packed executable?
When executables are packed with a tool such as UPX, the real code and data sections are encrypted or obfuscated, then loaded into memory using an injected decrypter stub. This makes static analysis ...
4
votes
3answers
1k views
Any additional security with large blacklisting hosts file?
I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with ...
4
votes
4answers
325 views
Is online banking more secure on iOS than a desktop computer?
Does Apple's iOS provide a more secure environment for online commerce (banking or shopping) than Windows or Mac OS X? Since the only software that can run on iOS must be vetted by Apple, the ...
4
votes
2answers
135 views
What is the state of the Windows Update certificate after Flame?
May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.
June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that ...
4
votes
4answers
2k views
Browser hijacked - how to fix and prevent?
For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
4
votes
7answers
275 views
Malicious Websites
Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
4
votes
2answers
186 views
How can I recognize and find file(s) dropped by malware?
Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file?
What are the procedures, ...
4
votes
1answer
173 views
Is Window's system restoration useful for getting rid of malware?
If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware?
We should suppose that it ...
4
votes
2answers
153 views
What is multi-path malware?
I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
4
votes
2answers
382 views
Has anyone else seen commands embedded in an ICMP echo request?
My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload.
The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
4
votes
1answer
157 views
“WICKED” entries in the default nginx vhost's logs
I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:
109.x.x.121 - - ...
4
votes
1answer
76 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
4
votes
1answer
129 views
The Economics and White Hat Nature of NSS ExploitHub
This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
2k views
What can I do to make sure my computer isn't infected with FinSpy?
What steps have been taken by common free software OS distributions to protect against it? What can Windows users do? What ways are there to rid a system of it?
3
votes
4answers
664 views
Writing malware in java?
To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++.
But, I discovered that it can be done - ...
3
votes
2answers
162 views
Where a sysadmin deletes a company's data, why can't they just restore from backups
As an example, in the UBS Duronio case, Mr. Duronio executed code that deleted everything in its path, but isn't there a backup server? Why was UBS hit by the loss of data? If the backup is available, ...
3
votes
2answers
345 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
3
votes
4answers
252 views
Malware via power outlet
This is perhaps a very dumb question, but as I have no knowledge nor experience of IT security I have no option but to ask here.
Is it possible to get malware onto your computer or smartphone by ...
3
votes
1answer
239 views
Is this code harmful? Why?
Code: http://pastebin.com/kJ8ZGP82
That code gets retrived from http://ui.sidepage.co for every HTTP page I visit (not HTTPS) and load it into the body tag of the page.
Is it harmful in any way? ...
3
votes
3answers
175 views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
3
votes
2answers
465 views
Why do I get AV alerts when browsing a web page?
I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!" ...
3
votes
2answers
137 views
Potentially unsafe files on second hard drive, how to get my files back?
I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
3
votes
2answers
108 views
DPAPI and malware
I'm considering using the Windows DPAPI to protect an ECDH key I use to encrypt some data in a local database in a Windows desktop application. I'm new to DPAPI, but its my understanding that DPAPI ...
3
votes
5answers
708 views
How can I know if my PC is getting infected?
I have installed an antivirus, but as no antivirus is perfect, what can I do to diagnose if my PC is getting infected?
For example, keeping a close eye on what programs and tasks run when I turn my ...
3
votes
3answers
5k views
How to prevent my website from getting malware injection attacks?
I found that my website is banned as malware website by Google. When I checked the code, I found some code injected to many files on my server. I cleaned everything manually editing all files in my ...
3
votes
1answer
191 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
3
votes
3answers
148 views
What are some ways to steal a password/PIN using this system?
http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf
Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the ...
3
votes
2answers
154 views
How content-type:image can lead to infected JAR file?
Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious ...
3
votes
2answers
190 views
How does duqu delete itself?
I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
3
votes
1answer
107 views
German malware general question
In the case of the recent find by CCC, how exactly would the malware work? In default mode, it takes screenshots of active windows, it logs data and forwards the data for remote pickup. It is also ...
3
votes
1answer
157 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
3
votes
2answers
217 views
What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?
Supposing there is private/secret data on a machine (i.e a x86 arch) the most reasonable thing to me would be to encrypt this data, so to protect it.
I understand that the purpose of ...
3
votes
2answers
2k views
Security Alert - Office File Validation - how to decide whether to proceed?
Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message:
The warning message is titled "Security Alert - Office File Validation". ...
3
votes
2answers
502 views
How does DNS Changer malware detection work?
This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
1answer
343 views
quizrace.com - Malware or just a game?
This quizrace.com quiz game is spreading like a virus all over internet forums and sites like 4cahn, minecraft etc (just google for it) - because it requires you to invite 3 friends to continue beyond ...
3
votes
1answer
200 views
what is the difference between virus, worm, trojan and other malware [closed]
Looking through the questions in IT security, I found out that there is no answer which cover this question in depth.
I am aware of the answer and just hope to see something detailed about:
main ...
3
votes
1answer
137 views
Recover file using Java RanNum Gen + Key
EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
3
votes
1answer
175 views
How dangerous is a virus introduced to a malicious website in chrome?
I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.
If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
3
votes
1answer
251 views
In the light of recent information about RarVM, can we still trust RAR files?
See:
http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
https://github.com/taviso/rarvmtools
It would seem according to these two sources that rar files can contain custom ...
3
votes
1answer
259 views
Looking for URL Blacklists of Malicious Websites [closed]
Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware.
Please indicate in your answer if the list is freely ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
