Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

2
votes
3answers
233 views

Can a wireless headphone (bluetooth) contain malware?

Can a wireless (bluetooth) headphone store data? Also, if it can, then can someone put malware in it? I assume that the device must necessarily be able to store some sort of data, since it has buttons ...
1
vote
1answer
282 views

Contents of Lenova/Superfish certificate

I would like to examine the Lenova/Superfish root certificate being used in the wild. I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, ...
53
votes
4answers
4k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
1
vote
1answer
84 views

How to analyze why Chrome downloaded a particular file?

I had a very few Chrome tabs open (see appendix) and other safe websites. Suddenly, without any prompt or action from me, chrome starts downloading the file "NEW!_iPhone7_LEAKED_PHOTO.JPG.exe" which ...
7
votes
4answers
1k views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
2
votes
0answers
109 views

Rogue WPAD server attack

Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive ...
1
vote
1answer
54 views

Is it safe to load a forensic image which might contain malware?

So you get a raw image of a compromised system and then you load it on an application suite like Autopsy. If the system had some kind of malware, could it spread to the operating system in which ...
0
votes
1answer
312 views

How exactly do viruses get on computer when watching online porn? [duplicate]

I've been hearing that your computer could get infected when you visit porn sites, especially when watching videos. But how exactly do viruses get on client side? Is it by cache? Or maybe by ...
4
votes
2answers
570 views

What is disk encryption worth? Threat of proprietary Bios, SMM, optionrom, TPM etc?

Supposing there is private/secret data on a machine (i.e a x86 arch) the most reasonable thing to me would be to encrypt this data, so to protect it. I understand that the purpose of ...
1
vote
2answers
142 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
7
votes
1answer
479 views

Can a malware steal the content of the clipboard? [duplicate]

Is there any malware that can steal the content of the clipboard?. E.g. say you have a text file with say private info or passwords, and you copy this data to paste on say another text file on a ...
1
vote
3answers
82 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
5
votes
4answers
670 views

How to keep Mac secure from viruses, malware and keyloggers?

How can I download and install software and make sure that it is not infected with viruses, malware or a keylogger? Also, I heard that Macs "don't get viruses". Is this true? Is it a good practice to ...
5
votes
2answers
131 views

Are malware detection rulesets publicly discoverable?

I am uncertain about how public malware detection rulesets are? By a "ruleset" I mean the rules, usually written in Yara, that malware detection engines use to determine whether a file or memory ...
3
votes
4answers
314 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
9
votes
2answers
223 views

concrete real-life examples where grsecurity prevented an exploit

From theoretical point of view, grsecurity kernel patch looks like a great hardening tool. Most importantly, PaX seems like a good idea. Do these theoretical advantages have indeed practical effect ...
20
votes
8answers
3k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
73
votes
10answers
6k views

How do you explain the necessity of “nuke it from orbit” to management and users?

When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
22
votes
4answers
6k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
4
votes
2answers
5k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
4
votes
3answers
1k views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
1
vote
3answers
2k views

Wife was conned into allowing her computer to be hacked, what do I do? [closed]

My wife had a popup on her old Windows Vista laptop (which I've been threatening to switch to Ubuntu Linux). It appeared to come from our ISP, and informed her that she was hacked, and to call a ...
1
vote
2answers
485 views

How should I deal with adware in chrome on ubuntu?

I use chrome (but also have firefox) on ubuntu 14.04 32-bit. Recently I started getting popups from 'softwareupdaterlp.com'. I had the sense to realize it was not legitimate and I didn't click install ...
-4
votes
1answer
86 views

How am I affected by malware? Malware transferred from service provider's base station or just port scan? [closed]

I need a malware expert here. I am being targeted by advanced hackers over the 4.5 years. So this is my situation: 1) My new phone: I just bought a new phone, with SIM card and mobile internet plan ...
2
votes
3answers
195 views

Domain Name Thefts

Due to past experiences, I have learned that when I'm contemplating purchasing a suitable domain name, I should NOT do so by searching on the websites of domain registrars (GoDaddy, name.com, etc.). ...
1
vote
1answer
48 views

Does SSL/TLS have the feasibility of detecting malicious things during transmission? [closed]

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly ...
3
votes
3answers
3k views

Can malware physically damage a hard drive?

I recently responded to an incident of supposed malware infection. The symptoms were simply, "My computer freezes at random times." The response ended with replacement of the physical hard drive and ...
0
votes
1answer
55 views

Segregating network systems and functions [closed]

I want to segregate network systems and functions so that if an attacker hacks in one area, he can't necessarily reach others. What should be the recommendation when information from one network is a ...
-1
votes
2answers
149 views

Fake Microsoft Security Department [duplicate]

some Indian man called home saying that he's calling from some Windows Security Department, and there are about 16 other people connected to my computer and the're doing illegal things on my computer. ...
1
vote
1answer
112 views

Is it “cross-platform attack” if first OS is not attacked at all?

I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver ...
1
vote
0answers
82 views

HTTP GET Request to a webpage that does not exist [closed]

I am seeing a machine is making a HTTP GET request to webpage (ex: www.sample.com/1.png), proxy devices respond with status code 407 (proxy auth required). But when I checked for the site via ...
2
votes
2answers
99 views

Is it safe to store a file in a temporary folder before it has been scanned for a virus?

I'm working on an application that makes use of the Symantec Protection Engine to scan uploaded files. I'm having issues with my files after they have been scanned. One possible solution I've seen ...
1
vote
1answer
57 views

Apps that require user to install advertised apps in order to get activated

I am analyzing a mobile application, and I am not sure if it is just an adware/greyware or does it enter the category of malwares. This app does not really do any harmful activity. But it forces user ...
-1
votes
1answer
74 views

Can malware “upload” itself to the actual mobile base station and regain back to another phone?

My question is can a malware from my affected phone "upload" itself to the ACTUAL REAL mobile base station from the service provider, and regain back to my another phone with the same number (same ...
6
votes
4answers
5k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
11
votes
5answers
284 views

Security of root terminal (su -) when logged into X

I often log into X as normal user (of course), open terminal and switch to root: su - I have then a terminal owned by user but effectively with root privileges. Are there any security issues in ...
1
vote
0answers
77 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
2answers
109 views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
3
votes
1answer
359 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache ...
2
votes
2answers
290 views

Convert PDF to plain text, remove malware?

Take a PDF, copy all, paste it into a .rtf document in textedit, --> make plain text. will this remove/nullify any malware from/in the pdf? In other words, if I open the PDF on one machine and convert ...
5
votes
6answers
479 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
4
votes
2answers
1k views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
0
votes
2answers
3k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
0
votes
1answer
61 views

What are features of a suitable tool for tracking and reporting security incidents? [closed]

What are features of a suitable tool for tracking and reporting security incidents? Is it a bad idea to have one central repository for tracking all types of incidents, from helpdesk issues, to ...
13
votes
5answers
563 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
3
votes
1answer
164 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
29
votes
7answers
14k views

Is making a clean install enough to remove potential malware?

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.? Or can something still persist installed in the ...
11
votes
3answers
854 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
2
votes
1answer
270 views

How is the file overlay read by an exe/virus?

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE. My question is if the overlay is not ...
3
votes
1answer
294 views

Sticky keys on RDP

A recent report on page 18 states that: [black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions. ...