Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
16
votes
4answers
4k views
Does a Virtual Machine stop malware from doing harm?
I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware.
Can a virus break out and read or write data from the host system? ...
12
votes
5answers
328 views
What is the risk of giving USB drives as promotional items by a healthcare provider
There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.
Besides this, if a healthcare company ...
4
votes
3answers
125 views
Duqu and other reference material for security people
I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen.
Isn't there a reference website or... that reports on these ...
7
votes
5answers
557 views
Detecting malware-infected USB drives
I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
9
votes
2answers
16k views
How serious is InstallIQ?
Background:
Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
2
votes
1answer
574 views
How do you remove the Security Sphere malware?
My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
5
votes
1answer
212 views
Downloading suspect files into quarantine?
Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?
8
votes
3answers
863 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
3
votes
1answer
107 views
German malware general question
In the case of the recent find by CCC, how exactly would the malware work? In default mode, it takes screenshots of active windows, it logs data and forwards the data for remote pickup. It is also ...
13
votes
4answers
11k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
5
votes
2answers
161 views
How does the predator network prevent outside control by an attacker?
I read several articles saying some of the command and control fleet for the US robotic attack planes may have been infected with a virus.
Does this command and control system communicate with the ...
4
votes
1answer
129 views
The Economics and White Hat Nature of NSS ExploitHub
This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
2
votes
1answer
183 views
Detecting Key Loggers
We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached.
Is there ...
3
votes
2answers
137 views
Potentially unsafe files on second hard drive, how to get my files back?
I have my files on a second hard drive (disconnected for now). This drive was connected to a system infected with Virus:W32/Virut. I have formatted my main hard drive and reinstalled Windows XP. Now I ...
6
votes
2answers
152 views
Where can I find good resources on reversing web malware?
I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients.
Does anyone have any ...
4
votes
3answers
1k views
What programming language is Stuxnet written in?
I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?
Is the source code for Stuxnet available anywhere?
13
votes
4answers
2k views
Is making a clean install enough to remove potential malware?
Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?
Or can something still persist installed in the ...
11
votes
5answers
487 views
Checking if notebook is clean of hardware spyware
Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware?
What should be looked for? How should it look?
If any visual tutorials with photographs are ...
5
votes
2answers
385 views
Does the Mebromi BIOS flashing rootkit mean APTs for personal computers are here?
With the recent discovery of the Mebromi BIOS firmware virus/MBR rootkit http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/ in the wild are we now actually in the age of Advanced ...
5
votes
1answer
275 views
How to detect infected machines on my wifi?
I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
4
votes
2answers
153 views
What is multi-path malware?
I would like to know, in malware analysis, what is meant by "multi-path execution". I read this when I encounter the words in malware detection literature related to Control Flow Graph (CFG).
18
votes
4answers
469 views
Malware - are removal tools acceptable or is bare metal re-install the only safe option?
I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine.
Is using a removal software tool to 'clean' an ...
7
votes
4answers
7k views
Security issues with allowing Dropbox installations on client PC's in our organisation
Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
3
votes
1answer
157 views
How can I assess the trust worthiness of a browser add-on?
Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.
...
7
votes
5answers
1k views
Browsing on a USB OS (Linux) safe from malware?
Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc.
I have a USB drive ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
7
votes
2answers
255 views
Are there any independent organizations doing (publicly available) IT security research?
When looking up security risks on the net I find that all research being cited (if any is cited) always seems to come from the Anti-Malware companies. (just e.g., this article cites F-secure, AVG and ...
6
votes
2answers
209 views
Statistics on purposes of viruses/malware
Are there any resources that analyze the purpose or goal or the major viruses/malware out in the wild today? For example, what percentage are used to construct botnets (for DDoS or something else)? ...
6
votes
3answers
138 views
Is it safe to attach a potentially malicious hard drive to a Solaris machine?
We bring in hard drives from un-trusted sources and would like to ensure that they will not contain any harmful content.
What kind of risk is there for Solaris? As in, if Solaris is running, and I ...
12
votes
6answers
688 views
Why do malware creators use such clever technologies for such silly purposes?
Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).
It was a ...
8
votes
4answers
340 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
12
votes
2answers
664 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
6
votes
4answers
1k views
What are the best ways to fake a web server
I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
10
votes
5answers
589 views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
5
votes
4answers
954 views
Pursuing a career in Malware Analysis
When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer ...
8
votes
1answer
787 views
Oligomorphism vs polymorphism vs metamorphism in malware
What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
5
votes
3answers
164 views
Spamming exploits without user detection
So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
1
vote
1answer
362 views
Firefox Desktop Shortcut Being Renamed
On my Vista PC the Firefox shortcut icon is being randomly renamed. The name changes to some variation of a recently visited URL. This unwanted action has survived several version updates. Of course I ...
2
votes
1answer
138 views
Can a bad guy be judged for gaining access to sensitive information?
Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
13
votes
3answers
2k views
Recommendations for honeypot software
A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
11
votes
5answers
540 views
Methods of mitigating threats from keyloggers
I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network.
Is there a common method that such malware uses to send its collection back to the ...
5
votes
4answers
316 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
15
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
5
votes
2answers
203 views
What applications are at risk from “Backwards Unicode Names” and what are the mitigations?
There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
4
votes
4answers
2k views
Browser hijacked - how to fix and prevent?
For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on ...
3
votes
1answer
343 views
quizrace.com - Malware or just a game?
This quizrace.com quiz game is spreading like a virus all over internet forums and sites like 4cahn, minecraft etc (just google for it) - because it requires you to invite 3 friends to continue beyond ...
5
votes
3answers
468 views
Phishing virus found on server
I recently had a call from BELL concerning a virus on our Linux ( Debian ) Server. Apparently Google emailed our client about an Italian Database found on our server that was doing phishing. They ...
37
votes
6answers
11k views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus might ...
7
votes
5answers
523 views
Can a mobile phone battery contain malware?
It has 3 terminals and is presumably a smart battery.
I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50.
The ...
