Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

21
votes
3answers
1k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
3
votes
1answer
141 views

How to verify .plist and .kext files are legitimate?

While scouring through tons of logs generated during an audit of a Mac filesystem after a potential malware infection, and I am wondering if there are any better ways to verify that all kernel ...
0
votes
2answers
194 views

Many suspicious requests are going from my browser whenever open any site

Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue. And sometimes I ...
0
votes
2answers
208 views

Malicious favicon icon?

Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all ...
2
votes
1answer
189 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
3
votes
1answer
84 views

Host based code injection defense vs anti virus?

Recently I came across a paper titled Host-based code injection attacks: A popular technique used by malware. Another paper titled "Bee Master: Detecting Host-Based Code Injection Attacks", suggests ...
41
votes
5answers
11k views

Accidentally came across the source code for some malware, what to do?

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source ...
1
vote
1answer
308 views

Can a hacker use someone else's IP address when running a scam?

I have a friend who works on a ship currently in Accra, Ghana. We do video chats but his system is extremely slow and sluggish. There have been times where our only form of communication is IM. A ...
3
votes
3answers
759 views

Is it dangerous to have the built-in Administrator account enabled?

I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it. I do realize it's a ...
1
vote
2answers
131 views

Can virtualization protect me from an infected BIOS?

As you know, there are attacks on the firmware of BIOS and HDD. What if I used some kind of VMS, maybe VirtualBox? Will this protect me from an already infected BIOS (and by that, I mean, no one can ...
26
votes
6answers
17k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
2
votes
1answer
123 views

How long does it typically take to distribute malware signatures?

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically ...
4
votes
1answer
219 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
0
votes
2answers
448 views

What is the purpose of this malware code?

This is the code that I found on my client's website: ?><noindex><nofollow> <iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" ...
1
vote
3answers
177 views

Gaming Mods Security Risks

I read the following post, and while the questions was specific to SkyRim, the more general answer was that it depends on the game. I wanted to pose a more generic question here to the security folks. ...
4
votes
2answers
151 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
3
votes
2answers
244 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
2
votes
2answers
891 views

How safe are Firefox addons from official mozilla.org site?

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting. I could not find any information on the Mozilla page, ...
7
votes
7answers
15k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
4
votes
3answers
846 views

Does Gmail's 'preview' feature for documents in the browser prevent malware?

I'm concerned about opening attached Word documents and other files (images, PDFs, etc). Gmail has a feature that previews these in the browser for you in a popup, without leaving the Gmail screen - ...
12
votes
1answer
242 views

New social engineering tactic that uses printer serial numbers?

We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company). Basically, the flow of events is this: ...
4
votes
1answer
606 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
5
votes
2answers
280 views

A compromised USB

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
4
votes
2answers
7k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
3
votes
1answer
755 views

Rogue WPAD server attack

Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive ...
5
votes
0answers
238 views

Enabling virutalization, addressing the bluepill risk?

Background to this question is the ambivalence I assume with virtualization. Also to start directly with clarity: the term bluepill should here be a placeholder to denote "malware that uses ...
2
votes
1answer
661 views

What's with the Facebook malware which posts obscene posts in all the groups? [closed]

How to get rid of the Facebook malware which sends pornographic posts in all the groups you belong to? I always made fun of people who became victim of this malware/virus saying they are not cautious ...
5
votes
2answers
2k views

Can a piece of malware/virus inject itself into an ISO

Let's say that I have an infected PC. I download a copy of the Windows ISO(obviously clean) and burn it to an USB. Is it possible that the malware on my computer can inject itself in this process/ISO ...
34
votes
3answers
55k views

Can you get virus just by visiting a website in Chrome?

I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome? So if I have a link (from a spam email) I can right-click >> ...
1
vote
1answer
123 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
40
votes
4answers
6k views

Have computer criminals been known to exploit easily-edited websites like Wikipedia to embed malicious scripts?

When I was reading a page on Wikipedia several months ago (December 2014) I saw what looked like a pop-up window from BT, but I soon realized that when I closed the page the pop-up disappeared. I then ...
2
votes
1answer
301 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
1
vote
1answer
86 views

Patching Mac DMA attack

I want to know a few things about the blackhat attack that attacks thunderbolt. Is there anyway to wipe or patch a currently infected computer? I am not versed per se in THAT level of security. I was ...
8
votes
1answer
12k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
0
votes
1answer
187 views

Can a ratter use your webcam undetected? [duplicate]

The Black Hat conference (I wasn't there) had a session on "ratters" (RAT for Remote Access Trojan) who take illicit footage of users (usually female) by hijacking their systems. The question I have ...
2
votes
1answer
836 views

JS malware detection

Is there a way to detect a malicious JavaScript code within a webpage before the script runs on my computer ? I want to develop a Python script that prevents from 8 JS malwares that I can embed on my ...
1
vote
1answer
62 views

Detecting the source of dll injection

Is it possible to determine the process that performed DLL injection against a victim process?
3
votes
2answers
384 views

Is it possible for malware to be in the BIOS or in hardware?

Is it possible for malware to be written in the BIOS section and loaded on every fresh Windows Install? If it is possible, can this affect Linux (Ubuntu and others) operating systems as well?
0
votes
7answers
5k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
-1
votes
1answer
215 views

A sneaky way of disabling Microsoft Security Essentials?

For a long time I've been dismissing and ignoring this popup, which is easy since it only appears at boot (or logon) which is once every few months: But recently I became suspicious after a crash (...
1
vote
0answers
18 views

Is it possible to low level format an Virtual Machine? [closed]

I just came to wonder, if you can low level format the disk of an Virtual Machine, maybe you guys can help me with that?
0
votes
3answers
235 views

Malware in RevSlider plugin?

Maybe my WordPress site is hacked, because it's always send spams (5000 / day). I found one file in plugins folder which contains this base64 code. What shoul I do? EDIT: Oh, i found another one: ...
11
votes
6answers
2k views

Ads appearing in our application when they should not be

I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application. I didn't add advertisements at all. It's ...
3
votes
1answer
298 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
-6
votes
3answers
166 views

What File Types Should I Scan Before Opening? [closed]

In general, a person downloads some files from the Internet. Secure practice is to, at least, scan them before opening them. In light of this, what file types (i.e. extensions) should a normal user (...
2
votes
0answers
262 views

Open source database of malware signatures [closed]

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files (...
1
vote
2answers
135 views

Actual use of covert channel in malware

I have seen several academic sources mentioning covert channels in computers, such as one process sending data to another process/thread on the same machine in a way that attempts to avoid detection. ...
1
vote
2answers
187 views

How does malware performs a UDP hole punch?

I want to know how do malware like ZeroAccess hole punch the network without using a external server? Or do they just mainly infect non-NAT users? Does that mean all NAT users are safe?
4
votes
1answer
136 views

Would DLL hijacking work with load-time linking?

I was wondering if DLL hijacking would work with all types of linking or just run-time linking. I hear that malware uses it and wanted to know how it works
1
vote
3answers
432 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...