Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

learn more… | top users | synonyms (1)

1
vote
3answers
237 views

Why don't the majority of today's malware use strong cryptography?

While reading another story of botnet takedown, my wondering has reached its apogee: Why don't malware authors use cryptography (encryption + signing) provided by good libraries when their creations ...
2
votes
2answers
110 views

What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype?

The following URL was sent to me by a trusted Skype contact (from my university): WARNING - DO NOT CLICK IF YOU DON'T KNOW WHAT YOU'RE DOING http://bit.ly/28PPw3V#dahubas=my_skype_id I clicked on ...
0
votes
1answer
43 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
2
votes
2answers
48 views

What would it take to scan a PDF for questionable content in addition to malware?

My company is trying to implement a new feature on our site to let customers load documents accompanying an order. We know that we will need to perform some kind of malware scan by calling out to a ...
18
votes
3answers
1k views

How can a font be used for privilege escalation?

Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't ...
1
vote
1answer
63 views

Is CryptoLocker part of the TeslaCrypt ransomware family?

I'm readin a Microsoft report examining the most prevalent ransomware families as of recent. On the news, I've heard of CryptoLocker, CryptoWall and TeslaCrypt, but I don't see any of them ...
1
vote
2answers
118 views

Confused about whether or not I'm infected

I want to upgrade to Windows 10 (I have 7) and then probably do a clean install as well. I'm not sure because I'm really confused now. I don't know what to believe anymore. It's very important to know ...
20
votes
3answers
888 views

How Do Rootkits & Other Low-Level Malware Still Manage to Load on Systems Protected by Secure Boot (and TB/MB)?

Let me try asking my question this way... Let's say that I'm a offensive cyber Bad Guy working for a foreign state-sponsored Advanced Persistent Threat unit. My unit is charged with, say, stealing ...
0
votes
0answers
48 views

Trying to build an offline virus total type product

I have been tasked with finding a way to scan a file using multiple AV products. The machines this is to be used on cannot be connected to the web, due to lab restrictions and the AV products cannot ...
0
votes
0answers
36 views

How do malware save configuration of C&C-server?

Malware must communicate with a command and control server. In order to be able to do that the malware must know specific things about that server (e.g. hostname, port, username, password...). Of ...
3
votes
2answers
147 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
0
votes
0answers
70 views

A JSE file was downloaded after clicking a notification on my Facebook account [duplicate]

I got a notification on Facebook that says "Finn mentioned you in a comment". After clicking the notification a file was downloaded on my phone. I found it unusual because when you click a ...
0
votes
0answers
10 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
2
votes
0answers
7 views

Is it better to have a secure channel or secure PIN entry for Smartcards?

Assume I do own a computer, a USB-connected keyboard and a USB-connected contact-based (trusted) chipcard reader with a hardware pinpad. There are now two types of smartcards relevant to this ...
-1
votes
1answer
34 views

Decompiling folders inside a jar file [closed]

I am in possession of a jar file that I have reason to believe has a RAT inside. I downloaded it inside of a virtual machine with jad installed and began to attempt to look at the source. I found that ...
3
votes
2answers
31 views

DGA (Domain Generation Algorithm) - malwares

Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C. As far as I know, there is ...
5
votes
2answers
91 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
2
votes
1answer
54 views

Virtual network for malware analysis

I'm attempting to do some analysis work on a malware sample but I'm running into a wall. I can't get the malware to execute correctly and talk to its C2 server. In my lab I have a Windows machine that ...
2
votes
2answers
93 views

Hardening Javascript in respect to Javascript Malware/Ransomeware like Ransome32

Are there any methods or standards to harden Javascript implementations to help reduce/remediate the the risks associated with Javascript malware like the Ransom32 or other types of Javascript attacks?...
1
vote
1answer
56 views

Why do browsers not protect against scripts coming with images?

I understand that this is how it goes: Malformed Image --> Buffer Overrun --> Stack Over Flow --> Execute Malware Pushed On Stack And though I don't a huge amount about this, I know that I ...
0
votes
0answers
60 views

Pop up in Facebook built-in browser

While I was visiting a page on a usual website with the built-in browser of the Android Facebook app, a pop-up just... poped-up, saying dumb stuff about my cellphone being full of viruses, etc. (Quite ...
1
vote
1answer
1k views

Is there a foolproof method to remove spyware from Android smartphone?

I am owning an Android smartphone. I learnt that factory reset may not remove spyware as it might have corrupted the image being installed by factory reset. Is there a foolproof method which ensures ...
3
votes
0answers
35 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
6
votes
4answers
579 views

Is this powershell script an infection?

While I was sitting in front of the computer not using it,my Windows 10 machine quickly flashed a few terminal windows, and then gave me a Windows Security popup, asking for my password. I have no ...
51
votes
10answers
17k views

Can headphones transmit malware?

Can headphones transmit malware? My friend borrowed my headphones (a pair of Apple EarPods) and plugged them into his Android mobile phone for a few minutes in order to listen to a voice message. ...
0
votes
3answers
205 views

How to delete one exe file that is probably malware?

I stupidly saved an .exe file that claimed to be an urgent Firefox patch (318K). I haven't (and won't) run it, but how can I delete it so that it's gone, i.e. no risk to my Win7 laptop? I thought of ...
-3
votes
1answer
135 views

What does a trojan look like? [duplicate]

I would like to know what a trojan looks like. There was a great example of a worm (although it is old) posted by Wired. Viruses embed themselves into an existing program, by changing the existing ...
-1
votes
1answer
96 views

What forms does trojans take? [duplicate]

I'll try and pose this question as simply as possible. I would like to know which forms a trojan can take. Does it need to be an .exe file? Can it be a hidden file attached to an .mp3 file for ...
6
votes
8answers
314 views

Difference between virus and trojan?

To my current understanding: A virus is a program that does not self replicate and relies on the host file being spread. It has malicious intent. A trojan is a program that is run by deceiving the ...
0
votes
3answers
1k views

Is mgicinjs.info a virus or malware site? How to get rid of it?

Today, I noticed that almost all of my web project (published or in localhost) have a set of weird script references in their pages: And they are all automatically generated - they don't appear in ...
-1
votes
1answer
76 views

What to do after exposure to a drive-by infection?

I clicked on a link that pretty clearly offered exposure to a drive-by infection. I won't post the link itself, but I got it from a link which is inside a reddit link (obviously the reddit website ...
0
votes
2answers
516 views

How exactly does this Flash malware function on Ubuntu?

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware. This is the first example I've ever seen of truly successful malware in the wild aside from privilege ...
2
votes
3answers
6k views

How to search for evidence of Camfecting (webcam hacking)?

I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot. I've ran a virus scan but no signs. Now my idea ...
0
votes
1answer
32 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
-3
votes
1answer
83 views

checking if malware altered system files in windows

a friend called me today because he opened an attachment of an email. It was a double zipped exe file - and malware: I started to analyze the file: first with virustotal - then with radare2 and the ...
1
vote
1answer
76 views

Boot-sector virus - can it spread only through floppy disks?

Do boot-sector viruses spread only through floppy discs, and so are the thing of the past, or can they spread through USB, removable hard drives etc? Techopedia states: The propagation of boot ...
19
votes
5answers
3k views

Dualbooting Windows and Ubuntu, can I get Windows viruses/malware while running Ubuntu?

Today I have both Windows and Ubuntu installed on my SSD. What happens if I for some reason get a malware/virus (targeted for Windows), perhaps downloading something I should not, while I am running ...
24
votes
2answers
2k views

How trustworthy is `sudo apt-get install (package name)` in Ubuntu?

One of the easy ways to install a program in Ubuntu Linux is to type a command in the terminal, but how do I know that the program is coming from a trusted source and not from somewhere dangerous? ...
5
votes
1answer
95 views

Can you extract the encryption key of a computer with full disk encryption via malware?

I recently discovered the subject of cold boot attacks which are able to extract the encryption key of the ram memory after the computer has shut down. and from what I understand is that law ...
-3
votes
1answer
102 views

Trojan horse - only a delivery method? [duplicate]

Viruses and worms are pretty basic, they infect and they spread. Trojans on the other hand do not. But my question is, what do trojans really do? I guess that depends on the payload? Are they (the ...
2
votes
1answer
68 views

How do boot-sector viruses propagate?

I'm doing research on various malware and I came across boot-sector viruses. Kaspersky states that "they are not designed to infect removable media." My question is, how do they spread then? Again ...
12
votes
1answer
223 views

Stack Exchange's javascript is malicious

I have, recently, discovered a rather annoying problem: every first-click I have on any Stack Exchange site creates an advertisement popup. This happens on my desktop, laptop, phone and even a VM. I ...
2
votes
3answers
143 views

Is it possible for a virus to be downloaded unknowingly and run when a website is opened?

Usually, the only time I see viruses happen is when someone mistakenly runs an infected file. But could one also be infected by just visiting a website?
0
votes
2answers
94 views

Can I get malware just by navigating to a webpage? [duplicate]

Is going to a webpage a risk per se? If yes, how does work, and how can we defend ourselves from this? I have to constantly review websites and I get the links from job seekers (that is, I'd navigate ...
1
vote
2answers
71 views

Detecting a Crypted executable that is supposed to bypass antivirus [closed]

I've seen many Crypters being advertised to bypass antivirus and they work. The malware crypted by the Crypter evades antivirus detection. How would you programtically or using a tool reliably ...
9
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
0
votes
1answer
55 views

Telegram messages in group are seen immediately [closed]

We have a small friends group using Telegram Messenger without any bot attached to group. When we send message in this group it is always seen (double checked) immediately even at midnight and hours ...
3
votes
2answers
239 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
38
votes
7answers
10k views

Can cookies carry viruses?

I was wondering whether a cookie can carry a virus (or any security-threatening code). In some sense it is similar to a download. So by simply visiting a site, could I get harmed?