Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
38
votes
5answers
2k views
What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?
Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
37
votes
6answers
12k views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus might ...
33
votes
5answers
2k views
Is it safe to install malware in a VM
Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer.
Can I install the malware in a VMWare VM, maybe even without ...
32
votes
3answers
1k views
Mars Curiosity Rover Security
Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious ...
25
votes
3answers
1k views
Stack Overflow is www.doioig.gov/? If not, then could I be infected
Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I ...
21
votes
5answers
1k views
Why would malware try to remove other malware?
Recently my php-based website got infected with malware (probably by a stolen ftp password).
Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
19
votes
2answers
471 views
Cohen's problem
Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that?
Background
Fred Cohen experimented with computer viruses ...
18
votes
6answers
844 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
18
votes
5answers
488 views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
18
votes
4answers
469 views
Malware - are removal tools acceptable or is bare metal re-install the only safe option?
I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine.
Is using a removal software tool to 'clean' an ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
17
votes
6answers
963 views
Best practices for handling computer viruses
I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.
In a small-to-medium ...
17
votes
6answers
452 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
17
votes
4answers
1k views
Reverse engineering malware/viruses
Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
16
votes
4answers
4k views
Does a Virtual Machine stop malware from doing harm?
I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware.
Can a virus break out and read or write data from the host system? ...
15
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
14
votes
5answers
823 views
Why would a virus writer bother to check to see if a machine is infected before infecting it?
I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
14
votes
3answers
529 views
Why do rootkits hide in drivers?
A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?
One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
13
votes
4answers
2k views
Is making a clean install enough to remove potential malware?
Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?
Or can something still persist installed in the ...
13
votes
4answers
11k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
13
votes
4answers
1k views
Malwares source repositories. Where?
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
13
votes
3answers
2k views
Recommendations for honeypot software
A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
12
votes
2answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
12
votes
2answers
449 views
Is there a real possibility of getting malware by “drive-by”?
I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one?
Assuming using only Firefox / Chrome and ...
12
votes
4answers
603 views
How is a worm different from a virus?
In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus".
Two related questions--
Is there a useful and clear distinction here or no? If so, what is ...
12
votes
5answers
328 views
What is the risk of giving USB drives as promotional items by a healthcare provider
There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.
Besides this, if a healthcare company ...
12
votes
2answers
667 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
12
votes
6answers
688 views
Why do malware creators use such clever technologies for such silly purposes?
Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).
It was a ...
11
votes
5answers
487 views
Checking if notebook is clean of hardware spyware
Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware?
What should be looked for? How should it look?
If any visual tutorials with photographs are ...
11
votes
3answers
434 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
11
votes
5answers
542 views
Methods of mitigating threats from keyloggers
I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network.
Is there a common method that such malware uses to send its collection back to the ...
11
votes
4answers
315 views
Becoming a malware analyst?
So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
10
votes
5answers
590 views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
10
votes
5answers
624 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
9
votes
2answers
17k views
How serious is InstallIQ?
Background:
Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
9
votes
1answer
294 views
Could once infected machine be ever trusted again?
I'm just about to switch to a new SSD drive, so I figured it's a good occasion for a really, really fresh start. I reconsidered every installed piece of software, uninstalled lots of crap ...
9
votes
4answers
527 views
How would you analyze an image to find out if there are scripts embedded in it?
How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
8
votes
3answers
868 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
8
votes
5answers
417 views
Finding Win32.Sality sample for malware analysis purposes
I wish to analyze the changes made by a virus like Win32.Sality. Where can I get the sample of this, or other similar, malware for testing?
8
votes
4answers
341 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
8
votes
1answer
795 views
Oligomorphism vs polymorphism vs metamorphism in malware
What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
8
votes
1answer
1k views
Detecting reflective DLL injection
In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
7
votes
3answers
579 views
Nmap indicates that “telepathstart” and “telepathattack” are listening on ports 5010 and 5011 of my Linux box. What are these?
I have a linux box on my network which, according to Nmap, contains two services called telepathstart and telepathattack listening on ports 5010 and 5011.
From the same box, I am receiving inbound ...
7
votes
5answers
1k views
Browsing on a USB OS (Linux) safe from malware?
Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc.
I have a USB drive ...
7
votes
4answers
7k views
Security issues with allowing Dropbox installations on client PC's in our organisation
Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
7
votes
5answers
523 views
Can a mobile phone battery contain malware?
It has 3 terminals and is presumably a smart battery.
I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50.
The ...
