Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
48
votes
10answers
4k views
How do you explain the necessity of “nuke it from orbit” to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
39
votes
6answers
12k views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus might ...
39
votes
5answers
2k views
What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?
Today, Microsoft released a security advisory warning that the "Flame" malware exploited a weakness in a cryptographic algorithm used by Microsoft Terminal Server Licensing Service, and was thereby ...
34
votes
5answers
2k views
Is it safe to install malware in a VM
Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer.
Can I install the malware in a VMWare VM, maybe even without ...
32
votes
3answers
1k views
Mars Curiosity Rover Security
Does the software in the Mars Curiosity Rover have any security features built-in? I can't imagine how someone would hack into it, but if the rover does indeed have some protection against malicious ...
25
votes
3answers
1k views
Stack Overflow is www.doioig.gov/? If not, then could I be infected
Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I ...
21
votes
5answers
1k views
Why would malware try to remove other malware?
Recently my php-based website got infected with malware (probably by a stolen ftp password).
Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute ...
20
votes
6answers
855 views
Why are vulnerabilities and lack of security possible in computers?
I have heard about computer vulnerabilities, virus, malware, etc.
Why are these threats possible?
Why doesn't the computer just do the things it is supposed to?
Why do some people write malware, ...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
19
votes
6answers
1k views
Malicious Links that Respond to Browsers but not curl or wget
There are some emails with links to people's cracked websites with a malware download
Like this kind of email:
fake DHL pack station email
... the links often take the form of:
http:// ...
19
votes
2answers
515 views
Cohen's problem
Fred Cohen determined theoritically that viral detetction is an undecidable problem. Can anyone provide an intuitive reasoning for that?
Background
Fred Cohen experimented with computer viruses ...
19
votes
2answers
819 views
How secure is the Windows 8 included Anti Virus known as Windows Defender?
How secure is the new Windows 8 anti virus known as windows defender?
Does it have a protection against malware which uses UAC bypass/process injection/rootkits/process persistence/running the binary ...
18
votes
4answers
472 views
Malware - are removal tools acceptable or is bare metal re-install the only safe option?
I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine.
Is using a removal software tool to 'clean' an ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
17
votes
6answers
980 views
Best practices for handling computer viruses
I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.
In a small-to-medium ...
17
votes
6answers
460 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
17
votes
4answers
1k views
Reverse engineering malware/viruses
Assuming a machine has malware, regardless of how it got there, one thing I would like to learn to do is to take the binary file and reverse engineer it to see what the malware is doing/has already ...
16
votes
4answers
4k views
Does a Virtual Machine stop malware from doing harm?
I would like to know if it is save for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware.
Can a virus break out and read or write data from the host system? ...
16
votes
2answers
6k views
Can you get virus just by visiting a website in chrome
I've recently read Google Chrome: The End of Drive-By Downloads. Is it true to say that drive-by-downloads are history in Google Chrome?
So if I have a link (from a spam email) I can right-click >> ...
15
votes
3answers
542 views
Why do rootkits hide in drivers?
A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that?
One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
14
votes
4answers
2k views
Is making a clean install enough to remove potential malware?
Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?
Or can something still persist installed in the ...
14
votes
6answers
1k views
What are the security implications of people downloading addons, wrongly thinking that they are safe?
I recently learned about a plugin for Firefox called Fire Sheep, which was featured on the Security Now podcast. I downloaded F.S. and began examining it. To my surprise it includes C++ code that must ...
14
votes
5answers
831 views
Why would a virus writer bother to check to see if a machine is infected before infecting it?
I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already ...
14
votes
4answers
12k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
14
votes
4answers
1k views
Malwares source repositories. Where?
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
14
votes
3answers
2k views
Recommendations for honeypot software
A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
13
votes
2answers
2k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
13
votes
6answers
477 views
Finding a specific malware sample for malware analysis purposes
I wish to analyze the changes made by a specific virus. For example, Win32.Sality.
Where can I get the sample of this, or other similar, malware for testing?
13
votes
2answers
685 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
13
votes
2answers
448 views
Is it possible to make a phone call appear to come from another phone, even to the network provider?
Quick Question
Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
12
votes
2answers
460 views
Is there a real possibility of getting malware by “drive-by”?
I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage or clicking a link and getting one?
Assuming using only Firefox / Chrome and ...
12
votes
4answers
598 views
Becoming a malware analyst?
So, I'm currently 16 and am considering a career in IT when I finish school. The thing that has intrigued me the most while growing up is malware. I've come across it so often and have often had to ...
12
votes
4answers
639 views
How is a worm different from a virus?
In spite of various online articles, I'm a bit unclear on the distinction between a "worm" and a "virus".
Two related questions--
Is there a useful and clear distinction here or no? If so, what is ...
12
votes
5answers
333 views
What is the risk of giving USB drives as promotional items by a healthcare provider
There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.
Besides this, if a healthcare company ...
12
votes
6answers
699 views
Why do malware creators use such clever technologies for such silly purposes?
Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).
It was a ...
11
votes
5answers
513 views
Checking if notebook is clean of hardware spyware
Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware?
What should be looked for? How should it look?
If any visual tutorials with photographs are ...
11
votes
3answers
445 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
11
votes
5answers
557 views
Methods of mitigating threats from keyloggers
I am concerned about keyloggers being installed on my system and transmitting sensitive data out of our network.
Is there a common method that such malware uses to send its collection back to the ...
10
votes
5answers
597 views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
10
votes
5answers
641 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
10
votes
2answers
18k views
How serious is InstallIQ?
Background:
Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
9
votes
3answers
901 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
9
votes
1answer
311 views
Could once infected machine be ever trusted again?
I'm just about to switch to a new SSD drive, so I figured it's a good occasion for a really, really fresh start. I reconsidered every installed piece of software, uninstalled lots of crap ...
9
votes
4answers
545 views
How would you analyze an image to find out if there are scripts embedded in it?
How would you analyze an image to find out if there are scripts or possible malware embedded in it? What tools / methods to use?
9
votes
1answer
838 views
Oligomorphism vs polymorphism vs metamorphism in malware
What is the difference between these three? As I understand it, polymorphic malware code actually is always the same, and it's just that it appears to be different (through encryption, data ...
9
votes
2answers
251 views
How do you visit a link without risking your computer?
I got a link from: http //61.19.247./~naowit/dustin.html (removed the last digits so you don't accidentally click it! (they were 192)), which was masked as a youtube.com link via email. Now I'm not ...
8
votes
4answers
345 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
8
votes
3answers
258 views
Reason for writing Self-Decrypting Virus
What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it.
How does this protect the virus from antivirus ...
8
votes
2answers
604 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
