Tag Info

Hot answers tagged

44

Most anti-virus vendors advise not to use their products together with those from others. That's not (just) because they fear competition. Live virus-scanners scan files on access. When they notice that a process accesses a file, they try to access it before the process to scan it. They even try to do that when that process is another virus-scanner. When ...


34

I would advise against it. In order to perform its job, an antivirus software has to root itself very deeply inside the system, hooking everything, installing drivers and you-name-it. In order to do so, it ends up using techniques similar to malware authors, which will be flagged as highly suspicious by other products. Even if it's not the case, it is ...


32

Antivirus detection is a feature extraction and a classification problem. A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...


21

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not. A lot of methods have been used in the past. For instance, some rootkits install ...


15

Very easy. Didier Stevens has provided two open-source, Python-based scripts to perform PDF malware analysis. There are a few others that I will also highlight. The primary ones you want to run first are PDFiD (available another with Didier's other PDF Tools) and Pyew. Here is an article on how to run pdfid.py and see the expected results; Here is another ...


14

Malware signatures are unique values that indicate the presence of malicious code. Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures. Calculating a single hash of a file and then comparing it against a list of millions ...


13

Regarding JavaScript: In Internet Explorer and some very old browsers, it's possible to inject JavaScript into stylesheets. Several ways to do this are described in the XSS Filter Evasion Cheat Sheet. The three major issues are: background-image and similiar: background-image: url('javascript:alert(/XSS/);') JavaScript expression: width: ...


12

It depends on how important the machine is. I know others say differently, but for my own machines, I always reinstall from scratch when I think something funny is going on. Given that AV scanners pick up only about 50% of malware on any given day (your stat may vary, but it's bad in any case), I'd be at least a little bit suspicious of removal tools too. ...


11

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis. However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...


10

False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations. It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons: There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size. Malware may ...


9

Please look at these videos at securitytube http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be ...


9

From the reviews I've seen of Windows 8 defender (which includes what was security essentials in Windows 7 and earlier), it's a pretty solid middle of the road A-V suite with some anti-spyware features. I don't think that it's as fully featured as the paid for security suites, but then it is free. From a personal perspective I use it as it seems fairly ...


8

Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good. Wes Brown gives a good talk here. Paul Melson blogs about this kind of thing, and has a presentation up here. But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your ...


8

A quick analysis: Threat: Somebody creates a clean file that matches a malicious file's MD5 hash. Result: The clean file is identified as malicious, but is merely a collision. Another file that does match still exists and will always be identified as the same. I suppose if this happens, there might be some talk about moving on. My guesses as to why we ...


8

Hooks are implemented in a whole bunch of ways: Modifying legitimate jump instructions to point at hooks instead of the normal code. User call table (IAT) hooking - modifying the addresses of user-mode APIs in a process. Kernel call table hooking (e.g. SSDT / GDT ) - replacing a call table pointer with the address of your hook. WndProc hooks (e.g. ...


8

tl;dr - compare the results of two functions that do the same thing, and look for differences. Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved. Rootkits work by intercepting certain system calls and ...


7

Just came by this very recent blog post by Lenny Zeltser which is pretty much right on the money 6 Free Tools for analyzing Malicious PDF Files http://blog.zeltser.com/post/5360563894/tools-for-malicious-pdf-analysis The tools he mentions are: PDF Tools suite by Didier Stevens PDF Stream Dumper Jsunpack-n Peepdf Origami MalObjClass There are details ...


7

Heuristic are: learning techniques common sense discoveries Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address. These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known ...


7

If your adversary has access to U and is able to modify that .mov file, and if you're expecting an imminent threat coming from U, then there's no safe way to copy that file and run it on T. An active persistent threat will find/pay for zero-day exploits and craft a version of the .mov file that will exploit a vulnerability in your media player, media ...


7

No. In theory, two antiviruses are better than one, in that there may be viruses in the database of one that aren't in the database of the other, or one may use scanning techniques that the other doesn't. In practice, however, because of the way they work, antivirus programs tend to detect each other as viruses.


6

It was lost when someone like your mom could lose her identity and payment cards to fraud. I would say that, no, anti-virus and anti-malware have been very ineffective since the Windows buffer overflow in 1999. In 2010, they are adding fuel to the fire and make systems more insecure, and not just because they provide a false sense of security. They are ...


6

There are a gazillion independent organizations and people that publish information on computer security. The problem is not finding them; the problem is keeping track of all of these sources of information. Two example starting places include Bruce Schneier's blog and Krebs on Security. If you think that all computer security research comes from ...


6

If you follow Full Disclosure (http://seclists.org/fulldisclosure/) and bugtraq (http://www.securityfocus.com/archive/1) mailing lists you can see that there are lots of security research by individuals or non-commercial entities. You should join full disclosure and bugtraq mailing lists and also follow exploits and papers published by ...


6

Trusted Execution Technology is coupled with a collection of security features available on the modern Intel chipset. The Trusted Platform Module (TPM) and other DRM like features are also in this bundle. The reasoning behind this is because of abstraction, which is more commonly attributed to a software architecture. The commonality behind all of these ...


6

First of all 'meterpreter' is not malware. I gather you mean how to detectet open meterpreter sessions between a compromised machine and the attacker. Most antivirus can detect meterpreter payloads in memory - they are public, and thats why metasploit has special polymorphic engines to try to hide the payloads. A nice factoid: Commercial tools like canvas ...


6

Introduction to Reverse Engineering Software - covers reverse engineering on both Linux and Windows. Haven't read it all the way through yet but seems to have some good coverage. Malware Analysis and Antivirus Technologies is a course being at Aalto University in Helsinki. They have the Chief Research Officer from f-secure giving some lectures. The first ...



Only top voted, non community-wiki answers of a minimum length are eligible