Tag Info

Hot answers tagged

49

Maybe commercial or free anti-malware installs backdoors Very true. Maybe they do. However – there are a lot of technically experienced individuals who are in a position to check, either through monitoring unexpected connections outbound, or through reviewing the code, so we can have reasonable assurance that they don't. But think about the ...


44

Most anti-virus vendors advise not to use their products together with those from others. That's not (just) because they fear competition. Live virus-scanners scan files on access. When they notice that a process accesses a file, they try to access it before the process to scan it. They even try to do that when that process is another virus-scanner. When ...


35

Antivirus detection is a feature extraction and a classification problem. A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...


34

I would advise against it. In order to perform its job, an antivirus software has to root itself very deeply inside the system, hooking everything, installing drivers and you-name-it. In order to do so, it ends up using techniques similar to malware authors, which will be flagged as highly suspicious by other products. Even if it's not the case, it is ...


21

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not. A lot of methods have been used in the past. For instance, some rootkits install ...


21

There is no more reason to expect that these software could put in a back door than any other software. Your Internet browser could put in a back door, your word processor could, your computer hardware itself could. Fundamentally, you have to source your software and hardware from vendors you trust and you trust them based on either their reputation or the ...


16

Very easy. Didier Stevens has provided two open-source, Python-based scripts to perform PDF malware analysis. There are a few others that I will also highlight. The primary ones you want to run first are PDFiD (available another with Didier's other PDF Tools) and Pyew. Here is an article on how to run pdfid.py and see the expected results; Here is another ...


15

Malware signatures are unique values that indicate the presence of malicious code. Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures. Calculating a single hash of a file and then comparing it against a list of millions ...


13

Regarding JavaScript: In Internet Explorer and some very old browsers, it's possible to inject JavaScript into stylesheets. Several ways to do this are described in the XSS Filter Evasion Cheat Sheet. The three major issues are: background-image and similiar: background-image: url('javascript:alert(/XSS/);') JavaScript expression: width: ...


12

It depends on how important the machine is. I know others say differently, but for my own machines, I always reinstall from scratch when I think something funny is going on. Given that AV scanners pick up only about 50% of malware on any given day (your stat may vary, but it's bad in any case), I'd be at least a little bit suspicious of removal tools too. ...


11

It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.


11

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis. However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...


11

You cannot trust anybody; but you have to... for instance, when you buy some food, you trust whoever produced it for not having put poison in it. It would be certainly feasible; yet it happens rarely enough that you accept that risk, especially since the alternatives have their own costs and risks (hunting wild animals, foraging for berries, growing potatoes ...


10

Please look at these videos at securitytube http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be ...


10

False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations. It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons: There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size. Malware may ...


10

I've already answered this question a few times here. Have a look at this answer in particular: Virus scanner on server And in particular this part: The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. ...


9

Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good. Wes Brown gives a good talk here. Paul Melson blogs about this kind of thing, and has a presentation up here. But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your ...


9

Hooks are implemented in a whole bunch of ways: Modifying legitimate jump instructions to point at hooks instead of the normal code. User call table (IAT) hooking - modifying the addresses of user-mode APIs in a process. Kernel call table hooking (e.g. SSDT / GDT ) - replacing a call table pointer with the address of your hook. WndProc hooks (e.g. ...


9

From the reviews I've seen of Windows 8 defender (which includes what was security essentials in Windows 7 and earlier), it's a pretty solid middle of the road A-V suite with some anti-spyware features. I don't think that it's as fully featured as the paid for security suites, but then it is free. From a personal perspective I use it as it seems fairly ...


8

You can always upload your PDF to wepawet :) http://wepawet.cs.ucsb.edu/


8

A quick analysis: Threat: Somebody creates a clean file that matches a malicious file's MD5 hash. Result: The clean file is identified as malicious, but is merely a collision. Another file that does match still exists and will always be identified as the same. I suppose if this happens, there might be some talk about moving on. My guesses as to why we ...


8

tl;dr - compare the results of two functions that do the same thing, and look for differences. Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved. Rootkits work by intercepting certain system calls and ...


8

Just came by this very recent blog post by Lenny Zeltser which is pretty much right on the money 6 Free Tools for analyzing Malicious PDF Files http://blog.zeltser.com/post/5360563894/tools-for-malicious-pdf-analysis The tools he mentions are: PDF Tools suite by Didier Stevens PDF Stream Dumper Jsunpack-n Peepdf Origami MalObjClass There are details ...


7

Heuristic are: learning techniques common sense discoveries Their objective is to recognise a virus by analysing its code (not limited to). If a program is programmed to open a certain file, or to load/read certain memory address. These methods are based on multiple criteria. They eventually can run program in virtual environment to monitor for known ...


7

The sad truth is that tightening your network will make you unpopular at your workplace. That said, many sys-admins would rather be unpopular knowing they have a safe(r) network than popular and spending all their time cleaning malware. Some cheap and effective ways to eradicate malware take away local admin, like you're planning to do (I can't stress ...


7

Introduction to Reverse Engineering Software - covers reverse engineering on both Linux and Windows. Haven't read it all the way through yet but seems to have some good coverage. Malware Analysis and Antivirus Technologies is a course being at Aalto University in Helsinki. They have the Chief Research Officer from f-secure giving some lectures. The first ...



Only top voted, non community-wiki answers of a minimum length are eligible