Tag Info

Hot answers tagged

49

Maybe commercial or free anti-malware installs backdoors Very true. Maybe they do. However – there are a lot of technically experienced individuals who are in a position to check, either through monitoring unexpected connections outbound, or through reviewing the code, so we can have reasonable assurance that they don't. But think about the ...


45

Most anti-virus vendors advise not to use their products together with those from others. That's not (just) because they fear competition. Live virus-scanners scan files on access. When they notice that a process accesses a file, they try to access it before the process to scan it. They even try to do that when that process is another virus-scanner. When ...


36

Antivirus detection is a feature extraction and a classification problem. A great analogy is the 20 questions game where the goal is to identify an arbitrary object by asking 20 seemingly unrelated yes/no questions. The idea behind the game is that each answer would eliminate half of the objects so it is theoretically possible to describe 2^20 (1,048,576) ...


34

I would advise against it. In order to perform its job, an antivirus software has to root itself very deeply inside the system, hooking everything, installing drivers and you-name-it. In order to do so, it ends up using techniques similar to malware authors, which will be flagged as highly suspicious by other products. Even if it's not the case, it is ...


26

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions. .pif is legacy from MS-DOS, like .com. It's ...


21

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not. A lot of methods have been used in the past. For instance, some rootkits install ...


21

There is no more reason to expect that these software could put in a back door than any other software. Your Internet browser could put in a back door, your word processor could, your computer hardware itself could. Fundamentally, you have to source your software and hardware from vendors you trust and you trust them based on either their reputation or the ...


17

Very easy. Didier Stevens has provided two open-source, Python-based scripts to perform PDF malware analysis. There are a few others that I will also highlight. The primary ones you want to run first are PDFiD (available another with Didier's other PDF Tools) and Pyew. Here is an article on how to run pdfid.py and see the expected results; Here is another ...


15

Regarding JavaScript: In Internet Explorer and some very old browsers, it's possible to inject JavaScript into stylesheets. Several ways to do this are described in the XSS Filter Evasion Cheat Sheet. The three major issues are: background-image and similiar: background-image: url('javascript:alert(/XSS/);') JavaScript expression: width: ...


15

Malware signatures are unique values that indicate the presence of malicious code. Simply speaking, When an anti-virus program scans your computer, it calculates the signature for a file (say like a hash), then compares that signature/hash to a list of known bad signatures. Calculating a single hash of a file and then comparing it against a list of millions ...


14

It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.


13

You cannot trust anybody; but you have to... for instance, when you buy some food, you trust whoever produced it for not having put poison in it. It would be certainly feasible; yet it happens rarely enough that you accept that risk, especially since the alternatives have their own costs and risks (hunting wild animals, foraging for berries, growing potatoes ...


12

It depends on how important the machine is. I know others say differently, but for my own machines, I always reinstall from scratch when I think something funny is going on. Given that AV scanners pick up only about 50% of malware on any given day (your stat may vary, but it's bad in any case), I'd be at least a little bit suspicious of removal tools too. ...


11

No, anti-malware packages will not detect every form of keylogger. They will detect known ones by hashing, and some may detect certain keylogger-like behaviour via heuristic analysis. However, I strongly advise you against this. First off, it's insulting to your employees. If I found out my employer was doing such a thing, I'd resign on the spot. Secondly, ...


10

Please look at these videos at securitytube http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be ...


10

False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations. It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons: There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size. Malware may ...


10

I've already answered this question a few times here. Have a look at this answer in particular: Virus scanner on server And in particular this part: The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. ...


9

Depending on what level you want to go to, the course Lenny Zeltser is doing at SANS is supposed to be very good. Wes Brown gives a good talk here. Paul Melson blogs about this kind of thing, and has a presentation up here. But check the laws in your area - some types of reverse engineering are illegal in some jurisdictions, even if it is just for your ...


9

Just came by this very recent blog post by Lenny Zeltser which is pretty much right on the money 6 Free Tools for analyzing Malicious PDF Files http://blog.zeltser.com/post/5360563894/tools-for-malicious-pdf-analysis The tools he mentions are: PDF Tools suite by Didier Stevens PDF Stream Dumper Jsunpack-n Peepdf Origami MalObjClass There are details ...


9

Hooks are implemented in a whole bunch of ways: Modifying legitimate jump instructions to point at hooks instead of the normal code. User call table (IAT) hooking - modifying the addresses of user-mode APIs in a process. Kernel call table hooking (e.g. SSDT / GDT ) - replacing a call table pointer with the address of your hook. WndProc hooks (e.g. ...


9

From the reviews I've seen of Windows 8 defender (which includes what was security essentials in Windows 7 and earlier), it's a pretty solid middle of the road A-V suite with some anti-spyware features. I don't think that it's as fully featured as the paid for security suites, but then it is free. From a personal perspective I use it as it seems fairly ...


8

You can always upload your PDF to wepawet :) http://wepawet.cs.ucsb.edu/


8

A quick analysis: Threat: Somebody creates a clean file that matches a malicious file's MD5 hash. Result: The clean file is identified as malicious, but is merely a collision. Another file that does match still exists and will always be identified as the same. I suppose if this happens, there might be some talk about moving on. My guesses as to why we ...


8

tl;dr - compare the results of two functions that do the same thing, and look for differences. Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved. Rootkits work by intercepting certain system calls and ...


8

This has been answered before on this site, in extensive detail. See these questions: What are the security risks of letting the users upload content to my site? Is it necessary to scan users' file uploads by antivirus? Antivirus for scanning anonymous file uploads What steps should be taken to validate user uploaded images within an application? What ...


8

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed. Note that this is very ...



Only top voted, non community-wiki answers of a minimum length are eligible