New answers tagged

0

Going back to a security in layers approach, there is no one magic bullet. Good detection / protection involves the use of multiple systems working together. For Detection: Start with good AV software (av-comparitives.org) and then add end-point protection (e.g., Carbon Black, Sophos, F-Secure...) top it off with some network monitoring (e.g., Splunk, BTB'...


2

This is not Javascript breaking out of a browser's vm/sandbox but rather an executable that runs with full local user privileges that happened to be written in Javascript... There's nothing to harden as local Javascript app platforms like NW.js are designed to allow exactly that and like all other platform/frameworks they can be used for good as well as for ...


3

The most important thing to consider here is that this type of JavaScript malware does not run in a browser. It runs in a special runtime called NW.js which gives powerful NodeJS API's not found in a browser. While NW.js shares many technologies with the Chromium browser, it is not a browser but a type of native wrapper for making desktop apps, and this ...


5

Right, when you're dealing with devious malware, it's very hard to determine whether you've completely removed it. Rootkits are pieces of malware that change core OS components (either on disk or in memory) to make normal OS functions return false data to hide the malware and/or its effects. Malware can conceivably modify the boot process to essentially ...


0

I have done in in a big security product. With VAD walking in kernel mode but also with the help of a feature to detect remote thread. First you detect remote thread to get the memory location. The injected thread will mostly have a start address that is not in any modules loaded by the application. This is not suppose to happen, after that you can go ...



Top 50 recent answers are included