Tag Info

New answers tagged

0

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


3

Mints97's answer is great, but I think there may be more to it than that. An especially wonderful (read: terrible) problem with Windows is that it supports complete Unicode character set in filenames, including (and this is the worst), U-202E. While I am sure it has some good innocuous uses, but it can allow people to maliciously change the filename in a ...


0

There was a widely publicized exploit a few years ago, which used a bug in a particular, widely distributed jpeg library. The net effect of this exploit was to allow executing arbitrary code on the victims machine, when nominally all they were doing was trying to view an image. Also, for example, there was an exploit for rich text files (rtf format) which ...


0

I remember back in the good old days when viewing or loading a .ico file with the api's that shipped with windows used to allow for direct code execution if crafted maliciously enough. And the entire concept behind the wmf file format was calling graphics routines directly . ( hence the creation of the device independent bitmap format, aka .bmp files ) So ...


0

Well you start up with analyzing the file format. And then take a while guess on how different software will react. For example JPEG - http://en.wikipedia.org/wiki/JPEG - uses special markers to delimit the start and end of image. Now one would bet that software that deals with JPEG will only look for the start and end of image markers and plot everything ...


29

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions. .pif is legacy from MS-DOS, like .com. It's ...


1

They do, you can lookup Metamorphic code(http://en.wikipedia.org/wiki/Metamorphic_code) and Polymorphic code(http://en.wikipedia.org/wiki/Polymorphic_code). They are techniques to make malware harder to detect by changing the code each time it's executed. Most AV-products rely on hashes, the other way to detect malware is by using heuristic scanning where ...


1

File hashes are by far not the most helpful method of detecting malware (unlike a couple of decades ago). Today, malware recognition (and sometimes classification) is heavily based on real-time heuristical analysis of its operations. This analysis deals with lots of data, which mostly consists of the system calls performed by the application, and their ...


2

You wrote, "The image file format was pif", but the article states "FireEye researchers found a collection of chats and documents while researching malware hidden in PDF documents." The program information file format was used on Microsoft Windows systems, though files in that format are rarer now than they once were. There were vulnerabilities associated ...


2

My answer assumes you are asking this for a production system, and that you aren't asking this because you are starting to learn to be an anti-virus researcher. Can you do it? Yes, as other answers have stated there are many databases which list hashes, or can ID a threat by a hash. but should that be your only line of defence? However, there is a ...


2

Do a quick search on google and you find a lot of databases. OWASP offers one with a pretty easy interface: OWASP File Hash Repository. Simply send a DNS query with the Hash in MD5 oder SHA-1 prepended to hash.sapao.net (see "Testing the system"). If you want to run a large number of queries, I suggest you make a copy of their freely available Amazon AWS ...


1

You can submit the hash to VirusTotal by selecting 'Search' and entering the hash. VirusTotal will return the status if it's seen the file before -- if it hasn't, you may be out of luck.


9

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed. Note that this is very ...


0

I'm going to throw a piece of paranoia in here ( simply because of stuff I have been doing recently on console hardware ), while direct executable content is definitely making life very easy for a attacker it's not the only vector , all it takes is one mis checked buffer in a games data file and all of a sudden you have the potential to smash through the ...


1

There are different kinds of mods. Mods which add or replace game content files like images, models or maps. These should usually be harmless, unless they exploit a bug in the game engine which handles these assets. Mods which add game logic in form of scripts. Many games have a scripting engine which allows mods to perform limited programmed logic. ...


4

Mods certainly can be used as infection vectors. A lot of it comes down to a question of trust. A mod with tens of thousands of downloads and nobody suggesting they've had any problems is likely to be OK (though still no guarantee!). In an ideal world: Wherever possible, avoid mods that have an installer. There are some situations that this can't be ...



Top 50 recent answers are included