Tag Info

New answers tagged

0

I think the best and most common example of this is software that has malware (specifically spyware/adware) like practices but operates as a "legitimate" business (particularly if they can get this into some terms and conditions and/or rely on users not selecting options correctly or other dark-patterns e.g. "Tick here to confirm you don't want to not ...


3

Honestly, the core question is whether vibration of the phone will give an application/website significantly more authority than without the vibration. Now, obviously I lack any research into this specific issue, but we can note that applications do not use vibrations as a way to convene authority. If anything it would feel wrong for an application to ...


0

I agree with the others that this question is super broad, however I can offer the following: Some AV engines short-cut their scans and will only scan those that it sees as "executable" (or have just been renamed to be executable) for that platform. In this instance unless it's a known executable file extension it will probably be missed. APKs are just ZIP ...


20

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


3

Suppose a malicious web page pops up a fake system notification and vibrates at the same time. How confident would you be of telling the difference between a legitimate pop-up and a .png on the web page you're viewing. (Source) Personally I have not heard of any exploit related to HTML5 Vibrate API, but it could be used for evil goals as shown on ...


3

I don't think what you are experiencing is the result of malware; it looks like the legitimate effect of the end of support for Windows XP (which came out 15 years ago, so by all means it is an obsolete product). If you really want to continue using Windows XP you should install a third-party antivirus to replace MSE. Just be aware that you won't be ...


11

The main reason malware can't evade AV this way is because the on-access scanner will catch that. From the AV point of view, malware moving to different files is the same problem as new files being created during the scan. A very simple solution is for the AV to keep track of new files being created (which includes current files being renamed). This is done ...


10

"Hide and seek" scenario Some AV perform "linear search" scans whereas others do it randomly (e.g.: AVG). But hiding a virus with such a hide and seek strategy is not the best approach since it would bring too much complexity to its development. There are some categories of virus such as stealth (intercepting calls from the OS and returning bogus or invalid ...


3

This is entirely possible, although the virus would need to have some way of telling what the AV scanner is doing (since many run constantly, whether or not they're scanning). It'd be unreliable, especially in comparison to other techniques such as concealment of the executable. A rootkit can completely hide itself from the infected operating system - as ...


1

Well, let me try and explain it as neatly as possible. These 'signature' based and 'behavior' based scanning tend to be offered as antivirus features. Viruses have signatures like you have. Some tend to have static signatures while others tend to have polymorphic ones. Imagine you could change your signature and try and get away with it (from your bank or ...


0

Signature based virus detection succeeds only with old viruses because they did not exists in different variants as it occurs nowadays. The signature can be MD5/SHA1 hashes for example. See this post for more information: What patterns does a signature based anti-virus look for?. Whereas behavior based detection (called also heuristic based detection) ...


4

Signature-based AV compares hashes (signatures) of files on a system to a list of known malicious files. It also looks within files to find signatures of malicious code. Behavior-based AV watches processes for telltale signs of malware, which it compares to a list of known malicious behaviors. The reason many AV products are add behavior-based detection is ...


2

That's the effect of most antivirus vendors' "safe browsing" protection, which intercepts all HTTPS traffic (it should be technically a TLS intercept). They act as a "trusted" provider (in the case of HTTPS) and acting as a proxy intercept all browser requests - both HTTP and HTTPS, checking whether the visited websites serve any malicious content. I would ...


4

Check "Scan encrypted connections" option It seems Kaspersky does SSL interception (Man in the Middle). Kaspersky KB entry 6851: SSL connection scan by Kaspersky Anti-Virus version 6.0.4.x (Archived here.) I would appreciate if someone could explain this behavior Some clients may use certificate pinning. And those can not be easily ...


1

For an operating system-specific answer... On Linux: everything. Yes, even files ending in ".txt". Any file in Linux can have the executable bit set, and hence any file in Linux can act similarly to a .exe in Windows. Moreover, Linux (or at least some flavours) doesn't check file extensions when deciding what program to use for opening a file; instead, it ...


3

A few years ago people thought that jpegs were fine. Then there was an exploit for a jpeg library. You should be scanning everything. What might be safe today, won't necessarily be safe tomorrow. (In addition, keep your system up to date - this is much more important.)


8

Everything. You don't keep a dog and bark yourself; why install an AV software and second-guess what it should be doing? Sure, you can do a risk analysis against every individual file, but that sounds dull. Modern AV is fast, just scan everything. Let it worry about downloads.


1

As for test environments, there are several open source mechanisms that combine given mail server with one or many antivirus engines. You can analyze them and reimplement invoking each engine in your own environment to scan a file. As for test data, look at http://vxheaven.org/ website for samples. And yes, you should use virtual machines instead of ...


1

If I look at google for "application level antivirus" I only get to a site which looks like a scam site, i.e. full of references with logos similar to NASA, HP, Comodo etc which don't point to these sites but instead try to sell you something. If you mean the same site then I would recommend hands off.


1

Setting the TECHNIQUE option to PSH for Powershell appeared to solve my AV evasion problem. Anti-virus does not detect malicious Powershell code nearly as well (if at all) as executable code. Thanks to @Michael for his answer, although exploit/windows/local/ask appeared to overwrite the manually uploaded payload with whatever was set in FILENAME during my ...


8

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit ...



Top 50 recent answers are included