Tag Info

New answers tagged

-1

I'm not a malware expert, but I know that blackhats tends to use a small spoofing technique by calling their malware a name that is used by the system, in order to not raise the user's attention. Also, all anti-viruses can be bypassed by performing different encoding methods that makes the malware undetectable. But of course, Anti-viruses companies are doing ...


1

Just like anti-virus identifies malware on your local machine - by checking for virus signatures. Although executable code cannot normally be ran through your web browser automatically, if there is a flaw in the browser or in a plugin such as Flash or Java, then the web page can exploit this to trigger a "drive by download". On example is this heap ...


0

HTML and JavaScript, when employed in specific ways, can be used to o wn your system, even your home router. The attack vectors against a web browser involve things like: malicious plugin files (mainly Flash, Silverlight) that exploit vulnerabilities in the plugin (Flash Player, Silverlight Player) JavaScript that exploits vulnerabilities in the browser's ...


1

"My question is, aren't these companies in a position to benefit or monetize their user's definitive clickstreams?" > Yes, they are. And, if I were you, I would not only look at my anti-virus software, but also directly to my browser which, depending on your provider, will most likely send the very same URLs to either Microsoft or Google services (Google is ...


0

That approach could somehow open another attack vector. If you can run the malicious code without being on disk first, run it from a removable media (where the infected code already exists and therefore wouldnt be checked) or run an apparently harmful file. In order to propagate the virus would just need to create an empty file and than after update it with ...


1

There are two ways in which these lookups may be ~safe for your privacy. First, these lookups should be encrypted via SSL. Assuming a good SSL implementation (i.e. assuming nothing like Heartbleed) and a client that quickly revokes rogue certs, this means that third parties cannot directly see your data, so you merely have to trust the lookup server. ...


9

No, scanning for viruses only at creation time is not secure for several reasons: Anti-virus heuristics and signatures update continuously, so something could be missed upon creation but would be caught at execution time. The anti-virus system might not be loaded when the file is created: Perhaps A/V was temporarily disabled for some reason Perhaps it is ...


1

You would still have to scan during reads whenever the source is untrusted - removable storage, network drives, etc. In principle if you always scanned files on creation/modification, then it would be safe to read local files without scanning. I don't know of any desktop AV software that has that behaviour though. It would be a performance improvement, not ...


0

Yes, that would be very secure. It will still let some bad stuff through, since it is still signature-based, but the bigger concern is that it would bring any system to its knees. For my job I analyze forensics for infected computers, and am in and out of the MFT and USN Journal a LOT. Files and mutexes are being created, altered, and deleted constantly ...


2

Different antivirus software packages have different detection capabilities and mechanisms. Virtually all support what is called a signature-based mechanism, where a particular series of bytes serves as a fingerprint that triggers a positive detection. It's important to understand this use of the word "signature" is completely different than a digital ...


0

Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? Not unless you include exotics. The problem boils down to if a product supports engines effectively scanning the target from the perspective of the intended environment. All malware we scan for exhibits some structure compatible with a ...


0

In short no, it does not matter for most cases, including unencrypted archives. Malware detectors snipe signatures, which are basically chunks of data. Unless the platform doesn't malform the data, you should be ok. That being said, theoretically, you may run into trouble with endianness if the AV doesn't interpret the data correctly. But in most cases the ...



Top 50 recent answers are included