New answers tagged

0

Though it is over HTTP, and the ideal would be over HTTPS, any software providers communicate over HTTP and sign the communication. Let's take a step back and answer what SSL (and TLS) provides. Encryption of content Validation of non-tampering To prevent tampering, may software providers digitally sign the content with a certificate or a GPG key and ...


0

In reference to your second question, it depends on the skill level of the attacker. If someone were able to monitor your traffic and potentially has a file on your computer, then they'd be able to do things like man in the middle attacks. There are several ways to bypass AV, and I wouldn't put full faith in any one software.


0

Antivirus software should be one layer among many in your computer defense kit. You will want to search out reviews and keep an eye out for the following criteria: Cost (fixed vs subscription) How many devices can yo install it on for that cost? Does it work on all of your devices? (Laptop, desktop, Apple, tablet, phone, etc...) Current reputation of the ...


3

The best numbers I've found so far are in the Microsoft Security Essential Report 19 where they show at page 89 that with full real-time protection the infection rate is still at about 2..5%. Then there are numbers from the Cicso Annual Security Report 2016 where they claim a time to detection at about 20 hours, but adware and browser injections are at ...


2

A quarantine is a place for you to review files that caused alerts. It's not about security, but convenience.


1

I do believe this question is related to http://reverseengineering.stackexchange.com/ rather than security forum. This is an extremely indepth sort of question to answer. For example, what is this application? Native or byte-code language e.g. Java, .NET etc. So, I'll make some assumptions that it's an x86 executable. You'll want to download: Process ...


1

For the purposes of this answer, I'm assuming you're doing a legal, permissible testing regimen for your own personal development or a client. Veil-Evasion is your friend here. I've had luck with the Python Shellcode-inject option (#38) and using the Pwnstaller, an obfuscated Python installer. I've noticed that some AVs notice the Python installer and ...


1

Check on another device to see if the same behaviour occurs. I don't believe removal of malware is the scope of this forum. However, I'd recommend you do an virus scan, check your BHOs and Addins on your browser.


0

Signatures are generally non-interoperable. There is some licensing going on, but generally, I'd say AV-vendors all have their own engines, and these engines may not be even able to understand the signatures/rulesets of other engines. Having people on staff (maybe even around the clock) that can extract useful signatures from a set/family of malware is ...


1

Some av vendors reuse the signatures of anothers. For example Kaspersky Lab have inserted into its bases the signatures for some non-malicious files to detect the reuse and after some time they observed them detected by some another's companies' avs as malicious.


3

Yes, signatures vary as they are developed by the antivirus vendors independently of one another. One vendor's product may catch malware that another misses, or get a false positive that another would not find. You may end up with multiple vendors having identical signatures for the same piece of malware because of malware's traits have few, or one ...


2

Secure Boot consists of several components working together ( https://technet.microsoft.com/en-us/windows/dn168167.aspx was my source for how the different components work). Because it works vertically (from the bootloader up) the security of the kernel-mode protection the requires that the lower levels work flawlessly. Secure Boot When the PC is ...



Top 50 recent answers are included