Tag Info

New answers tagged

0

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


0

It's entirely possible. There are a lot of examples of this, especially something like Stuxnet which was allegedly found in the wild in 2005 and disregarded but was found in 2010. Some earlier antiviruses would go by signatures and allow things like polymorphic viruses. This isn't as common lately, as heuristics and other technology has developed. All in ...


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...


4

Obviously it can remain undetected for a long time, as there are several famous cases of malware having multi-year lifetimes. The key is stealth. The wider the malware is spread, the greater the odds it will be discovered. The more damage the malware causes, the faster the victim will look to fix it. The most successful malware refuses to spread to ...


1

Most common vectors: Drive by download - Download is forced on to your computer, and you may either be forced or tempted to execute a malicious file. You are just browsing and all of a sudden you get freebooks.pdf.dll, or worse a browser/OS flaw lets the download happen without you seeing it. Malicious advertisement with malicious javascript - Malicious ...


1

They do, you can lookup Metamorphic code(http://en.wikipedia.org/wiki/Metamorphic_code) and Polymorphic code(http://en.wikipedia.org/wiki/Polymorphic_code). They are techniques to make malware harder to detect by changing the code each time it's executed. Most AV-products rely on hashes, the other way to detect malware is by using heuristic scanning where ...


1

File hashes are by far not the most helpful method of detecting malware (unlike a couple of decades ago). Today, malware recognition (and sometimes classification) is heavily based on real-time heuristical analysis of its operations. This analysis deals with lots of data, which mostly consists of the system calls performed by the application, and their ...


2

My answer assumes you are asking this for a production system, and that you aren't asking this because you are starting to learn to be an anti-virus researcher. Can you do it? Yes, as other answers have stated there are many databases which list hashes, or can ID a threat by a hash. but should that be your only line of defence? However, there is a ...


2

Do a quick search on google and you find a lot of databases. OWASP offers one with a pretty easy interface: OWASP File Hash Repository. Simply send a DNS query with the Hash in MD5 oder SHA-1 prepended to hash.sapao.net (see "Testing the system"). If you want to run a large number of queries, I suggest you make a copy of their freely available Amazon AWS ...


1

You can submit the hash to VirusTotal by selecting 'Search' and entering the hash. VirusTotal will return the status if it's seen the file before -- if it hasn't, you may be out of luck.


0

I'm going to throw a piece of paranoia in here ( simply because of stuff I have been doing recently on console hardware ), while direct executable content is definitely making life very easy for a attacker it's not the only vector , all it takes is one mis checked buffer in a games data file and all of a sudden you have the potential to smash through the ...


1

There are different kinds of mods. Mods which add or replace game content files like images, models or maps. These should usually be harmless, unless they exploit a bug in the game engine which handles these assets. Mods which add game logic in form of scripts. Many games have a scripting engine which allows mods to perform limited programmed logic. ...


4

Mods certainly can be used as infection vectors. A lot of it comes down to a question of trust. A mod with tens of thousands of downloads and nobody suggesting they've had any problems is likely to be OK (though still no guarantee!). In an ideal world: Wherever possible, avoid mods that have an installer. There are some situations that this can't be ...


0

Your question potentially applies to many different situations so it is difficult to answer it definitively. Ideally, you should make your question more specific. As a general rule, file scan signatures target whatever the deployed package is. So, it does not matter whether it is an RPM or EXE or what. Whatever form the malware is deployed in, will be ...


0

I'll do my best to deal with your first question, since people mainly discussed the second and third ones you asked--and respectfully those are simple matters of fact, and subordinate logic. Yes you can get malware/viruses (it is increasingly common, much more than Apple wants to admit), and therefore yes you want to protect yourself from that stuff. ...


2

It might depend on your definition of "thin client". The thin clients I know download just enough from the server to do their job, and that includes things like programs. As such, they will download the installed AV package from the server. In this way, the thin client itself doesn't need one, because it "borrows" it from the server. If the server that ...


0

I presume these are x86 clients that are loading OS from the network? Do these folks have internet access? If so, it seems there is still an attack vector -- If my memory serves, at least one variant of the cryptolocker type malware attempts encryption of every .doc,spreadsheet, photo, or other user data file (including those found on network shares) it ...



Top 50 recent answers are included