Tag Info

New answers tagged

0

HTML and JavaScript, when employed in specific ways, can be used to o wn your system, even your home router. The attack vectors against a web browser involve things like: malicious plugin files (mainly Flash, Silverlight) that exploit vulnerabilities in the plugin (Flash Player, Silverlight Player) JavaScript that exploits vulnerabilities in the browser's ...


1

"My question is, aren't these companies in a position to benefit or monetize their user's definitive clickstreams?" > Yes, they are. And, if I were you, I would not only look at my anti-virus software, but also directly to my browser which, depending on your provider, will most likely send the very same URLs to either Microsoft or Google services (Google is ...


0

That approach could somehow open another attack vector. If you can run the malicious code without being on disk first, run it from a removable media (where the infected code already exists and therefore wouldnt be checked) or run an apparently harmful file. In order to propagate the virus would just need to create an empty file and than after update it with ...


1

There are two ways in which these lookups may be ~safe for your privacy. First, these lookups should be encrypted via SSL. Assuming a good SSL implementation (i.e. assuming nothing like Heartbleed) and a client that quickly revokes rogue certs, this means that third parties cannot directly see your data, so you merely have to trust the lookup server. ...


9

No, scanning for viruses only at creation time is not secure for several reasons: Anti-virus heuristics and signatures update continuously, so something could be missed upon creation but would be caught at execution time. The anti-virus system might not be loaded when the file is created: Perhaps A/V was temporarily disabled for some reason Perhaps it is ...


1

You would still have to scan during reads whenever the source is untrusted - removable storage, network drives, etc. In principle if you always scanned files on creation/modification, then it would be safe to read local files without scanning. I don't know of any desktop AV software that has that behaviour though. It would be a performance improvement, not ...


0

Yes, that would be very secure. It will still let some bad stuff through, since it is still signature-based, but the bigger concern is that it would bring any system to its knees. For my job I analyze forensics for infected computers, and am in and out of the MFT and USN Journal a LOT. Files and mutexes are being created, altered, and deleted constantly ...


2

Different antivirus software packages have different detection capabilities and mechanisms. Virtually all support what is called a signature-based mechanism, where a particular series of bytes serves as a fingerprint that triggers a positive detection. It's important to understand this use of the word "signature" is completely different than a digital ...


0

Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? Not unless you include exotics. The problem boils down to if a product supports engines effectively scanning the target from the perspective of the intended environment. All malware we scan for exhibits some structure compatible with a ...


0

In short no, it does not matter for most cases, including unencrypted archives. Malware detectors snipe signatures, which are basically chunks of data. Unless the platform doesn't malform the data, you should be ok. That being said, theoretically, you may run into trouble with endianness if the AV doesn't interpret the data correctly. But in most cases the ...


0

Comment to @user54791 and @iszi's comment: Avast shields untrusted certificates with a certificate issued by a different issuer, called "avast! Web/Mail Shield Untrusted Root". As long as this issuer stays untrusted, there is still a security warning when a HTTPS connection with an untrusted certificate is accessed. So there is no need to disable HTTPS ...


1

This is happening because as others described, the Mail/Web shield needs to be able to scan your web traffic before it is saved on your system / does any harm. Scanning encrypted SSL/TLS sockets requires that Avast can decrypt the connection. There is no other way for Avast to decrypt the connection than to generate its own certificate with a known derived ...


13

Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by encrypting the payload against a value that could only be derived by a valid target system - it didn't appear to do anything particularly malicious outside of that ...


10

Yes, consistently. Viruses must be used and found before a definition is created. APT (Advanced Persistent Threats) are a huge deal in recent times where people will spend years developing viruses, called 0 day threats, for specific targets that will remain undetected for very long periods of time. Viruses like these are usually a product of nation states as ...


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


0

It's entirely possible. There are a lot of examples of this, especially something like Stuxnet which was allegedly found in the wild in 2005 and disregarded but was found in 2010. Some earlier antiviruses would go by signatures and allow things like polymorphic viruses. This isn't as common lately, as heuristics and other technology has developed. All in ...


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...


4

Obviously it can remain undetected for a long time, as there are several famous cases of malware having multi-year lifetimes. The key is stealth. The wider the malware is spread, the greater the odds it will be discovered. The more damage the malware causes, the faster the victim will look to fix it. The most successful malware refuses to spread to ...



Top 50 recent answers are included