Hot answers tagged

76

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


28

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


15

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


11

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


6

This is a useless question but still interesting one :) and that is not audio jack He is a security freak like me, not real freak but there are some people who really care for their device security and of course a CEO will have some serious data inside his laptop, I am sure you understand that covering mic and cam is so that even an un-authorised access ...


4

Normally, facebook will not email you directly even in the event of a hack. What has most likely occurred, is someone obtained your facebook account primary email, which is easy for a determined attacker, then created a fake email (they could use hyperlink forging websites to make a link such as "security.facebook@facebook.com" or something similar) then ...


3

Attackers are not interested in her, but rather those associated with her. It could be YOU that is the target, and she is solely being used to get to you. This is how impersonation works on the social engineering level. When I perform social engineering during penetration testing, I impersonate someone with the most solid connections to my target. For ...


2

Facebook isn't a desktop application which stores log files on your computer like Skype would, but rather a web server application which has its own log files no one can have access to without getting in the web server. The only two things you could possibly do are: (Legal) File a complaint to the police, if it's a legal matter, for them to ask Facebook ...


2

If it is your personal WiFi (Verizon jetpack) and you are running WPA2 from your tablet to your Jetpack ... while it is possible for them to run a WiFi sniffer and/or a MitM proxy ... it is very unlikely. Like coffeethulhu said SSL/TLS can be can be intercepted and decrypted IF your company controls the network access you are using for your chat (its ...


1

Depends on the level of packet capture they are doing. If they are doing full packet capture with ssl/tls interception then yes. You don't have to be the NSA to do this kind of interception but it is not something that most businesses will want to pay for.


1

One of the points of social media login is to avoid password entry by resuing your existing loggged-in state with the social media. If you have not already logged in to the social media site in your browser, simply do that over mobile connection and then connect to this wifi. Some social media may want to verify your password before you can approve an ...



Only top voted, non community-wiki answers of a minimum length are eligible