Tag Info

Hot answers tagged

20

I think it's generally popular sites, not just porn sites. However there might be some reasons why pornsites tend to attract more malware. Mostly malware originates from dodgy advertisement platforms. Because the morality of porn is often debated and not accepted in every culture, a lot of larger advertisement websites, such as Google Ads, do not allow ...


8

Everything. You don't keep a dog and bark yourself; why install an AV software and second-guess what it should be doing? Sure, you can do a risk analysis against every individual file, but that sounds dull. Modern AV is fast, just scan everything. Let it worry about downloads.


6

While in theory a malware infection could do this as part of it's payload, it's much more likely to be a buggy program that is writing too many log files. Malware tends to attack the disk by either deleting or encrypting existing files. As a start, empty the temp folder and watch it to see exactly what files are being written. Note that lots of things are ...


5

Some Tor exit nodes are known to be hostile, typically injecting advertising Javascript into any unencrypted web page that passes through them. There's no reason such nodes can't inject attack Javascript or other malware. Barring a security flaw in the Tor software itself, an entry or relay node cannot attack your computer (other than trivial attacks such ...


4

Infection is not the likely intrusion vector: it was likely that the account was compromised. The user's passwords should be changed right away and the account inspected to see if other accounts have been linked, etc.


3

A few years ago people thought that jpegs were fine. Then there was an exploit for a jpeg library. You should be scanning everything. What might be safe today, won't necessarily be safe tomorrow. (In addition, keep your system up to date - this is much more important.)


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Generally speaking, you are correct. Let's look at some exceptions: If the malware exploits a vulnerability in your email program. If the malware exploits a vulnerability in the software used to "unzip" it. If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer). If the malware exploits a vulnerability in the ...


3

Generally, most drive by browsing attacks are through browser vulnerabilities, which redirect you etc., but some are through PDF render engines, or in fact any input or display functionality. These do not have to be zero-days. Many browsers have vulnerabilities - some that have been known for years and have fixes out.


3

There's a longstanding issue (feature?) with IE doing Content Sniffing instead of just respecting Content-Type; this still exists largely for historical reasons. You do have the ability to disable it - MIME Type Detection references the Feature Controls - if you want to make your machine(s) more secure. It is still marginally useful since a common 'fix' ...


3

It's a myth that porn sites are more risky to use than other websites when it comes to malware. This report published by Symantec in 2011 (PDF, see page 33) identified that you can get malware from pretty much any kind of website, even those which can be work-related for many professions. In fact, porn sites ranked lower than many other categories of ...


2

Your logs can help you determine when, what and where. If you're using Apache and a version of Unix (BSD/Linux/etc), I would start with the following: tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 404 > 05-27-2013-404s.txt tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 403 > ...


2

By itself, Clamav is not on par with the best commercial alternatives. For best results use multiple detection engines well rated in comparative reviews. Engines with the highest detection rate generally suffer from more false positives, so consider quarantining inconsistent results for later manual checks. Also available are automated sandbox analysis tools ...


2

Yes. Just having a file on your hard drive does nothing. However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens ...


2

Potentially yes. Examples: You download a picture. While you never open the picture, the OS may generate thumbnails for it. If there's a bug (vulnerability) in the thumbnail generator, it may result in code execution. You download a document. While you never open the document yourself, the Search Indexer reads the file to speed up finding documents. If ...


2

Different antivirus software packages have different detection capabilities and mechanisms. Virtually all support what is called a signature-based mechanism, where a particular series of bytes serves as a fingerprint that triggers a positive detection. It's important to understand this use of the word "signature" is completely different than a digital ...


1

For an operating system-specific answer... On Linux: everything. Yes, even files ending in ".txt". Any file in Linux can have the executable bit set, and hence any file in Linux can act similarly to a .exe in Windows. Moreover, Linux (or at least some flavours) doesn't check file extensions when deciding what program to use for opening a file; instead, it ...


1

Drive by exploits are a result of targeting vulnerabilities in a particular web browser. A web browser is a large piece of software with the potential for many bugs. PDF rendering, flash players, Javascript engines are all complex and have a long history of vulnerabilities. A good mitigation is definitely keeping your browser up-to-date. A zero-day exploit ...


1

How is it possible to use an incorrect type and still get the file loaded by the user? If it were the browser loading it, it would indeed get handled as a GIF, and fail, in general. (There are content-sniffing problems in web browsers, but not ones that would trigger here.) However, when you instantiate an applet with the <applet src>/<object ...


1

Ultimately, a batch file can write another file and execute it. Batch files can write ASCII characters fine, but other byte values can be more tricky. There are ways to do it, e.g. that which is shown in this answer. On this page a much more thorough bootstrapping method is explained. On recent Windows, it would be simpler to produce a VBScript file and run ...


1

Once a machine has been compromised it can not be rescued with a virus scanner, the only secure way to fix this is nuke it from orbit and restore it from backup.


1

There's no mechanism within Windows batch file scripting to download files. You could use VBScript instead, though. An alternative is to set up a network share on the same network as the target and copy a file across from there. This is a technique often used in penetration tests to gain further access to a network you've already got basic access to. As ...



Only top voted, non community-wiki answers of a minimum length are eligible