Tag Info

Hot answers tagged

19

I think it's generally popular sites, not just porn sites. However there might be some reasons why pornsites tend to attract more malware. Mostly malware originates from dodgy advertisement platforms. Because the morality of porn is often debated and not accepted in every culture, a lot of larger advertisement websites, such as Google Ads, do not allow ...


6

While in theory a malware infection could do this as part of it's payload, it's much more likely to be a buggy program that is writing too many log files. Malware tends to attack the disk by either deleting or encrypting existing files. As a start, empty the temp folder and watch it to see exactly what files are being written. Note that lots of things are ...


4

Some Tor exit nodes are known to be hostile, typically injecting advertising Javascript into any unencrypted web page that passes through them. There's no reason such nodes can't inject attack Javascript or other malware. Barring a security flaw in the Tor software itself, an entry or relay node cannot attack your computer (other than trivial attacks such ...


3

There's a longstanding issue (feature?) with IE doing Content Sniffing instead of just respecting Content-Type; this still exists largely for historical reasons. You do have the ability to disable it - MIME Type Detection references the Feature Controls - if you want to make your machine(s) more secure. It is still marginally useful since a common 'fix' ...


3

It's a myth that porn sites are more risky to use than other websites when it comes to malware. This report published by Symantec in 2011 (PDF, see page 33) identified that you can get malware from pretty much any kind of website, even those which can be work-related for many professions. In fact, porn sites ranked lower than many other categories of ...


3

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf) I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality. Very few these days are in the OS.


3

Generally speaking, you are correct. Let's look at some exceptions: If the malware exploits a vulnerability in your email program. If the malware exploits a vulnerability in the software used to "unzip" it. If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer). If the malware exploits a vulnerability in the ...


2

By itself, Clamav is not on par with the best commercial alternatives. For best results use multiple detection engines well rated in comparative reviews. Engines with the highest detection rate generally suffer from more false positives, so consider quarantining inconsistent results for later manual checks. Also available are automated sandbox analysis tools ...


2

Yes. Just having a file on your hard drive does nothing. However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens ...


2

Potentially yes. Examples: You download a picture. While you never open the picture, the OS may generate thumbnails for it. If there's a bug (vulnerability) in the thumbnail generator, it may result in code execution. You download a document. While you never open the document yourself, the Search Indexer reads the file to speed up finding documents. If ...


2

Your logs can help you determine when, what and where. If you're using Apache and a version of Unix (BSD/Linux/etc), I would start with the following: tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 404 > 05-27-2013-404s.txt tail -n 100000 /path/to/apache/logs/access_log | awk '/27\/May\/2013/'|grep 403 > ...


1

How is it possible to use an incorrect type and still get the file loaded by the user? If it were the browser loading it, it would indeed get handled as a GIF, and fail, in general. (There are content-sniffing problems in web browsers, but not ones that would trigger here.) However, when you instantiate an applet with the <applet src>/<object ...


1

Ultimately, a batch file can write another file and execute it. Batch files can write ASCII characters fine, but other byte values can be more tricky. There are ways to do it, e.g. that which is shown in this answer. On this page a much more thorough bootstrapping method is explained. On recent Windows, it would be simpler to produce a VBScript file and run ...


1

Once a machine has been compromised it can not be rescued with a virus scanner, the only secure way to fix this is nuke it from orbit and restore it from backup.


1

There's no mechanism within Windows batch file scripting to download files. You could use VBScript instead, though. An alternative is to set up a network share on the same network as the target and copy a file across from there. This is a technique often used in penetration tests to gain further access to a network you've already got basic access to. As ...



Only top voted, non community-wiki answers of a minimum length are eligible