Tag Info

Hot answers tagged

62

Having a proxy SSL certificate creates some privacy and security implications: Superfish can impersonate any site This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted. Certificate pinning does not protect you, ...


37

You can check to see if you're machine is vulnerable by browsing to this site: https://filippo.io/Badfish/ Quoting from the site: (If the browser asks you to confirm/trust/accept with a pop-up, you're not vulnerable. And for the future consider that answering yes to those pop-ups is dangerous: you are giving up the security of the connection.) ...


27

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions. .pif is legacy from MS-DOS, like .com. It's ...


13

I would enable auditd to monitor changes to the files you expect to be backdoored. You will be able to determine which account and process that is responsible for doing these changes. After installing auditd (not installed pr default on all systems), you can start monitoring changes in files. To do this, simply run the command: auditctl -w /var/www -p wa ...


12

Here are a few risks that you expose yourself to with this specific software: It uses the same private key for each installation. Since the associated is a root CA and is inserted into your private trust list, it makes it trivial for ANYONE to generate any certificate and have it trusted by the affected client (in this case, even server certificate pinning ...


9

Yes. It can be done with Javascript too. The beef-xss toolkit has an attack which facilitates this. https://github.com/beefproject/beef/tree/master/modules/host/clipboard_theft


9

I originally posted this as a comment, but I think this could do with a little explanation. From my experience with website takeover scenarios, when a shell is uploaded to a website, the hacker either manages to exploit a vulnerability in the server, gain root access, backdoor your SSH and compromise all other sites on the server, or he simply doesn't ...


8

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed. Note that this is very ...


8

As a secondary issue, this type of software hides the true nature of how data was encrypted. Because the software replaces known certs with its own, a user does not know much about the original cert. How does the software convey that to the user? If the original cert was out of date or did not match, how would this be sent to the user? If the site is ...


8

From a theoretical standpoint, you are connecting to a remote machine and it is sending data back to your machine. While in the normal context, this is just display, location type data, it is possible that some sequence of bits could be processed in such a way that it causes an exploit in your rdesktop or other tool used to make the remote connection. With ...


6

Hopefully, someone will do the testing and give a definitive answer for Kaspersky for you. Meanwhile, here's an answer for the general case: It depends. Does running an SSL proxy against yourself weaken your security posture? Certainly. Will any given product weaken your security posture as bad as Superfish? That's very implementation-dependent, and also ...


5

I've had a very similar thing happen to a site I manage. After much frustration of deleting the malicious code and then it appearing about 2 weeks later, I discovered this: I took note of the date stamp of when all the files got modified, then I looked up the access log for that minute. I saw a certain page was requested that seemed suspicious, since it was ...


4

Robert Graham of Errata Security has generously extracted (and provided for download) the Superfish certificate, and cracked its password as well. See this link. EDIT (per suggestions): $ cat superfish.cert | openssl x509 -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 15203047915477327079 (0xd2fc1387a944dce7) ...


4

Mods certainly can be used as infection vectors. A lot of it comes down to a question of trust. A mod with tens of thousands of downloads and nobody suggesting they've had any problems is likely to be OK (though still no guarantee!). In an ideal world: Wherever possible, avoid mods that have an installer. There are some situations that this can't be ...


4

It sounds like the attackers have installed a rootkit on your server. A rootkit can provide a backdoor even if everything looks clean. The best approach now in my opinion would be to wipe the server and reinstall from scratch. Patch the websites to eliminate the vulnerability. If you need to restore from backup (you have backups, right? :) ) make sure it's ...


4

Most likely either another administrator or some of your users have set their computers to use Google's DNS service (located at IP addresses 8.8.8.8 and 8.8.4.4). It's probably nothing to worry about. If your firewall has packet capture capabilities, you can try running a capture and then opening the capture file in Wireshark to inspect the traffic and make ...


3

Sounds like you have a good game plan. Make sure whatever OS (I'm a fan of linux in this scenario) you choose she does not have admin rights at all. Also if you go with windows I had the same issue with family and got them to use http://www.bluepointsecurity.com Usually these guys are just out to get a hold of money or your card info in exchange for ...


3

I'm root@anapnea.net, and grsec is the reason I can sleep at night. As an example of an exploit blocked by grsec, you can look at almost any of the recent kernel vulnerabilities. Stock exploits simply don't work against a grsec kernel. As an example of a vulnerability blocked by grsec, and in particular UDEREF, you have the recent x86_32 local root. Grsec ...


3

See the FTC page on Tech Support Scams: In a recent twist, scam artists are using the phone to try to break into your computer. They call, claiming to be computer techs associated with well-known companies like Microsoft. They say that they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for ...


3

Mints97's answer is great, but I think there may be more to it than that. An especially wonderful (read: terrible) problem with Windows is that it supports complete Unicode character set in filenames, including (and this is the worst), U-202E. While I am sure it has some good innocuous uses, but it can allow people to maliciously change the filename in a ...


2

The computer was compromised and any data on it should be treated as if it's in the attacker's hands. Now I doubt this is actually true (those pricks are usually "nice" enough to only charge you around 200$ for a rogue/scareware "antivirus") but you shouldn't take any chances. What I'm most concerned about are session cookies, so you should change passwords ...


2

You can use DNSCrypt to protect against DNS poisoning, HTTPS Everywhere in case you forget. Maybe install Tunnelblick and setup a secured OpenVPN server on a remote machine/network you know is likely to be healthier. Good luck.


2

If you have access to the modem and router then setup a separate router for just you. Back when I lived with roomates, this is what I did. I also hid the network (did not broadcast the SSID). Note of course that you will never be secure if the roommate grants physical access to your router to the 'hacker' (or worse, your roommate is the hacker!). Bottom ...


2

You wrote, "The image file format was pif", but the article states "FireEye researchers found a collection of chats and documents while researching malware hidden in PDF documents." The program information file format was used on Microsoft Windows systems, though files in that format are rarer now than they once were. There were vulnerabilities associated ...


2

This probably is not applicable to your specific situation, but is relevant for the more general question. If you have a second computer, and are able to sniff the traffic coming off of the computer you have doubts about, then you might be able to determine if the system is compromised by watching that traffic. Going into analyzing that traffic is far ...


2

It's somewhat safe to load on Autopsy, to dissect it using fwextract, lazarus, and with a bunch of forensics tools, but is not safe to execute anything of it nor open any files from it using the default applications. It's easy to create a bunch of infected pdf files that will exploit your Adobe Reader, or png files, or whatever. Some files can infect your ...


2

Based on another major Superfish update: Komodia client side SSL verification is broken! The major problem with SSL Intercepting proxies (or any in-house crypto software) developed by OEMs or a third party like Komodia is that you can't really trust them (especially after the Superfish buzz)! TLDR of this new update: An attacker does not even need to ...


1

Most common vectors: Drive by download - Download is forced on to your computer, and you may either be forced or tempted to execute a malicious file. You are just browsing and all of a sudden you get freebooks.pdf.dll, or worse a browser/OS flaw lets the download happen without you seeing it. Malicious advertisement with malicious javascript - Malicious ...


1

You're either behind a malicious proxy/VPN or your host file is effected. Most likely the latter. On windows 8 you can check your hosts file here C:\Windows\System32\drivers\etc\hosts Remove any lines with strange IPs. Infact you can remove everything if you aren't running any cracked software or have routes setup for a web server. This could also be ...


1

There are different kinds of mods. Mods which add or replace game content files like images, models or maps. These should usually be harmless, unless they exploit a bug in the game engine which handles these assets. Mods which add game logic in form of scripts. Many games have a scripting engine which allows mods to perform limited programmed logic. ...



Only top voted, non community-wiki answers of a minimum length are eligible