Tag Info

Hot answers tagged

17

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


8

Everything. You don't keep a dog and bark yourself; why install an AV software and second-guess what it should be doing? Sure, you can do a risk analysis against every individual file, but that sounds dull. Modern AV is fast, just scan everything. Let it worry about downloads.


5

I think it's just a scary tactic from the site to make you download something malicious. Do you have any AV on your OS? Did your browser downloaded anything automatically? If you have AV and haven't downloaded anything I would say you are safe. Just ignore this kind of messages. They are just a scary tactic, no website could scan your PC to find a ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


4

Is this the end of malware use of DNS? No. Might tweak the landscape a little, but not hugely. It seems like the dataset in the news article could protect against both. It's useful for catching people using malware that other people have caught before. It is not useful for catching someone who sets up a burner domain just for their attack ...


3

I don't think what you are experiencing is the result of malware; it looks like the legitimate effect of the end of support for Windows XP (which came out 15 years ago, so by all means it is an obsolete product). If you really want to continue using Windows XP you should install a third-party antivirus to replace MSE. Just be aware that you won't be ...


3

Honestly, the core question is whether vibration of the phone will give an application/website significantly more authority than without the vibration. Now, obviously I lack any research into this specific issue, but we can note that applications do not use vibrations as a way to convene authority. If anything it would feel wrong for an application to ...


3

A few years ago people thought that jpegs were fine. Then there was an exploit for a jpeg library. You should be scanning everything. What might be safe today, won't necessarily be safe tomorrow. (In addition, keep your system up to date - this is much more important.)


3

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: ...


3

Let's see what we know about this code: It is obfuscated You didn't put it there So it is malicious beyond reasonable doubt.


2

Email is certainly the most common method of pushing malware to a network, but it is not the only one. Also, while malicious files can be delivered as attachments to emails, they can also be presented as links that end users click on, resulting in a drive-by download or perhaps a more traditional virus that the user then has to download and execute ...


2

If you are careful as you say, the chances will be lower, but not 0. Trusted websites can also contain malicious flash content. The games on Facebook are made by third parties and that means that you can never be sure if the game has some malicious code. Adds can also contain malicious flash. Another problem is, if a website has an XSS vulnerability, an ...


2

I want to know how do malwares like ZeroAccess hole punch the network without using a external server? ZeroAccess uses a P2P structure with no single central server. While most of the nodes can be behind a NAT some super nodes need to be not behind a NAT so that they can be reached from the other nodes (behind NAT) and relay communications. That means ...


2

Actually you can deobfuscate the JS malware you received. You could do it yourself in few hours. You can see the attacker is substituting the alphabet and numbers from 0 to 9 and then encodes them. The spams you receive could hence result from that malware. It will be good for you to study how it works exactly in order to take the appropriate actions. ...


2

Suppose a malicious web page pops up a fake system notification and vibrates at the same time. How confident would you be of telling the difference between a legitimate pop-up and a .png on the web page you're viewing. (Source) Personally I have not heard of any exploit related to HTML5 Vibrate API, but it could be used for evil goals as shown on ...


1

It's the same remote php shell I decoded here: What is this? Virus or scanner? There are only minor changes, and of course changed $GLOBALS["auth"] variable containing code encryption key, which means, that probably this code has been embedded by bot belonging to the different owner.


1

begueradj's answer is good, I only want to add that I went ahead and decoded the data. What executes doesn't look like anything related to spam email, rather it looks like logic related to cookies though I'm not sure exactly what it's doing (anyone more fluent with PHP willing to take a stab?). Code included below: @ini_set('error_log', NULL); ...


1

For an operating system-specific answer... On Linux: everything. Yes, even files ending in ".txt". Any file in Linux can have the executable bit set, and hence any file in Linux can act similarly to a .exe in Windows. Moreover, Linux (or at least some flavours) doesn't check file extensions when deciding what program to use for opening a file; instead, it ...


1

AV isn't dead but is certainly bypass'ble. AV is pre-assumed to be dead because it's signature based and could be triggered only after having done manual analysis of the threats evolving. It's still at infant stages where you can decide if perimeter defenses would be as stable ONLY with installation of AV's. Also, if you look at the ASCII led backdoors on ...


1

Some (most) malware needs a way to contact its master (the "C&C" as "Command and Control" -- a military expression). This can be to exfiltrate some confidential data that was plundered from the affected system, or, possibly, to obtain fresh information from the C&C, e.g. more commands to execute on the target. Most of the time, the malware wishes to ...


1

It depends on what do you want to achieve: to hide the information that is being sent between the processes or the fact that they are communicating. If your goal is only to obtain confidentiality you can encrypt the information that is being sent between two or more processes. Prior to this you need to some background information on IPC(on both windows and ...


1

You can look first at what STUN is. Afterwards, you can use a library and try it out. From the rfc: Applicability Statement This protocol is not a cure-all for the problems associated with NAT. It does not enable incoming TCP connections through NAT. It allows incoming UDP packets through NAT, but only through a subset of ...


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


1

Yes it can. PDF is a rich format that aside form static content, can contain dynamic elements. The latter can for example contain JavaScript, and other elements. Modern PDF viewers tend to warn the user about potential malicious activity though. If you want an example malware, check out pidief. And generally PDF malware will predominantly be just the ...


1

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.


1

No, you are not necessarily infected yet just by seeing that warning message. The website you have visited is compromised and is trying to perform a drive-by download attack which consists in installing malware on your computer without your consent (you can not see anything wrong happening on your machine during the installation process) or -which is your ...



Only top voted, non community-wiki answers of a minimum length are eligible