Tag Info

Hot answers tagged

37

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


9

This can be done using techniques like: Docker virtual Machines Jails Clusters (out of scope for home use) The trick here is to NOT use a single user environment like Windows. but use a environment where you could safely test any file without risk of infection. So you need a READ-ONLY Environment (full OS, not just the location being tested) which makes ...


7

First things first If you suspect your server has been compromised, you should be implementing an Incident Response plan. There are lots of resources out there for putting a plan together, including a recently released "Criminal Division Guidance on Best Practices for Victim Response and Reporting Cyber Incidents" from the US Justice Department. Before you ...


6

Yes, this is rogue. This script will execute any PHP code passed as plm12345plm POST parameter. This means, an attacker can execute arbitrary PHP and -- depending on the server configuration -- further code on your server. The first GIF89a line is likely placed to bypass basic file verification during upload of the script as a GIF image. If the file could ...


4

Yes, this is a PHP web shell. Eval should be the red flag. Basically, if the user can access this file on your server, they may be able to execute OS commands. If you have properly implemented your site, the attacker should not be able to trick PHP into executing the code in what I am assuming is a .GIF file. However, if I were you I would batten down ...


4

Though you might expect this if traveling to certain countries, this question hinges on whether we should trust the authorities (or a specific person, still an opinion) and somewhat separately known capabilities (which are broad). An essential answer is the risk you're willing to accept. You could say you can't trust your device if it ever leaves your ...


4

Not necessarily. Malicious self-executing code take advantage of bugs affecting the code of some software handling the data. You refer to a bug in the way EXIF has to be processed, but the picture data also has to be handled by the software and the code handling this data might also have bugs which could potentially be exploited. Removing EXIF data will ...


3

I hate to say it, but it sounds like you got tricked. It's a common scam for a pop-up to claim you have malware or viruses and "offer" you a to fix it for some fee. In reality you are usually paying for the privilege of giving hackers full control over your computer (if you installed software for them, that is). Second, limi1.com doesn't appear to have ...


3

Unfortunately I would have to agree with the poster named "Freedom" who has made the observation that you cannot trust U.S.-manufacturered, -owned or -designed systems. The Snowden revelations proved far beyond a reasonable doubt that not only the NSA (but a long list of other "alphabet-soup" U.S. surveillance state entities), long ago declared war against ...


3

I would suggest that you look into the direction of Trusted Computing. It won't "defend" you, but it might help you ensure that you are booting in a known/secure environment. There is a load of information available here, just search for TXT and trusted computing. But for starters, you can ensure this by using a platform with a TPM and Intel TXT, then go ...


2

If you really want to do this, the method with the least stability impact is to disable on-access protection, URL protection, email scanning, and everything else that scans at the time of potential infection. Note that this is "method with least stability impact", not "best method". By configuring your system this way, you ensure that you will be infected ...


2

Installing multiple AVs is a very bad idea as the antiviruses will conflict with each other, will take unnecessary space on your hard drive and may cause system instability.I suggest you go with a well known antivirus that satisfy your needs and if ever you need to scan a file using multiple AV then use a free service like VirusTotal Here is a sample ...


2

Though it's better in the sense that communication is automatically between two windows (and you can hope the object disappears after it's transferred), I'm voting no¹ because: It uses Automation, its interface is public It's not thread-safe (so it's global) Windows in Windows can be hooked The only protection I saw was at the process level: you ...


2

Is the only place to store the code ready for execution, inside the EXIF data segments of a JPEG image? Not necessarily. However, it is much more likely that a bug exists inside the EXIF processing code. JPEG processing code for the actual image is pretty standard, using tried and tested algorithms. It is the EXIF processing which is more bespoke per ...


2

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab. Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, ...


2

This is the easy case for anti-virus software. However, do not suppose that a malware has to be unencrypted to be executable. Polymorphic code brings self-decryption to malwares, it can be helped by Metamorphism to ensure that even the very start of the decryption routine, since there must be indeed a unencrypted starting point, does not present any ...


2

Yes the risk is very big. NSA is know to put spyware on hardware before shipping (see here), NSA is know to ignore the US constitutions and spy on calls and internet activity of US citizens so do you really think they care about foreigners? If they seize your laptop and you ever get your hands back on it, throw it on the trash its junk now. I can bet ...


2

Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any ...


1

Beyond the tools that Kyle mentions if you need something you need to run from time to time check out BriMorLabs Live Response Collection it might be able to provide you all the data you could use to start to do a root cause analysis on the system.


1

I ran into this issue not too long ago. If you have done a clean OS install then it is likely that your Chrome settings have been tampered with, infected, auto-backed up, and restored once you log into Chrome again after the clean install. You can try and reset your Chrome settings. It actually took me hitting this more than once and manually inspecting my ...


1

But the US has great consumer credit card protection. Call your CC company and tell them that you didn't authorize the charges. You cannot be held liable for more than $50 of invalid charges though most companies will not even charge you that. You may have to eat one $29.97 charge. You definitely need to cancel your card. If anything from limi1.com was ...


1

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety. You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to ...


1

Firstly I would like to explain differences between Viruses, Trojans and Malware. Malware - is the short form of Malicious Software. It is basically a software written to cause damage or infiltrate computer systems without the owner informed consent. It is general term used to represent various forms of intrusive, hostile and annoying code. Virus - is a ...


1

Such code would of necessity exploit a buffer overflow or other data-to-code jump trick. As such, it will only be effective against a limited range of hardware. So you can run a JPEG lint checker written for, say, ARM in a virtualized device. The exploit will be uneffective against the emulated CPU, which will then be able to report on the JPEG structure.... ...


1

No, malicious code in your PHP file is not a virus or a trojan. Most end user anti-malware tools do not scan for these types of things. The malicious actions in your web app may be legitimate commands that make sense in a different context. You may want to look into static code analysis tools which analyze code for software design errors.


1

I have now deleted the folder and all files it contained. I've also killed all the processes. Did you make copies of the files, or simply delete them? Because without them there's really no way to tell you anything definite about them. You should not assume you've cleaned everything out or blocked all access to the attacker. Your best bet is to ...


1

If you use FTP for access to files on your website, you need to be very careful. If you store your FTP usernames and passwords on your local computer using software like FileZilla, your website can be compromised if malicious software or a Trojan is installed on your computer. Never store credentials on your local computer. Additionally, you should use ...


1

Not true exactly - bios can be overwritten. This is how bios upgrade tools work. Another minor correction: the BIOS doesn't operate on a lower level than the OS, at least on modern systems. That would mean that the OS uses BIOS API calls to handle the hardware. But it is not so, the OSes have a nearly bios-independent software stack. The last well-known OS ...


1

Yes it is possible although newer bios has code signature protection which make this attack unprobable. The BIOS is tied to the computer architecture in this case x86/x64 and it's end goal is to load the OS. So no matter the OS even no OS you can flash (write) the BIOS. However, the BIOS is not a malware delivery channel. For any useful work (accessing ...



Only top voted, non community-wiki answers of a minimum length are eligible