Tag Info

Hot answers tagged

44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


16

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger. This ...


8

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-app isolation. Third-party "firewall" apps on Android are probably a bit over-hyped, and the level of protection they can offer without rooting is in my opinion ...


4

Obviously it can remain undetected for a long time, as there are several famous cases of malware having multi-year lifetimes. The key is stealth. The wider the malware is spread, the greater the odds it will be discovered. The more damage the malware causes, the faster the victim will look to fix it. The most successful malware refuses to spread to ...


4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up. It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


3

Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm How long is a piece of string? Ensuring confidentiality isn't the only goal of information security, if the App was to run a background service that constantly consumed significant CPU with the goal of draining your battery would that be a threat? ...


3

Malware analysis should be done in a VM preferably disconnected from the Internet. This is mainly to protect your system, and stop it from spreading (if the malware has that capability). You can also use snapshots, or sometimes you can setup a VM to never keep state. VirtualBox is free and will do the job. VMWare Player is also free, but limited. ...


3

Yes. Just about every security feature of mobile operating systems is implemented in software. Complex software like that can will have bugs. Some of these bugs will be exploitable to give unauthorized access. This applies to any sufficiently complex software, because programmers are no more superhumanly perfect than anyone else.


3

JRoute is the module tasked with dealing with internal urls. The evil code is hooking there to make such urls show their spam page. You could see what they changed by comparing the files with the official ones from Joomla. In the end, you should replace the compromised Joomla php files with the original ones.


2

VM box --(virtualnetwork)--> Linux VM with iptables (NAT and restrict only port 80/443, etc) --(nat/bridge)--> Host PC This will ensure infections in your VM box cannot spread laterally. And also make sure your user accounts in the VM box are not the same as the ones on your network.


2

It's always possible that any files on an infected machine are infected themselves, but I'd say that image files are a less common target for malware. One approach would be to upload them to a cloud service and then make sure that you scan them with an A-V solution when you re-download them. Whether it's worth the risk to you will depend on how much you ...


2

This proof of concept is about communicating from a non-air gaped machine to an air-gaped (not on the network) machine. Both machines need to be infected with the malware. This would be like a stuxnet type of attack; it may be possible to get one time access to the air-gaped machine to install the malware, but you can't get continued access because you need ...


1

It depends which malware and what it was designed to do. If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that ...


1

Hacking is a completely inappropriate description for what is purportedly demonstrated that video, and I'm sure the term was only applied for the sake of creating a more appealing headline. What the video is demonstrating is nothing more than communicating, there are no vulnerabilities being exploited, no unauthorized access being gained, and no information ...


1

Yes, at least a bootkit can do this, and now it cames out that its easy, John Loucaides and Andrew Furtaki just showed it with there bootkit Lighteater. They have given a speech on CanSecWest. Title how the speech was: 'How many million BIOSes would you like to infect?'. The only way to get rid of it is to flash your motherboard. Even the change of your ...


1

The seminal work on detection of promiscuous interfaces on the network is Detection of Promiscuous Modes using ARP Packets: ...promiscuous mode detection is performed by checking the responses of ARP packets, when ARP request packets are sent to all nodes on the network I don't know of implementations offhand, but the paper is detailed enough for ...


1

Akamai and Cloudfront are both names associated with CDN's. In many cases CDN's are hosting collection sites for metadata associated with IP addresses for tracking purposes as well as their initially intended use of caching large files for various websites. Although these particular names may or may not be associated with legitimate traffic, your lack of ...


1

I work for in the healthcare industry, and we manage people’s health records. In the past, I have always been told to re-image when I worked for the government, and while there are many reasons, the best I thought was that you are 100% sure the threat is gone once you re-image. I think the real question is(on weather to try and clean vs re-image): Are you ...


1

IP addresses are not assigned locally. Every internet service provider receives continuous blocks of IP addresses to sub-assign to their customers. Most ISPs do this based on location, but they are not forced to do this. However, marketers discovered the tendency to assign IPs based on region and used this to build GeoIP databases which webmasters can use ...


1

In order to get those hashes, you need samples of the malware that you want to detect. That is one of the reasons why AV companies have very large teams to hunt for and identify malware, and why their database of hashes tends to be guarded. For your project, you will need to find (or write) malware and collect those hashes.


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


1

There is no isolation between GUI apps on X11, so that allows your user to spy on your clipboard's content, create windows that may look like spoofs of your own windows (e.g. spoofs of your polkit1 dialog or screen locker), record your entire monitor, implement a keylogger... Just create a guest session, seriously. Or use a VM. I would not trust other ...


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...


1

You may find a forensic tool called unhide to be of interest! http://www.unhide-forensics.info unhide uses a variety of techniques to find (or unhide) hidden processes and TCP/UDP ports utilized by rootkits/LKMs (Loadable Kernel Modules). It supports both Linux/Unix & Windows... More details on the techniques used can be found on the website: ...


1

The rdesktop client supports resource sharing with the -r switch. A local directory from the connecting PC can be shared with the remote server under a special share under \tsclient\<sharename> -r disk:<sharename>=<path>,... Redirects a path to the share \tsclient\ on the server (requires Windows XP or newer). The share name is ...



Only top voted, non community-wiki answers of a minimum length are eligible