Tag Info

Hot answers tagged

44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


25

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


21

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


5

If you're trying to eliminate malware, a simple format is sufficient. Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


4

I worked on this problem for an email scanning system, and can say that the lexical properties of URLs for maliciousness are minimal, especially with the constraints you are imposing. It's true that malicious URLs often "Look random", but that's because your experience has transformed "imgur.com/gallery/lBKRZ" into "harmless image server gallery", but ...


4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up. It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately ...


3

Malware analysis should be done in a VM preferably disconnected from the Internet. This is mainly to protect your system, and stop it from spreading (if the malware has that capability). You can also use snapshots, or sometimes you can setup a VM to never keep state. VirtualBox is free and will do the job. VMWare Player is also free, but limited. ...


3

Go to https://www.virustotal.com/ Put in the URL of the website you visited that gave you the JavaScript warning. It will search to see if that URL has malicious content. You will get results. Unless there is zero-day malware on that URL, the results will be correct.


2

This proof of concept is about communicating from a non-air gaped machine to an air-gaped (not on the network) machine. Both machines need to be infected with the malware. This would be like a stuxnet type of attack; it may be possible to get one time access to the air-gaped machine to install the malware, but you can't get continued access because you need ...


2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


2

Well, one step in the right direction would be to install from a trusted ISO. Ubuntu's ISO is signed with their GPG key. Details are here: VeriFyIsoHowto But then, how do you know that that GPG key is really their's? Me, I'm confident enough with googling for the key (and the assumption, that Google is delivered via HTTPS and that Google has not been ...


1

You are overthinking this. It's possible that an attacker intercepts your connection to Ubuntu servers and redirect your download to a tainted image, but it's a difficult task: They have to be in a position to be able to MiTM your connection, by standing in the route between you and the Ubuntu Servers Maybe perform a DNS attack on you to redirect you to ...


1

That's a remote command shell for a server that's probably been hacked, and you should consider the server compromised. You would be wise to suspend everything it hosts, audit all code on the machine and rebuild it / replace it. Remote users who probably control this script can force it to issue any command by posting "CODE" that's base64_encoded (that sent ...


1

You will not be able to tell the application/port/process based on the network traffic alone. For that, you will need to analyze the logs on the endpoint. The add-ons you mention to block ads will help in reducing the noise you are seeing, since I imagine you're seeing a ton of random ad-traffic tied to legitimate white-listed sites users are browsing to. ...


1

how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet? It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were ...


1

The nature of an exploit using an image often is a buffer overrun, for instance: Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) To defend against such an attack, all practices and techniques to detect attacks on the stack and heap of your image processing programs will help. Rigorously checking the source code is the first ...


1

Trying to detect malicious URLs is a difficult and in many ways impossible game to win, just like trying to detect malware in executables. IF you are trying to protect your network from malicious URLs, there are threat feeds available, which are useful, be as others have stated, domains are cheap and easy to throw away. The strongest way to prevent ...


1

Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.


1

First, websocket connections are initialized from javascript which gets executed by the web browser on the client. That means typical websocket connections are outbound connections, not inbound connections. Inbound websocket connections would only be possible when the host runs a websocket server. A normal browser will usually not do this. And even when the ...


1

It depends which malware and what it was designed to do. If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that ...


1

You could take a memory image with Moonsols DumpIt and analyze the image with Volatility. You can also use Mandiant Redline to collect a memory image as well and perform some generic analysis of what could be bad. If you have a tap or span port setup you could go back and analyze the packets if you were doing full packet capture. You could use ...


1

Hacking is a completely inappropriate description for what is purportedly demonstrated that video, and I'm sure the term was only applied for the sake of creating a more appealing headline. What the video is demonstrating is nothing more than communicating, there are no vulnerabilities being exploited, no unauthorized access being gained, and no information ...


1

Yes, at least a bootkit can do this, and now it cames out that its easy, John Loucaides and Andrew Furtaki just showed it with there bootkit Lighteater. They have given a speech on CanSecWest. Title how the speech was: 'How many million BIOSes would you like to infect?'. The only way to get rid of it is to flash your motherboard. Even the change of your ...



Only top voted, non community-wiki answers of a minimum length are eligible