Tag Info

Hot answers tagged

60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


15

Droppers are a framework for deploying payloads. This is useful for botnets because the bot master can deploy his botnet without a specific payload, then rent out his network to his customers who provide the payload they want. Crime-as-a-service. Got to love it.


12

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


3

Generally speaking, you are correct. Let's look at some exceptions: If the malware exploits a vulnerability in your email program. If the malware exploits a vulnerability in the software used to "unzip" it. If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer). If the malware exploits a vulnerability in the ...


2

The answer to this question has two sides... First: If you host the libraries yourself then you have to check the security notices on the library regularily and update the library accordingly. This can be a very time consuming task if you include several libraries which must be updated independently. On the other side you can audit each library you use. ...


2

Potentially yes. Examples: You download a picture. While you never open the picture, the OS may generate thumbnails for it. If there's a bug (vulnerability) in the thumbnail generator, it may result in code execution. You download a document. While you never open the document yourself, the Search Indexer reads the file to speed up finding documents. If ...


2

From the Add-on FAQ: Are add-ons safe to install? Unless clearly marked otherwise, add-ons available from this gallery have been checked and approved by Mozilla's team of editors and are safe to install. We recommend that you only install approved add-ons. From the "more information" link in the FAQ: Full Review — a thorough functional and ...


2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


2

Yes. Just having a file on your hard drive does nothing. However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens ...


2

Probably somebody is calling you with voIP phones... you can make it seem as if you are calling from any number or even make it appear as is "xxx bank" or whatever. So no biggies on that part. It is very popular nowadays to call people from voIP systems with fake caller info. On your second question, being called from only known people... Look for a ...


1

Searching for script headers <script> is a pretty good giveaway, not really necessary, also searching for function-based language with the format ******(***) is helpful. The 'function' declaration is pretty obvious, as is 'var' As far as whether or not it is JavaScript per-se and not a similar language can be a challenging task. Really, though, looking ...


1

If you always receive the calls from the very same person, then it might be a trojan on THEIR phone that calls you. However, if theres calls from multiple persons, then it might be the thing that people call "pocket calls", basically, the phone sits in pocket along with keys, wallets, and other objects that push buttons and/or touch touchscreen which in ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


1

Yes it would increase security, as (malicious) cross-domain information leaks aren't possible between browser instances. You can also minimise the use of plug-ins and add-ons in high security browser environments, as they expose additional attackable surface. Another way to mitigate the risk of malicious code running in your browser are ad blockers and ...


1

Yes, malware/spyware can indeed detect antivirus software and perform defensive mechanisms. This is a never-ending ‘arms race’ on how and where they hide code. Fortunately, once a system is compromised there is no 100% accuracy on getting back to a clean slate without wiping the system back to a known good state. In my enterprise environment, once we ...


1

It will depend on what your end goal is. For my part, I create a process by which I can rapidly (within 15 minutes) wipe and reload a drive image on a machine. I take an image of the infected machine first then, wipe, reload, and get the user back up and running. I load the infected image in a protected environment and look for network activity and changed ...


1

If you are looking to do a more hands on manual analysis of malicious software, it can involve a variety of tasks, some simpler than others. These efforts can be grouped into stages based on the nature of the associated malware analysis techniques. This cannot always be observed, but in many scenarios you have an opportunity to perform manual investigation ...


1

If ping is returning an unwanted IP address for a domain, it almost certainly means something is hijacking your DNS settings. The first step to check would be the hosts file /etc/hosts Then look here to determine what server or process is resolving your DNS /etc/resolv.conf Alternatively, you can use this command scutil --dns Firefox may be working ...


1

It's a Chrome extension. What's happening is that some extension is injecting its own ads into webpages. That way, they can get the revenue instead of the webpage you are visiting. This JS file seems to be a blacklist of sites where they won't inject ads (or so, I am assuming). Reference: ...


1

If the malware is same as the one identified as Andr/FBILock-A by anti-virus firm Sophos, they have detailed removal instructions here: http://nakedsecurity.sophos.com/2014/07/25/android-fbi-lock-malware-how-to-avoid-paying-the-ransom/ It appears that (according to Sophos) this malware does not actually encrypt files, so you may be the victim of some other ...


1

Probably not, but it isn't a guarantee. Viruses are just computer programs. They have to be executed by something (in most cases, simply copying the uncompressed files of a virus is not enough to infect your computer either), and generally speaking, compressing one is going to result in making it impossible for it to execute without being uncompressed ...


1

A piece of malware embedded into a file typically contains an exploit and a payload. The exploit is the characteristics that will cause programs that use this file to execute the payload. In contract, a virus that is itself a binary does not need an exploit but just needs you to run it, and its contents essentially is the payload. To keep it simple, an ...


1

As per the comment on Uwe's answer, there's only a security advantage if the URL you use reference a library with the security problems fixed. Although, to expand on my comment there, the jQuery team have been working with Google to make the latest production release (i.e. with security fixes) available at a (new) non-varying URI. However Google still need ...


1

First of all, you should check that your firewall is enabled in Windows. Make sure it doesn't have any weird exceptions listed in it. Secondly, install and run antivirus scanner(s) for the entire system. You can run 'netstat -aon' from command prompt to see all "listening" ports. Also check from task manager if you have any weird processes running with ...


1

You will need an Ethernet hub, not a switch (available cheap on eBay) and a second computer. Plug the Win8.1 computer into the hub and plug your Internet connection also into the hub. The Win8.1 computer now has connectivity through the hub. Download Wireshark to the second computer and install it. Plug the second computer also into the hub, start ...


1

Often malware can attempt to mask itself, so if you are compromised it may be difficult to detect on the system itself. I don't know much about the use of this system, but moving slower and slower could mean adware if it browses a lot of websites. Still somewhat malicious but not quite the same intent as a RAT. You could consider running spybot search and ...



Only top voted, non community-wiki answers of a minimum length are eligible