Tag Info

Hot answers tagged

7

Yes, certainly. Malware that affects network accessible services very rarely require user interaction. A worm such as SQL Slammer is a prime example, which propagated across the Internet looking for exposed SQL Servers that had a blank password for the sa account. Client machines may also expose vulnerable services, but even if they don't, they can ...


5

Yes it is completely unfeasible. Your suggestion bases on you knowing the contents of a particular file. You want to use this and the encrypted file to decrypt the other files. There would be two ways to approach this. One would be to use weaknesses of the encryption algorithm in a known plaintext attack, the second, which you are addressing in your last ...


4

First off, you're wrong: Linux (or non-Windows, really) systems infected with malware is rather commonplace. End users might be less exposed to these type of attacks because they do not run the affected software. Another factor in the difference in perception is that different OSes are used for different things and malware authors are tailoring their attack ...


3

Users of applications cannot. They can only try to not have rogue apps running on their systems. In this case we have an app that is normally harmless or even (attempts to be) beneficial unless it detects you're approaching a juicy login. Some, each alone insufficient, ways of "protecting": do not install untrusted apps or from untrusted sources. pay ...


2

The market for a penetration testing lab is probably a tiny subset of the market for penetration testing services and an even tinier subset of the market for information security. I'd encourage you to do your own investigation by reaching out to potential prospects, but a resource which may be of use is the Delling Institute. See: ...


2

The simple answer to your question is no; trying to revert those files after the encryption is said and done is unfeasible (assuming the FDE (full disk encryption) algorithm used is secure). However, some of what you stated is actually feasible. It's just kind of complicated. Having placeholder files and a program that regularly checks the data in those ...


1

http://cwsandbox.org/ explains it all. The product is now called Threat Track. They have an uploader form.


1

"Viruses" are just a fancy general-public-compatible word for "malware". Server security is much easier because the scope of what needs to happen and how is well defined and more static on servers. You can deploy user accounts, SELinux or AppArmor profiles and other forms of isolation just as much as you'd like on a server and you know exactly what ...


1

First, use a known clean computer (not related to anything you had and not connected to anything you have now) to clear up all your online presence, especially various cloud storage services such as icloud/googledrive/dropbox/onedrive. Close up any unneccessary accounts and get your email in order - it often is the key point that must be secure. Set up two ...


1

There is no good software way to do this. Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the ...


1

As an immediate patch, you should run such an application in a separate X server on a different VT. This is the only way you can guarantee that the app does not use the X API to spy on other clients. You may also try your hand at XSELinux but I know of very few people in the world who know how to run it, and it usually severely limits what your target app ...


1

I would demonstrate a simple SQL injection, it's always nice to see the look on people's faces when you attack a website with a browser as your only weapon. Setup a simple site with a login page and then show them how you can expose the admins password by simply adding few characters to the url. After you get the admin's password delete the entire site. ...


1

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure. You can reset the DNS server settings to what ...



Only top voted, non community-wiki answers of a minimum length are eligible