Tag Info

New answers tagged

3

Go to https://www.virustotal.com/ Put in the URL of the website you visited that gave you the JavaScript warning. It will search to see if that URL has malicious content. You will get results. Unless there is zero-day malware on that URL, the results will be correct.


1

It depends which malware and what it was designed to do. If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that ...


3

Malware analysis should be done in a VM preferably disconnected from the Internet. This is mainly to protect your system, and stop it from spreading (if the malware has that capability). You can also use snapshots, or sometimes you can setup a VM to never keep state. VirtualBox is free and will do the job. VMWare Player is also free, but limited. ...


0

You could take a memory image with Moonsols DumpIt and analyze the image with Volatility. You can also use Mandiant Redline to collect a memory image as well and perform some generic analysis of what could be bad. If you have a tap or span port setup you could go back and analyze the packets if you were doing full packet capture. You could use ...


0

This is equivalent to an evil maid attack, which compromises the (unencrypted) bootloader to capture your FDE password the next time you start your computer. This assumes the bootloader is kept on the same drive. If that's not the case (for example if you keep your bootloader on a removable drive) and you explicitly configure your computer to not boot from ...


2

This proof of concept is about communicating from a non-air gaped machine to an air-gaped (not on the network) machine. Both machines need to be infected with the malware. This would be like a stuxnet type of attack; it may be possible to get one time access to the air-gaped machine to install the malware, but you can't get continued access because you need ...


1

Hacking is a completely inappropriate description for what is purportedly demonstrated that video, and I'm sure the term was only applied for the sake of creating a more appealing headline. What the video is demonstrating is nothing more than communicating, there are no vulnerabilities being exploited, no unauthorized access being gained, and no information ...


1

Yes, at least a bootkit can do this, and now it cames out that its easy, John Loucaides and Andrew Furtaki just showed it with there bootkit Lighteater. They have given a speech on CanSecWest. Title how the speech was: 'How many million BIOSes would you like to infect?'. The only way to get rid of it is to flash your motherboard. Even the change of your ...


44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up. It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately ...


0

Does it make a difference to a virus scan which system it is being run on and what type of malware it's looking for? Not unless you include exotics. The problem boils down to if a product supports engines effectively scanning the target from the perspective of the intended environment. All malware we scan for exhibits some structure compatible with a ...


0

In short no, it does not matter for most cases, including unencrypted archives. Malware detectors snipe signatures, which are basically chunks of data. Unless the platform doesn't malform the data, you should be ok. That being said, theoretically, you may run into trouble with endianness if the AV doesn't interpret the data correctly. But in most cases the ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


0

I would suggest you to try scapy, if you're doing it on linux. It has great features for the case you need. https://samsclass.info/124/proj11/proj16x-promscan.html


1

The seminal work on detection of promiscuous interfaces on the network is Detection of Promiscuous Modes using ARP Packets: ...promiscuous mode detection is performed by checking the responses of ARP packets, when ARP request packets are sent to all nodes on the network I don't know of implementations offhand, but the paper is detailed enough for ...


3

Yes. Just about every security feature of mobile operating systems is implemented in software. Complex software like that can will have bugs. Some of these bugs will be exploitable to give unauthorized access. This applies to any sufficiently complex software, because programmers are no more superhumanly perfect than anyone else.


0

In a word ... no. These attacks bypass your OS and anything running on it. If you are interested in physical security, you need to add hardware that protects these devices or by a secured computer.


1

Akamai and Cloudfront are both names associated with CDN's. In many cases CDN's are hosting collection sites for metadata associated with IP addresses for tracking purposes as well as their initially intended use of caching large files for various websites. Although these particular names may or may not be associated with legitimate traffic, your lack of ...


-2

You read like a Markov chain generator, hopefully its just translation software and not a not invasion :) A modified .htaccess file could be the source of your unwanted URL/content. I would also recommend that you run joomscan on your website to check for known vulnerabilities.


0

I would like to address Oleg V. Volkov answer: When it comes to companies, and the bigger they are the more you are susceptible, cleaning has these problems: Most likely, the task of cleaning gets relegated to tier 1 folks, who may or may not do the cleaning properly. Any tier 1 who re-images will remove the threat. Some tier 1 folks will clean ...


1

I work for in the healthcare industry, and we manage people’s health records. In the past, I have always been told to re-image when I worked for the government, and while there are many reasons, the best I thought was that you are 100% sure the threat is gone once you re-image. I think the real question is(on weather to try and clean vs re-image): Are you ...


3

JRoute is the module tasked with dealing with internal urls. The evil code is hooking there to make such urls show their spam page. You could see what they changed by comparing the files with the official ones from Joomla. In the end, you should replace the compromised Joomla php files with the original ones.


2

It's always possible that any files on an infected machine are infected themselves, but I'd say that image files are a less common target for malware. One approach would be to upload them to a cloud service and then make sure that you scan them with an A-V solution when you re-download them. Whether it's worth the risk to you will depend on how much you ...


1

IP addresses are not assigned locally. Every internet service provider receives continuous blocks of IP addresses to sub-assign to their customers. Most ISPs do this based on location, but they are not forced to do this. However, marketers discovered the tendency to assign IPs based on region and used this to build GeoIP databases which webmasters can use ...


3

Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm How long is a piece of string? Ensuring confidentiality isn't the only goal of information security, if the App was to run a background service that constantly consumed significant CPU with the goal of draining your battery would that be a threat? ...


8

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-app isolation. Third-party "firewall" apps on Android are probably a bit over-hyped, and the level of protection they can offer without rooting is in my opinion ...


1

In order to get those hashes, you need samples of the malware that you want to detect. That is one of the reasons why AV companies have very large teams to hunt for and identify malware, and why their database of hashes tends to be guarded. For your project, you will need to find (or write) malware and collect those hashes.


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


1

There is no isolation between GUI apps on X11, so that allows your user to spy on your clipboard's content, create windows that may look like spoofs of your own windows (e.g. spoofs of your polkit1 dialog or screen locker), record your entire monitor, implement a keylogger... Just create a guest session, seriously. Or use a VM. I would not trust other ...


16

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger. This ...


0

It's entirely possible. There are a lot of examples of this, especially something like Stuxnet which was allegedly found in the wild in 2005 and disregarded but was found in 2010. Some earlier antiviruses would go by signatures and allow things like polymorphic viruses. This isn't as common lately, as heuristics and other technology has developed. All in ...


2

VM box --(virtualnetwork)--> Linux VM with iptables (NAT and restrict only port 80/443, etc) --(nat/bridge)--> Host PC This will ensure infections in your VM box cannot spread laterally. And also make sure your user accounts in the VM box are not the same as the ones on your network.


1

For every innovation that you might achieve to work towards undetectability, there are legions of security researchers working to discover your methods. The more sophisticated your methods, the more sophisticated the response. This is truly a self-defeating spiral for both sides. But, there is a theoretical "endgame" where one creates the "perfect" malware. ...



Top 50 recent answers are included