Tag Info

New answers tagged

0

There are lots of ways for malware to hook into Windows auto start. There are simple cases where the registry is modified to load modules on start. Here is the a list of auto start locations in the registry. And a bit more info on Windows startup paths. There are more advanced techniques, Target a driver. Drivers are loaded fairly early on in the boot ...


5

In order to do any damage to your computer or data stored on it, the page would have to either exploit a security vulnerability in software on your computer or prompt you with an additional confirmation dialogue. The warning may be due to the page exploiting a security vulnerability for which there is not yet a patch available, so the warning should be ...


3

Yes, no, maybe so. There are a couple major things in play here. Javascript is a full fledged programming language. This did not use to be the case in it's infancy as a crutch for DHTML (Dynamic HTML, whatever that was!). As a full fledged language with a full blown interpreter/compiler it is really no different than other most other languages software is ...


5

The threat a virus impose in your system is, ideally, independent of its programming language because viruses exploit vulnerabilities in operating systems, applications, APIs etc. In this sense, a Javascript virus is as dangerous as any other virus. Also, for web applications, JavaScript is one of the main attack vectors in techniques such as cross-site ...


1

"Too dangerous" is very subjective of a term. It really depends on what the JS is being used for. JS is merely a tool. The most common (and perhaps most damaging) is called a cross site scripting attack where malicious JS redirects traffic. This traffic can be spoofed and therefore appear as trusted/secure but it really isnt. Thus, I say this attack is ...


1

Except for the few exceptions for viruses that can run on Wine and iyou have Wine installed, Linux generally won't be affected by Windows virus. Note though that Linux can be an asymptomatic carrier of Windows viruses. If you send other people a file infected Windows virus, their machine can catch the virus, even if the file looks fine on your Linux ...


18

Yes there are known attacks of this type. The site you are trying to visit is one. That's why your browser is telling you not to visit the page. Javascript files included on pages are always executed by the browser. That's what Javascript does. Whether or not it has the necessary privileges to do something malicious is where the battle is at. It is unlikely ...


1

As with most remote exploits targeting a 3rd party plugin (i.e, Adobe Flash, in this case), the attacker used a malformed compressed flash video to corrupt the embedded flash player on the victim. The exact mechanisms are unclear to me as I have no intent on clicking on the video you linked because that video COULD be malware itself... however, the ...


0

I believe this has nothing to do with drive-by downloads as the author claims. It just seems to me that he visited a website that had been injected with an iFrame containing the malicious site (a form of Cross-Site Scripting attack). He says his browser crashed and that's it. It's hard to test more without actually visiting the page where the incident ...


1

There are many features in the PDF that can be used in malicious ways without exploiting a vulnerability. One example is given by Didier Stevens here. Basically he embeds an executable and has it launch when opening the file. I am not sure how today's versions of readers handle this but its a good method of using PDF features in malicious ways.


0

Yes, in fact, there have been many historical PDF exploits. The PDF reader built into popular Internet browsers support a robust sandboxed security model, so viewing a PDF in a browser is much more secure than viewing the same file in a native PDF reader. I'd recommend either Chrome or Safari as they've done best in penetration testing.


4

Yes it can. Whether a file is malicious or not, does not depend on the file extension (in this case PDF). It depends on the vulnerabilities in the software which will be parsing it. So for example, PDF reader that you are using potentially contains a buffer overflow vulnerability, then an attacker can construct a special PDF file to exploit that ...


4

Most drive by malware downloads first start out with javascript. A quick search shows this as a good simple example: var OSName="Unknown OS"; if (navigator.appVersion.indexOf("Win")!=-1) OSName="Windows"; if (navigator.appVersion.indexOf("Mac")!=-1) OSName="MacOS"; if (navigator.appVersion.indexOf("X11")!=-1) OSName="UNIX"; if ...


1

Usually how they work is the user runs a java application or applet (whether known to the user or not) and due to java being cross platform it detects the OS and typically from there downloads a virus more machine specific usually written in C or C++


1

What are the common vectors for installing rootkits? (And if I understand correctly, this would include MBR as well as BIOS? So same question for each.) Mainly by hooking the system calls. I suggest you read a book about this because I cannot cover it all here. I suggest: practical malware analysis and rootkit arsenal How common are rootkits that ...


1

So many ways! What is the most common type of software flaw that is exploitable? Buffer overflow. A buffer overflow is where a program requests a size of memory but then writes more data in that location (overflowing) to the memory next to it. For example: A program like OpenOffice Writer (Word Processor Like MS-WORD) (this is pure fiction by the way) ...


0

The short OP is asking why clicking on a .txt runs a virus. If a virus changes the associated program for an extension, then your computer can start mad_notepad_that_also_runs_a_virus.exe instead of notepad.exe when clicking on a .txt file. But clicking on i_love_you.txt.extension_like_that_will_obviously_make_this_computer_explode.exe, even if a very naive ...


0

What to do next? Wipe the server clean and re-install, making sure you're using the latest versions of everything. Once an attacker gets in, it's difficult or impossible to figure out what's been tampered with. You could try making a copy of the compromised server for offline analysis, but you probably won't find anything interesting: if the attacker can ...


4

One possibility not yet mentioned is unicode shenanigans. Unicode supports displaying many languages, including those written left to right, and those written right to left. One way it does this is using special characters including: [U+202E] Windows supports unicode, including in filenames. You see a file on your desktop: evilexe.txt It looks like a ...


11

Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How come is this possible ? To add to the answer to a similar question (thanks for finding it, Tcholas!): You are correct in thinking that a virus in and on itself is harmless. A virus sitting in a file somewhere is no immediate threat to your computer. But when you open a file ...


0

Been a long time since I've done C structured exceptions (MS specific but emulated on Wine), but the syntax is close to this. Somebody using this could have a lot of fun even if Z is not mapped. bool isLinux = 0; __try { asm { mov AL, 172 int 80h } isLinux = 1; } __except {} if (isLinux) asm { /* Linux shellcode here */ ...


7

One possibility is by exploiting overflow vulnerabilities. When opening the image, the software failure will "throw" the virus into unauthorised memory sections that may be executed by the system. Here you have a description by Symantec of a vulnerability that exploited Internet Explorer in this sense. Also, this question was answered in Stack Overflow.


25

This is possible thanks to OLE (Object Linking and Embedding) technique. It is intended to share information between applications that run on Microsoft Windows operating system. Mainly, it allows to embed objects in documents. Official Microsoft Documentation explains the benifits of OLE. But as any other concept, it could be used for a neferaious ...


1

I believe it's gotten a lot better. There are tons of security implementations that makes exploits hard to come by. Grsecurity does a great job at implementing a userland ASLR, along with their RBAC system and PAX usage. SELinux and App Armor are other things that can be used. Along with the low level precautions(ASLR, DEP, Nx, Stack Cookies, SEH) it makes ...


2

Well... It's quite an open/hard question.. I'd say it has become a lot better, but so has the threats! I remember back in the golden XP days how easy it was to access the Administrator account, since you wasn't asked to give it a password... With Vista and up, it wasn't so easy... However, when someone/something blocks you, well, you simply find a ...


2

I would argue that computers are more secure today than they were in the past for one simple reason known attacks have had operating systems patched against them. I had a professor tell me once that it was easy to overwrite DOS system memory and it wasn't uncommon for games to overwrite it just so they would have that memory then put it back when they were ...


2

It's an arms-race! Theoretically, you cannot inspect a system from within itself. You need to be one level above: if you want to inspect user-space malware, you need to be in kernel land. If you want to inspect kernel malware, be in the hypervisor. Practically, for your case, you can try to change common analysis tools to avoid detection by the malware. For ...


2

You can't rely that there is any antivirus/scanner that would block them. If you want to check the files with an antivirus, you must run it yourself in your uploader. Zip files are specially dangerous, since they could upload a .zip containing a .exe, a .zip that is an infected Office document, a .zip which when called by java runs a virus… There are also ...


3

Many things can go wrong with file uploads. If by "infected" images, you mean images which will trigger arbitrary code execution on your visitors' machines, I'd say that you're probably okay (but an antivirus sweep can't hurt). However, there are other things to look for when implementing an image-hosting website (or a file hosting website). You said that ...


2

If your upload form are not secured and not verified lots of things about the files wich is trying to be uploaded on your server , yes you can upload an infected image. You intercept the http header like tamper data or other tools , and you can modify the extension of your file and other parameters : example : ...


1

Most of Steve DL's points are good, the "best" approach is to use a run-time linker (RTLD) that you have more control over. The "LD_" variables are hard-coded into glibc (start with elf/rtld.c). The glibc RTLD has many "features", and even ELF itself has a few surprises with its DT_RPATH and DT_RUNPATH entries, and $ORIGIN (see ...


5

Reduce your exposure within System Preferences > Sharing close everything you don't need. To give you a practical example, in my case, everything is off. Shut off netbios: cd /System/Library/LaunchDaemons /usr/bin/sudo launchctl unload -w com.apple.netbiosd.plist ps ax | grep 'PID|netbiosd' This might highly reduce network noise. Scan for residual ...


3

We cannot comment on the possibility of a latent infection of your computer. We do not have enough information, and this is not an infection-removal forum. But, we can talk about your bigger questions. To know if you have privacy is tricky. You can't prove a negative (no one has seen my communication, or everyone has seen none of my communication), but you ...


2

Long answer: Nothing you've described "post OS reinstall" sounds abnormal - with the borderless nature of the internet, it's not surprising that lots of your legitimate traffic seems to be going to servers in other countries (or without DNS entries). While applications which utilize UPnP to function may put you at higher risk for intrusion or exploitation ...


1

Yes, there is a way: don't let that user run arbitrary code. Give them a restricted shell, or better, only a predefined set of commands. You wouldn't prevent any malware from running, unless you've used some non-standard privilege escalation mechanism that doesn't erase these variables. Normal privilege escalation mechanisms (setuid, setgid or setcap ...


3

The domain is 1e100.net but the whois entry you show is for le100.net, with an l, not a 1 (if these appear to be the same for you, then choose a better font). The 1e100.net domain is a lot more legitimate, and its name is some sort of joke. Indeed, if you do a whois request on it, you get: Domain Name: 1e100.net Registry Domain ID: (...) Registrant ...


2

May be able to clarify if you provide an operating system. If you are seeing suspicious traffic originating from your machine to some suspicious hostnames, you should try to see what files/programs are running on your machine producing the traffic. It is possible that they are not malicious, but if they are, there has to be some application ...


2

Essentially, you need to control the execution environment of the apps. There's no magic about it. A couple of solutions that come to mind: You could somehow set all the binaries that worry you as setuid/setgid (that does not mean they must be owned by root, as far as I know). Linux normally prevents attaching to a setuid/setgid process. Please do verify ...


0

Be careful. Check out this answer. Please note that there is malware which will not be detected by anti-virus programs, malware that will infect BIOS and firmware rather than OS.


2

To avoid a whois service from using your input for domain squatting, you should always use the whois service of the official operating entity of that top level domain. For .com, this is VeriSign.


0

I don't think that not being technically proficient is really a problem for installing him a Linux. Given that he has gotten so paranoid to not want go online anymore, it should be possible to convince him to try that. Linux is not hard when it is already installed and working properly (no programs missing, hardware errors…) there aren't special needs, ...


2

Writing entries to the Run subkey is the most common technique used by malware to launch itself automatically. The Autoruns tool shows you what programs are configured to run during system bootup or login. It lists executables that run, DLLs loaded into Internet Explorer and other programs, and drivers loaded into the kernel. So you can compare the hash of ...


0

You can't. See my answer to the similar question How isolated are 2 operating systems on 1 harddisk? The nastiest of the malwares you installed in disk B could easily wipe the contents of disk A. You would want to use a virtualization solution (QEmu, VMware, VirtualBox, VirtualPC…). In this way, the guest operating system doesn't have full control over the ...


0

No, they won't be much isolated. Each install will be isolated from a normal usage. For instance, a Windows update installed on one Windows, won't be applied to the other. The main problem, as hinted by Rory Aslop, is that both will be able to see each other partition. So a virus which eg. infected each .exe files on the computer, will infect both ...


0

There can be security benefits of using something like tails for example keyboard logger - having an on-screen keyboard can get around this, and recording the monitor feed is impractical (lots of data + processing), but possible network monitoring/injection - using TOR and ONLY secure connections, you can be pretty secure from snooping, although it depends ...


4

This is a very broad question. As you have not really talked about the type of encryption whether it be file based or memory based and so on. Short answer: No, Just because it uses encryption doesn't mean it will be undetectable. Long answer: It will however be likely to be undetectable until the AV vendor manually reverse engineers and generate some form ...


1

Malware doesn't care if you're running a "standard-install Ubuntu desktops only". Malware will run as long as the system supports the correct instruction set that the ELF binary was compiled for. Ubuntu is debian based supporting the following instruction sets: IA-32, x86-64, ARMv7, ARM64, PowerPC. Generally you find most are built on IA-32 or x86-64 ...


3

It seems strange that odd behavior only occurs when using Skype. If there was a RAT (remote administration Trojan), which can include key logging functions, your computer would be compromised across the board. The loading/processing cursor icon might not be signalling malware at all, its strange that you would suddenly think this is a sign of a virus. If ...


0

Yes, because while most viruses are not targeted at Linux, and so you personally are less at risk, you can still be a good citizen when sending data to people who use Windows. Example: you receive a file from WindowsFan1999, via email or dropbox or CD or whatever. You try and open it, but you think it's corrupted. so you forward the file on to knowledgeable ...


28

You can install an antivirus if you want. It should not hurt your machine, but don't expect much protection for your system and don't consider yourself entirely safe. The efficacy of antivirus software is very relative, and they're mostly in use to avoid propagate old malware especially if you have Windows machines in your ecosystem. You should expect a ...



Top 50 recent answers are included