Tag Info

New answers tagged

0

Certain compromised websites could lead to malware installation on your computer by simpling visiting them and without noticing anything suspecious. Other websites can perform the same goal by poping-up annoying windows that whether you click on Ok or Cancel or even click on the close corner X could trigger malware installation. In both cases the scenario is ...


1

It's the same remote php shell I decoded here: What is this? Virus or scanner? There are only minor changes, and of course changed $GLOBALS["auth"] variable containing code encryption key, which means, that probably this code has been embedded by bot belonging to the different owner.


1

begueradj's answer is good, I only want to add that I went ahead and decoded the data. What executes doesn't look like anything related to spam email, rather it looks like logic related to cookies though I'm not sure exactly what it's doing (anyone more fluent with PHP willing to take a stab?). Code included below: @ini_set('error_log', NULL); ...


2

Actually you can deobfuscate the JS malware you received. You could do it yourself in few hours. You can see the attacker is substituting the alphabet and numbers from 0 to 9 and then encodes them. The spams you receive could hence result from that malware. It will be good for you to study how it works exactly in order to take the appropriate actions. ...


4

Is this the end of malware use of DNS? No. Might tweak the landscape a little, but not hugely. It seems like the dataset in the news article could protect against both. It's useful for catching people using malware that other people have caught before. It is not useful for catching someone who sets up a burner domain just for their attack ...


1

For an operating system-specific answer... On Linux: everything. Yes, even files ending in ".txt". Any file in Linux can have the executable bit set, and hence any file in Linux can act similarly to a .exe in Windows. Moreover, Linux (or at least some flavours) doesn't check file extensions when deciding what program to use for opening a file; instead, it ...


3

A few years ago people thought that jpegs were fine. Then there was an exploit for a jpeg library. You should be scanning everything. What might be safe today, won't necessarily be safe tomorrow. (In addition, keep your system up to date - this is much more important.)


8

Everything. You don't keep a dog and bark yourself; why install an AV software and second-guess what it should be doing? Sure, you can do a risk analysis against every individual file, but that sounds dull. Modern AV is fast, just scan everything. Let it worry about downloads.


2

I want to know how do malwares like ZeroAccess hole punch the network without using a external server? ZeroAccess uses a P2P structure with no single central server. While most of the nodes can be behind a NAT some super nodes need to be not behind a NAT so that they can be reached from the other nodes (behind NAT) and relay communications. That means ...


1

Some (most) malware needs a way to contact its master (the "C&C" as "Command and Control" -- a military expression). This can be to exfiltrate some confidential data that was plundered from the affected system, or, possibly, to obtain fresh information from the C&C, e.g. more commands to execute on the target. Most of the time, the malware wishes to ...


1

It depends on what do you want to achieve: to hide the information that is being sent between the processes or the fact that they are communicating. If your goal is only to obtain confidentiality you can encrypt the information that is being sent between two or more processes. Prior to this you need to some background information on IPC(on both windows and ...


1

You can look first at what STUN is. Afterwards, you can use a library and try it out. From the rfc: Applicability Statement This protocol is not a cure-all for the problems associated with NAT. It does not enable incoming TCP connections through NAT. It allows incoming UDP packets through NAT, but only through a subset of ...


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


0

It is difficult to know whether you are being targeted specifically. It is very likely that you are getting hit with automated scans that can be ignored as long as you have configured your firewall to block all incoming traffic. Phishing attacks and outbound connections to malicious sites are much more serious as they are more likely to succeed. Here is a ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


0

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background ...


3

Let's see what we know about this code: It is obfuscated You didn't put it there So it is malicious beyond reasonable doubt.


1

Yes it can. PDF is a rich format that aside form static content, can contain dynamic elements. The latter can for example contain JavaScript, and other elements. Modern PDF viewers tend to warn the user about potential malicious activity though. If you want an example malware, check out pidief. And generally PDF malware will predominantly be just the ...


1

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.


3

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: ...


1

AV isn't dead but is certainly bypass'ble. AV is pre-assumed to be dead because it's signature based and could be triggered only after having done manual analysis of the threats evolving. It's still at infant stages where you can decide if perimeter defenses would be as stable ONLY with installation of AV's. Also, if you look at the ASCII led backdoors on ...


-1

Say I'm a normal Internet user [...] what are the chances that I will get hacked or malware find a way into my PC? 100%


2

If you are careful as you say, the chances will be lower, but not 0. Trusted websites can also contain malicious flash content. The games on Facebook are made by third parties and that means that you can never be sure if the game has some malicious code. Adds can also contain malicious flash. Another problem is, if a website has an XSS vulnerability, an ...


1

No, you are not necessarily infected yet just by seeing that warning message. The website you have visited is compromised and is trying to perform a drive-by download attack which consists in installing malware on your computer without your consent (you can not see anything wrong happening on your machine during the installation process) or -which is your ...


5

I think it's just a scary tactic from the site to make you download something malicious. Do you have any AV on your OS? Did your browser downloaded anything automatically? If you have AV and haven't downloaded anything I would say you are safe. Just ignore this kind of messages. They are just a scary tactic, no website could scan your PC to find a ...


0

I wrote a tool (in C# and powershell using reflection) that walks thread stacks and reports where the function calls are loading from using GetMappedFile. Shows where all functions are executing from (i.e. which dll and where on disk) if the MappedFile property is blank, most likely reflectively loaded ;) https://github.com/secabstraction/PowerWalker


2

Email is certainly the most common method of pushing malware to a network, but it is not the only one. Also, while malicious files can be delivered as attachments to emails, they can also be presented as links that end users click on, resulting in a drive-by download or perhaps a more traditional virus that the user then has to download and execute ...


0

If the suspicious emails are from a consistently different IP than the trusted emails, then it seems unlikely that his computer is compromised. Instead, it sounds like someone has found a way to spoof his email address, using their own computer to send it. Without knowing more information, I can't really speculate as to why someone is doing this. However, ...


10

You're lucky: it's Windows-specific. First, I took the code, and went to jsbeautifier.org to beautify it: var stroke = "5556515E070B0A1005071024120D171005011C140116100D17014A0A0110"; function do193() { return ',"h'; }; function do112() { return ') { '; }; function do127() { return 'r xa'; }; function do88() { return '= 0;'; }; function ...


0

This sounds a lot like ad-injection software installed by accident. This could be something like a Chrome extension or something bundled along with a download. Google recently did a study on the matter, and they state that they "received more than 100,000 user complaints about them in Chrome since the beginning of 2015", making this a realistic scenario for ...


1

As @schroeder said, someone (probably the same ones that control the 208.91.197.39 IP) hijacked the DNS of your registrar. This means that they changed the DNS records so that the domain (what you incorrectly call "URL") name your customer bought now points to the IP 208.91.197.39 instead to the legitimate IP or domain assigned to your customer. The ...


1

If you're really that paranoid about your air-gapped systems, you might want to consider using backup tapes. They include no active part that could be exploited and aren't mounted as a standard file system so that limit the way the data they contain could be exploited.


3

The weak link in most smartcard applications is PIN entry. Extracting private keys directly from the card is nearly impossible. With some acid package destruction and electron microscope work, a skilled team, and enough time, money, and luck you can in theory extract keys but it involves not only physical access but a scenario where the card will be ...


-1

No. Forget about the remote part. Just give your smartcard to the attacker and tell him to use any resources to get the private key. He will not be able to do so on a local attack let alone on a remote attack. That is all what tamper proof is about. At least that is what the manufacturers claim.


1

You can have a look at Script Defender, ScriptSafe and ScriptBlock Chrome extensions. It looks like they can do what you are asking for. But the JavaScript issue you are talking about is only the tip of the iceberg. Protecting yourself against ransomware is much more complicated than this. At a glance, here is what you can do : If you are using Windows, ...


6

Yes it's possible. An obvious example would be a Remote Access Trojan (RAT). Once your computer is infected they can do essentially whatever they're set up to do. This includes monitoring your screen, logging keystrokes, and accessing webcams. My personal experience with this was being infected with the Blackshades RAT a few years ago. I was monitored for ...


3

Yes this is very possible. Remote Administration Tools (RATS) such a DarkComet or Blackshades are commonly used for this.


1

To put it simply, an attacker can create an executable that has an encrypted virus inside of it. When the executable is downloaded to the victims machine it is not detected as a virus because the bad part is encrypted. When the user clicks on the file, The outer executable will load the encrypted data in memory and decrypt it, then execute it, all using RAM ...



Top 50 recent answers are included