Tag Info

New answers tagged

0

I have not seen anything pivot between the browser and the user that can inform them before the connection is made. Any add-on or application would take a serious beating processing so many variables. Let's have a look: Requester (via browser whether initiated or not) --> browser --> Go get this malice.com/bad.cgi How far do you think you'd be able ...


0

There have been more visible instances of "memory only malware" and I think from a practical perspective you would drive yourself bonkers trying to find that needled in the haystack. What could you possibly look for? Page_Execute_ReadWrite calls? Mutexes? Not only that problem (which calls to look for), but when malware begins hooking into other processes, ...


0

Another solution is to build or modify a existing browser, to not allow any type of external URL typing. You could even have it to use a screen keyboard or such to prevent malicious programs from using SendKeys(); and you could have scrambling screen keyboard and much other security features, And user confirmation if the browser is called externally with a ...


0

I would suggest this: Use a Proxy, which initially blocks all requests. For each blocked request, to authorize them, you would have to type a captcha or Another challenging factor that the malicious program will NOT be able to pass. If the captcha is passed, then the site in question will be permanently added to a whitelist allowing it to pass everytime. Of ...


1

Searching for script headers <script> is a pretty good giveaway, not really necessary, also searching for function-based language with the format ******(***) is helpful. The 'function' declaration is pretty obvious, as is 'var' As far as whether or not it is JavaScript per-se and not a similar language can be a challenging task. Really, though, looking ...


2

Probably somebody is calling you with voIP phones... you can make it seem as if you are calling from any number or even make it appear as is "xxx bank" or whatever. So no biggies on that part. It is very popular nowadays to call people from voIP systems with fake caller info. On your second question, being called from only known people... Look for a ...


1

If you always receive the calls from the very same person, then it might be a trojan on THEIR phone that calls you. However, if theres calls from multiple persons, then it might be the thing that people call "pocket calls", basically, the phone sits in pocket along with keys, wallets, and other objects that push buttons and/or touch touchscreen which in ...


15

Droppers are a framework for deploying payloads. This is useful for botnets because the bot master can deploy his botnet without a specific payload, then rent out his network to his customers who provide the payload they want. Crime-as-a-service. Got to love it.


0

I'll say yes, if Cryptoware 2.0 use a server listed in the list you use. https://easylist.adblockplus.org But it's not the primary job of AdBlock. If you want something to block adware, malware and spyware you should look something like disconnect.me or ghostery. You could also secure your lan by using Secure DNS like using those dns Comodo DNS DNS #1 : ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


2

You are technically wrong when you say "signed the virus". the CA NEVER signs any code. What CA can do, is issue a code-signing certificate. Then the MAKER of the virus do sign the code. This means the CA never see the code and you can't really blame the CA for issuing a code-signing certificate. The Point of a code-signing certificate, is to bind the code ...


0

It was signed by a certificate of the famous and trusted Comodo company. One of the interesting aspects is that the variant of the malware discovered by security researchers is apparently signed a few hours before the campaign was launched, with a valid digital certificate from Comodo, which makes it more difficult to detect on the affected ...


2

Yes. Just having a file on your hard drive does nothing. However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens ...


3

Generally speaking, you are correct. Let's look at some exceptions: If the malware exploits a vulnerability in your email program. If the malware exploits a vulnerability in the software used to "unzip" it. If the malware exploits a vulnerability in the software used to view its contents (ie Windows Explorer). If the malware exploits a vulnerability in the ...


-1

What you are describing sound like FakeAlert or fake antivirus/pc booster/system optimizer software. The sole purpose of the software to get you to buy the "Full" edition to get ride of non existent problems, or problems it has created. They may add advertising on the side, hence Google search diversion...etc. It's not silly malware. It's there to make ...


-2

On wide network level, I would use Malicious File Hunter from https://www.maliciousfilehunter.com/ to search for all double extension files with * . * .exe or for PDF files with *.pdf.exe. The more wild cards you add, the slower search will be, although resources are used at client end, not the system running search.


1

It will depend on what your end goal is. For my part, I create a process by which I can rapidly (within 15 minutes) wipe and reload a drive image on a machine. I take an image of the infected machine first then, wipe, reload, and get the user back up and running. I load the infected image in a protected environment and look for network activity and changed ...


1

If you are looking to do a more hands on manual analysis of malicious software, it can involve a variety of tasks, some simpler than others. These efforts can be grouped into stages based on the nature of the associated malware analysis techniques. This cannot always be observed, but in many scenarios you have an opportunity to perform manual investigation ...


1

If ping is returning an unwanted IP address for a domain, it almost certainly means something is hijacking your DNS settings. The first step to check would be the hosts file /etc/hosts Then look here to determine what server or process is resolving your DNS /etc/resolv.conf Alternatively, you can use this command scutil --dns Firefox may be working ...


0

From the sound of it, you probably don’t need to nuke it. However, without a more advanced look/tools you can’t know you’re good without nuking it. There are plenty of tools out there to catch and remove these types of malware. The problem is, if it’s more advanced they can miss it and you won’t know. These tools can’t see everything that might have been ...


1

It's a Chrome extension. What's happening is that some extension is injecting its own ads into webpages. That way, they can get the revenue instead of the webpage you are visiting. This JS file seems to be a blacklist of sites where they won't inject ads (or so, I am assuming). Reference: ...


1

If the malware is same as the one identified as Andr/FBILock-A by anti-virus firm Sophos, they have detailed removal instructions here: http://nakedsecurity.sophos.com/2014/07/25/android-fbi-lock-malware-how-to-avoid-paying-the-ransom/ It appears that (according to Sophos) this malware does not actually encrypt files, so you may be the victim of some other ...


0

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such ...


-1

An online decryption tool is available from FireEye: https://www.decryptcryptolocker.com/ The thing to note here is that it is specific to certain types of Ransomwares. If you are encrypted by a new variant of Ransomware then it might not decrypt.


0

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but ...


1

Probably not, but it isn't a guarantee. Viruses are just computer programs. They have to be executed by something (in most cases, simply copying the uncompressed files of a virus is not enough to infect your computer either), and generally speaking, compressing one is going to result in making it impossible for it to execute without being uncompressed ...


1

A piece of malware embedded into a file typically contains an exploit and a payload. The exploit is the characteristics that will cause programs that use this file to execute the payload. In contract, a virus that is itself a binary does not need an exploit but just needs you to run it, and its contents essentially is the payload. To keep it simple, an ...


2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


1

Yes it would increase security, as (malicious) cross-domain information leaks aren't possible between browser instances. You can also minimise the use of plug-ins and add-ons in high security browser environments, as they expose additional attackable surface. Another way to mitigate the risk of malicious code running in your browser are ad blockers and ...


0

These Kaspersky has the easiest accessible statistics for OS. You don't have to download a PDF and browse through, and they get to the OS distribution pretty fast. http://securelist.com/analysis/kaspersky-security-bulletin/58265/kaspersky-security-bulletin-2013-overall-statistics-for-2013/


2

From the Add-on FAQ: Are add-ons safe to install? Unless clearly marked otherwise, add-ons available from this gallery have been checked and approved by Mozilla's team of editors and are safe to install. We recommend that you only install approved add-ons. From the "more information" link in the FAQ: Full Review — a thorough functional and ...


0

It's conceivable, but it's more likely the malware will take steps to deactivate or otherwise sabotage the AV. Or, more typically, that the AV won't know how to completely remove one or more parts of the installed malware, leaving stealthy backdoors behind that will reinstall/update the software and/or install other malware. You can't really be confident ...


1

Yes, malware/spyware can indeed detect antivirus software and perform defensive mechanisms. This is a never-ending ‘arms race’ on how and where they hide code. Fortunately, once a system is compromised there is no 100% accuracy on getting back to a clean slate without wiping the system back to a known good state. In my enterprise environment, once we ...


2

Potentially yes. Examples: You download a picture. While you never open the picture, the OS may generate thumbnails for it. If there's a bug (vulnerability) in the thumbnail generator, it may result in code execution. You download a document. While you never open the document yourself, the Search Indexer reads the file to speed up finding documents. If ...


0

Malicious code needs to be run by your computer, but sometimes you don't have to open the file in order for it to be run. Some browsers can be infected by drive-by-downloads, which infect your machine simply by browsing. But, for your specific question, if you downloaded a file, it will not infect you until you open/run it.


0

Guest account shouldn't be able to run binaries outside a whitelist, to prevent potential problems in case the user download a specifically crafted software exploiting a privilege escalation flaw, resulting in the control of the machine (and can now proceed to install a malware system wide)


1

As per the comment on Uwe's answer, there's only a security advantage if the URL you use reference a library with the security problems fixed. Although, to expand on my comment there, the jQuery team have been working with Google to make the latest production release (i.e. with security fixes) available at a (new) non-varying URI. However Google still need ...


0

That something is installed under guest account does not mean it operates under those priveledges, the priveledges of the program are checked on startup by the user, it could still run in the background (i.e. the keylogger). And even so, if you install it yourself, there is a high chance you installed it as the Administrator, mostly when a program is ...


12

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


2

The answer to this question has two sides... First: If you host the libraries yourself then you have to check the security notices on the library regularily and update the library accordingly. This can be a very time consuming task if you include several libraries which must be updated independently. On the other side you can audit each library you use. ...


0

Using third party libraries is always the safer and for sure the recommended way to go (if you trust them). To check your third party libraries you can (e.g.) use the owasp dependency checker. That becomes hard for pure content/script-sites, i guess. I think what your expert ment was to avoid using foreign content in your websites not libraries.


1

You will need an Ethernet hub, not a switch (available cheap on eBay) and a second computer. Plug the Win8.1 computer into the hub and plug your Internet connection also into the hub. The Win8.1 computer now has connectivity through the hub. Download Wireshark to the second computer and install it. Plug the second computer also into the hub, start ...


1

Often malware can attempt to mask itself, so if you are compromised it may be difficult to detect on the system itself. I don't know much about the use of this system, but moving slower and slower could mean adware if it browses a lot of websites. Still somewhat malicious but not quite the same intent as a RAT. You could consider running spybot search and ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


1

First of all, you should check that your firewall is enabled in Windows. Make sure it doesn't have any weird exceptions listed in it. Secondly, install and run antivirus scanner(s) for the entire system. You can run 'netstat -aon' from command prompt to see all "listening" ports. Also check from task manager if you have any weird processes running with ...



Top 50 recent answers are included