Tag Info

New answers tagged

0

See this answer for some musings about the definitions of such terms, and, in particular, how fuzzy and mostly irrelevant they are. If we really want to make distinctions, then: A spyware is some software which spies on the user. A trojan is some malicious software which gets installed by the victim himself, who was deceived into thinking that the ...


1

The most important part of this post is "with antivirus". Do you have automatic submissions turned on? If so, those computers might have sent in an 'automatic submission' to the AV mothership at some point. It might have been flagged for evaluation, and possibly run in a controlled environment to see what behavior it would exhibit. These environments are ...


0

There's at least one proxy service (trendmicro) that sends occasional duplicates of GET requests as some sort of probe for malware. You shouldn't be alarmed, and your GET requests ought to be idempotent anyway.


3

Yes it can, for example using : Ajax A reference to an external JS or css file An iframe or even a HTTP 302 redirect. This can be used by online malware to generate trafic for a DDoS Attack. Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior. In response to your edit: Yes, Ajax can do ...


4

When you attempt to take over control of a botnet, you are committing an act which is just as criminal as what the original owner of the botnet was doing. No matter how good your intentions are, you are taking control of other peoples IT systems, which is illegal in most parts of the world. Report the botnet to the authorities. When you don't believe that ...


4

If the httpd file was replaced, what ELSE was replaced? This looks like a 'nuke from orbit' scenario. As for taking over a botnet, that isn't a good idea. Whatever that botnet does can be attributed to you because you became one of the controllers in its network. Report to the authorities in your area.


9

In order to make C code "safe", even against a malicious developer, then you have to fix the core issues of C, which have all been repeatedly exploited for arbitrary code execution (exactly what you want to avoid): Weak types. In C, you can take a bunch of bytes, and interpret them as a pointer, an integer, or whatever. All it takes is a cast. As long as ...


3

Safer than not using a parser in that it will stop casual attackers, but not as safe as using a sandboxed scripting language. The big problem you'll run into is that some fairly low-level features of the C language, such as pointer arithmetic, can be used in nefarious ways. For example, you might forbid the use of open(), but a plugin could find a point in ...


3

In general, restoring from a clean backup will wipe out any malware you have. However, there are rare exceptions. Malware can install itself in your computer's BIOS, in which case it will persist through anything but a BIOS flash (and if it can sabotage the flash process, it can survive even that). BIOS-infecting viruses are extremely rare, though, ...


0

Malware was detecting the presence of Rootkit Revealer, so they changed the way that program ran. It now is started by a windows service with a randomized executable name. Similarly, you could use a supervisor process to launch procmon and any other detected executables under "assumed" names.


0

Enterprise or private? In enterprises the one common thing is spearfishing IMHO. For private users, malware and unsigned javascripts. From the perspective of 0, where would you start if you want to penetrate a network, we have to start somewhere.


1

To avoid infection from storage devices, don't execute any files from them, and configure your operating system to not do so automatically. But storage devices aren't the only threat in form of USB. For example, take a look at this USB keyboard: "But that's not a keyboard! That's a USB thumb drive!" Are you sure? "Of course! I can tell a keyboard apart ...


2

One good practice you should follow to avoid getting infected from USBs is to disable the Autorun functionality in all of your computers. If I recall correctly, Windows 7 and 8 have Autorun disabled by default for all devices except CD and DVDs, although the slightly different Autoplay function can still be used on USB devices. You can find a quite thorough ...


-2

Don't connect a promiscuous USB device(s) to your machine. This practice is guaranteed and the only way to prevent "being infected" from such, Oh, and works every time it's tried. TNO PERIOD!


0

Generally speaking, this is called hybrid encryption. When we need to encrypt a lot of data with RSA, well, we don't; not only would this be highly inefficient, but we also don't really know how a big chunk of data should be split into small messages to be individually encrypted with RSA: from a cryptographer's point of view, this is a non-trivial issue, ...


3

Because mythical imagined malware that might subtly modify your unique proprietary source code is very unlikely to exist, there are a couple of slightly more real threats you could check for. If your friend's computer was compromised by a human hacker, the hacker could have copied your code to his computer, studied it, changed it, and uploaded his changes ...


0

Since these are .java / text files, all changes are visible; there is no decompression/unpacking/reversing required here. Since you use Git, my best suggestion would be to see the changes done form your previous commit and the last one. You can see all the changes done to the file and make sure there is nothing malicious code added to it. Git has a ...


0

Over the years, Microsoft has done a lot to make it harder to exploit Outlook out of the box, however, any system that processes data from untrusted sources is open to being exploited. There are many potential vectors for this, particularly if you grab additional content for messages beyond the basic text. It's impossible to guarantee you computer couldn't ...


2

Malware in an email can theoretically compromise your system even if you don't open it. Every mail that comes in is processed to some degree, and vulnerabilities in the email program could be used my embedded malware. This has happened in the past IIRC, several years ago, and I believe it had to do with image processing. Currently there are no published ...


3

Drive by downloads exploit vulnerability (or a set of vulnerabilities) either in the core browser engine or one of its extension to gain code execution. The index page the user initially visits contain the first stage of the exploit which might contain JavaScript for exploiting a use-after-free bug in the browser or might contain Java or ActionScript to ...



Top 50 recent answers are included