Tag Info

New answers tagged

1

As the data is embeded in a PHP script file, it is perfectly safe to download the file and edit in a script editor. If you do manage to decode the obscured data, you do, of course, need to be careful how you handle that. There is no danger to you or anyone else as long as you are not trying to interpret the data automatically. Even trying to interpret the ...


3

Not so paranoid, Opening files in a text editor should be safe. Opening other file types is more risky, PDF's, images, office documents, have all had vulnerabilities where opening the file in certain viewers. Most text editors are simple enough that they have few vulnerabilities. Ensure you never run the .php files, I would recommend changing the file ...


1

Chrome will automatically add search engine configurations any time you visit a site that has a compatible search box. If you don't want it to be there, then remove it. How did it get there? The user went to the pirate bay, and chrome added it. The answer to all of your probability questions is: not very probable given the fact that Chrome will helpfully ...


2

Josten i looked for the malware and found it here is the link but you have to go on the forum and download it http://malwaretips.com/threads/2014-12-11-destover-malware-7-samples.38799/ Go to the Link to malicious sample/URL and you will see the zip file and the password for it.


0

Various sites will offer you the option to add them as a search engine, so it may be likely that the user visited the Piratebay and just clicked to approve such a thing.


1

Bash re-written Turla knock-door In order to understand how this work, I wrote this: #!/bin/bash myIpSum=${1:-0a230673aeea81fba0e6e66aae22cb4c} printf -v bport %04X ${2:-22} # port to watch for incoming ``knock'' printf -v rport %d ${3:-80} # change this for greater then 1024 if not root! while :;do while IFS=': ' read seq loci locp remi remp ...


1

By closing unnecessary ports you just decreased your attack surface, which is a good practice. But by running a modern operating system and web browser, you still have a relatively large (or should I say huge?) attack surface. For example, a secure up-to-date fully-patched drive-by-download-immune browser may not protect you from: Vulnerabilities in ...


1

Your key assumption is impossible. A "drive-by-download-immune browser" capable of surfing the modern web does not exist. Even if no known public vulnerabilities exist for a certain browser, there is always the possibility of zero-days. You don't download anything, but every time you visit a website with Javascript enabled, you are allowing arbitrary code ...


0

The .pdb contains information for the compiler. It contains debugging symbols. It also contains names of library's that are used in the application and also names of forms and resources. The reason why you are seeing .pdb path in the exe file is because it was released with debugging turned on. If you got hold of .pdb file it could help you reverse engineer ...


1

You don't necessarily need two separate firewalls to accomplish this. Without seeing a diagram of your current network topology though, it's difficult to make recommendations. You mention two separate LANS. Are these logically or physically separated? You mention copying files onto a USB drive and moving the data to a machine on the other network. That ...


1

So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way. Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, ...


-2

Learn reverse engineering, assembly language x86 and x64 preferably. If you don't have the time and patience to start learning those then you don't have the time and patience required to analyze malware on the lowest level. Programming is your friend so is networking and the security aspect of it especially. Once you get your feet wet in those subjects then ...


5

The Practical Malware Analysis book itself comes with hands on exercises for each chapter with solutions in the back of the book. It's a great resource that you should probably invest in. If you're not familiar with reverse engineering topics then I would suggest learning x86 Assembly, Windows Programming, and Windows Internals concepts. Pick a debugger ...


0

There are many facets to your answer. Botnets do resort to innumerable possibilities for evading detection, and even secure communication with the C2. Can the malware update itself periodically? DEFINITELY. I have seen malware in the wild which contacts the C2 and downloads updates even every hour. But a daily update is pretty common. In essence, the ...


0

Yes as long as they is communication with the server and the victim then they can remotely modify anything they have access too. Another way is to include some sort of function in the malware that would periodically change the amount that's displayed.


2

From what it sounds like this is not a problem limited to you. Many other WordPress websites have been hit. I'd expect someone to come out with a more comprehensive solution soon. That being said: ARS Technica just reported that it seems like a premium plugin called RevSlider is responsible for the security hole. Other than restoring the website from a ...


0

There are two types of linking: static linking and dynamic linking. DLL Hijacking is when a malicious program takes advantage of dynamic linking. For dynamic linking to work there needs to be a list of paths to find the shared library that is being linked. In Windows there are various ways for the search path to be affected. But there is generally an ...


0

Given Turla is based upon cd00r, there should not be any privilege escalation involved. cd00r runs as normal user application, starting an inetd service on some predefined ports. Thus, removing execute permissions on inted should be enough to block it. sudo chmod o=r `which inetd`


1

How do major AVs deal with signed binaries? ie: Does it influence their detecting ability of the signed malware? If so, how? For example: Do they check CRLs and get the binaries with revoked certificates under stronger scrutiny? Do they only check if the certificate was valid at the time of signature? If 1 or 2 is valid (ie certificate not revoked ...


2

Source:http://blogs.mcafee.com/mcafee-labs/signed-malware-you-can-runbut-you-cant-hide It’s been more than a year since McAfee became an Intel company, and the team and I have been privileged to be a part of designing and developing our DeepSAFE technology, as well as Deep Defender, the first available product that leverages this advancement. Recent threats ...


0

If you are good enough you don't really need a degree to work as a malware analyst. But chance is that in certain position for example, Data Scientist which relates to malware domain, you may need a research degree (for e.g: PhD in Computer Science) to secure that position. Unless you want to stick in the analyst position forever...


4

The hex gibberish you see is machine code. Googling for that particular hex string reveals this wiki page. According to the wiki, this actually runs: rm -rf ~ / & Yes, it's pretty harmful but it should be safe to run in a virtual machine, if you have a backup (or snapshot), under a non-privileged user, otherwise running it as a privileged user ...


3

You could try to put the file on a filesystem which is mounted as read-only. That would at least thwart any attack which uses the normal attack path via file access over the operating system. However, when the malware doesn't use the normal filesystem and does instead attack the raw hard drive devices, this will not help you. The best way to restore a file ...


3

To answer your question, Microsoft does not care because you followed their directions to disable UAC in order to 'bypass' their UAC. To disable UAC remote restrictions, follow these steps: 1.Click Start, click Run, type regedit, and then press ENTER. 2. Locate and then click the following registry subkey: ...


1

Any data can be encrypted; there's nothing you can do to make arbitrary data unencryptable.* As for "a honeypot with a file to somehow reveal the key needed to decrypt the rest of the files," that's what's called a chosen-plaintext attack. Some encryption methods are susceptible to it, but for that reason they're not generally used in the real world. ...


12

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


1

Hooking uses an operating system feature to monitor events sent to the process, like low level keyboard and mouse messages. Applications can utilize a targeted or global hook in order to keylog (malevolent) or listen for keystrokes in order to perform value adding functionality such as executing macros or other hotkey functionality. (benevolent) DLL ...


2

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the ...


0

Polymorphic/metamorphic is usually at least partially written in a low level language. The purpose of polymorphic malware is to evade virus scanners. It does so by making it hard to identify a signature for the file. The simplest version, of course, is a loader which decrypts a section of code when it is time to run. However, this has a limitation: the ...


0

There are definitely a few sites which offer malware binaries for download, and highlight to an extent, the malware family that the binary belongs to, and the related behavior. One such example is VirusTotal. This seems to be a relevant discussion as well.


0

Many companies that maintain these types of data correlations (FireEye, Crowdstrike, Symantec, etc) don't disclose this. They do so because for many of those companies, it's their bread and butter at times. This has led to (what I believe) many companies continuously getting compromised by the same threat actors over and over. (One company seeing something, ...


1

This link is for PDF-aware developer tools: http://www.adobe.com/devnet/pdf.html Specifically, the 1.7 reference that DarkLighting mentions is: http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/pdf_reference_1-7.pdf Section 3.2.4 of the document seems to address your question: 3.2.4Name Objects A name object is an atomic symbol ...


1

Text comments can be included in PNG, JPG, and GIF files. No steganography is necessary. As you have discovered, if the image is included (using PHP's include construct) the code will be executed. That works because PHP has copy mode and interpret mode. Included files start in copy mode, so the PHP interpreter is not looking at the bits of the image at ...


1

I bet there's a small piece of code hidden somewhere that takes care of deobfuscating the real payload from the image and then executing it; that allows the attackers to have a very small piece of malware that they can easily hide somewhere in an otherwise unoffensive PHP file, while keeping the big and not-so-sneaky malware in an image which allows it to go ...


2

You might want to look into the excellent article How to Get Started With Malware Analysis by Lenny Zeltser on SANS. It was written in 2010 but is still relevant today.It covers the Articles, Books, Forums, Blogs and Courses that one could follow to become a Malware Analyst As mentioned in other answers, you also need to be fundamentally good at x86, C/C++, ...


2

I'm not a kernel hacker, but from what I read the technique is analogous to a function hook in user space. Premise User space code interacts with the kernel through system calls. There are system calls that reveal information about the state of the kernel, e. g. f returns list of loaded kernel modules. The kernel manages a table t of system calls and the ...


0

"Re-releases" happen by accident all the time, when an infected, mothballed system gets re-activated, or old, infected media gets pulled out of archive. Case in point, my webserver has a log entry for a Code Red infection attempt in 2013, twelve years after the worm was originally released. Because of this, antivirus software does not normally remove ...


0

If you peruse the various vendors catalogs of malware detected, successfully cleaned malware is re-released continuously with tweaks or is polymorphic in a manner that requires updates in detection to take care of software updates their creators apply. Viruses and malware are just like OS systems now. All those security updates that you see released for ...


2

Yara is a tool which is used to write a rule for detection of malwares whereas CLAMAV is antivirus that has predefined rulesets that is used to detect the malicious software or malware. Today there are various antivirus engines use yara rules to detect malwares. YARA provides simple and efficient way of writing rules. It is more popular because of it can be ...


2

Popular commercial brands are not going to have the BadUSB exploit "installed" when it comes from the factory. You must understand how the badUSB exploit works. BadUSB is an exploit that can be executed against almost ANY USB drive. It's not something that can be exploited on some vendor drives and not other drives. For your drive to become compromised, ...



Top 50 recent answers are included