Tag Info

New answers tagged

1

Installing multiple AVs is a very bad idea as the antiviruses will conflict with each other, will take unnecessary space on your hard drive and may cause system instability.I suggest you go with a well known antivirus that satisfy your needs and if ever you need to scan a file using multiple AV then use a free service like VirusTotal Here is a sample ...


1

Yes it is possible although newer bios has code signature protection which make this attack unprobable. The BIOS is tied to the computer architecture in this case x86/x64 and it's end goal is to load the OS. So no matter the OS even no OS you can flash (write) the BIOS. However, the BIOS is not a malware delivery channel. For any useful work (accessing ...


0

They don't get access to your "authentication data" (e.g. password) but to a token, delivered by Google, hopefully not forgeable, that allows apps to identify legitimate Google accounts. It would seem that Google also provides an API for browsing through your devices and an API for installing apps across all devices (not that I haven't checked, but that's ...


0

Let's take another look on this question: detecting malware purely on behaviour is very hard --- not only malware can try detect whether it is running in a virtualised enviorment, but it can (for example) wait some time before activating malicious behaviours (a kind-of-related example: some time ago a chrome extension that waited 7 days before activating ...


1

...practical, to build a sandbox that's identical to an actual computer... test every file and program in a sandbox before it is used... I think this is the wrong question to ask. The real challenge is not to build a sandbox which behaves like a real computer, but one which behaves like a real computer used by the targeted user. Malware actually uses ...


3

Put an actual computer in a physical sandbox environment. The computer itself isn't a sandbox and don't virtualize anything. Need active directory? Put active directory in the sandbox environment. Do your tests, verify what has changed, review computer and network logs. This is more practical than building a sandboxed OS which limits normal hardware ...


8

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with other aspects of a machine. But there is theoretical analysis for the ability of a machine to be virtualized by Popek et al: ...


17

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your question is grounded in practice and in this case the answer is "yes, but it would cost too much". Effort in virtualisation today aims at speeding up the virtual ...


-2

One of connected devices could do MITM attack. Maybe your PC, a neighbor, or your router if it is infected. A rooted android device can also do MITM attacks with dspolit/csploit


0

You download the potentially-MITMed iso. You get the good hash from a trusted way (irc, phoning a friend at a trusted network…). You must use a trusted binary to compute the checksum. This is typically done by using the previous OS (that we assume not to be compromised). If you verify with PGP instead of hashes, you change 2 of getting the right iso hash ...


21

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


0

You may also want to look in ~/Library/LaunchAgents as well as ~Library/LaunchDaemons for a file consisting of a series of numbers and letters. The sequence of these characters will be the same in both directories. Send them both to the trash (you will be asked to login), then empty trash on restart. Another method to unhijack the browser is to Force-Quit ...


2

You are overthinking this. It's possible that an attacker intercepts your connection to Ubuntu servers and redirect your download to a tainted image, but it's a difficult task: They have to be in a position to be able to MiTM your connection, by standing in the route between you and the Ubuntu Servers Maybe perform a DNS attack on you to redirect you to ...


2

Well, one step in the right direction would be to install from a trusted ISO. Ubuntu's ISO is signed with their GPG key. Details are here: VeriFyIsoHowto But then, how do you know that that GPG key is really their's? Me, I'm confident enough with googling for the key (and the assumption, that Google is delivered via HTTPS and that Google has not been ...


0

How can I know due to which application/port/running process that traffic is occurring? Run netstat -ABN from the command line on the end point. This is real time snapshot though, so you'll have to run this while it's occurring.


0

Any system can be compromised if not used carefully. As others have said, if the phone is rooted and apps are installed that do contain exploits then a risk exists for information to be captured from the various interfaces on the device because the device itself can no longer be "trusted." Some apps can contain malware and viruses such as the free ...


-3

Windows 7/8/8.1 will be massively safer than android as they still get security updates from microsoft, android is a complete mess for security, there is a few problems. 1 - google do not support android for very long, a recent exploit they announced wont be patched in 4.3 and older, 4.3 was not even 12 months old when they announced this. Microsoft ...


0

About the script The code is obvious malicious script written in PHP for sending spams and other illegal activities. This script actually is very easy to decode by changing eval to echo and executing it will print the well formatted source code. The reason why the authors of that exploit spent so much time on securing this code via transposition array ...


1

That's a remote command shell for a server that's probably been hacked, and you should consider the server compromised. You would be wise to suspend everything it hosts, audit all code on the machine and rebuild it / replace it. Remote users who probably control this script can force it to issue any command by posting "CODE" that's base64_encoded (that sent ...


0

This file employs similar tactics to obfuscate the payload. The variable names and indentation changed, and its actions become very clear: <?php $char_transposition_map = Array('1'=>'N', '0'=>'S', '3'=>'O', '2'=>'8', '5'=>'v', '4'=>'3', '7'=>'H', '6'=>'n', '9'=>'W', '8'=>'u', 'A'=>'C', 'C'=>'f', 'B'=>'9', ...


25

The last line performs an eval() of function v78ZFAX() given the two parameters like so: eval(v78ZFAX($vFHLJ89, $vIIJ30Y)); That first parameter is the part that takes up the bulk of the code. It is assigned all that random-looking garbage, with . concatenating all those strings together into one long string: $vFHLJ89 = ...


0

This question has been answered, but others may benefit from hearing all sides of this. I'm a security analyst that does malware incident response for a giant company. Most of these answers seem to lead you down the path of reverse engineering new threats and developing signatures or other inoculations, but I ask you to clarify your question; you may be ...


1

You will not be able to tell the application/port/process based on the network traffic alone. For that, you will need to analyze the logs on the endpoint. The add-ons you mention to block ads will help in reducing the noise you are seeing, since I imagine you're seeing a ton of random ad-traffic tied to legitimate white-listed sites users are browsing to. ...


2

Another things are crypters. Crypters are a software just like obfuscators that take in a malware and encrypts its data so that it becomes undetectable by any anti-malware programs. This crypters uses special encryption algorithm and a method to inject the malware directly into a already running program like explorer.exe without even touching the hard ...


4

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research. As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal ...


1

Yes, the BIOS is software. If it is writeable/flashable, it is possible for the BIOS to be overwritten or modified such that it performs malicious actions. The BIOS boots before the operating system and bootloader, so it is entirely possible for BIOS malware to impact and infect on each boot or on fresh installs. This is not a windows specific problem. The ...


1

how does one make a worm to send packets to execute bytes on a computer without the legitimate user downloading the Stuxnet? It has been widely publicised that Stuxnet used at least four 0day vulnerabilities in Windows to circumvent measures which otherwise might have prevented arbitrary code being executed without the user's knowledge. These were ...


1

The nature of an exploit using an image often is a buffer overrun, for instance: Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987) To defend against such an attack, all practices and techniques to detect attacks on the stack and heap of your image processing programs will help. Rigorously checking the source code is the first ...


4

I worked on this problem for an email scanning system, and can say that the lexical properties of URLs for maliciousness are minimal, especially with the constraints you are imposing. It's true that malicious URLs often "Look random", but that's because your experience has transformed "imgur.com/gallery/lBKRZ" into "harmless image server gallery", but ...


0

In addition to what @Mark said about formatting your hard drive, you should format the Master Boot Record as well. It's very unlikely that your adware was that insidious, but better safe than sorry. To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment: bootrec.exe /FixMbr Here's more info on Bootrec.exe Similar ...


5

If you're trying to eliminate malware, a simple format is sufficient. Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries ...


1

Trying to detect malicious URLs is a difficult and in many ways impossible game to win, just like trying to detect malware in executables. IF you are trying to protect your network from malicious URLs, there are threat feeds available, which are useful, be as others have stated, domains are cheap and easy to throw away. The strongest way to prevent ...


1

Domain names are cheap. Attackers are quite happy to register a domain to use in a single campaign. At some point thereafter the domain will be red-flagged by reputation services, but by that time the attacker has moved onto the next one.


1

First, websocket connections are initialized from javascript which gets executed by the web browser on the client. That means typical websocket connections are outbound connections, not inbound connections. Inbound websocket connections would only be possible when the host runs a websocket server. A normal browser will usually not do this. And even when the ...


0

WebSockets are not plain TCP sockets, but offer a behavior similar to TCP sockets inside a HTTP tunnel. To actually use them to connect to arbitrary ports you have to have some server side backend which will make "real" TCP connections to the requested port from the WebSocket. Apart from that this question is better asked at security.stackexchange.com.


3

Go to https://www.virustotal.com/ Put in the URL of the website you visited that gave you the JavaScript warning. It will search to see if that URL has malicious content. You will get results. Unless there is zero-day malware on that URL, the results will be correct.


1

It depends which malware and what it was designed to do. If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that ...



Top 50 recent answers are included