Tag Info

New answers tagged

3

The weak link in most smartcard applications is PIN entry. Extracting private keys directly from the card is nearly impossible. With some acid package destruction and electron microscope work, a skilled team, and enough time, money, and luck you can in theory extract keys but it involves not only physical access but a scenario where the card will be ...


-1

No. Forget about the remote part. Just give your smartcard to the attacker and tell him to use any resources to get the private key. He will not be able to do so on a local attack let alone on a remote attack. That is all what tamper proof is about. At least that is what the manufacturers claim.


1

You can have a look at Script Defender, ScriptSafe and ScriptBlock Chrome extensions. It looks like they can do what you are asking for. But the JavaScript issue you are talking about is only the tip of the iceberg. Protecting yourself against ransomware is much more complicated than this. At a glance, here is what you can do : If you are using Windows, ...


6

Yes it's possible. An obvious example would be a Remote Access Trojan (RAT). Once your computer is infected they can do essentially whatever they're set up to do. This includes monitoring your screen, logging keystrokes, and accessing webcams. My personal experience with this was being infected with the Blackshades RAT a few years ago. I was monitored for ...


3

Yes this is very possible. Remote Administration Tools (RATS) such a DarkComet or Blackshades are commonly used for this.


1

To put it simply, an attacker can create an executable that has an encrypted virus inside of it. When the executable is downloaded to the victims machine it is not detected as a virus because the bad part is encrypted. When the user clicks on the file, The outer executable will load the encrypted data in memory and decrypt it, then execute it, all using RAM ...


2

Executable file encryption is rather obfuscation than real encryption, since encrypted file still have to execute. So "decryptor" part has to know the decryption algorithm and/or key. Antivirus software has: various emulators, for x86 code, x64 code, normalized JavaScript code etc. various decryptors/unpackers for all "crypters" and archives known to ...


2

The way you convert a jpg to a bmp would be to essentially decompress the jpg and write it as a bmp. To convert one archive format to another you'd have to decompress the original first and then compress in the new format. Whether this is "safer" or not depends on whether the tool you're using to automatically decompress has different vulnerabilities to the ...


3

Being able to convert an archive from one format to another without decompressing it is very rare. Different formats use different file structures and algorithms that are incompatible and you'll be forced to decompress the source format at some point. When conversion by decompression is done, many of the vulnerabilities could be exploitable. The attack ...


3

I worked at antivirus industry 12 years ago, so I'll try to explain, but it is possible that my knowledge is a bit outdated. Each serious antivirus vendor has antivirus lab, whose work is split to: detect new viruses and develop solutions for them: signatures, behavioral patterns for heuristic detection, specialized detection code, sometimes cleaning code ...


0

As mentioned by echelon, Zeus source code is available in GitHub. Availability of its source code (leaked in 2011) is one of the reasons many modern botnets are evolved from Zeus. Be careful when infecting with your botnet several VM/computers you control, you don't want the to infect real user machines with your toy botnet! For additional security you ...


0

The antivirus product have different techniques to check if a given file is malicious or not. The most common technique is to check the file signature against the virus database. If there is a match then the file is considered malicious else not. Antivirus products examine a file and create a signature of it, depending upon the characteristics of the file. ...


1

The file it is trying to download is not exactly malware; it is a potentially unwanted program (PUP) (probably spyware). See here for details. Apparently the game you downloaded was either downloaded by a downloader, or packaged into an installer, that relied on OpenCandy. From their site: What is OpenCandy? OpenCandy is a service that helps app ...


1

I hope the game was not a cracked version. The cracked games sometimes have malicious files. The cracker of the game sometimes adds some malicious files so that these files can help the cracker to make some money by advertising or downloading files. Any how it is a better idea to rescan your machine completely. If nothing found then try scanning with a ...


0

If you setup log management and send event logs as syslogs, as seen in the following document -- then you can monitor for IoCs (or hunt through the events). http://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262 For example, if Flash crashes, EMET alerts, or your AV describes a particular ...


2

Julia Wolf of FireEye, Inc. did an analysis: Video here: Julia Wolf, 29C3, 2012-12-29, CVE-2011-3402 Technical Analysis PDF here: Julia Wolf, CanSecWest, 2013-03-08, Windows Kernel TrueType Font Engine Vulnerability Video/Slides again here. HackInParis, 2013-06-20, Analysis of a Windows kernel vulnerability: from espionage to criminal use Gist seems to ...


0

Technically access to kernel land memory space should not be needed to render a font, hence the existence of an exploit and patch. The patch addressed the rendering engines need to access and create writable memory within the stack. While that can occur in either user land memory or kernel level memory registers, this particular lack of bounds checking ...


1

The two previous posts give great advice. Here are the areas I would focus on: 1. C and Assembly Languages - Critical you know Assembly like a second language 2. Debuggers - WinDBG and gdb - A debugger will be your best friend 3. Windows and Linux Internals - You must know exactly how the target system works so you can identify exactly what the malware ...


0

Your book list is a great start. pss' advice to look at the job specs is great as well as his other points. There is nothing like doing, though. To start doing, I suggest starting with crackme (reverse engineering) exercises and some packet analysis exercises. Not only will you learn about malware analysis, you will learn a whole lot about related ...


0

A malware analyst is supposed to be able to perform deep analysis of a malware and provide a signature so that the antivirus software can detect that malware. (This is the reason why antivirus software companies would like to hire you) In order to analyse a malware you might need to have knowledge of reverse engineering. Reverse engineering is a huge topic ...


-3

It's a fake, and is trying either to get you to click on the "OK" button so that it can run something nastier, or to lead you to some scammer's site. The good news is that there are limits on what code that runs on page-load can do in modern browsers, because it isn't started by the user. Just popping up an alert-box isn't much of a risk. It's awkward, in ...


1

To protect yourself from such invasive advertising, I would recommend you to install an ad blocker. It might be ethically questionable to use it on all websites, because that way you are depriving website owners of their income. But when a website uses malicious advertisement, using it is reasonable self-defense. Another way to protect yourself from such ...


1

There are many vectors. In one of my favorite videos from a certain security conference, a guy attacks a laptop running Ubuntu with a regular thumb drive (i.e. no hardware hacks) just by inserting the drive to the computer. Even though there was no autorun, there was automount and indexing. The drive contained a crafted JPEG file which used a flaw in the ...


1

Most of the infections come from computers where security is poorly managed so the autorun feature isn't disabled. Moreover, USB devices are inherently insecure as their firwmare can be rewritten for malicious intent. From SRLabs BadUSB: Reprogramming USB peripherals: To turn one device type into another, USB controller chips in peripherals need to be ...


3

Its a fake alert for scaring users, it will later download fake antivirus program and show you fake scan results. These results will be very alarming and exaggerated displaying various types of virus present on the system and will ask users to buy the product in order to clean the system. Don't fall prey to such scams and never buy any of these products. ...


4

This message is just utilizing the alert function from javascript which is used to display a message to the user. One thing you need to understand is that once this tab has been opened you have already browsed to the "scam" site, the message is shown by the scam site. No harm can be done from the message itself and not from clicking OK. It doesn't matter ...


3

What you describe is a wrong, spam practice but it does not cause other inconvenience over the spam aspect. Browsers allow JavaScript code initiated by a user click to add bookmarks in order to allow websites to propose friendly "Bookmark this site" buttons. However such functionality can be exploited in order to store unwanted bookmarks in visitors browser ...


1

They aren't perfectly secure, as demonstrated with this exploit: VENOM, CVE-2015-3456, is a security vulnerability that impacts some common computer virtualization platforms, notably Xen, KVM, VirtualBox, and the native QEMU client. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and ...


0

We saw this exact issue on one of our servers today. Check the cron files on your system to see if they have been manipulated by this malware - in our particular instance the malware was set to run via the apache user's cron. Check if anything has been added to any of your cron files: grep 'run.sh' /var/spool/cron/* If any results are found, comment them ...


1

I had ads and redirects via ads.matte.com on many devices on the network including android phones, PC's and IPads. I found out that going through a VPN service fixed the problem completely but didn't want to run a VPN service on all devices. The solution for me was similar to some other contributors but very simple to do. All devices used DHCP from the main ...



Top 50 recent answers are included