Tag Info

New answers tagged

3

Traditionally a virus is malware which uses the infected host to replicate itself to other systems, i.e. by infecting files which might get shared, copying itself to network drives or USB sticks. It gets usually not knowingly executed by the user but gets executed when the user opens an infected file, runs an infected program etc. A trojan is a malware ...


1

These terms have a great deal of overlap and should not be understood to be mutually exclusive of each other. The vocabulary used to describe different forms of malicious software developed organically as researchers described what they were finding to each other as well as distilling the concepts into recognizable terms for people unfamiliar with ...


3

There are several scenarii you may think about. I am not going to be exhaustive, but I will mention briefly the milestones that can come to my mind: Your website is effectively clean Let us suppose your website is clean as you say. So why Google still blacklists it? There may be several reasons for this situation: Reason #1 Google effectively did not ...


4

Why does Google Safe Browsing keep detecting malware on my website? Probably because there is or was malware on this site. We provide a freemium service to upload large files and download them later on. Unfortunately these kind of services get easily abused by anybody which likes to spread malware. They are looking for services which are not ...


4

In the context you provide, it has to do with a backdoor that changes or moves over time. There might be a backdoor on port 8000, then it switches to port 8001, etc. The idea is that once a backdoor is discovered, the hacker must re-discover it to use it again. See also the concept of "port knocking" in real life, where the backdoor only opens once you ...


3

In surveillance I believe the concept of 'roving' is down to the court order placed on an individual. For example; If an authority, be it the police, intelligence or security services is issued a roving surveillance order by a court to tap your phone, then they tap your phone, but then you dispose or make inactive that phone, then the order will allow ...


1

Change your password. Regardless if this is a genuine compromise or not password hygiene is vital, especially when anything that is suspicious is flagged up. You should also set up two factor authentication. There are number of innocent reasons why this could happen though, I've listed a few below, which are in no way ment to be an authoritative final ...


1

As schroeder states it's much more likely that something between you and your ISP caused your public facing IP address to change. The vast majority of consumer internet dynamically allocates you an IP address, so simply restarting your modem will probably result in it changing.


0

Virtualized Environment. Set up a series of virtual machines on virtual networks in a host that is in its own segmented network (VLAN, firewalls, no outward connections allowed, etc.). Run all your analysis in this environment. You connect by connecting to the host, then from there to the virtual machines. Even if malware runs rampant, you only risk the ...


1

There have been a few incidences of add-ons in the Experimental category being found to have malware. I seem to remember the Thai dictionary addon being found malicious even after approval, but interestingly I cannot find any supporting links at the moment. From the Mozilla blog: Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and ...


3

It will prevent any exploitation of any vulnerabilities unique to the application that you would use to normally open the attachment (e.g. Adobe reader, image viewer, etc). It will not prevent exploitation of vulnerabilities in the browser due to rendering the attachment (although this would hard as the attacker would have to create a browser exploit that ...


9

As written in @Rob's comment, the scammer is trying to get the S/N of your printers (information gathering, the first step in a social engineering attack) so later on will place the real scam: either call and pretend he's your legitimate printer supplier (after all, he knows the S/N of your printers) and persuade you to order cheap paper and toner supplies ...


0

Found it... It's NOT a virus... These files are added by SaveFrom.net chrome extension... I opened all of my sites by IE and see no sign of those scripts as that extension is not present in IE... Damn, what a heavy fear and pressure...!


6

In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non-applicable target. To give a special meaning to an otherwise invalid piece of data is an application of in-band signaling. In the context of servers, 0.0.0.0 means "all IPv4 addresses on the local machine". If a ...


1

When you open an attached document on Gmail using the preview mode (if I may say so), you are safer because it is just an image of the attachment; you can imagine this image as a screenshot, I mean opening the document that way makes you safer because it does not include the functionalities of the original document: However, a similar functionality is ...


-2

Gmail does not allowed some file extensions to be attached via emails for security reasons. MS Office files are considered trusted by default. The idea of opening attachment and preview it on Gmail's page may not be vulnerable. Although the possibility that a virus/malware is sent via gmail is high (i.e renaming the file extension from .exe to .txt), but ...


0

Honestly, you don't want to stick an infected USB stick into a Windows OS or Mac OS running system, since merely plugging in can cause infection. Instead, if you suspect your drive is infected, grab a Live CD for a specialized Linux distro that has anti-virus capabilities, such as Avira Rescue System, boot your system into that secure environment, and then ...


5

As USB drives can be compromised in ways that are not identifiable by an antivirus and not corrected by formatting the drive, the only foolproof solution is to destroy the drive.


1

WPAD attack is a common attack technique among penetration testers (and attackers) usually performed on the network segment where workstations can be found. Doing WPAD attack on servers might make sense, but it is not common. E.g. there can be an auto-update mechanism which downloads regularly something from the internet. But as you said, your servers had no ...


5

Go through the apps you gave some permission on facebook. Especially the "post on my behalf" permission. Remove any you don't trust (or don't remember giving them permissions). Anyway, it might be a one time thing, and there is nothing to get rid of. Read through this blog post for more information. In the extreme case, you might be indeed infected by ...


5

Is it possible that the malware on my computer can inject itself in this process/ISO? Practically, I do not remember hearing a virus infecting an ISO file. Theoretically speaking however, nothing can prevent a virus from infecting an ISO file because, after all, an ISO file is just an archived file. Regarding this fact, viruses have always infected ...


8

It is technically possible to write some malware that intercepts the ISO extraction process and then writes a boot sector to the media in order to run some malware before the normal boot sequence to hinder detection. I do not know whether there are any current occurrences of this type of malware in the wild however. It is probably not worth worrying about ...


0

It is admitted that drive-by download attacks occur only thanks to the user's interaction as it was the case, for instance, with the HDD Plus virus where visitors of the compromised website needed to double click at least on rad.msn.com banners. But actually there have been drive-by download attacks that run successfully on IE, Safari, Chrome and Firefox ...


1

To track outbound connections from your system, likely the best approach would be to use software like Little Snitch for Mac OSX or Glasswire for Windows which can log these connections and also alert/block as needed.


4

Short answer: It will need internet connectivity briefly, then it will encrypt everything even if you disconnect. Long answer As soon as CryptoWall runs, it will generate a random RSA public and private keys, connect to one or more control servers, and upload the private key along with some information on the system it is, like OS version, public IP and ...


0

(This is just a complement to the correct answer from Wim Lewis.) Once you have the pid of your suspect process, here are a few commands to help you analyse what this process might be doing. Let's say you stored this pid in the variable _pid. lsof -p ${_pid} will provide you all the files opened now opensnoop ${_pid} will show you all the files during ...


2

A mature wiki software like Wikimedia usually does not allow normal users to embed any scripts in wiki articles. But still, wikis are prime targets for search engine spammers. The structure of wikis is very search-engine friendly which means that wikis often get quite a lot of page rank which in turn exends to any websites linked from them. Also, anything ...


1

ps l [pid] will list, among other things, the "parent process ID" (PPID) of the process. (If the parent process has exited, though, that information is lost and PPID will be 1.) ps eww [pid] will list its environment variables, which may give a hint where it came from. Are you sure this is malware and not an unexpected behavior of something you're doing on ...


2

I've never before seen anything like this. Is this the only case or has this been known to happen? The scenario you experienced could be innocuous as highlighted in @RоryMcCune' answer as well as it can be a nefarious attempt/attack. Let me explain this last scenario. There is one interesting scenario about your question: as @RоryMcCune said, what ...


13

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


0

I just want to add an information to make you more be careful of this issue than other answers (without diminishing their value) outlined. A researcher said: Companies and administrators tend to trust that breaking out of a VM is not possible. A lot of people consider this to be just another proof-of-concept. They don't understand that is a ...


1

How can this type of hijacking be avoided? I am running Internet Explorer with Windows 8. Switch to Google Chrome. This has the following option which becomes active when repeated dialogue boxes are displayed: Selecting the checkbox will help prevent a malicious webpage from holding your current browser session to ransom.


1

First of all, the phone number that appears on the message alarms appears to be used by nefarious people as you can read for example here. This is said, I want to describe the scenario you experienced according to the behavior you witnessed: Certain compromised websites could lead to malware installation on your computer by simpling visiting them and ...


0

Look on Phoronix.com for Purism reviews, Michael has done a few blog posts on topic, including some controversy about what Purism is doing with their firmware. Traditional IBVs (Independent BIOS Vendors) like AMI/Phoenix/Insyde have closed source codebases. Intel has Firmware Support Package (FSP) and AMD has ASGEA(sp) which contain the necessary blobs that ...


4

I would suggest using Firefox with NoScript or comparable setup. NoScript allows you to monitor scripts loaded from websites and selectively allow certain JavaScript to run. That way you can avoid dubious scripts from running. It is especially useful as many malware is not hosted on the website itself , but often through ads or other third party content. ...


2

Yes, it is possible to deactivate the webcam active light. Here, here, and here all show examples of security researchers doing it.


1

I would consider this to be the milk snake of the ransomware world. In that you are right, FBI ransomware is rather a crafted malicious JS code that is more annoying and scaring than penetrating the operating system, and as you can read on the TheSafeMac: …there is no indication that this is actually Mac malware of any kind. It’s simply an ...


2

IMO, the only way to be sure about your firmware is if you build it and flash it yourself, and don't let system out of your hands. Intel Tunnel Mountain and MinnowBoard are the Intel dev platforms for UEFI. You can build your own firmware on these boxes. If you are concerned about this sort of thing, you might want to use a Novena or perhaps a Purism laptop ...


2

The only way to get control over your computer, that works always, is to physically replace the infected BIOS flash chip with a non-infected one (provided that only the BIOS is infected). It is possible that the flashing utilities aren't infected by the government, so you can perhaps even flash a non-infected BIOS from inside a system, which comes with its ...


0

Quick answer: No Longer answer: It all depends on how the virus acts and spreads itself. Apart from the well known attack vectors such as network connections and file sharing, viruses are able moves between guest and host OS for example by using the emulated virtual COM port. There are also some reports of viruses which attacked the host via virtual ...


0

But - why disable it? If you don't use it, disable it! It's like a telnet service that's no longer being used because you installed an SSH daemon, I sure hope telnet is disabled. Also from an audit perspective, you want to make sure no one had the ability to use this account. Personal administrative accounts make sure things can be tracked back to ...


2

can malware spread when sending a clean file to someone or receiving it via bluetooth ? As you mentioned, malware uses pair-wise communication mechanisms such as Bluetooth to spread. But whether the file you want to send is clean or not does not prevent you (or the destination deice) from being infected because one of the commun ways that malware ...


1

It depends when you need to detect it, when it is happening or after the fact. Live detection is much easier because you can hook system functions that are used to inject DLLs and log the information. When a process debugs itself, it will get notifications when DLLs are loaded. Or you can list DLLs periodically and see differences. There are many methods ...



Top 50 recent answers are included