Tag Info

New answers tagged

2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


0

Here's the official statement... http://support.citrix.com/article/CTX200217 Citrix NetScaler ADC and NetScaler Gateway We are not currently aware of any direct risk from this issue to the main traffic path for NetScaler vServer endpoints. Some risk may exist for management interfaces so, in line with existing best practice, we recommend that access to ...


1

Netscalers appear to be vulnerable! Netscaler is running GNU bash, version 2.05b.0(1) , which is stated as vulnerable in http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 Here is what I get: root@ns# env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test root@ns# Response from Citrix on the ticket I raised: ...


11

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


1

It's not fancy. You look at some cookies from the website and try to figure out what information they encode, then try to change the values returned and see if it does anything useful to you. At one extreme, a cookie value like UserToken=f7a7731073f766c6f555a0b9a821dded is unlikely to be any use to you. But if you have cookies like Item=iPhone6&Price=899 ...


1

As gcc complies to the ELF format. PE is Windows Executable files.


0

using System.IO; using System.Security.AccessControl; using System.Security.Principal; using System.Reflection; static void Main() { //////////// Security Prolog var codeBase = Assembly.GetExecutingAssembly().CodeBase; var uri = new UriBuilder(codeBase); var folderImage = Uri.UnescapeDataString(uri.Path); var fs = ...



Top 50 recent answers are included