Tag Info

Hot answers tagged

28

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


22

Let's break it down by category. What information does Carrier IQ monitor? Trevor Eckhart says (depending on the phone manufacturer) it receives each key pressed/tapped, the location of any tap on the screen, the contents of all text messages received, the name of each app that you open or switch focus to, information about each call you receive, your ...


21

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not. A lot of methods have been used in the past. For instance, some rootkits install ...


18

As you said, most drivers run in kernel mode, so they have access to all the interesting stuff and can easily hide from debuggers. There are more reasons which makes drivers an interesting place: There is a huge amount of device drivers, and vendors provide new versions of drivers that differ from the version included in the operating system. So unlike ...


17

A rootkit is a set of tools that you run on a target machine when you somehow gained access to it with root-level privileges. The point of the rootkit is to transform that transient access into an always-open door. An example of a rootkit would be a modification of the sshd binary, so that it always accepts "8gh347vb45" as password for root, regardless of ...


16

Various reasons: Attacker is often not the Developer - Developers of malware sell the packages to anyone - the payload will be then defined by the attacker. Some attackers want to be stealthy - some don't, in fact some delight in being obvious and notorious. Practice - developing techniques Apathy/Ignorance - end users are really no good at fixing ...


12

The number of options for places to hide, places to hook etc is so vast that any step-by-step list for manual checking is going to be incomplete. And of course, there is a whole other story of kernel rootkits, which leave a very small amount of traces in the system, that can usually be discovered with forensic analysis if implemented correctly. What you ...


12

As stated above, root kits work similar on a virtual host as they do on a normal host EXCEPT that many malware/virus/rootkit authors have developed mechanisms to detect whether or not they are in a virtual machine, so they can be scripted/programmed to behave differently than they would on a normal machine. This is highly evident when reverse engineering ...


11

Removal? Forget about it. There is unauthorised root access to your server; anything could have been installed by now and you would have no reliable way to detect it. Even for a forensic expert with local access, it would take a long time to completely audit a system to ensure no trace of extant malware. The only reasonable and responsible course is to ...


10

A Korean researcher demonstrated this on Samsung Smart TVs at Black Hat this year. (Slide deck here.) He mentions that the malware was originally designed for cell phones, and that TV sets were even easier to attack because battery life did not give them away. His basic premise is that if he owns your device, he owns the power indicators, too. Remote ...


10

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


9

If you can find the offending executable or dll, one thing you can do is to upload it at https://www.virustotal.com. Try even the svchost file if you feel it's suspicious. It will show you how many antivirus engines detect it out of a huge list, and will also forward your sample, if it fails to be detected, to antivirus companies for further processing and ...


9

This is such a massive question that I think the only answer is going to be to practice a defence in depth approach to security. Start at the first point of contact and build up protection down the the very core. In order to see what those type of kits are doing make sure you are logging and monitoring everything, this should give you some idea of what is ...


8

I defend myself by not running any of the apps targeted by any of those exploits. I suggest elinks(1) on grsecurity Linux. If you mean, "How do you defend a large organization filled with many users and systems running some, if not all, of the apps targeted by a massive list of exploit packs and crimepacks?", then the correct answer is to implement an ...


8

As part of a CTF challenge that I run, we had some reverse-engineering challenges last year. I posted some advice on how to perform the analysis (verified by folks that do this on a daily basis). The blogpost is here. The links point to tutorials for IDA and OllyDbg, two of the most popular tools for such analysis and there's a nice paper from one of the AV ...


8

tl;dr - compare the results of two functions that do the same thing, and look for differences. Instead of focusing on that single rootkit scanner, I'm going to talk about generic techniques that rootkits use and how we can find them. This should give you a better overview of the challenges involved. Rootkits work by intercepting certain system calls and ...


8

As a rule, this is a fruitless endeavor. It is very uncommon for a hacker to log in from his home IP or from any server directly traceable back to him. It's far more common for hackers to use previously-hacked targets as jump-off points for future attacks. Often attackers will also use other relays (such as IRC bouncers or public IRC networks) to relay ...


7

Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server? Step one: Disconnect the machine in question from all communications channels: Ethernet, WiFi, Bluetooth, serial, Firewire, USB, audio cable, Infrared, parallel. Only the power cable, keyboard cable, and monitor cable should remain connected. Check ...


6

There was WeaponX in 2004, there is even a guide here on how to develop one yourself. Since OSX is a combination of Mach and BSD, there have been rootkits specially developed to target the Mach or Unix side or both. I use Rkhunter on my Unix machines, there is a version for OSX as well, so I suggest you take a look at that. The problem with a rootkit is ...


6

Quick Answers The quickest answers are: "defense-in-depth", and "plan for failure" You have protections in place, but what if they fail? What if an attacker finds a way in using a method that you did not anticipate? From these perspectives, then, yes, rkhunter is necessary. But, then you start asking, "when do I stop adding more protection?" Right ...


6

Try using Wireshark to do a packet capture and see whats data is being sent out. Then you should at least be able to tell if its anything to worry about. Alternatively try using the netstat -p command that will list what programs are currently listing on ports and you can see if there is anything strange.


6

That exists handily? I'm not aware. However, within the memory space that the VM allocates, the kernel is in predictable location. One could write code which reads the memory and compares the structure to what is expected. If I were implementing such a creature, I'd focus on following the system APIs and ensuring that they are appropriate. One likely ...


6

Another aspect that has not been adequately addressed by CarrierIQ or their customers (the network providers) is what is effectivly stored in memory by the CarrierIQ rootkit and how. All we know from the CarrierIQ marketing person interviewd is that between 200K and 400K of data is sent on a regular basis, but no indication has been given as to if this is ...


6

Your server is infected. It shall be cleansed. With fire. The primary function of a rootkit is to install itself in an inconspicuous place, and intercept whatever it needs to resist reboots and upgrades. For instance, it may have added its code in the kernel itself, and hijack read and write system calls so that it automatically reinfects the kernel file ...


6

The simplest option is actually to set up a machine with a couple of antivirus/antimalware products on it, with no connectivity to other networks, and plug the devices in. It is not foolproof by any means, but to get a deep assurance you would have to examine the driver files and that is likely to be time consuming and uneconomic. Depending on where you ...


6

You don't need anti-virus. Simply look at the contents of one of the drives. Are they empty? Fine, then you are ok. Pull random samples out and check them. If you asked the vendor to put files on the drive, such as promotional materials for you company, then makes sure that the files match precisely. Remember: do this from a machine with the latest ...


6

Most of the time, it's only just barely safer, and sometimes it's less safe. Under what conditions can I simply download the exe(cutable?) Signed packages from major distributions are built on the Distribution's build servers. In that regard, it's almost certainly best to use the packaging system. Are there times when I should I compile the binary ...



Only top voted, non community-wiki answers of a minimum length are eligible