Tag Info

Hot answers tagged

51

Yes, that's possible. The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine. These types of exploits have been common amongst popular document ...


42

The common reasons for links in spam email are: verification that your email address is valid and that it is read which makes the email address more valuable for address brokers (the link needs to have some individual part, that can be a number, but it can also just be unique word from the dictionary). This kind of link may be labeld "unsubscribe". the ...


27

Sure. In Cohen's famous result, he says that a perfect virus detector should emit an alarm if and only if the input program can ever act like a virus (i.e., infect your machine and do damage). Consider the following program: f(); infect_and_do_damage(); where f() is some harmless function, and infect_and_do_damage() is a viral payload that infects your ...


25

The website seem to be be only checking the User-Agent. I tried the following wget --user-agent="Mozilla/5.0 (Windows NT 5.2; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" "http://tfdesignsandpcrepair.com/dinwnle.php?get_info=ss00_323" -O file.zip and it seems to be working One possibility is that you might have tried so many times without a valid User-Agent ...


25

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that. The user could just execute malicious code directly if that's their goal. Really you're interested in whether there's a possibility of ...


22

Some formats can be called inherently insecure due to their complexity and their history of use as attack vectors. Adobe PDF and MS Office files come to mind. Any kind of binary executable is certainly problematic unless sandboxing is deployed. But in general it depends on the application that is used to open the file, not the file itself. Even simple ...


18

You can lookup vulnerabilities at http://cve.mitre.org/. "CVE is a dictionary of publicly known information security vulnerabilities and exposures." A rough seearch of Firefox, returns 888 Chrome, returns 729 Flash, returns 371 Further filtering of the severity of these would need to be done, but this gives an upper bound of found vulnerabilities. ...


17

Firstly, there is no guarantee you'll even be able to run a VM inside a VM. It may seem obvious but it is by no means certain it will even work. This is because VM's may rely on virtualization features of your hardware which are not exposed inside the VM itself. Secondly, why two, why not three, four, five, etc... There is such a thing as overkill security. ...


17

The goal of most malware is to remain active as long as possible. The longer it can collect keystrokes, participate in DDoS attacks, redirect search results, send spam emails, shows popup ads, etc., the more profitable it is for the creator. To reach this goal, it has to be undetected. If a piece of malware infects a machine twice, it may leave the machine ...


17

It all depends on the person; but a good first step would be to change their default browser to Chrome or Firefox - install AdBlock Plus (http://adblockplus.org/, or similar) and Ghostery (http://www.ghostery.com/) in their browser, and a decent anti-virus (Microsoft Security Essentials (http://www.microsoft.com/mse) should be fine, and since it's free - you ...


16

In theory, any format that requires complicated processing or allows embedding of other formats (especially Flash) can be dangerous. The most relevant issues right now are however: Any Microsoft Office files (not so much because of Office vulnerabilities but because these files can embed Flash and exploit its vulnerabilities) PDF files Obviously, any files ...


16

Theoretically, no, an infected machine cannot be trusted anymore. In practice, wiping out the hard disk (or just removing it and inserting a new one) is often sufficient, although some virus have been known to reflash part of the BIOS, for pure wanton devastation, or to make the virus resistant to disk formatting. Some motherboards will not allow reflashing ...


15

Various reasons: Attacker is often not the Developer - Developers of malware sell the packages to anyone - the payload will be then defined by the attacker. Some attackers want to be stealthy - some don't, in fact some delight in being obvious and notorious. Practice - developing techniques Apathy/Ignorance - end users are really no good at fixing ...


15

The difference is mostly a matter of historical tradition. Biologically, a virus is a piece of RNA. RNA is an intermediary vessel for genetic code, which temporarily duplicates a piece of the DNA (the permanent storage of genetic information in a cell). RNA then goes through some "engines" which can duplicate it and/or convert it into proteins (genetic code ...


13

Just to expand on one item in @Hendrik's list, the exploitation item: It is much easier to write an exploit which requires a user to click on something than to fully automate the attack from a position of no contact. All that link has to point at is an exploit for a vulnerability that isn't patched on the user's machine and the results could include things ...


13

There are several known ways that a malicious USB device can compromise your computer: Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled. Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a ...


13

There must be some security hole in the application. Think like any very-simple-and-common .txt file: if you open it with an hex viewer, or with a well-designed textpad editor, it should only display the file content, and ok. Then think about of processing the file, somehow, instead of just showing the contents. For example, reading the file and ...


13

When you plug a USB key in, a considerable amount of things happen. The OS first talks to the USB device to know what kind of device it is and what it can do. Then, if the device says that it is a kind of disk, the OS will look for a filesystem on it, then mount it, and explore some of the files. Depending on what files were found and their name, the OS will ...


12

I have a couple of questions here: Are the files fine when in the lab? And only become 'infected' when you move them to your USB drive? Are you certain the USB stick is clean? Does the USB stick have software on it which is supposed to write files as exe's (some versions do this if encryption is enabled) The reason I ask is that it could be an issue you ...


12

Yes, this is one hundred percent possible: Browsers are huge programs, containing script engines, markup parsers, rendering engines and even audio / video codecs. Any of these parts could have a vulnerability, which might be exploited. Browers run JavaScript, which is a Turing-complete language, making it nearly impossible to analyse what it is doing ahead ...


12

Answer: Yeah. It's possible. Re-install OSX and then change all her passwords. She got phished. IT Services is correct here. Prevention: To prevent this from happening in the future make sure she understands the importance of updates, and how to spot and avoid phishing scams. How it Happened: A lot of attackers will use shortened URLs or legitimate ...


12

Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). To take the fair use criteria one by one: Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a ...


12

Detection for a piece of malware is never removed from a mainstream AV. Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it. Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific ...


11

It is certainly conceptually possible for a virus to attack firmware such as video BIOSes. The virus would have to be tailored for each firmware, so there would have to be a large variety, but that's only an economic argument, not a technical argument. The economics means that you're only likely likely to see firmware viruses in targeted attacks (where at ...


11

Strictly speaking, any software that is added to your computer potentially increases its attack surface. So, it is best practice to only install (or leave installed) software that you actually need. Additionally, if software is installed without your knowledge or consent, this can be an indicator of an underlying security problem. Either: Somebody else ...


11

What you should do now is wipe your computer and start afresh. Treat it as a lesson learnt. You ask whether malware can survive a professional system clean-up. The answer is yes. Once your computer has been compromised, you can no longer trust that it is safe. In fact, I wouldn't consider Microsoft tech support to do a professional system clean-up. Wipe it, ...


11

Step 1 - Nuke your USB drive. Format the thing. Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected. Step 3 - Change your passwords. Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it. Step 5 - Harden ...


11

As mentioned in some of the comments, there are no sites which can be guaranteed safe. Even reputable sites have suffered through banner ads, coding mistakes, deliberate attacks etc. so the first problem is that you cannot trust any website. You can work out a level of likelihood of safety by looking at the code from a sandbox and following links, but many ...


11

Compared to Windows, Mac OS X has: Smaller user base: Means it is less interesting to malware creators, thus fewer viruses. Although there are viruses for Mac OS X, they're not as much as Windows malware. In the past few years, this has been changing, and it's backfiring. Because people think they're less prone to malware, they tend to develop bad usage ...



Only top voted, non community-wiki answers of a minimum length are eligible