Tag Info

New answers tagged

0

IHVs extend BIOS by hooking interrupts and providing new code, via Option/Expansion ROMs, a blob stored on the IHV's flash ROM. On UEFI, they don't use BIOS blobs, they use UEFI drivers (PEI Modules, DXE Drives, UEFI Drivers). Malware authors can target BIOS Option ROMs and UEFI drivers. LegbaCore recently said they're working on an Option ROM verification ...


0

The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data. Image a piece of malware that targeted a known vulnerability in your antivirus software, or your spam filtering software.


1

How to diagnose if you are under a brute scan or a targeted attack? If you have the possibility to do so, keep free a specific public @IP within your network. Register it correctly on the DNS as a typical name for a web server. But don't attribute this @IP to any real machine within your network. I mean don't go as far as to create a honey pot, just create ...


0

It is difficult to know whether you are being targeted specifically. It is very likely that you are getting hit with automated scans that can be ignored as long as you have configured your firewall to block all incoming traffic. Phishing attacks and outbound connections to malicious sites are much more serious as they are more likely to succeed. Here is a ...


5

Being hit hundreds or thousands of times per day is completely normal, and I wouldn't worry about it at all. There are a few major sources of suspicious traffic: Automated scanners. A number of organizations "map" the Internet and produce a ton of traffic. They do so more or less randomly. I've gotten a lot of traffic on ports 80 and 443 despite not ...


2

The goal of a piece of malware is to stay on your system for as long as it can. To do this it takes a number of steps, and often just having user administrative privileges is not enough. Gaining execution is only one step. If the malware is lucky enough for the user to execute it it can not assume that it has admin rights. In which case, exploitation of a ...


1

Don't assume the user always has admin rights. That may be the case on home computers, but on corporate networks, the users may be non-privileged users. As to why a virus needs to expoloit a specific vulnerability: Many users aren't stupid enough to download a virus onto their machine and then run it. Even if they did, then UAC would pop up an obvious ...


1

If it's a flash video that's malicious, and your flash player is vulnerable to that particular attack, than it does not matter where it comes from and where you watch it. It's enough to play it to give access to your PC to the attacker.


3

Let's see what we know about this code: It is obfuscated You didn't put it there So it is malicious beyond reasonable doubt.


17

Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer. One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer. Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text ...


6

Autorun applies mostly to external drives connected to the machine, less to downloaded files. If you do not execute the downloaded file, in theory you should be safe. However, practically, your computer may open it itself for your convenience and without asking your approval, whether it is to generate some kind of thumbnail or preview of the document, to ...


69

There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples, but other cases are sure to exist: The file targets a vulnerability in your ...


1

It depends on the type of virus you may have downloaded. Macro viruses: when you open an infected document using the program it is designed to attack. Same thing occurs with program viruses that infect other programs of your machine if the program infected by them are activated by executing them. Boot sector viruses: they infect your hard drives by their ...


1

Based on a relatively brief search of google for my own wants, I've found that the question of "how do I protect my USB" is replied with "This is how you protect your computer." I like this thread because it specifically outlines USB. http://www.irongeek.com/i.php?page=security/thumbscrew-software-usb-write-blocker That is something for your computer, ...


1

No, you are not necessarily infected yet just by seeing that warning message. The website you have visited is compromised and is trying to perform a drive-by download attack which consists in installing malware on your computer without your consent (you can not see anything wrong happening on your machine during the installation process) or -which is your ...


5

I think it's just a scary tactic from the site to make you download something malicious. Do you have any AV on your OS? Did your browser downloaded anything automatically? If you have AV and haven't downloaded anything I would say you are safe. Just ignore this kind of messages. They are just a scary tactic, no website could scan your PC to find a ...


2

No, that is not how encryption works. Where it then you could defeat any Full Disk Encryption by knowing the contents of say some default icon file.



Top 50 recent answers are included