meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 7 months |
| seen | Apr 14 at 2:52 | |
| stats | profile views | 7 |
I'm a computer security researcher. I have programming skills in C/C++, Java, Objective-C and PHP.
|
Oct 22 |
comment |
Experience with a recent DDoS attack on Apache @Polynomial in general I don't like the idea of sending my traffic to a third party for analysis and mitigation, though it's a nice feature. |
|
Oct 22 |
asked | Experience with a recent DDoS attack on Apache |
|
Oct 6 |
answered | Security Assessment vs. Risk Analysis |
|
Oct 2 |
awarded | Supporter |
|
Oct 2 |
comment |
How a malware executes remote payload OK. So looks like utilizing mmap to load executable in a new process memory and executing it, without being detected on the file system or in the exec system call. Interesting one. |
|
Oct 2 |
awarded | Scholar |
|
Oct 2 |
awarded | Student |
|
Oct 1 |
comment |
How a malware executes remote payload I'm also adding dynamic class loading when the code is written in a language like Java. Using ClassLoader, the payload is retrieved over the network (and possibly stored as a class file) and then runs in the Java runtime environment. |
|
Oct 1 |
comment |
How a malware executes remote payload Yes right, I forgot this one. Passing it to an interpreter could be in many ways, through a pipe, calling the interpreter by invoking the shell using system(...), and perhaps by calling a shared library and feeding the code. |
|
Oct 1 |
comment |
How a malware executes remote payload So, given your list + fexecve(), we can summarize it by either opening a file, creating a pipe (also sort of a file), and loading the payload in an executable memory region. |
|
Oct 1 |
accepted | How a malware executes remote payload |
|
Oct 1 |
asked | How a malware executes remote payload |
