2

I am trying to detect spyware on my PC by traffic analysis. I am connected to a VPS (the sniffer) by a VPN and I am going to select all the sent data by the POST method. Is this correct? I mean the only way to send data out via HTTP is through the POST method, (leaving out CONNECT) correct?

Improve this question
1
  • I recommend tracing the spyware back to where you first downloaded it. Have you recently downloaded a malicious file? They’re also a number of programs that can help you find and eliminate the spyware. I recommend taking a look at forest’s answer.
    – CoderPE
    Commented Nov 11, 2018 at 1:39

2 Answers 2

Reset to default
4

There are countless ways spyware can exfiltrate information, including, but not limited to:

  • HTTP using a method such as GET, POST, PUT, etc.

  • Raw TCP or UDP payload contents.

  • Hidden in TCP or even IP headers (e.g. smuggled in the URG pointer).

  • ICMP payload contents, which are normally hidden.

  • Induced timing variations in legitimate network traffic.

Checking for sensitive data sent over HTTP POST will not help you detect spyware as there are so many other ways to exfiltrate information from a compromised server. Unfortunately, you will need to know what you are looking for in order to detect spyware traffic. However, if the spyware is not particularly advanced, there are many operating system-specific tools that you can use which will tell you what processes are communicating with the network. This of course assumes that the spyware is not running as a privileged user or in any other privileged context (e.g. kernel mode), otherwise it could hide from any such tools.

Improve this answer
0

I mean the only way to send data out is through the POST method ? (leaving out CONNECT)

No. You can encode data in the URL as well. And maybe it doesn't even use HTTP. You can also encode data in Cookies that are sent through a GET request. The idea that only POST is able to send data is a common misconception. HTML forms aren't even restricted to use POST; you can specify a method.

If it uses HTTP then your best shot is to look for HTTP requests that you didn't make. Then scan through this list and check them because there's probably a lot of background software/services that do all sorts of HTTP requests as well (such as checking for available updates and whatnot).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .