All Questions
2,591 questions
0
votes
0
answers
65
views
Decrypting hacked wordpress files
My friend asked me why his website seems weird on Google and why meta title seems to be “トリプルフローアイロン”.
After checking request logs on his hosting panel and checking files on FTP, it’s clear that the ...
- 1
2
votes
1
answer
78
views
MacOS: How to verify dialogue box is genuinely from Apple (not Malware)
A class of dialog boxes, similar to the one above, is a persistent nuisance on a Mac instance. How does one verify dialogue box is genuinely from Apple (not Malware)
- 1,553
0
votes
0
answers
32
views
Microphone and screen recording [closed]
Why does a green recording symbol appear at the top of my phone as if I am recording a video and I won't even be using my phone? Also my screen records itself and my conversations and stores the ...
0
votes
1
answer
102
views
Are cookies stored with encryption and and how do browsers protect them?
I was using yt-dlp to download YouTube videos. It has an option to obtain cookies directly from the browser, probably all of them.
Do the browsers store the cookies with any encryption?
If so, how ...
- 111
0
votes
0
answers
32
views
How to remove backdoor files from Mac? [duplicate]
On November 18th, I was hacked and lost $10,000 worth of cryptocurrency from my Phantom Wallet. The funds were transferred to the hacker’s account at 2 AM. The day before, at around 5 PM, I had a ...
- 1
2
votes
0
answers
87
views
Malware scanning / AV evasion without sample submission & outdated tools
I'd like to verify that my payload won't get caught by any AVs and ideally EDRs. One way to do this is of course uploading it to VirusTotal and having it scan / check against popular anti virus ...
- 121
0
votes
0
answers
106
views
Can audio content itself carry malware? [duplicate]
According to this question's answer, a screenshot of a malicious image can in fact carry malware, meaning that the actual image itself is malicious.
But does this apply for audio content?
I know that ...
- 3,035
1
vote
1
answer
87
views
Web Server API returns Hacked webpage when Unity Project makes API call
We currently have a linux/apache/sql webserver that has API access for our app in the meta store(Quest 2 & 3).
when manually type in the address on chrome (desktop computer) I get the proper API ...
- 11
0
votes
0
answers
40
views
Using Process Monitor to detect any attempt of using network ressources?
could someone please help me with the following issue? I have completely disconnected my PC from the network and would now like to check if there are any processes trying to establish a network ...
- 43
1
vote
0
answers
76
views
Un-Quarentinable Files and Ghost Malware?
I've run into a series of odd behaviours from my computer (Windows10) and Avast Antivirus and believe I might be infected with an impersonator malware (or I'm being paranoid). I don't know what to do ...
- 11
1
vote
2
answers
132
views
Can USB installation stick rewrite any firmware inside my PC?
I had written an OS installation image to USB to be launched on untrusted PC. Can the untrusted PC modify USB's installation image, for example Windows 10 image, so that when I plug in the same USB to ...
- 43
3
votes
0
answers
806
views
Is it safe to use Internet Archive following its cyber-attack?
This is a follow-up to a question regarding recent Internet Archive hacking.
Website web.archive.org was restored in a readonly mode but is it safe to use it? Looking at the brief disclosure of the ...
- 233
2
votes
2
answers
136
views
checking for the existence of PondRAT malware and eliminating it from Linux (Ubuntu)
News have been going around about the PondRAT exploit that can come from certain Python packages. I have a bunch of Python projects and, while I'm pretty sure I haven't directly downloaded any of the ...
- 165
1
vote
0
answers
121
views
WordPress Site Hacked to redirect stripe.js offsite for credit card skimming - Can't Find The Source
We are experiencing an issue on our WordPress site running WooCommerce, for the second time this year where a hacker is injecting some kind of script that is redirecting the stripe.js code from it's ...
0
votes
0
answers
80
views
What are reliable indicators of suspicious network traffic? [duplicate]
I often see advice in discussions about malware detection that emphasizes monitoring for suspicious network traffic. Honestly, this task seems easier said than done. For example, when using tools like ...
- 43
1
vote
1
answer
70
views
spyware on windows pc [closed]
I have the impression that my boss knows everything i do, even when i am at home. I had to give my laptop away to install printer driver at work and i think they could installed something on my laptop ...
- 21
2
votes
1
answer
183
views
Could it theoretically be possible to get a virus installed through inficted router? [duplicate]
I was wondering if its possible to accidentally install malware and have it spread to your router/ethernet hub. Then reinstall windows and hard reset your drives so the virus has been removed from ...
- 23
0
votes
1
answer
81
views
Enabling App Notification, Not Secure?
so im kind of a beginner and i always hear that when i request data from a server only then the server is allowed to send me data, else it would be a security hole to allow a server to send me data ...
- 23
0
votes
1
answer
44
views
Running and unknown nodeJS/react app
I made a mistake - i was reached out for work regarding a project. Accidentally built it and ran it locally and it was obviously a bunch of nonsense code designed to look like a normal react project ...
- 101
1
vote
1
answer
148
views
Potential Linux.Xor.DDoS - chkrootkit
I have a Debian server, and I was recently contacted by my hosting provider that my server is being used to DDoS people/servers. Is this the cause?
Searching for Linux.Xor.DDoS ... INFECTED: Possible ...
- 11
0
votes
1
answer
160
views
If you downloaded a video file that could potentially contain malware but it didn’t finish downloading, can it still do damage?
What happened was that I downloaded a video from dood(.)sh (a sketchy website), but while it was still downloading I closed the tab, so the download didn’t finished, I checked my files and it weren’t ...
- 1
4
votes
1
answer
175
views
Site preventing Page-closing, CTRL+W, Window Button, etc
I was happily learning ReactJS when I accidentally clicked the URL for www.someurl.com. After all the redirects, the final page prevented me from leaving using CTRL+W, Windows key, Escape, Opening the ...
- 143
2
votes
1
answer
125
views
How to update BIOS before BIOS infected Host reinfects BIOS?
I learned about the BIOS being able to be written to by malware. It reminded me I have a used laptop that performs noticeably slower than any comparable devices, so I went ahead an downloaded BIOS ...
- 141
1
vote
1
answer
225
views
GPU Firmware Infections through AUTOMATIC1111 (StableDiffuision)?
I would like to ask a question about a strange incident that occurred as a result of using the StableDiffusion tool AUTOMATIC1111 (https://github.com/AUTOMATIC1111/).
Here's what happened: I used the ...
- 43
2
votes
0
answers
61
views
what snort rules can detect covert channels?
I'm new to snort. I'm trying to set up rules in snort to detect the presence of covert timing channels. Ideally, I would like to use pre-made rules like the snort community rules.
So far, I've found ...
- 31
1
vote
0
answers
134
views
Can anyone decipher this .BAT malware? [closed]
Its a 3.37MB batch file. When opened in Notepad/++ it's all Chinese and some unknown characters. It's still remaining largely undetectable despite being launched in the wild more than 2 days ago, ...
- 11
1
vote
0
answers
72
views
Jump-Oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another?
Jump-oriented Programming: Why is it better/easier to jump to the dispatcher gadget than to jump from one functional gadget directly to another functional gadget?
My understanding of JOP:
In jump-...
- 21
0
votes
0
answers
69
views
Jump-Oriented Programming: Harder than ROP because the registers need to be prepared individually? + Turing complete, but large overhead/slow?
Full title: Jump-Oriented Programming: Is it harder than traditional return-oriented programming because you need to manually prepare all the addresses and registers or is there a different reason?
...
- 21
0
votes
0
answers
115
views
How to harden VMware for malware analysis? [duplicate]
I’m looking for answers specific to VMware Workstation Pro 17.5.2. in 2024, not answers about other VM softwares.
On Windows 11, how can I harden a VM in VMware Workstation Pro 17.5.2 so that malware ...
- 21
0
votes
0
answers
26
views
Can signing into a compromised account on a new device infect the new device? [duplicate]
Can signing into a gmail account that was compromised/hacked infect a new device? (Account was compromised on one device, and a new device is used to sign in).
What about for other accounts, like ...
2
votes
1
answer
193
views
What are the infection risks for a SMB/Samba file share from an infected client PC?
I have a PC on my home network that I consider potentially infected by exposure to an untrusted program from the internet. (Antivirus detected nothing, and the PC runs fine, but I'm choosing to err on ...
- 23
28
votes
4
answers
9k
views
How long does malware last "in the wild"?
I watched this YouTube video where the uploader connected a Windows 2000 virtual machine directly to the internet, no NAT or firewall.
Within minutes, his VM is infected with malware, the overwhelming ...
1
vote
2
answers
387
views
Backdoor:PHP/Webshell.O virus detected in an uploaded image file. Should I be worried? How can I prevent it?
I have a site which allows users to upload images. One uploaded file was recently detected by antivirus software (uploads aren't scanned, this was a system wide scan after)
Upon upload, I check the ...
- 111
0
votes
1
answer
193
views
Can a USB stick be made to automatically hack a system?
I am a cybersecurity professional who is interested in researching the field of injectables.
Does a device exist, or can be made, that if plugged into a computer would instantly start attacking the ...
1
vote
3
answers
265
views
Can my phone got infected if visit my mail inbox without opening any mail attachments?
I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments.
Is this true?
If yes, how risky for ordinary mail ...
- 11
0
votes
1
answer
155
views
Why Ransomware generate keypair in victim?
I read this answer Ransomware encryption keys and understood how wannacry works. But I still have a question: as I understand, the hacker will put the hacker's RSA public key in the malware, the ...
- 1
0
votes
2
answers
195
views
Clean wipe of USB stick of any hidden codes
If I purchase a supposedly brand new USB stick (or micros SD, or similar portable storage devices) online, and I don't quite know the origin where they are produced, and I am a bit paranoid, is there ...
- 105
7
votes
1
answer
436
views
Why did the xz-tools attacker put so much effort into hiding the malware when they could manipulate the tarball?
With all the discussion about the xz-tools supply chain attack on the Linux distros, what confuses me:
As stated here or on the infographic here, the attackers worked their way to becoming trusted ...
- 173
0
votes
0
answers
67
views
Can my VPN hide my IP address so I can test malware? [duplicate]
I heard that VPN could mask your IP address, but is this perfectly secure? I am trying to open up what I suspect to be malware on a VM, and I obviously don’t want it to be sending my real IP address ...
- 1
11
votes
1
answer
463
views
XZ compromise and consequences for people having used it
Here's a hot topic:
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
https://lwn.net/Articles/967180/
https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@...
- 3,501
1
vote
0
answers
174
views
Malware in a PDF
I opened a PDF yesterday.
How large would a PDF be that has malware? The one I downloaded was approximately 5 MB.
If I opened the PDF on a browser, would the browser be infected?
For some context: I ...
- 11
1
vote
1
answer
155
views
Does PDF level compression implicitly cleans file of malware?
Recently I've been looking into PDF files security, specifically about malware exploiting vulnerabilities in PDF readers. I thought about one thing - does compressing PDF file (for example, by using ...
- 13
0
votes
0
answers
33
views
Is my home network infected? [duplicate]
Today, my family brought me a quite old laptop (it had Windows 7 Enterprise from around 2009). When I tried to turn it on, it was already complicated because I got a black screen with options, but the ...
- 1
0
votes
1
answer
119
views
Can an Azure template contain a virus, a backdoor or malware?
Sometimes you can find projects on the internet that can propose you to import a template to Azure, like this one.
You have a button and if you click it allows you to deploy:
Then you go through the ...
0
votes
1
answer
101
views
How dangerous is this suspicious PHP code? [closed]
I found this code on my web server in /wp-content/uploads/2023/index.php:
$hello_dolly[]='b8f878fc41d0fd3c';
$hello_dolly[]=$_POST;
$hello_dolly[]='color';
if (isset($hello_dolly[1][$hello_dolly[0]])) ...
- 134
0
votes
0
answers
134
views
If you encrypt an entire USB with Veracrypt can malware be put on the USB while encrypted?
Let's say that you take a USB drive and encrypt the entire thing with Veracrypt. Could someone modify that USB drive to include malware on it? This is not assuming that physical changes to the device ...
- 607
0
votes
1
answer
294
views
How to check whether a printer driver is malicious or not
While downloading a printer driver from the company's website, redirected to a google drive link. Google warning says it could be malicious.
The company is MEPL- based in India, but it is using a ...
0
votes
0
answers
316
views
Is it possible to infect a monitor via HDMI plus Ethernet [duplicate]
I caught a virus because of an exe file I downloaded to my computer last week. I am replacing my modem, graphics card, motherboard, processor, ssd and ram components with new ones. What are the ...
0
votes
0
answers
97
views
Possible to supply IKEA Tradfri with Malware? (How to detect / remove)
Maybe I'm overly cautious here, but I bought a 2nd hand IKEA Tradfri lightbulb. The package was opened so whoever owned it before had access to the bulb itself.
My question is: Am I too cautious ...
- 51
1
vote
0
answers
100
views
Streamer Virus on offline network [closed]
I have an offline network with 200 users. and routers, switches, 4 esxi servers and 1 netapp rack.
After about a year, my team found out that we have a virus in the network called streamer.exe that ...
- 11