Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

2
votes
1answer
60 views

Why did Stuxnet have command and control servers?

I am currently reading Countdown to Zero Day which, amongst other things, describes Stuxnet in lay terms. It states that Stuxnet could report to two command and control servers. Most basic ...
0
votes
1answer
50 views

badBIOS reflashing

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants. Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS ...
1
vote
0answers
32 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
0answers
26 views

Watchbog cryptomining. Who can get some more info about it? [on hold]

This is a comment on a previous post A process called ./watchbog is mining crypto currency in our server. How do I stop it? It happened to me in a RHEL 6 system and wanted to share my info in case ...
-2
votes
3answers
3k views

How to make undetectable malware [closed]

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). Does this imply that there exists a totally undetectable virus? ...
0
votes
0answers
26 views

What are the steps of making a fully undetectable piece of malware? [duplicate]

I've been recently taught how antiviruses work. I know that there is more to it but they basically have a list of known malware that they have encountered and every time they scan, they check if their ...
0
votes
0answers
24 views

I am looking for names of malware that looks for certain applications or folder or ports before further execution, what are their names? [on hold]

Title says it. Adding on, malware similiar to stuxnet that looks specifically for date, etc, step 7 project folder. e.g if the malware was targeting port 3306, MYSQL, it would have to scan port 3306 ...
2
votes
2answers
75 views

Security and thumb drive [duplicate]

If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example
6
votes
3answers
8k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
0
votes
3answers
216 views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
4
votes
1answer
84 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
2
votes
2answers
81 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
0
votes
2answers
246 views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
3
votes
2answers
187 views

Malware Author's Mindset

I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life ...
-5
votes
0answers
48 views

Are mp3 download sites safe? [on hold]

I'm interested in using this service. https://www.mp3juices.cc Is it a legitimate service or is it sketchy? Help.
169
votes
11answers
29k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
1
vote
1answer
69 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
0
votes
1answer
68 views

How are victims targeted from outer networks (WAN)

I started getting more interested about security about one year ago, and from all the things I have learned up to this day I never knew how particular victims are targeted from the attackers from ...
3
votes
3answers
67 views

Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?

Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time? Submitting a file to VirusTotal via File upload results in numerous hits for malware. ...
0
votes
1answer
40 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
1
vote
1answer
285 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
0
votes
1answer
116 views

Local Video Screenshot during Netflix

I was just binge watching Netflix from my MacBook Pro on a TV streamed using HDMI. It automatically started the final episode of the season but about 20 seconds into it, a screenshot from a local ...
0
votes
2answers
183 views

Ways to hide injected dll?

So if I inject my dll to a pprocess (or all running processes, including AVs) and it hooks some functions, why can't I just simply hook the functions (WinAPI functions) that could detect my injection ...
0
votes
1answer
52 views

How can I detect an infection in a database?

Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
23 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
6
votes
2answers
449 views

Why is my Windows desktop using a DNS Server on localhost?

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's ...
1
vote
3answers
187 views

Accidentally clicked a phishing link, am I at risk?

I clicked a link from a fake Twitch streamer and now I'm scared of being spied on. I typed my account details but didn't actually sent them because I realized it was a fake link right before clicking ...
27
votes
6answers
3k views

Why do malware creators use such clever technologies for such silly purposes?

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question). It was a two-...
-1
votes
1answer
50 views

If there is a way to use insecure USB-connected devices in a secure way

This is sort of like working in a lab with toxic chemicals. There is a way to work and wear certain special clothes so you don't get contaminated. Likewise, I wonder if when dealing with malware you ...
0
votes
1answer
110 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
-3
votes
2answers
80 views

Can a Basic Dell Laptop BIOS be tracked? [closed]

I Have a dell latitude 3480 and i was wondering if i sell the laptop would i still somehow be able to track the computer from BIOS.
2
votes
1answer
72 views

How to report a malicious script? [duplicate]

I recently received an email with some malicious script written in JavaScript which affects DLLs. I just want to know if there is a kind of security board or something along those lines where I can ...
1
vote
1answer
76 views

100% detectable backdoor attacks on network

Every article I have read on backdoor attack prevention says pretty much this: Protecting against them may be difficult. I am tired of reading how it can be ~difficult~ to protect against. ...
2
votes
1answer
81 views

Image upload meta information

I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs).. I remove the exif section of the image for security. However ...
3
votes
1answer
121 views

Information on the specifics of how behavioral antiviruses work?

I'm looking into security software and it seems like the Next Big Thing is behavioral antivirus. I'd like to try possibly making my own rinky-dink "next-gen behavioral AV" so I can gain a better ...
0
votes
1answer
219 views

How can I safely use potentially infected USB sticks from a previous OS installation?

So I recently upgraded an old MB Pro to Mojave because I was concerned I could've infected it. Now I'm probably overreacting to all of this but since I was using all of my USB sticks in the previous ...
2
votes
0answers
77 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
1
vote
2answers
213 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
0answers
68 views

Why is Spotify using my webcam (AppleCamera)

I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam. lsof | grep "AppleCamera" Google and Spotify showed up: Spotify 668 ...
1
vote
1answer
89 views

Why did hosts get infected if the endpoint protection product has a signature for that malware?

Multiple hosts were attempting CNC communication that is specific to a threat from at least 2013, H-worm. However, endpoint protection is deployed on these hosts and functioning but no malicious ...
1
vote
3answers
135 views

Extracting features from PE files. Machine learning and malware

Are the features which can be extracted from a PE file (some information from headers, section names, strings, import, export sections etc) enough to use them to train particular machine learning ...
2
votes
1answer
63 views

Does IOMMU protect against malware insertion through PCI Network card/Sound card DMA?

I've just read about this: https://www.tripwire.com/state-of-security/security-data-protection/backdoors-hardware-attacks-rakshasa-malware/ Asides from the question in the title, I'd also like to add ...
2
votes
2answers
331 views

Did I install malware/virus?

I bought a laser plotter, and the seller provided me with software to control it. It's called EleksCam. The provided package from the seller (from aliexpress) consisted of assembly instructions and ...
-2
votes
0answers
44 views

Google Insisting Site Is Hacked, Used All My Resources To Fix It Still Not Enough [duplicate]

I've taken action to remove the said script or link (saskmade). https://saskmade.net/head.js?ver=2.0.0 Here's what I did: Installed Wordfence scan and remove infected files Installed 2 more WP ...
-1
votes
1answer
75 views

What hardware components in a laptop should be removed in order to prevent it from wirelessly communicating with other devices?

If you have a laptop, what hardware components should be removed in order to prevent it from wirelessly communicating with other devices? In other words, how can I prevent a laptop from getting ...
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
4
votes
2answers
119 views

Upload malware to F-Droid repo?

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
1
vote
1answer
135 views

Can a smartphone get hacked even when off? [duplicate]

I've read that there are multiple batteries inside a smartphone, so even when you turn it off it can still communicate with other devices. So my question is, could a smartphone get hacked even when ...
0
votes
1answer
46 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
0
votes
2answers
256 views

Suspicious new folder named .um in internal storage, google search says file is spyware

I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the ...