Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
203
questions with no upvoted or accepted answers
6
votes
0
answers
192
views
What security isolation exists between VDI instance to VMware Horizon to ESX?
I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
- 1,264
6
votes
1
answer
235
views
How to find malware added in supply chain to Android phone?
As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
- 69
5
votes
0
answers
436
views
How to deal with Sage Ransomware 2.2 infection?
My PC got stuck like this:
It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
- 51
4
votes
0
answers
329
views
Comodo Firewall HIPS (Paranoid Mode) Regedits
I've activated Comodo HIPS on "paranoid mode" to firstly see if I have an intrusion via my router but moreover to understand processes that occur.
As of recent, I have had a lot of requests ...
- 41
4
votes
2
answers
741
views
Malware techiques via Linux Chrome and its effects, non-root
Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
4
votes
1
answer
668
views
Suspicious Skype IP connection
I'm posting this three weeks after a malware and keylogger scare that happened through Skype, and my own negligence, which resulted in a fresh install of Windows 7.
Everything's running and clean, ...
- 51
3
votes
0
answers
199
views
Process Injection and Process Isolation by OS
If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
- 31
3
votes
1
answer
538
views
Kinsing Malware entering via compromised Dockerhub Images?
I got a server infected with the Kinsing malware, which mines crypto on your server, maxing out your CPUs.
The malware initially creates the files /tmp/kdevtmpfs and /tmp/kinsing If you delete these ...
- 131
3
votes
0
answers
2k
views
How does PUA:Win32/InstallCore get on my PC?
I run a full (not quick) scan of Windows Defender every night. Somehow, between two nights ago and last night an instance of PUA:Win32/InstallCore got placed on my PC. Windows Defender removed it, ...
- 159
3
votes
0
answers
159
views
First Known Client/Server Architecture Malware
What malware was the first to use a client-server architecture to relay commands?
The earliest that I could find appears to be NetBus which was written in early 1998. The next closest would be Back ...
- 311
3
votes
1
answer
903
views
Show confirmation popup before running any downloaded program in Windows 10
I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
- 61
3
votes
0
answers
173
views
How did Stuxnet prevent the user from seeing the malicious files on a USB stick?
From what I can tell there were two main TMP files present on the infected USB stick. The smaller of the two would run first and hook various functions related to viewing files so as to hide the LNK ...
user224270
3
votes
2
answers
1k
views
How can user send malware code via input=file
After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
- 139
3
votes
1
answer
2k
views
Potential router malware? Receiving "Access Denied" and other weird blocks from various websites
So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few ...
- 131
3
votes
0
answers
125
views
Search function in Outlook and attachements
I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
- 31
3
votes
0
answers
103
views
What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?
Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
- 223
3
votes
0
answers
207
views
Need Security advice on virtualization and windows security
I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction?
Below is my what, how and why I made my virtual machine.
Let me tell you what ...
- 31
3
votes
0
answers
185
views
Wikileaks Vault 7 'WheepingAngel' SmartTV Malware
I investigated a little about the WheepingAngel Malware that was recently leaked due the 'Vault 7 CIA Leaks' by Wikileaks. What i couldn't find where the actual CVEs that enable WheepingAngel to ...
- 324
3
votes
0
answers
819
views
Does storing user files in S3 ensure that my server is secure from user uploaded malware?
Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
- 129
3
votes
0
answers
162
views
Special characters found in logs?
Whilst reviewing logs for a PC we believe to be compromised, we noticed that we had special characters in the authentication failure logs originating from the PC itself. By this I mean that the logs ...
- 31
3
votes
0
answers
286
views
Host process for windows services network activity between other computer on same network
Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
- 133
3
votes
1
answer
372
views
Malware Analysis for Internet of Things Malware
How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
- 31
2
votes
1
answer
199
views
Is running rsync as root problematic?
Is there a security risk with running rsync as root to copy potentially malicious files? Or for that matter with any read command like cp, cat, du?
Background:
I'm moving data from various systems ...
- 21
2
votes
0
answers
43
views
BPFDoor injection point and containment
How to determine BPFdoor entrypoint?I used following link to detect it on host https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-...
- 21
2
votes
3
answers
494
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
- 31
2
votes
2
answers
339
views
Suspicious "ChromeSync" pop-up in Android requesting credentials
Since late May, I have been getting suspicious pop-up messages overlay on top of android Apps (see screenshots), requesting entering of the "ChromeSync Passphrase" for my google account.
I ...
2
votes
0
answers
523
views
Can a virus infect windows 10 bootable media?
I created a bootable windows 10 usb from my friend's computer. I used the official tool from microsoft. I was dumb enough to not check my friend's computer beforehand (turns out he had Utorrent Web ...
- 29
2
votes
0
answers
121
views
Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?
I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them.
Afterwards, I'll ...
- 21
2
votes
1
answer
2k
views
Can a malware steals my Facebook c_user, xs, and datr Cookies?
Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...
- 21
2
votes
0
answers
366
views
What is the current (mid-2020) status of hardware rootkit/malware and possible detection/monitoring?
I've posted a question (link) related to a potential compromised computer via SSH access with root user. Although no evidence of a break-in, I'm considering extended measures to ensure (as much as ...
- 53
2
votes
0
answers
888
views
Identifying Source of Malware Attack on Laravel App
We have a Laravel 5.6.x application running as a REST backend with PHP 7 on one of our servers. The server uses CentOS with WHM/cPanel/PhpMyAdmin
Recently that server issued a maldet warning (our ...
- 21
2
votes
0
answers
132
views
Can binary firmware packages be executed on the system?
Kernels like linux-libre (standard in Debian and other free Linux distributions) ship no binary firmware packages by default.
From my limited understanding of their functionality, a binary firmware ...
- 263
2
votes
2
answers
2k
views
Bypassing Windows Defender VBA custom code
I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
- 51
2
votes
0
answers
201
views
Identification of Unknown Potential MITM/Malware involving SSL Connections
On my server one of the services is a Discord bot. It was down which prompted me to look into why.
In my syslogs I noticed three increasingly concerning items:
do-agent[1066]: 2019/08/25 08:50:21
...
- 121
2
votes
0
answers
149
views
Can malware in Android persist after reformatting/reinstalling?
Something similar to this happened to me recently.
According to the suggested actions in the post:
Do take the device into the dealer and make them explain what those messages are. If they can't ...
- 21
2
votes
0
answers
117
views
Burst and rebuild pdf to discard eventual embedded malware
This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
- 250
2
votes
0
answers
103
views
Invocation of a trusted NodeJS script tries to connect to unkown IP
I have a houskeeping script which I invoked using node index.js which got me this output
The error is because you cannot connect to the IP, but why would it try to connect to it in the first place?
...
- 21
2
votes
0
answers
345
views
BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?
Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation.
The ...
- 21
2
votes
0
answers
229
views
Are there any malware for USB-connected printers
At work, we have a printer/scanner that connects only to USB. As far as I know, no one who uses it has a print server on their computers so I'm not sure it's accessible over the internet. Because most ...
- 983
2
votes
0
answers
168
views
How to get malware campaign runners to use my mail honeypot?
I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
- 21
2
votes
0
answers
616
views
Can VBR rootkit survive format?
I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
- 31
2
votes
0
answers
114
views
Wannacrypt - MS Outlook email
I use MS Outlook for email and have an exchange account such that the email is stored on my laptop as well as in the cloud.
Is it safe to rely on the cloud version of the mail as a backup in the event ...
- 31
2
votes
0
answers
104
views
Unwanted browswer redirection
I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
- 175
2
votes
0
answers
176
views
What is the typical half-life of a virus/worm on the internet?
I am curious about the typical half-life (i.e., loosely relating to radioactive half-life here), if one has been measured/estimated, for the average virus/worm on the internet.
Has anyone done a ...
- 177
2
votes
0
answers
84
views
Can I trust LPS?
LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
- 61
2
votes
0
answers
685
views
Novicorp WinToFlash Lite, spyware etc
I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick.
While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
- 121
2
votes
1
answer
152
views
Cross OS GPU based malware
I've been doing some research into GPU based malwares, and would like to know if there is a way to run them on a dual boot scenario with the code being executed only on one Operational System and be &...
- 121
2
votes
1
answer
854
views
Feasibility of persistent iOS malware which survives factory reset
Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be ...
- 121
2
votes
2
answers
353
views
If a computer gets infected with malware, can the host firewall block the malware from communicating back to its controller on the internet?
I'm trying to figure out how secure a host firewall is, hence the question in the title.
I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for ...
1
vote
1
answer
41
views
How serious are npm module vulnerabilities?
Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them.
I've seen plenty of articles that talk about the rise in malware/spam in npm packages:
...
- 11