Questions tagged [malware]
Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.
2,508
questions
6
votes
2
answers
501
views
Do antivirus programs increase your attack surface and potentially give more power to malware?
When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
- 1,552
0
votes
0
answers
39
views
Is it possible to be infected without installing anything like said at the beginning of the video? [duplicate]
It seems like a 'crazy' claim that John McAfee makes at the very beginning of this video, is it true?
"Over half of all smartphones, both iOS and Android are infected with
keystroke logging ...
0
votes
0
answers
34
views
If a malware infects a usb, will formatting remove it? [duplicate]
My computer probably had malware. Decided to install linux and do a disc wipe using a linux distro called Pop!_OS (ubuntu based)
Can a piece of malware/virus inject itself into an ISO
According to the ...
user261600
0
votes
2
answers
618
views
How common are firmware infections?
Hard drive firmware infections were documented in 2015:
The hacking tool, believed to be a product of the NSA, is significant because subverting the firmware gives the attackers God-like control of ...
- 333
-2
votes
1
answer
539
views
Online service to download file from URL directly as zip [closed]
Is there an online service which allows to download a file from a URL directly zipped?
I want to analyze a potential malicious JavaScript file with some automatic anti virus engines but I don't want ...
- 125
2
votes
1
answer
152
views
Cross OS GPU based malware
I've been doing some research into GPU based malwares, and would like to know if there is a way to run them on a dual boot scenario with the code being executed only on one Operational System and be &...
- 121
0
votes
1
answer
377
views
Is malware a threat vector for REST APIs?
Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files.
Is it possible to execute malware in this scenario?
Would there be any justifiable ...
- 159
1
vote
0
answers
213
views
How can I know if phone is already infected?
Last year, my friend who is learning hacking for nearly 3 years hacked my phone using social engineering by installing some malware in my phone. (After researching on Google, I think it might be a ...
- 11
1
vote
2
answers
385
views
Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
1
vote
1
answer
879
views
How do hackers use C&C servers without revealing their identity and keep them up?
I recently watched a couple of YouTube videos about malware analysis and in most of the cases, the reverse engineer easily found out which IP address the malware connects to.
Usually, there is a link ...
- 41
1
vote
1
answer
2k
views
How to detect whether request to a URL from a system is made through a browser or through a software/malware
I am using FortiAnalyzer-VM64 v6.4.2 GA build2122. Many requests are logged in my firewall/UTM log that are to malicious websites. Although these requests are blocked by the UTM, the problem is that I ...
- 11
2
votes
1
answer
2k
views
How can I wipe an infected SSD [duplicate]
Recently my PC fell subject to some malware. The malware is hidden and all the antivirus software can't find/detect it. The things it has done so far is spyware like, it disabled System Restore from ...
- 21
25
votes
9
answers
9k
views
How is it possible to get infected with malware by opening a file on a Mac or Windows machine?
Corporate security trainings keeps saying "download a file from the web or email attachment and open it and you might become infected". I know this used to be the case on old Windows ...
- 393
0
votes
2
answers
1k
views
Can spyware be downloaded and installed on Android phone in a minute or less?
Following Scenario:
You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone).
Now let's presume that the very exact person has intentions to install ...
- 1
0
votes
1
answer
2k
views
Is it possible for malware to infect google drive?
If I move a malicious file to Google drive, can my other files there get infected? Or can my google account itself get compromised?
user261600
1
vote
0
answers
358
views
Looking for origin/ verification of malicious domain names [closed]
My network sniffer for websites has discovered a number of hosting domains in the report which I can not correctly assign to categories. I don't know if there are providers behind these domains that ...
- 11
0
votes
1
answer
144
views
Can you subvert a physical system at runtime?
In case of a virtual machine it is possible to break out of the VM and gain code execution on the host. In that way you could evade any detection mechanism for malware inside the VM and maybe even on ...
- 1
0
votes
1
answer
126
views
WMI commandline utility, console window host, and windows command processor all opening for a split second
Basically these 3 processes open for about 1/3 of a second and then instantly close on my task manager. I don't know what it is and I wasn't able to find anything on google about it. I am a little ...
- 1
0
votes
0
answers
923
views
Hijacking a WhatsApp session
If a device running a WhatsApp account has already be compromised. Can the attacker steal session cookies/encryption keys on the device and establish a persistent connection to receive calls and ...
0
votes
1
answer
222
views
If I dedicate one computer to answering emails, and turn network discovery off, will that help protect the rest of my network from malware?
My boss is very concerned about malware. He has heard that malware usually comes in via email attachments, and so he wants me to set up a computer specifically for that task and isolate it somehow.
Is ...
- 3
0
votes
1
answer
115
views
Analyzing potential threats from re-directs
I just clicked a link on pinterest to take me to the source website. Upon clicking, it took me to the following 5 links:
https://s3.amazonaws.com/bishkek0303/decorative-graphic-design-element-in-...
- 155
0
votes
1
answer
432
views
SSD supports hardware AES encrytion. hdparm does not report a "Security" section. Should I be concerned?
Note that this is a different case from similar question asked 7 years ago, here: hparm -I /dev/sda does not report a Security section - should I be concerned?
In my case the SSD (part number: ...
- 3
0
votes
0
answers
173
views
Where is malware stored online before it is downloaded?
Where can malware be stored online?
I've looked at several websites about malware infection and it mentions things like drive-by downloads and exploit kits, but I can't see where the actual .exe, ...
- 1
0
votes
3
answers
474
views
What to do after opening a potentially malicious link on smartphone?
What must one do if they opened a malicious link?
Warning: Please do not open the links below as they may be malicious. They have been deliberately mangled to prevent accidental opening
I received an ...
- 1
5
votes
1
answer
3k
views
Any legitimate reason for notepad.exe to make network connections
Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
- 265
0
votes
0
answers
129
views
Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious
Backstory:
I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about ...
0
votes
1
answer
308
views
Is it possible to protect browser credentials from malicious processes?
What items should be considered to create a browser that prevents all access to stored credentials by a malicious process? Hardware attacks being out of scope.
Are there public projects addressing ...
- 183
1
vote
0
answers
638
views
Security of Third Party Plugins in Thunderbird
In Thunderbird (a popular open source email client), there is an extension store similar to Mozilla Firefox which adds further functionality to the client. Mozilla has an article detailing the ...
- 77
0
votes
3
answers
313
views
Is it safe to open email links in a private window?
Sometimes there are links on the email you have to click because they are agrements, but they are coming from a different URL. As of now what I'm doing is opening a private window and pasting the link ...
- 363
0
votes
1
answer
499
views
Can malware go from a computer to an android phone
My computer (probably) had malware, and during that time I connected my phone to it (via USB) for transferring files, using as midi, etc. Is there a chance the malware could've spread from the ...
user261600
0
votes
2
answers
462
views
How to completely restrict Steam in Linux to defend against remote zero day exploits?
My question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or ...
- 388
1
vote
2
answers
257
views
Scanning for malicious hardware on display replacement for a smartphone
I recently bought a replacement display for my smartphone on ebay from a national supplier.
I later realized that it does not have the Huawei logo printed on it, but it is working fine.
There were ...
- 11
1
vote
1
answer
477
views
Utilising 3rd-party AV definitions with ClamAV engine
I have ClamAV/engine pretty widely deployed on most of my Linux/UNIX/POSIX & other boxes - including gateways & at-rest storage, but I've found the ClamAV definitions... lacking... sometimes.
...
- 65
1
vote
2
answers
457
views
Can a ransomware attack succeed with no root privileges, but instead if it does have privileged user access?
If an attacker succeeds in getting the password of an IT support privileged account (that has Domain Control rights), can he successfully carry out the attack and do the lateral movement needed ...
- 33
0
votes
0
answers
335
views
BING default search enginge Firefox malware?
Whenever I open Firefox, it starts with the BING search engine. The default search enginge of Firefox was set to "MyFireSearch" which I changed to Google. I also have no extensions that ...
- 137
1
vote
1
answer
346
views
Does a virus (malware) ever expire?
There's a possibility that my old USB stick (which I haven't used in over a year) got a virus-infected audio file (AAC) among other trusted files. Can I safely open the trusted files bypassing the ...
- 25
0
votes
1
answer
913
views
Windows defender detected and quarantined this: HTML/Phish.GR!MSR. Is there anything further I should do to check my computer has been affected?
Windows defender detected the trojan HTML/Phish.GR!MSR and quarantined it.
After that, I scanned the computer with Malwarebytes and it found nothing.
I can find very little information online about ...
- 101
0
votes
0
answers
33
views
Is verification code a scam? [duplicate]
When facebook sends the confirmation code, the name FACEBOOK is not displayed as the sender,, instead phone numbers of different countries. Until now, it was only on my notebook, but today I synced my ...
0
votes
0
answers
46
views
WP Blog with phishing js file by a Google Search Result? [duplicate]
I wanted to check the WP homepage of a friend of mine, so I googled "rafaeltheissen be piano".
The first Google result seems to point to the official page: https://rafaeltheissen.com/
Here ...
- 101
1
vote
2
answers
312
views
What is Malware Family: pva.intowow
I've gotten an e-mail from my ISP saying that one of my devices might be infected with malware.
In the e-mail they have provided me with some information about the malware but I'm having trouble ...
- 111
0
votes
1
answer
2k
views
Could there be malware in a video on twitter? [duplicate]
I don't know anything about security.
I want to download the videos I like from twitter. And I'm not going to do it by writing a program. I will manually find the necessary link in the html document ...
- 1
5
votes
2
answers
2k
views
IoCs of Pegasus spyware penetration
What are the indicators of compromise (IoCs) that indicate methods used by the Pegasus spyware on mobile phones?
How is penetration still possible when the latest and up-to-date OS of the phone is ...
- 570
0
votes
2
answers
424
views
Why are web browsers insecure?
Currently in the news is yet another hack, this time from NSO and it is reported that an attack vector is via a web link. This is far from unique, as we have got used to advice to not click on "...
- 109
-1
votes
1
answer
537
views
What is this obfuscated JS code trying to do? [closed]
I received phishing email that contains base64 encrypted JS code in the attachment. I decrypted it but can't understand it because of obfuscation. Do you guys have any clue what this code is trying to ...
1
vote
2
answers
624
views
Create memory image of infected machine without risk
I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics.
The problem is that the machine does not have the tools for ...
- 11
3
votes
0
answers
199
views
Process Injection and Process Isolation by OS
If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
- 31
3
votes
1
answer
537
views
Kinsing Malware entering via compromised Dockerhub Images?
I got a server infected with the Kinsing malware, which mines crypto on your server, maxing out your CPUs.
The malware initially creates the files /tmp/kdevtmpfs and /tmp/kinsing If you delete these ...
- 131
0
votes
0
answers
19
views
Infection from website [duplicate]
I wanted to learn more about keyloggers and how to protect myself from them. I clicked on a result from google, but the site seems to be infected.
Link to Sucuri results
Do I need to reinstall my ...
- 1
1
vote
1
answer
294
views
Could video streaming pose a security threat?
lately I have wondered if through video streaming you could get infected by some type of malware, can it be possible? I have two cases I would like to consider, lets say I stream a video that was ...
- 11
0
votes
1
answer
93
views
Odd Kerberos Hosts After HD Wipe, and fresh OS re-install
After reformatting my hard disk and rebuilding/re-installing the latest macOS operating system, I found the following IP addresses after running Kerberos.internal.com:
kerberos.internal.com has ...
