213 votes

Has it been mathematically proven that antivirus can't detect all viruses?

Under one possible interpretation of that, it's a result of Rice's theorem. A program is malicious if it performs some malicious action, which makes it a semantic property. Some programs are malicious ...
Joseph Sible-Reinstate Monica's user avatar
194 votes

Has it been mathematically proven that antivirus can't detect all viruses?

Actually, the opposite can be easily proved: since all computer viruses are executable code in one way or another, all you have to do is write an antivirus program that will report ANY executable code ...
walen's user avatar
  • 1,777
174 votes
Accepted

Is it possible to detect 100% of SQLi with a simple regex?

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
schroeder's user avatar
  • 129k
142 votes
Accepted

Can Beehive detect a Snowden-like actor?

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a ...
ThoriumBR's user avatar
  • 54k
133 votes
Accepted

If malware does not run in a VM why not make everything a VM?

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...
Steffen Ullrich's user avatar
108 votes

Is it possible to detect 100% of SQLi with a simple regex?

NO Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
Sefa's user avatar
  • 1,754
95 votes

Has it been mathematically proven that antivirus can't detect all viruses?

According to Wikipedia: In 1987, Fred Cohen published a demonstration that there is no algorithm that can perfectly detect all possible viruses. It also references this paper. That might be the ...
Harry Johnston's user avatar
84 votes

How to detect when files from my USB were copied to another PC?

No logs are recorded on the USB itself around file accesses. At best, you might know if the files were changed by looking at the file timestamps, which can sometimes happen just by opening them, ...
schroeder's user avatar
  • 129k
74 votes
Accepted

Is it possible to tell if hard drive is encrypted?

We have two types of encryption here, "file based encryption" and "full disk encryption". There are documented forensics methods and software (e.g. EnCase) that help us detect the schemes and programs ...
Silverfox's user avatar
  • 3,407
59 votes

Is it possible to detect 100% of SQLi with a simple regex?

Technically, this is completely possible (though doing so also renders the database useless): .+ Will indeed detect any possible SQLi. However, it will also detect any attempt to do normal queries(...
Fake Name's user avatar
  • 927
53 votes

How to detect when files from my USB were copied to another PC?

There is no way to be sure by strictly technical means. On the one hand, if your friend has antivirus software installed, it would probably scan your USB stick as soon as it was plugged in their ...
IMil's user avatar
  • 1,091
26 votes

Has it been mathematically proven that antivirus can't detect all viruses?

The statement can't be mathematically proved unless it is reformulated as a mathematical proposition. At the very least, that requires a mathematically sound definition of what a "virus" is: which is ...
Michael Kay's user avatar
24 votes

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. The very fact that you're asking the question this way shows you're thinking about the problem ...
Daniel Pryden's user avatar
23 votes

Can Beehive detect a Snowden-like actor?

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
Steffen Ullrich's user avatar
21 votes

Would it be plausible to write your own anti-crypto-ransomware tool?

Why there are not already more anti-crypto-ransomware tools? Because there are. They are called virus scanners and they should have heuristic algorithms to detect this behavior. Unfortunately the ...
Philipp's user avatar
  • 49.4k
20 votes
Accepted

Reduce Noise when Penetration Testing

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For ...
atdre's user avatar
  • 19.1k
19 votes

Has it been mathematically proven that antivirus can't detect all viruses?

tl;dr- The answer depends on exactly what requirements you impose on the question. If you merely want to detect all viruses without further constraint, then simply flag anything and everything as a ...
Nat's user avatar
  • 1,441
18 votes

Can Beehive detect a Snowden-like actor?

Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
RG1's user avatar
  • 191
16 votes
Accepted

What is TTP hunting?

According to this TTP refers to the Tactics, Techniques and Procedures of cyber threats. Edit: Traditional security measures like firewalls, IDS, endpoint protection, and SIEMs are only part of ...
FatSecurity's user avatar
16 votes

Has it been mathematically proven that antivirus can't detect all viruses?

It depends on your definition of "stop". If you define stop as being "detect, ahead of time, that code could do something malicious, and prevent it running", then as others have mentioned, this is ...
James_pic's user avatar
  • 2,580
15 votes

Is it possible to tell if hard drive is encrypted?

While you can't tell for certain, you can tell within a certain range of confidence. Encrypted data looks like white noise: each bit has exactly a 50% probability of being set, regardless of the rest ...
tylerl's user avatar
  • 83.4k
14 votes
Accepted

Signal listening

Passive detection is called "passive" exactly for that reason: it is not detectable. That's by definition. Now your question might be: is there a way to "emit a signal" (i.e. convey information) that ...
Thomas Pornin's user avatar
14 votes

How can you detect kernel exploits?

No, there is nothing all kernel exploits have in common. Or at least, there is nothing unique to them and not present in standard, legal interaction with the kernel (such as using syscalls or ...
forest's user avatar
  • 66.7k
13 votes

Reduce Noise when Penetration Testing

You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a ...
David's user avatar
  • 16.1k
12 votes

How to detect when files from my USB were copied to another PC?

It depends on what kind of filesystem is on the disk. Most filesystems retain an access time that can be viewed with ls -lu, provided the "friend" mounted the filesystem read/write. (Note: ...
Toby Speight's user avatar
  • 1,224
11 votes

Is it possible to detect 100% of SQLi with a simple regex?

No. First of all, there are several evil things you can do with SQL injections which don't require the use of the SELECT keyword, like the infamous universal password ' OR '1' = '1 or the common ...
Philipp's user avatar
  • 49.4k
10 votes

Is it possible to tell if hard drive is encrypted?

If the data is filled with randomness then that means that it is encrypted. Is it that easy to tell? No. If I am going to throw out, or give away, a hard disk I would remove personal data from it by ...
Nick Gammon's user avatar
  • 1,217
10 votes

Can Beehive detect a Snowden-like actor?

No it can't. And the quote that you pulled clearly explained why not, and how people came to claim that it could. What Beehive might be able to do is tell you that a Snowden-style attack has taken ...
Hobbamok's user avatar
  • 225
9 votes

Finding a backdoor on a server?

To expand on @tlng05's point, rootkit authors are professionals, often with decades of experience. Unless you have decades of experience fighting rootkits, then they'll know about more hiding places ...
Mike Ounsworth's user avatar
9 votes
Accepted

HIDS - Choosing between regular OSSEC or Wazuh fork

Regarding Wazuh differences with OSSEC, the Wazuh team is working on updating the documentation to explain those better (and on a new release and installers). Wazuh new version (2.0, currently found ...
snaow's user avatar
  • 106

Only top scored, non community-wiki answers of a minimum length are eligible