213 votes

Has it been mathematically proven that antivirus can't detect all viruses?

Under one possible interpretation of that, it's a result of Rice's theorem. A program is malicious if it performs some malicious action, which makes it a semantic property. Some programs are malicious ...
user avatar
193 votes

Has it been mathematically proven that antivirus can't detect all viruses?

Actually, the opposite can be easily proved: since all computer viruses are executable code in one way or another, all you have to do is write an antivirus program that will report ANY executable code ...
user avatar
  • 1,765
173 votes
Accepted

Is it possible to detect 100% of SQLi with a simple regex?

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
user avatar
  • 123k
143 votes
Accepted

Can Beehive detect a Snowden-like actor?

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a ...
user avatar
  • 50.3k
133 votes
Accepted

If malware does not run in a VM why not make everything a VM?

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...
user avatar
109 votes

Is it possible to detect 100% of SQLi with a simple regex?

NO Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
user avatar
  • 1,734
95 votes

Has it been mathematically proven that antivirus can't detect all viruses?

According to Wikipedia: In 1987, Fred Cohen published a demonstration that there is no algorithm that can perfectly detect all possible viruses. It also references this paper. That might be the ...
user avatar
83 votes

How to detect when files from my USB were copied to another PC?

No logs are recorded on the USB itself around file accesses. At best, you might know if the files were changed by looking at the file timestamps, which can sometimes happen just by opening them, ...
user avatar
  • 123k
77 votes

Sanitize computer after Homeland Security seizure

Given that your laptop was in possession of a government entity with unknown intentions towards you for an extended duration, there's really no way you can restore it to a fully trustworthy state. If ...
user avatar
  • 27k
74 votes
Accepted

Is it possible to tell if hard drive is encrypted?

We have two types of encryption here, "file based encryption" and "full disk encryption". There are documented forensics methods and software (e.g. EnCase) that help us detect the schemes and programs ...
user avatar
  • 3,369
59 votes

Is it possible to detect 100% of SQLi with a simple regex?

Technically, this is completely possible (though doing so also renders the database useless): .+ Will indeed detect any possible SQLi. However, it will also detect any attempt to do normal queries(...
user avatar
  • 907
52 votes

How to detect when files from my USB were copied to another PC?

There is no way to be sure by strictly technical means. On the one hand, if your friend has antivirus software installed, it would probably scan your USB stick as soon as it was plugged in their ...
user avatar
  • 771
47 votes

Can a Trojan hide itself, so its activity doesn't appear in task manager process?

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via ...
user avatar
  • 132k
38 votes

Sanitize computer after Homeland Security seizure

This is a great question. Basically, once a device has been seized by an adversary with the level of sophistication as a nation-state, especially the United States, that device and all data contained ...
user avatar
29 votes
Accepted

Is there a way to detect web server in case it's not present in HEADER?

If a website does not use a custom built server to modify the HTTP headers, you can try by examining the order of arrangement in the HTTP response fields. From OWASP: Apache 1.3.23 server: HTTP/1.1 ...
user avatar
28 votes

Sanitize computer after Homeland Security seizure

Depending on your level of paranoia about this and the amount of your code, at the extreme you can move to a LOW-TECH method to circumvent anything that has been done. Buy a cheap printer. Connect it ...
user avatar
  • 397
26 votes

Has it been mathematically proven that antivirus can't detect all viruses?

The statement can't be mathematically proved unless it is reformulated as a mathematical proposition. At the very least, that requires a mathematically sound definition of what a "virus" is: which is ...
user avatar
24 votes

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. The very fact that you're asking the question this way shows you're thinking about the problem ...
user avatar
23 votes

Can Beehive detect a Snowden-like actor?

Anomaly detection systems like Beehive make it easier than before to dig through lots of data and detect suspicious behavior. This means that it is possible for an analyst to focus on the more ...
user avatar
21 votes

Would it be plausible to write your own anti-crypto-ransomware tool?

Why there are not already more anti-crypto-ransomware tools? Because there are. They are called virus scanners and they should have heuristic algorithms to detect this behavior. Unfortunately the ...
user avatar
  • 48.8k
19 votes
Accepted

How does a website detect proxy?

A proxy will by default tell the destination the IP address of the original requester by adding a X-Forwarded-For HTTP header to the original HTTP request. This make it obviously easy for the server, ...
user avatar
19 votes
Accepted

Reduce Noise when Penetration Testing

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For ...
user avatar
  • 18.9k
19 votes

Has it been mathematically proven that antivirus can't detect all viruses?

tl;dr- The answer depends on exactly what requirements you impose on the question. If you merely want to detect all viruses without further constraint, then simply flag anything and everything as a ...
user avatar
  • 1,443
18 votes

Are there / have there ever been viruses that completely evade virus scanners for very long?

Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by ...
user avatar
  • 132k
18 votes

Sanitize computer after Homeland Security seizure

1) So there's no way of knowing they haven't. I feel like that's a bit above their paygrade (and would they have the time to?). It depends on your paranoia level. If your thoughts flow like a tranquil ...
user avatar
  • 4,737
18 votes

Can Beehive detect a Snowden-like actor?

Snowden's intent was data exfiltration and he was also a system admin. So, he had access to large amounts of data normal users didn't and would have a different pattern of how he interacts with the ...
user avatar
  • 191
16 votes
Accepted

What is TTP hunting?

According to this TTP refers to the Tactics, Techniques and Procedures of cyber threats. Edit: Traditional security measures like firewalls, IDS, endpoint protection, and SIEMs are only part of ...
user avatar
16 votes

Has it been mathematically proven that antivirus can't detect all viruses?

It depends on your definition of "stop". If you define stop as being "detect, ahead of time, that code could do something malicious, and prevent it running", then as others have mentioned, this is ...
user avatar
  • 2,520
15 votes

Is it possible to tell if hard drive is encrypted?

While you can't tell for certain, you can tell within a certain range of confidence. Encrypted data looks like white noise: each bit has exactly a 50% probability of being set, regardless of the rest ...
user avatar
  • 82k
14 votes
Accepted

Is it possible to detect DPI (Deep Packet Inspection)?

It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible