Hot answers tagged

8

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (...


3

This is not an exploit, as there is no underlying vulnerability to be exploited. It's more akin to malware, in the sense that it does something malicious on your system. As you probably know, .bashrc and .bash_profile run after a user runs bash and authenticates successfully. This is not a vulnerability and very much so by design and/or necessity, however ...


3

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon myself to determine the true answer and show my testing process. Below are screenshots of a fresh Windows 10 installation in a Virtual Machine(VM) within which I ...


2

This post on the SANS ISC InfoSec Forums website states Windows 7 is not affected. . .The affected library, crypt32.dll (CryptoAPI), is present in older versions of Windows, including Windows 7. But not all versions of this library are affected. and CMU CERT Coordination Center Vulnerability Note VU#849224 explains Windows 8.1 and prior, as well as ...


2

First off (only because you mentioned "realistic"), this is not exactly a realistic scenario for a 64-bit system. The main reason is that the address space is much much larger, which makes it much more difficult to predict and land within your NOP sled. For a more detailed explanation, see this answer. Also, no-execute-stack (NX) is almost universally ...


2

Piquing my interest, I wanted to do some research and found that these types of cases are relatively common. In cases like this, if your Security & Privacy settings are still set to default and bluetooth is regularly used in conjunction with the Public folder, then yes, there's the potential that someone could gain access. But, only to that Public folder....


2

Many crashes aren't exploitable for anything except denial-of-service (DoS). The most common example would be a NULL pointer read; attempting to dereference a pointer to (or anywhere near) 0 will fail, and unless the exception/signal is caught will cause the program to crash. However, just because the program tries to read from zero when given invalid input ...


1

Consider a segfault caused by trying to access memory location 0x0 (ie a null pointer de-reference). Maybe one part of the code thought it was done with a variable and set the pointer to null, and maybe under normal operations it really is done with it, but fuzz testing found some edge-case where something tries to read that variable again after it was set ...


1

Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too. Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware ...


1

I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated. As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home ...


1

There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown ...


Only top voted, non community-wiki answers of a minimum length are eligible