15
The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text:
...
5
If your device isn't connected to the network, either because WiFi is turned off or because your device isn't configured to automatically connect to the network, nothing on that network can affect your device.
However, an attacker may create a network with the same SSID and PSK as one that your device recognizes, such as the WiFi network used at your ...
4
It's very common practice even by legit companies to track open success rates by placing a image link in the body of an email. Then if your email browser like outlook is configured to auto-load images in emails then it makes an HTTP request out to a website to load the image. That request will have a unique id in the url specific to you ... so now that web ...
3
That CVE number is totally bogus. The format for CVE's is CVE-[YEAR]-[number], so any CVE issues this year would start with CVE-2019, CVE-2020 won't be around until next year. The fact that you couldn't find the number on Mitre's website confirms that.
Mails like the one you received are scams. They try to make some quick money by threatening to disclose ...
2
There are many possible ways to retrieve the data harvested.
Depending on the type of attack (automated / targeted), the intended goal of the attacker and the means available to the attacker. Often, one of these is chosen (this is not an exhaustive list!)
Use a Command & Control system that selectively tells the malware what to do and where to send data....
2
It depends on the kind of malware. If it's just a malicious browser extension with no outside-of-the-browser components - which you can test by disabling all browser extensions and seeing if the problem goes away - then it's easy. All you'd need to do is delete (and possibly report) the malicious extension. Of course, the attacker could still have had all ...
2
No, from VirusTotal support:
VirusTotal inspects items with over 70 antivirus scanners and URL/domain blacklisting services, in addition to a myriad of tools to extract signals from the studied content.
If the attack you received was a SQL Injection, the best you could do is to fix the vulnerability that let the attacker to inject malicious code in your ...
2
Windows is not case sensitive by default. If the only symptom you have is a lowercase w and nothing else, it's not an issue to be worried about.
You don't need to remove the drive to inspect on a Linux machine. Download any modern Linux iso, create a bootable USB drive on another machine, and boot on the suspect machine.
2
Yes, a program can change a file intentionally or accidentally(ie a bug). There's nothing preventing that assuming it has write permissions, even if you're only opening/closing it. And that will, of course, change the hash value. You can run diff <(xxd pdf_just_downloaded.pdf) <(xxd pdf_just_opened.pdf) to see the byte changes between the two versions ...
2
Unless the content of the file changes in any way, it is not possible. Hashing algorthims rely on the content of the file to determine the hash of the file.
Unless the file has changed its own content upon execution, or you have written to the file in some way (even metadata within the file itself), then the hash will not change. One flipped bit in a file ...
1
In short, there is no risk when your device is not connected to the network unless the hacker changes the SSID and password of the WiFi to one of the saved (and enabled auto-connect) ones in your device; which is rare, especially when the hacker has not targeted you.
But to be on the safe side:
forget (remove) all saved WiFi on your device,
use VPN for any ...
1
From reading/Googling various docs and looking at incident investigations, it seems to be both. However I am looking for some advice/pointers on the following dilemma.
As you said, it's probably both. It may even depend on the mode the malware enters; it may enter sleep mode waiting for some event or date.
And there's many kinds of malware, from many ...
1
I did this myself. By essentially replacing eval's with echo's I was able to peel away enough layers until I reached the ugly webshell underneath. Appears to be the FilesMan webshell. This blog post matches the code I'm seeing pretty well: http://blog.codeguard.com/malwaregone-threat-analysis-wso-filesman-backdoor/
1
Let me put it like this,
Nowadays malware are often connected to a CNC ( Command and Conquer ) Domain, they often communicate with this domain to inform the hacker that the malware is now active and is pending for future commands to execute, this is part of the sophisticated approaches that is being used today.
The malware enters your environment.
Calls ...
1
As you ask in Steffen's answer about is it safe to use email while using VPN, if you don't trust on this VPN, you can set Google's DNS directly on your MAC and stop using this VPN. To do this, go to System Preferences and then Network Preferences. Go to DNS tab and put 8.8.8.8 on DNS #1 and 8.8.4.4 on DNS #2.
Actually, your problem can be restrict to your ...
1
This looks like a man in the middle attack but not on your computer but instead on your network - otherwise the problem would likely not vanish if you use Tor or VPN.
This might be because you are using an insecure network (like an open WiFi hotspot) where somebody is doing an attack or because your private network is compromised. The latter could be for ...
1
Defining what you mean by "malicious", what you mean by "investigate", and who is doing the investigating are all important.
If you need to determine if the site is hosting malicious code, then you need to run a malware scan on the URL. There are many online sites that can do this for you (as well as the AV on your machine). VirusTotal is a big one and ...
1
It is highly advisable to use two factor authentication in jump servers. The whole purpose of having a jump server is to segregate a "more trusted" set of resources from a "less trusted" set of resources. For example, by virtue of your desktops being exposed to Internet (and potentially phishing via email), they constitute a less trusted zone. The bar to "...
1
No, it's not useful and I just tested it. Here's what I did.
I tried to find a couple of malicious URLs. I ended up picking one to an exe file from https://malc0de.com/database/ , and one to a js file that was mentioned in the news not long ago (about an ongoing attack to Magento). Here are the links that show VirusTotal clearly detects those files and ...
1
Not at all. Write protection is not read protection, and it's more likely a flag saying "I prefer not being written" than a switch. And the OS or card reader can ignore that and write anyway.
According to Wikipedia:
The presence of a notch, and the presence and position of a tab, have no effect on the SD card's internal operation. Rather, it relies on ...
1
As @gowenfawr explained setting the write protection switch will not prevent your computer from reading and executing anything on the storage media.
It would only work the other way around: if your computer is already infected, the malware could not spread onto the storage media.
But even if the switch would prevent the malware from spreading, ask yourself: ...
1
you look at the device and sees it has a write protection switch, so
you move it to turn it on and the storage media is now read only.
Now does that mean malware can't spread from it, can the malware
bypass that protection?
No. Malware acts by being read and executed from media, not by being written to it. Setting the media to read-only merely ...
1
Complement to other answer with details.
This is a kind of Web tracking , possibly by making use of Web beacon by taking advantages of many email client simple HTML renderer.
The sender can embed an URL with an unique identification name inside the email as HTML code. e.g.
<img src="http://www.example.com/id12345.jpg">
Since many email ...
1
On both Windows and Linux (and any other modern OS), the answer is yes if the rootkit is running in kernel mode (as a kernel-mode driver / kernel module). If the rootkit is merely running as Administrator/SYSTEM/root, but hasn't loaded anything into the kernel, it cannot directly write to kernel memory any more than any other user-mode application (which is ...
1
This is attackers scanning for CVE-2019-9978 social warfare RCE (remote code execution) vulnerability
https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-wordpress-social-warfare-plugin-cve-2019-9978/
It is trying to execute the benign test command of
echo "h1loo1"
The scanner/ attacker then tests to see whether they got the word "h1loo1" back ...
1
Tapping a file without an extension will not run it so you are safe there.
If you have unexplained apps or files on your phone and you suspect malware your only good course of action it's to re-image/reset the phone to factory defaults.
Only top voted, non community-wiki answers of a minimum length are eligible
