6
There is a new and growing technology area called Content Disarm and Reconstruction (CDR). This does what you are asking for in general, however not all CDR solutions tackle all file types (like audio and video).
The idea is that the file is analysed and reconstructed to contain only the data and format, but nothing else. It's like a sanitised copy of the ...
3
It depends on the vulnerability.
You can most likely remove the exploit by re-encoding or repacking the audio data. However, to do so, you must take care not to use the vulnerable library to decode the audio data. So, you must make sure that audacity (or ffmpeg, or whatever) does not use this library to decode your file before encoding it again. That means ...
2
Unless a file is somehow auto-executed or otherwise opened by your system, it is not possible for malicious code to run.
2
As of December 17th (2020), it has. See the announcement in Twitter
https://twitter.com/NSACyber/status/1339652646513291264
and the debugger branch of Ghidra in GitHub
https://github.com/NationalSecurityAgency/ghidra/tree/debugger
2
If the malware on your computer injected malicious macros (or some Microsoft Office exploit) into your documents, in an attempt to re-infect you or others when they are opened, then re-opening them in Office on your computer is potentially risky. The same goes for PDFs.
Google Drive's web-based preview of the documents does not cause the documents themselves ...
2
Let's unpack this:
"... Can I safely view these types of files on a google drive (without downloading them)..."
When you view or edit a remote file, you are downloading it. You can see it only because it's on your computer. Depending on circumstances it may only be in memory, it may be written to a temp file, it may be in chunks if the file is ...
2
Why not declare the name of dll as below? Is it just a certain insertion of a null char?
No, these two lines of code create identical null-terminated strings in the resultant binary:
char dllA[] = {'K','E','R','N','E','L','3','2','.','d','l','l','\0'};
and
char dllA[] = "KERNEL32.dll";
Perhaps the malware author believed there was a difference, ...
2
A complete whitelist of trusted devices should block Rubber Ducky specifically as I don't think it has a programmable device ID, but I'm not 100% sure.
However if the question is more generic, then no!
The more programmable Bash Bunny can do the same thing and it supports programming it's device ID. I've bypassed whitelist device lockdowns by using a Bash ...
2
You should check the reputation of the site or the comments of the file. As someone told you in comments, unless someone is using a day 0 attack or and unpatched vulnerability you will be safe. You can't do anything more before you download the torrent.
If you wanna check if the torrent has any kind of malware after the download, you should have a sandbox ...
1
Is it a Windows server or Linux ?
Did you run an AV scan to see if the server is not infected ?
What's the open ports situation ?
Since it's a web server , do see any strange open ports besides ports 80,443
Temporary solution
You could run a script to scan wordpress directory and delete malicious files while logging it
#!/bin/bash
now=$(date)
while :
do
...
1
Usually those people are not very tech-savy. Thus there is a high risk that their PCs might be infected and they might spread it unknowingly via attached USB flash drives.
When booting from a Linux Live CD and accessing the data there, the risk could get reduced as with a reboot, changes to the OS are gone and most malware is written for other operating ...
1
Despite it sounds strategically good, multiplatform malware that would infect both the computer and the router are rare. That's probably because such malware would require two set of vulnerabilities to abuse, and therefore only be effective against a certain pair of computer OS and router model. That would only be practical in targeted attacks, but not for ...
1
On examining closer, you will see that it listens to the loopback interface (127.0.0.1). It is used for the 1Password extension to talk to the 1Password Agent.
It should listen to loopback only, like my cupsd does:
but it may accept connections from your own machine. Note that ::1 is the IPv6 loopback address.
How to determine if it is from your own ...
1
My PC was infected with ransomware and I lost many files. I always backup my C: drive so I was able to restore my operating sytem. I lost some files on my D: drive due to the ransomware so now I always backup this drive more often as well.
My solution to this ransomware problem is to use Deep Freeze (www.faronics.com) to protect all files on drive C:. ...
Only top voted, non community-wiki answers of a minimum length are eligible
