96
Should I be concerned about this?
Yes.
This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. If it was an OTP failure, you would have received an OTP when that login attempt was ...
65
Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute.
The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be download, doing way more than the loader.
It's like most malware ...
23
It really depends on the programming language and the context into which the code is being injected.
For examples of what can be done in a very small amount of code space, check out the Code Golf stack exchange.
11
As I am assuming that the 14 bytes within the video file triggers some memory vulnerability, as Peter Cordes said, those 14 bytes are machine code!
That is a very important fact, as many people answering here is thinking about source code, characters and all. All of that takes ~8 bits / 1 byte per character. So with 14 chars, one possibly cannot do so much.
...
9
It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is:
0: 54 push rsp
1: 5e pop rsi
0000000000000002 <y>:
2: 31 e2 xor edx,esp
4: 0f 05 syscall
6: eb fa jmp 2 <y>
...
9
It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (...
7
True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general.
If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code ...
6
The use of your email to sign up for services might be a coincidence and not being done by the party who logged into your account. I get a dozen of these types of "mistakes" a week from around the world due to my fairly generic email account. So, this set of events might not relate to the person who logged in.
However, there are a couple of scenarios that ...
4
CDR and analysis inside a sandbox are both techniques which have their own problems.
Sandboxes can be bypassed by clever attackers by basing the behavior of the malware on environment and time and thus not showing malicious behavior inside the sandbox.
CDR instead somehow must assume what kind of payload is allowed in the first place in order to remove ...
3
It's protected in the sense that malware cannot be installed on the unmounted encrypted drive. However it's still possible for the encrypted drive to be damaged or destroyed if the drive can be written. A simple dd to the raw unmounted drive can destroy it.
---- Edit ----
If the encrypted drive is a bootable drive, then there is an unencrypted boot ...
3
You shouldn't be concerned.
Just as you said yourself, the attacker was blocked and you have changed the password. There are, however, some actions you should take:
Verify that the discovered password does not hint at any other password you may have used anywhere else.
Harden passwords of other accounts you hold that the attacker may deduce from the ...
3
Relevant talk: https://media.ccc.de/v/36c3-10737-sim_card_technology_from_a-z
Our phones blindly connect to them every day.
Wrong, towers need to authenticate; if you're not using obsolete 2G ciphers, that auth can and will be relatively secure.
In fact, attackers can set up rogue towers that trick phones into connecting to them instead in order to ...
3
Is it possible to decode the md5 hash, and therefore learn which malicious website was using the back doors to my server?
As for the (in)feasibilty to decode the md5 hash see for example here. In short: if it is simple you can brute force it, if it is complex it will be infeasible.
But even if you would be able to decode the hash: it does not contain the ...
3
CDR Overview
CDR (Content Disarm and Reconstruction) describes the process of creating a safe copy of an original file by including only the safe elements from the original file, as defined by the document manufacturer (e.g. Adobe for PDF, MSFT for Word etc.).
CDR Advantages
High Security
Protects from known and unknown attacks.
Deterministic – Since ...
2
There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown ...
2
Malware sitting quiescently on your system is not a danger in the sense that it can spontaneously do something. The risk is more along the lines of, "Don't Push The RED Button!"
The fact that it's there is an opportunity for mistakes. It could be a manual mistake of you inadvertently running it, or another program (like a Virus Scanner) finding it and ...
2
You're wasting your time.
I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.
Even the big names in software development can't protect their software from cracking. Despite very draconian DRM that drives legitimate users nuts, it all ends up on the pirate sites within days of ...
answered Dec 30 '19 at 5:52
Joseph Sible-Reinstate Monica
4,7012 gold badges13 silver badges27 bronze badges
2
Hypothetical questions like this are difficult to answer and are thus discouraged. In order to be able to receive specific answers, you would first actually need to have been infected by the malware. Second, you would need to be capable of discovering, extracting, and analyzing said malware before anybody would be able to tell you what you should be worried ...
2
The company isn't 'attacking' your servers, rather it's just part of a scan that the company provides as a service to it's customers.
On their website they claim they "scan the entire public internet to create real-time threat intelligence streams...bla bla bla". Basically they scan the internet, and provide the data to their customers.
These logs are ...
2
You have been confusing and combining many different concepts into one. To understand how all this works, you need to separate out all the functions separately. Each is simple by itself.
Once the virus code is running, it can do what any other program can do on a computer. It can even trigger functions that already exist on the computer and other programs.
...
2
As far as I am aware, MFA only protects your login to the GMail web mail service. If the attacker could successfully guess your password and you have IMAP client access enabled on your GMail account, he would still have had access to your emails up to the time where you changed the password. You should definitely review those access settings, check the trash ...
1
Your best option is simply to keep everything as up-to-date as possible.
Your example of choice is what is known as a 0-day exploit. Of course once the software provider learns about it and fixes it, it is no longer an zero-day, and the solution is simple: upgrade your software to the latest (protected) version. Before the software vendor learns about the ...
1
Generally malware analysis and steganalysis are orthoginal to each other.
Malware analysis deals with malicious code.
Steganalysis deals with hidden messages.
Yes the hidden message could be malware but it really doesn't matter, it's just a hidden message until it's extracted. For it to run automatically as malware, some other code (malware) would have to ...
1
Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too.
Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware ...
1
I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated.
As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home ...
1
WannaCry does not have any VM detection features, at least according to all the existing analysis. WannaCry itself also does not launch the EternalBlue SMB exploit; the WannaCry dropper does. If you're just trying to use the unpacked crypter executable, you won't see it attempting to exploit EternalBlue.
The first thing the dropper does is attempt to ...
1
I will explain both, DLL Hijacking & DLL Injecting.
DLL Hijacking is a way for attackers to run unwanted code on your system. This means that if an attacker can get a file/program on your system (by social engineering, remote control, etc.) that file could be performed when the user runs an application that is vulnerable to DLL Hijacking.
DLL injection ...
Only top voted, non community-wiki answers of a minimum length are eligible
