Hot answers tagged

259

If the device left your sight for any amount of time, replace it. It can no longer be trusted. The cost to assure it can still be trusted significantly exceeds the cost of getting a new one There is effectively no way to verify that the hardware has not been tampered with without significant expertise and employing non-trivial resources. The only solution ...


228

Take a look at this USB keyboard: "But that's not a keyboard! That's an USB drive, silly!" Actually, no. It looks like a USB drive to you, but when it gets connected to a computer, it will report that it is a USB keyboard. And the moment it is installed, it will start typing key sequences you programmed on it beforehand. Any operating system I know ...


214

Under one possible interpretation of that, it's a result of Rice's theorem. A program is malicious if it performs some malicious action, which makes it a semantic property. Some programs are malicious and some aren't, which makes it a non-trivial property. Thus, by Rice's theorem, it's undecidable in the general case whether a program is malicious.


191

Actually, the opposite can be easily proved: since all computer viruses are executable code in one way or another, all you have to do is write an antivirus program that will report ANY executable code as viral. It logically follows that such a program will detect ALL possible viruses: All code is detected by your antivirus (C → D) All viruses are code (V → ...


186

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


174

What do I do now? How do I get rid of the virus? The best option is what is referred to as "nuke it from orbit." The reference is from Aliens: The idea behind this is that you wipe your hard drive and reinstall your OS. Before you do this, you should make sure you have the following: A way to boot your computer off installation media. This can ...


164

I think the safest option for you would be to use Qubes OS with its built in DisposableVMs functionality, and its “Convert to Trusted PDF” tool. What is Qubes OS? Qubes is an operating system where it's all based on virtual machines. You can think of it as if you had different isolated ‘computers’ inside yours. So that way you can compartmentalize your ...


153

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain: The actual bottom line is that a compromise of our data will cost the company approximately X dollars + Y hours to recover. This is Z% likely to happen given the malware ...


143

A backup operator will have the permission and behavioral markers of someone that moves lots of data around. Like any sysadmin where there's no dedicated backup operator in place. Snowden was a sysadmin. He would knew all the protection protocols in place. He could just impersonate anyone, from any area, download things, impersonate the next one, and keep ...


143

You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is not malicious: 1.5 GB would be an extremely large virus. Since viruses are usually transmitted over a network, smaller is better. It isn't executable. Malware ...


136

WannaCry attacks are initiated using an SMBv1 remote code execution vulnerability in Microsoft Windows OS. The EternalBlue exploit has been patched by Microsoft on March 14 and made publicly available through the "Shadowbrokers dump" on April 14th, 2017. However, many companies and public organizations have not yet installed the patch to their systems. The ...


129

Antivirus is more dangerous in that it parses complex attacker-controlled data in a highly privileged context. This is a recipe for privilege escalation exploits. As a result, sophisticated attackers can often abuse antivirus programs to gain SYSTEM privileges. This is not a rare occurrence or one that is only a problem for enemies of a powerful government. ...


126

TL;DR Yes, but it's unlikely. Just to be sure, either unplug the PC or ensure it can't connect to anything. Several operating systems - notably Windows 10 - have the possibility of setting "automatic wakeup", using appropriate drivers and related, complicated hardware management. As a result, IF (and that's a big if!) a malware program has gained ...


122

Modern computers don't have a BIOS, they have a UEFI. Updating the UEFI firmware from the running operating system is a standard procedure, so any malware which manages to get executed on the operating system with sufficient privileges could attempt to do the same. However, most UEFIs will not accept an update which isn't digitally signed by the manufacturer....


99

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be downloaded, doing way more than the loader. It's like most malware ...


96

Should I be concerned about this? Yes. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. If it was an OTP failure, you would have received an OTP when that login attempt was ...


95

If you download and execute WannaCry, it will still lock your files and attempt to infect other unpatched computers in the network. WannaCry only needs the SMB exploit to get into a system, not to get out. Once it has control of your system, it does not need the exploit to execute arbitrary code, including the worm. The MS17-010 patch protects your computer ...


94

According to Wikipedia: In 1987, Fred Cohen published a demonstration that there is no algorithm that can perfectly detect all possible viruses. It also references this paper. That might be the analysis Mr. Schneier was referring to.


91

Recently, a form of attack has surfaced which does not "hack" the computer through code or software vulnerabilities, but instead does actual damage to the electronics. A creator known as Dark Purple created a device known as the USB Killer 2.0 (based on an earlier version created by him based on the same concept) which, when plugged into the USB slot of the ...


91

You can put any text strings into a cookie, so in theory you could put some kind of code there. But for code to do any harm something needs to run it. The web browser does not interpret the content of cookies as code and does not try to run it, so cookies should not be dangerous. (If you have heard cookies being referenced in security related discussions, it ...


85

I doubt there is a way to store any information (thus transfer information) on regular headphones. Some more advanced models (such as noise canceling) have some processing ability and firmware, but I don't see it as a viable attack vector.


85

Not on a well-designed car The CD player is part of the media system. It's likely that the media system has a number of security vulnerabilities, and a malicious CD can probably take control of the media system. It would be difficult to fix this without either greatly increasing the cost, or restricting the functionality of this. The car control systems - ...


82

Websites can append to your clipboard The risk is exactly what you said it was. It's definitely possible to append malicious commands to the clipboard. You could even append && rm -rf /* (only executes if the first command was successful), or ; rm -rf /* (executes even if the first command was unsuccessful) and brick certain UEFI devices. You ...


78

I'd use a Raspberry Pi, the Model A/A+ without a network connection, as: It (or rather Linux) can read most types of filesystem on a USB stick. The only non-volatile storage it has is an SD card, which can be reformatted (or discarded if you're paranoid) afterwards. If the USB stick turns out to be electrically malicious, you've only lost $20 of hardware. ...


78

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


77

You can install an antivirus if you want. It should not hurt your machine, but don't expect much protection for your system and don't consider yourself entirely safe. The efficacy of antivirus software is very relative, and they're mostly in use to avoid propagate old malware especially if you have Windows machines in your ecosystem. You should expect a ...


75

Let me summarise what you are seeing: someone navigates to a typo-squat site (goggle.com) the browser is then flooded with numerous pop-ups, warning windows, etc. eventually, the anti-virus starts to detect malware the machine crashes It is difficult to think that there are young technology professionals now for whom that sequence is new and strange. For ...


73

Yes, it is possible for previews to execute malicious code. Previews are created by checking the file type, and generating a thumbnail. For images, it resizes them. For videos, it decodes them, seeks into them, and creates a snapshot. For HTML files, it renders them with something like WebKit, and saves a snapshot. While previewers do not intentionally ...


69

I'm afraid this stems from a misunderstanding from the reporter: ... said a device that appeared to be empty could still contain a virus. In the video the reporter's referring to it is clear, in fact, in the first two minutes Karsen says he's NOT talking about viruses. He then goes on to demonstrate, on screen, that the seemingly empty USB device is ...


68

The main information we are lacking is your threat model. Is it likely that the military targets you specifically, and would be willing to expend some resources on you? We don't need to know the details, but the answer changes depending on whether what happened is more or less standard procedure for your country, or you are being singled out. And we don't ...


Only top voted, non community-wiki answers of a minimum length are eligible