Hot answers tagged

95

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be downloaded, doing way more than the loader. It's like most malware ...


43

Can I get my files back? How? Maybe. If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove the malware first. If you don't do that, you will just get infected again. If you don't have backups, things get trickier. Some ransomware has been beaten and ...


33

It really depends on the programming language and the context into which the code is being injected. For examples of what can be done in a very small amount of code space, check out the Code Golf Stack Exchange site.


23

It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is: 0: 54 push rsp 1: 5e pop rsi 0000000000000002 <y>: 2: 31 e2 xor edx,esp 4: 0f 05 syscall 6: eb fa jmp 2 <y> ...


16

Should I pay the ransom? The inclination here is to post an emphatic HELL NO, tell them where they can stick their malware, and bid them a good day. No payouts for you, Mr. Neer-do-well! The company I work for was hit by the original cryptolocker (circa 2013) and we were able to do just that thanks to a simple but effective use of Windows Backup. Odds are,...


14

As I am assuming that the 14 bytes within the video file triggers some memory vulnerability, as Peter Cordes said, those 14 bytes are machine code! That is a very important fact, as many people answering here is thinking about source code, characters and all. All of that takes ~8 bits / 1 byte per character. So with 14 characters, one possibly cannot do so ...


10

True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general. If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code ...


6

Some people think that breaking stuff is funny (or, in other words, they do it "for teh lulz"). It's possible there's some other explanations, of course - maybe they have an ethical objection to software piracy and think anybody who attempts it deserves to have their system wrecked, maybe the program attempted (or would have attempted, if given more time?) ...


4

I remember reading somewhere that there's no way at all of knowing what an exe does on a computer. How true is that? As much I wish there was a magic .exe problem-finder program, there isn't. If you really are worried about what an .exe file will do to your computer, run it in a VM (though VMs aren't completely safe) or on a computer or laptop you don't ...


4

Who is the target for bot nets? A lot of botnets use consumer devices that are insecure by default, or are shipped with vulnerable software. Imagine you buy the ACME HomeLink™ wireless router, which comes with a neat administrative console for customer comfort. If you have a problem, all that customer service has to do is connect to your router on port ...


3

Most of the ransomware attacks directed at US computers originate from countries which used to make up the USSR, to include Russia. I personally got hit with one of these about 3 years ago. It locked all my files, and booted a wordpad note saying I'd been hacked, and auto-took me to several websites saying I'd been hacked and demanding ransom. They wanted ...


3

Modern packers will handle this in the same way as the Windows PE loader: by implementing relocations. The .reloc section in a PE file (documentation here) holds details about which addresses need to be “fixed up” if the image cannot be loaded at the preferred address. This is referenced in the standard PE header. A packer can read this data and ...


2

No, it is normal for legitimate applications to appear as "not verified" in autoruns.exe and they are often not digitally signed (even by Microsoft). In my experience, this is normal behaviour and I have seen legit applications (e.g. explorer.exe, svchost.exe, etc) that weren't digitally signed. I wouldn't worry too much about what autoruns tells me, if I ...


2

In my experience It will carry malware. Many websites add malware to the crack or the .exe of the game to infect your PC. Don't forget that the creator of the crack (Ex. SKIDROW) can add malware to the crack so, you can't be 100% secure that the game is not infected. Take care too that, in many countries piracy is illegal.


2

It's most a tradeoff between management effort and easy of use. An adblocker will usually run inside the browser, and have some performance impact. They will use memory and CPU time to parse the incoming HTML data, search his internal database to match ads, and remove them from the page. All that incurs some performance penalty. The biggest benefit is that ...


1

ad.doubleclick.net is not malware. It’s an advertising link retuned by Google to redirect your browser to the desired site. DoubleClick is Google’s advertising company. They use this referral scheme in order to track your browsing habits (to learn what words you searched for that led you to click on their ad), and for Google to collect a referral bonus for ...


1

More often than not, they contain some type of malware - sometimes unnoticeable and will barely affect your computer. While you are extremely unlikely to get arrested for downloading pirated software/games due to the large amount of people that do it, I suggest not downloading anything pirated as it's still illegal. Having a good antivirus will often not ...


1

In fact malwares can be present non only in plain files, but also in hidden parts of a file system (hidden files, apparently non allocated blocs, system blocs, etc.) So, you have two different action here: select what should be transfered ensure that what is transfered should not contain malware For the first part, someone, or a group of persons should ...


1

A proxy forwards all traffic and therefore has the possibility to also modify the traffic and thus also to modify the traffic in a malicious way, including making the client download malware or exploiting bugs in the client processing the traffic. This is definitely true for plain HTTP but is also true for HTTPS if the client does not properly check the ...


1

Most file formats (such as videos) aren't going to execute code unless: The file is somehow a valid executable and you purposefully execute it The application viewing it (e.g. a video player) has a specific vulnerability, and the file contains crafted content to exploit that specific vulnerability In either case, there is no way to give you an answer ...


1

Yes there is. You want a forensic USB Write Blocker. The write blocker plugs into the questionable computer and your USB plugs into the write blocker, allowing only reads from your thumb drive and blocking writes. Write blockers start at around $150 and go up.


1

You cannot protect the stick from being "infected", if by "infected" you mean that the other computer writes a malware file onto it - unless you have a USB stick with a hardware write protection. What you want to protect is your own computer against executing that file from the USB stick and thus becoming infected. You can achieve that in several ways, ...


1

If you want a guarantee, go back to scratch. Nuke the disk and reinstall from source media. There are too many things that can't be "cleaned" using any tools. When we want to see the contents of an untrusted hard drive, we spin up a clean VM (free stuff, look at virtualbox). We attach the drive to the VM, recover the files we know are safe. Run any kind of ...


1

For fourteen (or any number) bytes in a message to be executed would presumably require a bug in the O.S. But if executed, it could certainly call other code already in the system (the existence or nature of which might also be a bug). Or, in a JPEG, an embedded preview could contain more code called by the fourteen bytes.


1

Your best option is simply to keep everything as up-to-date as possible. Your example of choice is what is known as a 0-day exploit. Of course once the software provider learns about it and fixes it, it is no longer an zero-day, and the solution is simple: upgrade your software to the latest (protected) version. Before the software vendor learns about the ...


1

Generally malware analysis and steganalysis are orthoginal to each other. Malware analysis deals with malicious code. Steganalysis deals with hidden messages. Yes the hidden message could be malware but it really doesn't matter, it's just a hidden message until it's extracted. For it to run automatically as malware, some other code (malware) would have to ...


1

From WikiLeaks' "Vault 7: CIA Hacking Tools Revealed", I see Ghidra has a plugin for interaction with OllyDbg ("the Ghidra Debugger") but this plugin has not been released in the Ghidra public release yet. https://wikileaks.org/ciav7p1/cms/page_51183656.html


1

A TrueCrypt encrypted volume is stored in a file on your hard drive (or flash drive, etc.). Therefore, this container file can be encrypted by ransomware, just like any other file can be. PS, VeraCrypt has picked up where TrueCrypt left off, plugged some security holes, and can read TrueCrypt volumes.


Only top voted, non community-wiki answers of a minimum length are eligible