Hot answers tagged

132

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the malware (i.e. some security researcher) since most normal users don't use a VM. But if everybody is using a VM then the chance is low that the VM is used for ...


53

In order for the opening of the file to pose a risk, the file would need to include an exploit for the specific text editor you use. Then when you open the file, the exploit would trigger. While possible that's not very likely. It certainly isn't common. The far more likely threat is that there is malicious PHP code in the file that triggers when the file is ...


48

Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is detected. Android suffers from infamous fragmentation problem due to which most android devices lose security updates after 3 - 4 years and forever become ...


38

You are assuming that the intrusion is coming from the VM to the hypervisor. A VM "breakout" is when the VM accesses the host directly. An infected VM that has access to the network can attack the host's network. That's not a "breakout". But the alert in your image is indicating that it saw traffic to a domain on a watchlist. That's not ...


35

Reverting the changes every 30 minutes is not a solution. You absolutely need to find out the root cause and stop this from happening by removing the vulnerability or the persistence. This may include monitoring the logs and other forensics, but also a fresh installation of WordPress (or in worst case the entire server) might be required.


30

I wouldn't worry about a non-well-reputed anti-virus software's findings in comparison to other well established anti-virus vendors. Even with the reputable ones, it could be a false-positive. Vendors themselves sets the scan settings in VirusTotal and some may choose aggressive settings like, heuristics. If you know the source of the app (i.e. the developer/...


28

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The other is that your research clearly has an observation bias (presumably, because you're finding the things that are easier to find on the web). Originally, ...


24

I can think of a few reasons: Android is open source That makes easier to analyze its workings and identify vulnerable code. It's more used More people use Android than iOS, so the resulting malware would infect more people. Emulators are more accessible Android emulators are more accessible. That makes testing different Android versions way easier. ...


18

Generally, it's safe, but there are known instances where viewing a file with unix tools trigger an exploit. E.g. CVE-2019-8904, where running file on a file triggers a buffer overflow. Edit: viewing a file with less may also be unsafe. less helpfully tries to decompress compressed files, and does other smart things, which makes it possible to exploit bugs ...


10

By default any file/URL submitted to VirusTotal which is detected by at least one scanner is sent to all those scanners that do not detect the resource. So there is a good chance that malware analysts at some of the anti-virus firms will give the file a look, and if it is malicious they will add signatures for it to their scanners. Try waiting a day or so ...


9

Here is an image of the SARS-CoV-2 genome. Will looking at the image give you COVID-19? Of course not. While you could call this the biological equivalent of "malicious code," it doesn't cause any harm unless it's presented in a format and context where it might be "executed." The same concept applies to computers - code or data that is ...


8

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only suggest a low-tech solution: a camera cover. This is the sort of thing you are looking for: https://www.amazon.com/C-Slide-Sliding-Computers-Chromebooks-Consoles/...


8

The detection in your screenshot is from an uncommon antivirus program. There’s also only one detection from over 50 total scanners on VirusTotal. If it was detected by a well known engine like Kaspersky or Microsoft (etc., there are lots of respected ones) it might be worth worrying some more. So what can you do now? if you have access to premium ...


7

No. Scenario 1: A rootkit is running, which could hide any malicious processes which are running. Scenario 2: One of the 'usual' processes which you referred to could have been compromised, and you might not able to tell the difference.


7

In fact, something similar is being practiced. First of all, note the following: Not all malware check for VMs, and there are other common criteria for not running such as research or monitoring tools. You don't need to run in a VM. You just need to make the malware think as if you do. One company which uses this technique is Minerva. They call it Hostile ...


7

It's easier and more profitable to write malware for Android, thus there is more research on, and more research papers about Android malware compared to iOS. To break down why malware is more common for Android: Easier Android allows developers more freedoms(that can also be utilized maliciously), a few things worth mentioning: Android can be 'rooted' by ...


6

Microsoft Office macros are a design of the past. Do note that they were designed back in the days when a userland program could overwrite memory of another application (or even the kernel!), boundaries were not checked when processing network packets, etc. It is also similar to the ActiveX web page additions that were created by Microsoft. Rather than ...


6

Yes, you can. Even an infected PHP file is only a set of instructions to the PHP interpreter, and it will do nothing evil when opened on Vim. I would first rename the file, so the exploit that already is running under Wordpress would stop working, and use Vim afterwards to check its contents. And make a full backup of the site while at it, export the ...


6

No. There are plenty of techniques to migrate malicious code into "legitimate" processes. Furthermore, just because you cannot identify a process does not mean it's not legitimate. As such, just by looking at the list of processes, you cannot tell whether a device is compromised or not.


6

There is a new and growing technology area called Content Disarm and Reconstruction (CDR). This does what you are asking for in general, however not all CDR solutions tackle all file types (like audio and video). The idea is that the file is analysed and reconstructed to contain only the data and format, but nothing else. It's like a sanitised copy of the ...


5

While hiding malware in an image is possible, it's not as simple as it may first seem, and there's a lot of nuance in terms of what "hiding malware in an image" could actually mean, and what the behaviour of that image is in practice. First things first, let's talk about steganography. It's the practice of hiding information inside other ...


5

A website does not need to be malicious. But the implementation of the website, the web server that hosts it, the OS that it runs on or the database may have vulnerabilities. Such a vulnerability may be exploited (by XSS, SQL injection, directory traversal etc.) and suddenly turns the trustworthy website into a malicious website without you (or anyone else) ...


5

This question is difficult to answer since there can be numerous ways for your PC to get infected once it is connected to the internet. One way you can end up with malware is (as @DigitalDracula pointed out) through untrusted content served through a trusted website. This usually in the form of ads. Even if you do not click on an ad, the untrusted content is ...


5

No. without cooperation from either side, you cannot decrypt the TLS traffic. That is the purpose of TLS. You are in the same position as an attacker of TLS, and TLS is doing its job. Since you have access to the computer that runs one side of the TLS connections, you can use a debugger to find the session keys in RAM and dump them (i.e. do the same thing ...


4

To give a slightly different answer from the others, a few backdoors have been caught in the linux kernel over the years (which means there are maybe some that have not been caught). I like to cite the example from 2003: A Look Back at the Linux Kernel Backdoor The modified code was this: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) ...


4

Could emulating a virtual environment stop some malware from infecting the system? Yes. Also, creating fake VM artifacts is not the only way to stop malware from executing. You could also create fake mutex objects or certain registry keys that malware oftentimes creates in order to avoid re-infecting the same machine. And there are a lot of other ways, ...


4

I doubt that your account is hacked. I think what you experience here is cognitive bias instead. Such phishing mails are pretty common and one even gets these without having iCloud or Paypal accounts. Usually one simply ignores these mails. But if one suddenly gets such a mail after creating or using such accounts, one is prone to assume a causal link ...


4

Just to combine the several commented replies and add my own view: There is NO usb device without Firmware (even if you call it something else). There are usb devices where you can NOT update the firmware (it’s on a rom chip of worm memory chip). -There are more ways than just firmware to hide code. The firmware on the usb chip of the flash drive has to ...


4

Yes, as others have said an exploit for PHP is not an exploit for vim, but one word of warning: Depending on the server and/or environment setup, your vim may be configured to do more than just display the file. If someone uses the same user on the server for development, there may be vim plugins installed such as vim-lsp or ConquerOfCompletion (CoC) that ...


4

I'm using 1 SSD and I think it's safe. You are "safe" in this sense when you have a full backup of your ssd which is not physically connected to any running computer. Is it possible that the virus on the 2nd drive can reach the 1st drive, somehow damage the PC, or bring other unwanted effects? Absolutely yes. If malware runs on your computer, it ...


Only top voted, non community-wiki answers of a minimum length are eligible