Hot answers tagged

99

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be downloaded, doing way more than the loader. It's like most malware ...


96

Should I be concerned about this? Yes. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. If it was an OTP failure, you would have received an OTP when that login attempt was ...


52

Yes, malware can infect user-created files. Yes, pendrives can get infected when inserted. And it doesn't matter how you transfer them, they will still be infected when they arrive. You want to scan the files and the pendrive before actually accessing the files.


52

In order for the opening of the file to pose a risk, the file would need to include an exploit for the specific text editor you use. Then when you open the file, the exploit would trigger. While possible that's not very likely. It certainly isn't common. The far more likely threat is that there is malicious PHP code in the file that triggers when the file is ...


48

Can I get my files back? How? Maybe. If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove the malware first. If you don't do that, you will just get infected again. If you don't have backups, things get trickier. Some ransomware has been beaten and ...


33

It really depends on the programming language and the context into which the code is being injected. For examples of what can be done in a very small amount of code space, check out the Code Golf Stack Exchange site.


30

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the firmware is signed and that the signature is checked by the router. This does not mean that the update process for your particular system was designed as such. For ...


30

I wouldn't worry about a non-well-reputed anti-virus software's findings in comparison to other well established anti-virus vendors. Even with the reputable ones, it could be a false-positive. Vendors themselves sets the scan settings in VirusTotal and some may choose aggressive settings like, heuristics. If you know the source of the app (i.e. the developer/...


28

No, you can't tell by looking at it. There are two mistakes in your reasoning. One is that you're confusing two methods of attack: modifying an existing device, and making a device from scratch. The other is that your research clearly has an observation bias (presumably, because you're finding the things that are easier to find on the web). Originally, ...


23

It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is: 0: 54 push rsp 1: 5e pop rsi 0000000000000002 <y>: 2: 31 e2 xor edx,esp 4: 0f 05 syscall 6: eb fa jmp 2 <y> ...


22

Yes, it’s possible to infect MS Office (MS Word, Excel,...) file-type files with malicious macros. The HTML files could be infected with malicious JavaScript. There’s a possibility that your endpoint/antivirus software doesn’t clean fully those malicious JavaScript and macros from the infected files so manual inspection/cleanup is needed or you should ...


19

Should I pay the ransom? The inclination here is to post an emphatic HELL NO, tell them where they can stick their malware, and bid them a good day. No payouts for you, Mr. Neer-do-well! The company I work for was hit by the original cryptolocker (circa 2013) and we were able to do just that thanks to a simple but effective use of Windows Backup. Odds are, ...


19

You need to check the exact description of the malware that was detected, because antivirus software nowadays doesn't just detect "viruses", but may also warn you about other kinds of software, like adware and riskware. If you look closely at the descriptions in your scan, you will notice, for example: Clyance: Unsafe. They don't tell you it's a virus, ...


18

Generally, it's safe, but there are known instances where viewing a file with unix tools trigger an exploit. E.g. CVE-2019-8904, where running file on a file triggers a buffer overflow. Edit: viewing a file with less may also be unsafe. less helpfully tries to decompress compressed files, and does other smart things, which makes it possible to exploit bugs ...


16

Yes, under certain conditions. If you have previously connected to a "hidden" wireless network, your NIC may continuously broadcast their BSSID's in hopes of connecting to them. It's the only way to "automatically" connect to a hidden network, because there is otherwise no way for the card to know when it is in range to a known hidden network. This looks ...


14

As I am assuming that the 14 bytes within the video file triggers some memory vulnerability, as Peter Cordes said, those 14 bytes are machine code! That is a very important fact, as many people answering here is thinking about source code, characters and all. All of that takes ~8 bits / 1 byte per character. So with 14 characters, one possibly cannot do so ...


13

When I need to view data from a system I know (or think) is infected with malware, I convert the data to plain text files and only view the resultant data with viewers that do not interpret the data (simple text editors and hex editors). This technique, of course, is much easier with certain data types than others. Although malware scanners are helpful in ...


11

Neither. A virus sitting on a disk as a file is harmless. A virus sitting in memory as data is harmless. It can only infect a machine when something tries to execute it or interprets it improperly. This can happen because of user action (tricking someone to download and run a .exe file) or because of application weaknesses which is what you are asking ...


10

True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general. If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code ...


10

By default any file/URL submitted to VirusTotal which is detected by at least one scanner is sent to all those scanners that do not detect the resource. So there is a good chance that malware analysts at some of the anti-virus firms will give the file a look, and if it is malicious they will add signatures for it to their scanners. Try waiting a day or so ...


9

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (...


8

The detection in your screenshot is from an uncommon antivirus program. There’s also only one detection from over 50 total scanners on VirusTotal. If it was detected by a well known engine like Kaspersky or Microsoft (etc., there are lots of respected ones) it might be worth worrying some more. So what can you do now? if you have access to premium ...


8

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only suggest a low-tech solution: a camera cover. This is the sort of thing you are looking for: https://www.amazon.com/C-Slide-Sliding-Computers-Chromebooks-Consoles/...


7

Some people think that breaking stuff is funny (or, in other words, they do it "for teh lulz"). It's possible there's some other explanations, of course - maybe they have an ethical objection to software piracy and think anybody who attempts it deserves to have their system wrecked, maybe the program attempted (or would have attempted, if given more time?) ...


6

You can check the firmware binary checksum, MD5 or hash and compare with the one published on the vendor download site. A checksum is a sequence generated after running a cryptographic hash function algorithm on a file. Calculating a checksum and comparing it with the one provided by the file source can be used as a file authenticity check method. If you ...


6

The use of your email to sign up for services might be a coincidence and not being done by the party who logged into your account. I get a dozen of these types of "mistakes" a week from around the world due to my fairly generic email account. So, this set of events might not relate to the person who logged in. However, there are a couple of ...


6

Yes, you can. Even an infected PHP file is only a set of instructions to the PHP interpreter, and it will do nothing evil when opened on Vim. I would first rename the file, so the exploit that already is running under Wordpress would stop working, and use Vim afterwards to check its contents. And make a full backup of the site while at it, export the ...


5

To answer your questions, we have to understand what malware in an mp4 file actually means. An mp4 file isn't an executable, so it will not run any (malicious) code directly. Therefore, if a mp4 file contains malware that wants to execute instructions, it has to exploit a vulnerability (e.g. a buffer overflow) in the program that plays the file. This can ...


5

Outlook web access rewrites all URLs to pass through its filter, so if you checked the entire URL all you got was "is outlook.com malicious?" and of course the answer is no. The link will redirect to "ht tp://actually sale.c om/" (remove the spaces to turn it back into a real URL). The * characters appear to be substitutes for the % character used to mark ...


5

Interpreting output like this when you are not a technical expert can be difficult, especially when you get 13/70 engines reporting malicious behavior. With uncertainty like this you can look at a few factors: the quality of the companies running the engine the type of behavior the community votes the risk you feel comfortable with In this case, you have ...


Only top voted, non community-wiki answers of a minimum length are eligible