New answers tagged

1

Generally speaking, the answer is no. There's a risk that a malicious archive will exploit a bug in your archive software to open a file, but if your software has such a bug then attempting to execute a script is actually relatively safe, as there's lots of ways to block that (you'd have fewer options it if just ran an executable or took over the archive ...


0

Not under normal circumstances. I mean, if no malware is already running on your PC and you are using well known archiving apps (default windows zip, winzip, winrar, 7zip). But it is very easy to missclick and run it on your own ;)


0

Yes. The printer kiosk has an Operating System that could itself be infected and infecting other devices that are connected to it. On the one hand, such system will be used by a large number of users, so the chance that a previously infected usb drive was connected there is quite high. One would assume that the design of such system should have taken into ...


0

The Incident trends report (October 2018 - April 2019) lists the top attack vectors as Office365 Ransomware Phishing Vulnerability scanning Supply chain attacks


0

BadUSB is no problem for internal devices. It is more the other way around, you should not connect external USB Devices to your computer. BadUSB works in the way that you think a ordinary i-phone charging cable or a USB stick or most likely a manipulated smart phone to your computer. But in realty the device acts as keyboard, mouse and or network card,and ...


1

It is not necessary that a pattern of bytes in the code of malware represent the signature. A signature in general, helps us identify the malware uniquely based on its characteristics. Below are the characteristics that go into consideration while defining a signature for the malware. Network Based: This includes comparison of network traffic with known ...


2

If I had the means to automatically detect a 0-day exploit in a piece of software, the vendor of that software has the same potential, thus these exploits would be caught before the software was ever released. Such things are done, of course, and they are called Source Code Analysis. They do exactly what you are trying to do: Automatically look for ...


0

You could go the plain old straightforward way: installing an antivirus and scanning the file. It's not a perfect solution, but it's a place to start and at least it would give you at least a little peace of mind about it. I'm actually a bit surprised no one suggested this. I'm not sure what distro you're on, but I'm sure there are plenty of antivirus ...


5

You could try "hexdump -C -n 512" to see if anything pops out at you in either the binary or ascii dump. It could be some mix of binary data and text data. Like a wget of a script that you mistyped, the hexdump might allow you to see some of the script.


23

I'd start with history | grep sudo from the terminal and look at the most recent sudo commands to see if any are malformed. It's your home directory. You haven't said it has special ownership so I'll assume you own it. It's almost certainly a botched shell command, so you probably made it from the terminal. It might be something created by a script but it's ...


1

You can also try head and see the first few lines of the file. The first few characters could reveal something about the file type. See magic number for more information.


11

I think the other answers cover nearly everything already (and have already solved the mystery). One additional thing to try if you are still unsure about deleting it is to do a scream test. You won't necessarily get a resolution as to the source of the file, but you can have some confidence it is safe to remove. Rename the file to something else and see if ...


25

Does anybody have any tips on how to proceed investigating this file? Since file doesn't recognize the "data" as an executable, it will be difficult to try to analyze dynamically (by running it) unless you can find the proper entry point. Another standard Linux tool you could try is: stat This will give you a little more of the metadata information than ...


141

You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is not malicious: 1.5 GB would be an extremely large virus. Since viruses are usually transmitted over a network, smaller is better. It isn't executable. Malware ...


0

You are probably safe if these are true: You didn't click the link* Your browser is updated with the latest patches** You aren't using any chrome or browser extensions*** Your computer is updated with the latest OS patches**** Generally, most exploits utilize well known vulnerabilities in common software like your browser, operating system, popular ...


3

It sounds like you need simple Write-Once-Read-Many-times (WORM) media. The most common media type that fits this description would be DVDs. If you trust that the DVD-R discs are actually blank (which will be the case if you get them from any reputable source), then you can write the video to disc, eject the disc, and never have to worry about it again. DVD-...


-1

"target evaluation" is the first phase of hacking, so you should ask yourself "why would someone try to hack me?" . if you are an student , it could be love letter rather than a sinister hacker! BTW if someone is targeting you, he/she has detailed plan. you can block the hacker (if it's not an illusion) using two methods : safer/harder way: using vm ...


0

If you simply want to make sure your removable media is not compromised by plugging it into another potentially compromised computer, there is a simple approach. Use a hardware write-blocker with your media when plugging it into other computers. Other computers can read the data but cannot write the media. Depending upon model and details, these run about ...


2

This is a very odd situation but I would take the following steps to understand what is on the card: Create a clean VM (Windows since this is the most popular OS and if there is malware it is probably compatible with Windows) and disconnect it from the host in every way Get a SD Card reader and mount it to the VM Insert the SD Card and see what's on it If ...


3

I'll go with a bit of an unorthodox suggestion. Don't connect storage media directly to the laptop at all. Treat the laptop as completely untrustworthy, and potentially disposable. Quite simply: pretty much every modern, general-purpose, digital data interconnect can be used to make your life miserable if the device at the other end is untrustworthy. You'd ...


0

Cheap but efficient solution: i would simply use a regular USB flash drive and create a custom autoplay action to force media formatting when plugged in so that there's no risk to have bad stuff run on your laptop. This post will give you some hints to do that.


0

Your browser provides to every visited website a string identifying itself and your OS, in the User-Agent header. A website could use that information to provide the appropriate file. It is quite common on normal software that the download you are offered is the one matching your system.


2

Both .srt and .txt subtitles and like other well known formats are pure test files - they contain text with time indexes and that's it. It is highly unlikely that a random malware can spread by itself even if inserted in such files. However, the only thing you should worry about are special vulnerabilities which could in theory specifically crafted so that ...


-1

This is one of the major issues faced by antivirus programs. They can give false positive to anything you can possibly think of, apart from the most famous programs and sites. In fact, they are some examples when some antivirus programs detected the most trusted sites as malware. Also, they can be corrupted and hijacked as well. A few years back this was ...


1

... Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that There are detailed tests at https://www.av-comparatives.org/testmethod/false-alarm-tests/. The results differ between vendors and time but on average can be said that the higher the detection rate (true positive) the ...


2

If you download the social media apps on the new phone from authoritative sources, I'm not sure how malware from another device could infect your new phone. 2FA would not help, because you would be logging into your accounts, and if there was some way to transfer the malware automatically, then it would happen after you used 2FA. Same thing for "changing ...


1

All my github repos have requirements.txt files in them, and GitHub will email you a warning if there are security issues. (it appears that GitHub will scan any file named requirements.txt anywhere in your repo) The dependency graph will also display some information. As a previous commenter mentioned synk which is a nice tool, I found that for python, ...


0

I personally didn't find any out of the box solution that is free. For personal projects or local I use https://snyk.io/test/ . I have good experience with them as they are always up to date.


Top 50 recent answers are included