New answers tagged

0

It is technically possible for a USB mouse to do something bad. But unlike a keyboard, a mouse can't easily control things on your computer since it can't see the screen to know where to click. To do something bad, it would have to turn in to a device such as a keyboard or other device with a driver that could be exploited. Next time you'll have to capture ...


0

Powershell Empire passed out of active development in April 2019, in part due to the problem of defenses catching up with it: "The original objective of the Empire project was to demonstrate the post-exploitation capabilities of PowerShell and bring awareness to PowerShell attacks used by (at the time) more advanced adversaries," said Chris Ross, ...


3

Buggy firmware. There's an old saying in IT: Never attribute to malice what can be sufficiently explained by incompetence. This can be fully explained by a buggy firmware that somehow re-enables it automatically after reboot, or never disables it in the first place, or resets that part of the configuration due to some other random event. Consumer router/AP ...


1

The only thing I've come across is that there must be malware inside the network. The attack (if any) could come from outside your network. This could be the result of a CSRF or DNS rebinding attack on your router configuration UI. This assumes that your router is vulnerable to either of them. This could be the result of a reflected XSS as well. Note that ...


0

Is this something that can happen where a grabify link can install malware without you knowing? Yes, a.k.a Drive by Download attack, it will install a malicious program in your device. What does this allow the owner of the link to do? Answer from Kaspersky Blog post: What Is a Drive by Download Drive by downloads are designed to breach your device for one ...


1

An IP address is simply like having your home address on a letter. They can know the area where you live but not more. A malicious user could try to hack your network but usually, home routers are pretty safe and will prevent any intrusion by default (if you haven’t modified port forwarding and settings like that). Anyway, random people online are already ...


1

The technique that you are asking for is called Data Exfiltration and yes. There are ways of detecting DE. Depending on the level of maturity of the threat this exfiltration could be more or less sophisticated. For example, the malware could grab sensitive information, cipher it and send it to the attacker. Or it could use a way easier method of ...


35

Reverting the changes every 30 minutes is not a solution. You absolutely need to find out the root cause and stop this from happening by removing the vulnerability or the persistence. This may include monitoring the logs and other forensics, but also a fresh installation of WordPress (or in worst case the entire server) might be required.


0

I would suggest you to terminate all your Google sessions from https://myaccount.google.com/security-checkup/2. Also be really careful with the extensions you install. I see more and more cases of people getting their Google Accounts hacked, because the extensions they install have full access on website traffic. So people just sign in and the extension ...


0

Barring any unknown vulnerabilities in the emulator, the general idea is that the emulated system is isolated from the host. This isolation may be reduced if you share filesystems and other resources with the emulated guest. The level of security may also vary based on the emulator you are using. Interestingly, qemu's docs notes that it shouldn't be relied ...


0

Specifically, would it be possible to insert bytes at the end of the code section, push everything else back, adjust the PE header/section sizes, then change the entry point to the new bytes? Or does something prevent this? Code signing can prevent this. For example, on my Microsoft Windows 10 system, the "notepad.exe" program file is signed by ...


3

There are an enormous number of options. In no particular order: You can enlarge the file, adding the malicious code and either making it the main entry point or adding a call to it from the exiting entry point. You can remove part of the file and replace it with your own code, if there's something you expect isn't needed (this is easier if you know the ...


Top 50 recent answers are included