New answers tagged

5

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only suggest a low-tech solution: a camera cover. This is the sort of thing you are looking for: https://www.amazon.com/C-Slide-Sliding-Computers-Chromebooks-Consoles/...


0

Aside from physically disabling the camera hardware, on some devices a webcam can be disabled in BIOS/UEFI, thus preventing access to the hardware from the operating system. You may not be able to tell whether the camera is actually powered and actively recording just by looking at it. On some devices, there is a faint LED indicator which tells you the ...


0

If you're sure the search results are NOT advertisement, then they might be redirecting your searches to their servers by redirecting. Normally they do these through installing browser plugins (via bundling with free software etc.). But you're saying this happens on a brand new installation which suggests network level rerouting or root kit (unlikely) ...


0

I used these guys for a few things, I liked it so they are my go-to now. https://www.hybrid-analysis.com/ Another option might possibly be a college or University with a computer science program. No guarantees but they might be willing to have students take a look at it if it pertains to a field of study they are involved in.


1

They haven't used this PC ever since that incident, because they were afraid that the scammer might have put some sort of malware onto their system. Since they aren't super tech-savvy, my friend asked if I could help him safely recover their photos. If the only thing you're recovering is photos, don't worry. Simply copy only jpeg files. If there's hidden ...


0

If you're after learning this and maybe writing some tools others can use, by all means go ahead. The community will be grateful. If you're after only making sure the files are clean 100+ %, you won't be able to do that. There will always be 1% unknown at the minimum (in reality, it is much more than that but we ignore those). You can consider 99% percent ...


1

Start by copying every image file on their infected device to a media card. Then on your recovery machine launch a VM running an OS that is immune to Windows malware (Linux), install ImageMagick, mount the media card, then use a script that calls ImageMacick to transform each image to PNG format. This will neutralize malware that leverages flaws in JPEG ...


0

It's true that zero-day could happen with any activity that causes a CPU cycle that consumes the file's content as data source. For example: it could happen when Thunderbird is saving the file to disk, if Thunderbird has a zero-day in file saving process. It could even happen when your anti-virus is scanning the file if your anti-virus has zero-day and they ...


2

Yes it is true. Both .Net and native applications (atleast those compiled by Visual Studio) contain an absolute path to a .pdb (Program Database) file when compiled in debug mode (which is usually the default). Since paths in Windows are usually of the form C:\Users\UserName\..., the path also reveals the malware author's OS username along with some ...


10

By default any file/URL submitted to VirusTotal which is detected by at least one scanner is sent to all those scanners that do not detect the resource. So there is a good chance that malware analysts at some of the anti-virus firms will give the file a look, and if it is malicious they will add signatures for it to their scanners. Try waiting a day or so ...


30

I wouldn't worry about a non-well-reputed anti-virus software's findings in comparison to other well established anti-virus vendors. Even with the reputable ones, it could be a false-positive. Vendors themselves sets the scan settings in VirusTotal and some may choose aggressive settings like, heuristics. If you know the source of the app (i.e. the developer/...


8

The detection in your screenshot is from an uncommon antivirus program. There’s also only one detection from over 50 total scanners on VirusTotal. If it was detected by a well known engine like Kaspersky or Microsoft (etc., there are lots of respected ones) it might be worth worrying some more. So what can you do now? if you have access to premium ...


1

If the payload is detected and then analyzed it is entirely possible to retrieve your IP from it. Obfuscating the payload may complicate the process of extracting the IP address to some extent, but an experienced malware analyst/reverse engineer will almost definitely be able to extract it eventually. For example, this answer shows that the IP in a MSFvenom ...


0

Coming from a different question to this one I have to note that currently malware may reside in (from most common to least common): UEFI BIOS SSD/HDD flash ROM NIC/Ethernet flash ROM Old GPU ROM (modern GPUs ROMs are digitally signed and it's impossible to circumvent it) The development of malware for any of these ROMs costs astronomical amounts of money, ...


-1

You could check using apache2 plugins or by programming to whitelist extensions along with some tools. In PHP, checking filename, filesize, etc is easy. You should check for both filename and extension. For filename it mustnt be more than 64 character long and only whitelisted extensions should be allowed. Dont rely solely on extension and magic bytes, try ...


3

Simply downloading a file should not cause any problems since the file was not executed. Malware generally cannot cause any damage unless it is executed. Additionally, on Windows, .bin files are not executable by default so if you use Windows, even if you did click on it, nothing should have happened. Although theoretically, downloading a file could result ...


2

Could emulating a virtual environment stop some malware from infecting the system? Yes. Also, creating fake VM artifacts is not the only way to stop malware from executing. You could also create fake mutex objects or certain registry keys that malware oftentimes creates in order to avoid re-infecting the same machine. And there are a lot of other ways, ...


1

As all software based techniques have a potential to be flawed or hacked (and, as @Jason commented: an app that is seemingly not running might still run), there may be a 'hardware' based solution: A good old sticker that covers the camera (only really practical for the front facing camera) is a solution that's not hackable. 'Camera cover slides', available ...


-1

One way to block camera access is to install camera blocker app. It can prevent all cameras from working when app is locked.


0

This could depend on per author / group behind the malware, With the widespread adoption of Lets Encrypt and the lower barrier of entries for things such as SSL certs I would speculate that it will become more common. It could potentially mitigate some IPS / IDS systems from viewing the traffic that is being sent


-1

The App poses risks of exposing you and your personal information online due to poor implementation of security and vulnerabilities in the App. Get rid of the App. There are too many articles explaining the exploits and risks of using TikTok dating back to 2019. One example is the advertisement sub-domain had vulnerabilities of XSS. Two USER data exposed ...


1

When you delete the app, then the account with your password still remains (in case you later decide to reinstall the app). It appears someone was trying to log into your Tik Tok account, couldn't, and then used the "forgot password" function. This doesn't necessarily mean malicious intent. It is possible that someone somewhere in the world ...


0

DLL hijacking requires an application that is vulnerable and the code in DLL gets the privileges the program calling it has. If the vulnerable program e.g. runs as SYSTEM or with administrator privileges (after the UAC prompt), the DLL gets the administrative privileges, but if the DLL is called from a process running as normal user, it has the same ...


1

Of course Google will warn about encrypted content, especially if it is not encrypted by themselves, hence they cannot decrypt the file. The warning comes only because they are not able to see the file's contents, not because there is something wrong with it. At all times they will prefer having control of all the variables: holding your password, the ...


2

There's a few ways this could have happened. You're right that it could have been HostGator pushing the popup. I would contact HostGator to confirm whether or not they have done anything like that. Someone got access to your web server. They could have exploited a vulnerability in your server, guessed the FTP password, or socially engineered a HostGator ...


2

Being that you were not connected to the site via HTTPS, there are two ways that the unexpected content that you saw could have been injected: An attacker gained access to your web server, and modified the HTML page, and injected the content there. An attacker on the network somewhere between your web server and your web browser injected the content into ...


0

If you're running windows 10, other articles have suggested the cause is actually Windows Update glitching out. My laptop's Microsoft functionality is corrupted, though, so I'm not sure if the solution of updating will actually fix it, but I figured I'd throw this out there for other potential wanderers of the forum. I have the same problem, but mine aren't ...


Top 50 recent answers are included