New answers tagged

0

Just to add to the previous answer, which covers pretty much everything -- VirusTotal actually does sometimes do dynamic analysis, especially if the file is commonly checked or initially looks suspicious. They started doing this in 2017, and you can get more information on it directly from them here. You can check to see if dynamic analysis has been run on ...


5

ad 1: It does upload your file, but only if the hash is not known. As the very first thing, a piece of Javascript will calculate a cryptographic hash (SHA-256 if I recall correctly, but might be wrong) and sends that. The engine then, rather than scanning, looks up the hash in a already-did-it database. Only if not present, or if you insist, it will upload ...


0

Disclosure: I work for an anti-malware vendor. The answer is "it depends on malicious content". If the malicious content is obfuscated or encrypted, but otherwise it is the same content which would be detected if not encrypted - the static analysis rules would be applied after the obfuscation/encryption layer is stripped down. The stripping in this case ...


2

Disclosure: I'm working for an anti-malware vendor. First, there is no anti-malware vendor which operates exclusively on signatures. Even free ClamAV is using more than signatures. So I'll address this question as related to "automated detection measures". Several vendors I worked for in past use automated means to create malware detection rules. According ...


2

There are several freely available threat intelligence feed around. See e.g. https://threatfeeds.io/ Do note that such lists are ephemeral in nature. Which IPs are currently being used for malicious activity is ever changing, and the information generally decreases in value as soon as it is openly published. For this reason, most high-quality threat feeds ...


0

AV companies today differ quite significantly from some 'not bothering' to dig into various complex stuff to some having very advanced adaptive countermeasures and on-line real-time threat detection capabilities. While some still use a classic system and limit to that, others already have behavior detection, exploit prevention host intrusion prevention ...


1

...that they simply choose to not even try to detect because there is no efficient method to do so? AV does not specifically choose to not analyze some malware since it is too hard. If it would know up-front that this is malware but too hard to analyze than it could simply block it based on this knowledge. AV simply has limited capabilities and therefore ...


0

Well, yes. As with any technical problem, you need to bound the effort you put into it. For example, AV could just be running a VM that replicates the host truthfully, and preexecute anything people download to analyze what it's actually doing. Not doing that is a deliberate choice. (Lesser versions of that are done, but, again, in an effort-limited way.) ...


0

Since you are asking about rootkits, I will answer your question in the term of rootkits. There are several other methods. First very little basics. There are 2 types of rootkits. User mode rootkits, which are designed to run in the user mode. The user mode is the the space in which a normal program (like Word or Firefox) is run on Windows. This space has ...


0

My best guess would be that the disc is carefully crafted (using typical optical disc burning methods) to exploit security holes in the optical drive firmware or the auto-running software of Ubuntu. So yes, having unlimited resources one can achieve what you are describing.


2

The resource manager or third party monitoring tools are software running on the computer. They could have vulnerabilities which a knowledgeable attacker could exploit with a malware in order to manipulate their output. Besides malware acting on the computer it is possible that an attacker modified the source code of the monitoring tool or replaced its ...


0

There are a few disadvantages to this technique: Using words requires a dictionary. Dictionaries are big in volume and for a malware, obtaining them might be slow, noisy and hence dangerous (can be detected). If they try to overcome this disadvantage they can use a small dictionary, but then the randomness of the generated algorithm is hurt and it is much ...


2

Yes, a program can change a file intentionally or accidentally(ie a bug). There's nothing preventing that assuming it has write permissions, even if you're only opening/closing it. And that will, of course, change the hash value. You can run diff <(xxd pdf_just_downloaded.pdf) <(xxd pdf_just_opened.pdf) to see the byte changes between the two versions ...


2

Unless the content of the file changes in any way, it is not possible. Hashing algorthims rely on the content of the file to determine the hash of the file. Unless the file has changed its own content upon execution, or you have written to the file in some way (even metadata within the file itself), then the hash will not change. One flipped bit in a file ...


-1

Generally, scanning for WiFi networks is done passively by your device. This means that a router broadcasts information (such as the name of the network, authentication method etc.) and your device listens. These networks show up in a list which you can chose to connect to, but the router does not know your device is there until it tries to connect. So being ...


1

In short, there is no risk when your device is not connected to the network unless the hacker changes the SSID and password of the WiFi to one of the saved (and enabled auto-connect) ones in your device; which is rare, especially when the hacker has not targeted you. But to be on the safe side: forget (remove) all saved WiFi on your device, use VPN for any ...


6

If your device isn't connected to the network, either because WiFi is turned off or because your device isn't configured to automatically connect to the network, nothing on that network can affect your device. However, an attacker may create a network with the same SSID and PSK as one that your device recognizes, such as the WiFi network used at your ...


1

From reading/Googling various docs and looking at incident investigations, it seems to be both. However I am looking for some advice/pointers on the following dilemma. As you said, it's probably both. It may even depend on the mode the malware enters; it may enter sleep mode waiting for some event or date. And there's many kinds of malware, from many ...


0

I think all you could know from such an attack (if the attacker is somewhat skilled) is that there's some connection outgoing that you potentially wouldn't want. There are many ways of how an attacker can receive data and still remain anonymous, here are some examples: Mixnet Virtual private network Using email services based in countries that likely won't ...


2

There are many possible ways to retrieve the data harvested. Depending on the type of attack (automated / targeted), the intended goal of the attacker and the means available to the attacker. Often, one of these is chosen (this is not an exhaustive list!) Use a Command & Control system that selectively tells the malware what to do and where to send data....


1

Let me put it like this, Nowadays malware are often connected to a CNC ( Command and Conquer ) Domain, they often communicate with this domain to inform the hacker that the malware is now active and is pending for future commands to execute, this is part of the sophisticated approaches that is being used today. The malware enters your environment. Calls ...


2

It depends on the kind of malware. If it's just a malicious browser extension with no outside-of-the-browser components - which you can test by disabling all browser extensions and seeing if the problem goes away - then it's easy. All you'd need to do is delete (and possibly report) the malicious extension. Of course, the attacker could still have had all ...


1

Defining what you mean by "malicious", what you mean by "investigate", and who is doing the investigating are all important. If you need to determine if the site is hosting malicious code, then you need to run a malware scan on the URL. There are many online sites that can do this for you (as well as the AV on your machine). VirusTotal is a big one and ...


Top 50 recent answers are included