New answers tagged

3 votes

How do EDR prevent you from uninstalling even as local admin?

As previously mentioned most EDRs have use kernel-level hooks. This text is from CrowdStrike's patent "Anomaly-based malicious-behavior detection" In some examples, the kernel-level ...
user avatar
5 votes
Accepted

What is a safe way to display malicious URLs in research PDFs?

Back in 2017 there was an IETF Internet-Draft draft-salgado-hxxp-01 for The "hxxp" and "hxxps" URI Schemes, which I think was a pretty good suggestion. This document describes the ...
user avatar
  • 15.9k
4 votes

How do EDR prevent you from uninstalling even as local admin?

Most EDRs (worth their salt) implement a driver which runs in the kernel, this driver performs a number of functions but one of the most notable functions can be categorised as "anti-tamper"....
user avatar
  • 148
0 votes

File sharing with compromised Windows machine

If the machine is untrusted, it should not be connected to the network. If you know that it could have malware on it and are unsure of the actual malwares, connecting it to the network could open ...
user avatar
3 votes

Exploit Development - Bad chars

There is not a universal root cause for bad characters in exploit paylods. What is considered a bad character in one buffer is not considered a bad character in another buffer, unless that character ...
user avatar
  • 148
0 votes

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

You don't need RSA key pair on your side to securely communicate via HTTPS. Browser agrees with the server about keys for the current session. See details here. At one of steps the server sends to the ...
user avatar
  • 7,916
0 votes

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

Note that in an https connection, the client does not have a private key - only the server does. Having said that, there are many ways that an adversary can view and/or modify your network connection. ...
user avatar
  • 19.4k
3 votes

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

So if your router gets hacked is decryption of https possible and can the complete url of sites that you visit be viewed? In order to decrypt HTTPS one must first be some man in the middle to get ...
user avatar
0 votes

If your router gets hacked, can the hacker acquire your RSA private key to decrypt HTTPS and view full URL's?

A hacker cannot decrypt your TLS traffic by hacking your router. The key is generated by the server on the TLS transaction, and it will never be transmitted anywhere. I read that they use packet ...
user avatar
  • 50.5k
1 vote
Accepted

Non executable virus?

You asked two questions in one so I'll focus on the second (the second Bitdefender flag looks like a false positive but I don't have enough information to confirm that, and you might want to check out ...
user avatar
  • 1,128
0 votes

Is making a clean install enough to remove potential malware?

I have had my BIOS infected with a rootkit before. HP machines have an easy process to first reflash the BIOS, and then perform a clean install of OS. The key is to do the BIOS reflash first and then ...
user avatar
0 votes

What is the security purpose behind the "enable editing" of MS Word?

Unfortunately, you can't sort, filter, or do lots of other "view only" types of operations. Also, what about imbedded objects? Are things enabled by "Enable editing" or is this ...
user avatar
  • 1
0 votes

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel)

Any code that appears to be appended to many files is malicious by itself since it does undeclared/unknown functions. In situations like this, you can declare your whole server compromised, and should ...
user avatar

Top 50 recent answers are included