Hot answers tagged

14

Actually, almost all of the CPU on the market, save for the very small ones meant for low-power embedded devices, offer "hardware-enforced isolation". This is called a MMU. Synthetically, the MMU splits the address space into individual pages (typically 4 or 8 kB each; it depends on the CPU architecture and version), and whenever some piece of code accesses ...


14

Sysinternals process explorer is your friend. This will show you more information than you're used to from Task Manager, including invisible tasks.


13

This really depends on how the process is hidden. If certain Windows API functions are hooked, then process managers using those functions will not see the process. So it's dependent on the particular piece of software trying to hide as well as the monitoring software trying to find it. Regardless of which monitoring program you use you're not guaranteed ...


8

Yes, it's possible. This kind of behavior is seen on a class of programs called rootkit. A rootkit employs a number of techniques to avoid detection. Some of those techniques: Thread injection In this case, Program B injects a thread on another running process. If Program A is searching for program_b.exe, it will not find it. Kernel Process Table ...


6

This is far from being a simple task thanks to memory protection techniques. In the old times of MS-DOS, Windows 9x and equivalent home computing systems, the memory was indeed equally shared amongst all the running process. In such conditions your feeling is right: any user process can access and modify memory from other processes, even the operating ...


6

If your threat model includes "malicious processes running as the same user as the legitimate process that needs the key", you need to go back to the drawing board and redesign. It is not possible to protect against that. Processes within a single user session are not, and should not be expected to be, secure from one another. The concern you express about ...


5

AV's wont continously scan for running processes as it is an expensive operation. It is better to use WMI for process launch notifications. As far as in-memory detection is concerned, AVs usually hook most of the system APIs and determine the process beahviour to flag if its malicious. As far detecting sending out requests to bad sites is concerned, that ...


4

There's 2 types of MFP's that I have seen: Those meant for SOHO/Consumer. Those does rarely have any permanent storage for documents, rather its a little flash area that stores configuration data only. If the configuration contains sensitive information, a factory reset is enough to clear information. They very often use standard SDRAM sticks (either SODIMM ...


4

If you want to restrict inter process communication on a machine, I'd suggest doing away with TCP and instead uses Unix domain socket. Unix domain socket can be used exactly the same way as TCP (it's a bidirectional socket), but it creates a socket file instead of listening on a TCP port. You can control permission on the socket file using standard ...


4

The issue is that the attacker can create a symlink before a vulnerable program can. For example, you could write a script that watches the process list, and as soon as a program with the right name shows up in the list, the script would race to create a symlink to a privileged file before the vulnerable program can. If the vulnerable program is running as ...


4

You're right that sudo only grants elevated privileges to the command you run with it. What the commenter is referring to is that running processes in a Linux desktop session can watch the keystrokes on that desktop session without you knowing. So if you open a terminal window on your desktop, type sudo <some command>, and enter your password at the ...


3

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives the process access to more resources. While a debugger might be used to prevent malicious activity, there is no way for the debugger to know what exactly you ...


3

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created. When you check the VBS creation code, you can see that it runs WScript.Sleep When you say that persistence does not run sleep(), I assume you mean that it isn't running that function in in the shell, and it isn't. But it is ...


3

The correct sign up procedure is as follow: Alices signs up with a new password and an email address (x@y) the account is created as blocked until email address validation Alices tries to login and only gets a message saying she must activates her account with the mails sent at the address x@y if the validation does not occur in the expected time (between 4 ...


3

The list of common/legitimate processes will depend on the OS installed. Also, the list will depend on the software you have installed on your machine. In Windows, you can trytasklistIn Linux, you can try ps You can make a list of trusted applications(which you can do manually or lookup online). Then, after getting the list of running processes ...


3

Here's a pretty helpful article in case you haven't seen it: http://www.techrepublic.com/blog/it-security/the-truth-about-copier-hard-drives-tips-for-securing-your-data/ The short version is that there are some loose standards but not every vendor will adhere, so YMMV. Either do some research before buying and make sure you know what you're getting into, or ...


3

You can pin more than one certificate, and you should pin at least 2. If somehow you lose access to one certificate, you can use the second. With only one certificate, nobody that connected to your site with pinning enabled will be able to connect to your site via HTTPS until the certificate expire (but they can connect via HTTP). If you employed HSTS, ...


3

As long as the user is not a local administrator on the machine they should not have permission to kill any processes run as other users (including domain administrators). However unless you have an unusual physical setup the user can always kill the process with the power button or physically removing the power supply. I would suggest additionally your ...


3

DAST can absolutely have false positives. It depends on the tool that you are using, but there are some that can give you hundreds of false positives. For example, a tool might check for SQL injection by inserting a single-quote and checking for an SQL error message, but an error message being present does not necessarily mean that there is an SQL injection ...


3

Oh yeah, I literally just finished triaging through a report full of false positives (I raised one legitimate ticket out of a 20 page DAST report). And by that I mean that, like @BrianWilliams' example, the tool is correct to report them because they may be real in some scenarios, but it takes a skilled analyst to decide whether or not the apply in this ...


2

You may find a forensic tool called unhide to be of interest! http://www.unhide-forensics.info unhide uses a variety of techniques to find (or unhide) hidden processes and TCP/UDP ports utilized by rootkits/LKMs (Loadable Kernel Modules). It supports both Linux/Unix & Windows... More details on the techniques used can be found on the website: http:...


2

In a typical implementation, the child can only ask the parent to perform specific predetermined operations. It does not have a completely free hand. So for example the parent might have the power to delete any file, but will only accept requests to delete files under a specific root.


2

ProcessExplorer by SysInternals can help with this if you have access to the machine. You can even submit hashed process data to VirusTotal to give you an idea if it's a legitimate file/process or not. It also color codes data which I find very helpful. And you can quickly determine which files are signed. For a quick tutorial on how to get the most out ...


2

I would definitely use Process Mon from Sys Internals as well. Link: Process Monitor Download Page I would also look into AutoRuns as well from the same site. If by chance the malware is persistent, AutoRuns will show you whether or not the process is initiated at boot - as well as other useful information. Good luck!


2

If you scroll down the page of the provided msdn link under the See Also heading there's a link to Debugger Security which states: The ability to debug another process gives you extremely broad powers that you would not otherwise have, especially when debugging remotely. A malicious debugger could inflict widespread damage on the machine being debugged. ...


2

The communications between these processes can always be intercepted by an attacker with privileged access to the system. With root access to the box, the attacker owns the system and can circumvent anything and everything you implement (for the most part). Encrypted traffic? The functions that process the encryption keys can be hooked or the process memory ...


2

Listening on localhost traffic is possible on Windows and Linux as well. In Linux tcpdump -i lo. You should consider at least encoding with special algorithm your communication and also consider protecting the process of broker from being dumped, debugged or reverse-engineered.


2

That would most likely be the Virtual address descriptor (VAD). More information about Process Hollowing techniques can be found at https://cysinfo.com/detecting-deceptive-hollowing-techniques/


2

Barring any exploits, there are two different scenarios here. If the process is owned by a different user account (e.g. it's owned by the local system account): One needs to be a member of the local administrators group, have the SeDebugPrivilege privilege, or any other admin granting privileges and/or permissions. If the process is owned by the same user ...


Only top voted, non community-wiki answers of a minimum length are eligible