Hot answers tagged

63 votes
Accepted

Malicious code somehow hidden with whitespace?

The code is exploiting a flaw in Sublime to prevent text from being displayed. This is what part of the code looks like in Notepad++. It is obviously looking for post['username'] and post['password']. ...
Nelson's user avatar
  • 1,029
34 votes
Accepted

Verifying android application integrity from server side

Update: For 2024, Google has replaced the SafetyNet API with the Play Integrity API. They are conceptually very similar, so the following still largely applies, although the details may differ with ...
josh3736's user avatar
  • 2,555
30 votes

Where can I find an engineer who can examine an exe and verify its legitimacy?

I wouldn't worry about a non-well-reputed anti-virus software's findings in comparison to other well established anti-virus vendors. Even with the reputable ones, it could be a false-positive. Vendors ...
K4M's user avatar
  • 592
24 votes

Verifying android application integrity from server side

The only thing the server can reliably determine about a device is it's behaviour towards the server (the data received, and in what time patterns). Assuming an attacker has knowledge and control of ...
marstato's user avatar
  • 2,315
20 votes

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and ...
Steffen Ullrich's user avatar
20 votes
Accepted

How to interpret virustotal, virusscan scan?

You need to check the exact description of the malware that was detected, because antivirus software nowadays doesn't just detect "viruses", but may also warn you about other kinds of software, like ...
reed's user avatar
  • 15.8k
14 votes

Is there a inherent security threat to having border security receive your passwords?

If you gave me your phone and password for 30 seconds I could install a Remote Access Trojan completely undetectable to the common user that would give me remote access to the phone just like I had it ...
MikeSchem's user avatar
  • 2,361
14 votes

Malicious code somehow hidden with whitespace?

This is a very old story: https://trojansource.codes/ https://en.wikipedia.org/wiki/Trojan_Source https://lwn.net/Articles/874951/ https://www.bleepingcomputer.com/news/security/invisible-characters-...
Artem S. Tashkinov's user avatar
13 votes
Accepted

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to ...
Mirsad's user avatar
  • 10.2k
12 votes
Accepted

Trojan "Win32/Tnega!MSR" found by Windows Defender - aliases used by other antiviruses?

Does anyone here know the alias used for "Tnega!MSR" by other antiviruses, or can point me to a resource so I can find it out myself? Use the VirusTotal website. They have a lot of ...
hft's user avatar
  • 5,031
11 votes

macOS and .ssh/id_rsa security

Yes, malicious software running as your user can do anything that you can do as a user. There is no privilege separation between different applications running as the same user. This has also been ...
David's user avatar
  • 16.1k
10 votes

Where can I find an engineer who can examine an exe and verify its legitimacy?

By default any file/URL submitted to VirusTotal which is detected by at least one scanner is sent to all those scanners that do not detect the resource. So there is a good chance that malware analysts ...
nobody's user avatar
  • 11.5k
9 votes
Accepted

Advertisement on Skype tried to download a file to my computer using Javascript

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a ...
lepe's user avatar
  • 2,194
8 votes
Accepted

Could YouTube downloaded videos be infected (by Youtube)?

To answer your 4 questions : Could (downloaded) Youtube videos be infected? Technically, yes, even if it is quite unlikely. In such a case a malicious video could infect you if it targets a ...
niilzon's user avatar
  • 1,619
8 votes

Where can I find an engineer who can examine an exe and verify its legitimacy?

The detection in your screenshot is from an uncommon antivirus program. There’s also only one detection from over 50 total scanners on VirusTotal. If it was detected by a well known engine like ...
David's user avatar
  • 754
7 votes

My Laptop has outgoing UDP packets on high numbered ports several times a second

Those UDP packets all seem to go to a public DNS server. Considering the destination port is 53, it is highly likely you are doing DNS queries and not something malicious.
Lucas Kauffman's user avatar
7 votes

Does malware persist after wiping hard drive and reinstalling OS from manufacturer disc?

Yes, and there have been cases of this being stored in different areas on the computer one classic example can be found at the following URL: http://www.pcworld.com/article/2948092/security/hacking-...
Trey Blalock's user avatar
  • 14.2k
6 votes

Does malware persist after wiping hard drive and reinstalling OS from manufacturer disc?

In general and at the moment (2016), wipe and reinstall is usually enough for an ordinary user. But notice the qualifiers; malware authors are often quite clever and adapt quickly to new ideas. The ...
Stilez's user avatar
  • 1,684
6 votes
Accepted

What infection vectors is Trojan.Linux.BillGates usually delivered with?

So I have found a few resources which seem to indicate that the main infection method is done by gaining access to the system using SSH bruteforce: A Avast antivirus research: The infection starts ...
Bubble Hacker's user avatar
6 votes

macOS and .ssh/id_rsa security

Your private key can be secured by using a passphrase, and that's another reason to use software from trusted sources only. Here are two links that will be a very good complement for your ...
galoget's user avatar
  • 1,504
6 votes
Accepted

Why arent all hackers traced ? ( network based attackers or malware which communicate with CNC servers)

By claiming that it should be possible to find the original hacker simply by tracing back all connections this question implicitly assumes multiple things which are not true: All countries would need ...
Steffen Ullrich's user avatar
6 votes

Generating a secret on a compromised computer

If the machine is compromised - there is nothing that you can introduce to make it harder to capture - they own the box, the memory and the OS. From what little I understand of Ruby as well the ...
McMatty's user avatar
  • 3,270
6 votes
Accepted

How to act on company-wide malware infestation

Two things come to mind. Isolate as much of your network as you can into zones and tackle each zone on its own. Set up firewall rules to prevent any incoming connections to any device that is not ...
schroeder's user avatar
  • 129k
6 votes
Accepted

Kali.download website blocked by Kaspersky because of Trojan, is it safe?

Kali has many tools that are legitimately malicious tools. So, it is not surprising that Anti-Virus would detect and block those tools. Mimikatz (the thing you listed as being blocked) is a tool on ...
schroeder's user avatar
  • 129k
6 votes

How to interpret virustotal, virusscan scan?

Sometimes engines will flag programs as viruses if the program or some part of the program is used in the payload of an actual virus. For example, programs made by PyInstaller are plagued by false ...
Nonny Moose's user avatar
5 votes

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even ...
Alexander O'Mara's user avatar
5 votes

How to isolate and identify a Trojan's machine code?

Answering Misconceptions I believe that I have several USB memory sticks infected with trojan(s). The memory sticks are data drives (not bootable). A memory stick is a stick used for computer ...
Mark Buffalo's user avatar
  • 22.6k
5 votes

Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)?

It is possible to have an encryption scheme where all the cryptographic routine run on a smartcard. The smartcard contains the encryption and decryption key and the cryptographic operations are run on ...
Lie Ryan's user avatar
  • 31.5k
5 votes

using booby-trapped video to find IP address

The video they sent would have been DRM Protected, DRM is a licensing technology that attempts to prevent unauthorised distribution and restrictive use of a media file. It works by encrypting the ...
Infosecxual's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible