Hot answers tagged

47

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First /...


30

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the nonce via Google Play Services. SafetyNet verifies that the local device is unmodified and passed the CTS. A Google-signed response ("attestation") is returned to ...


21

The only thing the server can reliably determine about a device is it's behaviour towards the server (the data received, and in what time patterns). Assuming an attacker has knowledge and control of all elements that influence the behaviour, the attacker can create a malicious clone and the server will never know. So, technically, this is impossible. Unless ...


20

These kinds of back-doors are polymorphic, that is they are designed to look different every time - in practice it's a waste of time trying to decipher them because they all do exactly the same thing. They take external input and they execute it. It might take input from a cookie or a post variable, and it might try and set some PHP options to prevent ...


20

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


19

The link provided in the question seems really fishy. If it's a "patched" version supposed to get rid of limitation, it's more than probable the fixer added some kind of additional surprises (like a virus) in it. The official site already proposes a free version of the software, so I would start here to avoid getting a virus from a random stranger. This ...


16

This is neither a virus nor a trojan, and it does not make the site unsafe to visit in any way whatsoever. Your antivirus package is crying wolf. Coinhive is a Javascript plugin which implements a cryptocurrency miner. While you view a web site which uses this script, your browser will perform calculations to mine cryptocurrency for the owner of the web ...


15

Traditionally a virus is malware which uses the infected host to replicate itself to other systems, i.e. by infecting files which might get shared, copying itself to network drives or USB sticks. It gets usually not knowingly executed by the user but gets executed when the user opens an infected file, runs an infected program etc. A trojan is a malware ...


14

If you gave me your phone and password for 30 seconds I could install a Remote Access Trojan completely undetectable to the common user that would give me remote access to the phone just like I had it in my hand unlocked (ie. listen to the microphone, access all files, pictures, text messages, calls, ect). If I can do that I'm sure any government is capable ...


13

From a theoretical standpoint, you are connecting to a remote machine and it is sending data back to your machine. While in the normal context, this is just display, location type data, it is possible that some sequence of bits could be processed in such a way that it causes an exploit in your rdesktop or other tool used to make the remote connection. With ...


13

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will happen when that file is ...


12

I don't think that a trojan horse will be specifically codded to hide from TCPview (or it is TCPview so popular that this happens?) but maybe there's a method to hide it's activity form any program trying to check the current internet connections (even wireshark) and what programs or windows processes (even svhost or system) are establishing those ...


11

Yes, malicious software running as your user can do anything that you can do as a user. There is no privilege separation between different applications running as the same user. This has also been noticed by xkcd. To protect your SSH key specifically, you can add a passphrase, as mentioned by galoget, but that will only help marginally -- a malicious ...


9

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a bug in the areyouahuman server which failed to set the content-type header. In the case of browsers, they normally display the "download file" pop-up when the ...


7

Short answer: Yes. Why? If the malware/virus is delivered via an application/file and the app/file is opened after you re-installed Windows, then the virus/malware will be reactivated. When you upgrade, you don't do a complete re-install of Windows, you just update it (for example from Vista to 7). If this happen it's very likely that the virus will run ...


7

Those UDP packets all seem to go to a public DNS server. Considering the destination port is 53, it is highly likely you are doing DNS queries and not something malicious.


7

To answer your 4 questions : Could (downloaded) Youtube videos be infected? Technically, yes, even if it is quite unlikely. In such a case a malicious video could infect you if it targets a specific player (and possibly a specific version). In such a case, a malicious actor would have uploaded a video in the hopes that someone downloads it and then plays ...


6

I'm sure others will be able to specify exactly how this could be done, but I'd like to point out that you should always assume that it can and has been done. Sure it might not be likely for most trojan infections, but due diligence demands that you act as though you can't trust anything a compromised machine is telling you. In practice this means that you'...


6

It is possible to have an encryption scheme where all the cryptographic routine run on a smartcard. The smartcard contains the encryption and decryption key and the cryptographic operations are run on the smart card, rather than the main OS. All that the main OS are able to do is send commands to the smartcard and receive encrypted or decrypted data, but ...


6

Yes, and there have been cases of this being stored in different areas on the computer one classic example can be found at the following URL: http://www.pcworld.com/article/2948092/security/hacking-teams-malware-uses-uefi-rootkit-to-survive-os-reinstalls.html This article goes into a little more detail on how this works http://arstechnica.com/security/...


6

So I have found a few resources which seem to indicate that the main infection method is done by gaining access to the system using SSH bruteforce: A Avast antivirus research: The infection starts by an attempt to brute force SSH login credentials of the root user. If successful, attackers gain access to the compromised machine, then install the Trojan ...


6

Your private key can be secured by using a passphrase, and that's another reason to use software from trusted sources only. Here are two links that will be a very good complement for your understanding: Protecting a Private Key Working with SSH key passphrases Hope it helps.


6

If the machine is compromised - there is nothing that you can introduce to make it harder to capture - they own the box, the memory and the OS. From what little I understand of Ruby as well the choice of Random is wrong for anything to be secured as it is only a pseudo-random number generator and instead you should be using SecureRandom. With ...


6

Two things come to mind. Isolate as much of your network as you can into zones and tackle each zone on its own. Set up firewall rules to prevent any incoming connections to any device that is not expecting it. Start with the machines that contain your most precious info. And by "handle it", I mean nuke each machine and rebuild from known good backups. ...


6

No, it's not a virus. The following xkcd comic illustrates this well: CC-BY-NC 2.5: Created by Randall Munroe, xkcd As you can see, the events you described have nothing to do with a keylogger, a virus, a trojan or what InfoSec professionals generally refer to as "malware". If you really had a malware infection, you would not notice it, and all the ...


5

Answering Misconceptions I believe that I have several USB memory sticks infected with trojan(s). The memory sticks are data drives (not bootable). A memory stick is a stick used for computer memory. In this case, what you have is a USB flash drive that works much like a hard drive, not your RAM. The USBs are flash drives containing thousands of files,...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


5

The video they sent would have been DRM Protected, DRM is a licensing technology that attempts to prevent unauthorised distribution and restrictive use of a media file. It works by encrypting the video and audio streams with an encryption key and requesting a license (decryption key) from a network server when the file is accessed. As it requires network ...


5

The article is clear enough-- it is a JS library that mines Monero (cryptocurrency). On legitimate sites, it's innocuous but annoying. But it has been bundled with (and thereby associated with) more than a few types of browser malware that force it to run on all sites and send the money back to the sole executor, which is why the AV is flagging it as bad-- ...


5

By claiming that it should be possible to find the original hacker simply by tracing back all connections this question implicitly assumes multiple things which are not true: All countries would need to work together to find the attacker because otherwise the attacker could just hide their path by connecting through several countries. But, this would mean ...


Only top voted, non community-wiki answers of a minimum length are eligible