New answers tagged

21

I have experience securing DICOM in an identical situation so I'll focus on that. Assuming you're using properly configured environment (Autorun disabled, frequently updated Antimalware, etc.) then CDs are relatively safe. The same cannot be said for USB drives. We used a burner PC for USB drives. These discs are usually created by a PACS system (Picture ...


2

A dedicated machine on a separate VLAN with Internet access to update virus definitions. Then SFTP to a dedicated Linux VM that would also be running an AV instance and if you can help it possibly even several different AV's like ESET + CLAM for example. Then after it's scanned again and validated clean to push that data or have the data pulled into your ...


1

No, storing a file that is dormant cannot do anything because it's dormant. There was a file hook into the raw file itself which is why you got the error. This could even be windows explorer trying to preview the file but even if you mounted the iso image where it shows up as a CD/DVD it's still dormant until you execute something intentionally or ...


24

It all depends on what you actually do with the data. A bunch of bits sitting on a disk is just that: a bunch of bits. It needs to be somehow executed in order to become malware and pose a threat to your network. This could be done in a couple of ways: windows allows autorun on removable media. Mitigation: change ingestion machine to Linux or carefully ...


0

Just to add to the previous answer, which covers pretty much everything -- VirusTotal actually does sometimes do dynamic analysis, especially if the file is commonly checked or initially looks suspicious. They started doing this in 2017, and you can get more information on it directly from them here. You can check to see if dynamic analysis has been run on ...


5

ad 1: It does upload your file, but only if the hash is not known. As the very first thing, a piece of Javascript will calculate a cryptographic hash (SHA-256 if I recall correctly, but might be wrong) and sends that. The engine then, rather than scanning, looks up the hash in a already-did-it database. Only if not present, or if you insist, it will upload ...


1

Although there have been poorly implemented ransomware attacks in the past that have been broken, I haven't seen that in a while so it's unlikely you can break it. Nevertheless it's worth googling. That said, here's a method that may provide partial recovery of critical files. Generally the ransomware attacks don't touch Windows Shadow Volumes. Get ...


Top 50 recent answers are included