61–70 of 103 posts
Earlier quoted context omitted.
Thanks. Being able to provide simple easily verified command on a public forum to detect the most stealthy malware is testament to the brilliant design of unix-style systems. If someone offered a Widows utility to do the same thing on a forum, only fools would run it.
Because you can't type a search string into the search box in explorer on windows?
> Even a regular user with limited privileges can launch it, allowing it to intercept traffic and run commands on infected machines. Huh, how do they do that? > The underlying executable file is written in the C and C++ languages and contains code from previously written libraries, a property that gives the malicious file self-reliance. Does that mean something? I don't get it. I thought arstechnica usually was writt…
They must have some pretty powerful zero-day vulnerability they're exploiting. Expect patches.
Earlier quoted context omitted.
I recall "search all files" looking inside pretty much everything, including exe and unknown file types. (it's been a while for me, too.)
I recall "search all files" only searching indexed folders, which by default leaves a lot of room for the virus to install itself somewhere that is not being search without even trying.
"It can't be detected using the common netstat command." How is this possible? I thought netstat would show any program which is listening for connections on a port, regardless of whether it's actively doing anything.
http://www.phenoelit.org/stuff/cd00r.c
Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have some external device which monitors computer components for change? It should have access to all the computer parts and should be without any interfaces except for physical ones (typing directly on its touch screen). Just an idea...
I can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have…
We can do some things, sure -- sandboxing by default, etc. But when it comes down to it, if the user is able to click an 'allow access to my banking information' button, then that user will be getting screwed.
The only response I can think of is taking that power out of the hands of the user, and putting everyone in a walled garden. That is something that I find distasteful.
Is there a solution that leaves users in power over their own computers? I don't know.
I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even tho…
Outbound filtering is great but easily beaten with a mild level of sophistication. The addition of outbound monitoring and analysis is gold. What kind if dns requests am I making how many per hour? how many per page load? how many per domain? What do my flows look like? Do i have DNS flows that last an hour? http connections that serve twice the normal data as my normal page load? http connectionsreturned per domain.…
It's a userland trojan and it's "one of the most complex APTs in the world"? One wonders what these people would think if they found MosDef in the wild.
"This is sophisticated nation-state malware" doesn't sound quite as stupid as "we found this a year ago but didn't know what it was".
I was wondering why Symantec thought it was from a culturally-homogenous country, and why that would be relevant...
I can't shake the feeling that current security measures are designed in the wrong way. Antiviruses are fundamentally flawed (blacklist instead of whitelist; mostly curing instead of preventing). Filtering traffic is difficult (it is relatively easy to hide information in heavy legitimate traffic). Maybe the way ahead is in ensuring that files (and images in memory, flash,...) don't get changed. Maybe we should have…