Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite
1

Can malware, if running within a plug-in or elsewhere within the browser, or if downloaded and executed, or within a site that attempts intrusion, attack other machines on the local network, even if no local shares are setup?

Examples too, please for Windows?

share|improve this question
Depends on the malware. But this question is off-topic for SU. Please check out the FAQ. – techie007 Aug 23 '11 at 14:15
@techie007 Unless he is asking about browser security.. – digitxp Aug 23 '11 at 15:11
@techie007 which I am. – therobyouknow Aug 23 '11 at 15:18
IMO This isn't really a question that's suited to SU, as it's very vague, and hypothetical without knowing the configuration of the network in question. We like specific, answerable questions. But I'll put in a vague answer, just because. ;) – techie007 Aug 23 '11 at 15:30
I always state that I have given a vote for an answer or a question, and the reason why. Who was the coward who downvoted this question? It's already clear that some folk are saying this question may not fit in su's remit but maybe that remit should be extended. If people really dislike this question on SU, I'd be happy to withdraw/delete it - but then we'd also lose the valuable answers already given - and with that the time people took to make them. – therobyouknow Aug 24 '11 at 9:08

closed as off topic by techie007, Linker3000, MaQleod, Nifle, studiohack♦ Aug 24 '11 at 2:21

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

3 Answers

up vote 3 down vote accepted

Yes, malware obtained through any source may proceed to attack other Windows computers on the local network. Even if no shares are set up, these attacks often use the administrative shares which are enabled by default (C$, for example) in professional versions of windows. They may also rely on exploits in entirely different subsystems.

a high-profile example would be downadup/conficker, which after initial connection would attempt brute-forcing of the administrative passwords on other Windows machines on the network.

This is why any computer suspected to be infected should be isolated from the network.

share|improve this answer
+1 Accepted because of the modes of attacks and examples and course of action. – therobyouknow Aug 23 '11 at 20:31
up vote 2 down vote

Yes, some malware you run can attack other machines on the network.

Will it be successful? Depends (on informaiton we don't have).

Examples of malware which attempt to spread? Check SARC (Symantec AntiVirus Research Center).

share|improve this answer
Viruses cannot crawl networks, worms can, Viruses can infect networks but is done by infected files being shared....en.wikipedia.org/wiki/Computer_virus – Moab Aug 23 '11 at 18:51
+1 for confirming the question (i.e. yes / no = yes) and for examples. – therobyouknow Aug 23 '11 at 20:31
moab: true enough, I'll fix it up. – techie007 Aug 23 '11 at 20:50
up vote 0 down vote

Absolutely. Once a hacker (or cracker, if you know the difference) takes control of a machine using a client side exploit (via browser vulnerabilities, that is sending you a malicious link that will fingerprint your browser/plugins and launch adequate exploits against them to compromise the system), he will typically try to escalate privileges (get ADMIN access), then pivot around the network. Pivoting involves launching scans and trying to exploit vulnerabilities in neighbor systems in the network. These vulnerabilities can be detected in any service running in the network.

Yes, open shares are often a hacker's favorite but even if all open shares are closed, the attacker can exploit other outdated services in the network.

See this video demonstration of pivoting after a successfull client side exploit using the free open source exploitation framework Metasploit.

I Hope this helps!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.