Slashdot Mirror
Open Source Malware Search Engine
chr0.ot writes "Metasploit creator HD Moore has released an open-source search engine that finds live malware samples through Google queries. From the article: 'The new Malware Search project provides a Web interface that allows anyone to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables.' The tool then searches for actual malware signatures and uses the signature output from ClamAV to find the name of the malware. This is then used in conjunction with a PE signature matching method to form a Google query. Afterwards the malware can then be downloaded directly from Google."
Let me get this straight.. now Google is good for porn AND viruses?
How do the other engines stay in business?!?
I wonder how they got that idea. I've never heard of it before.
Clippy:
It looks like your searching for viruses,
well your in the right place.
ps, anyone else notice that slashdot is like waiting for a bus, you wait for hours with no updates then 4 come along all at once.
Hope the problems have been fixed now.
liqbase
you wait for hours with no updates then 4 come along all at once
Only if you mean the same one comes along four times.
Now it's a tripe.
Do you see what I did there?
The link is here for those that missed it...
When all is said and done, nothing changes...
A search engine for open source malware?
-phozz
I in no way think that google should block sites, but it would be nice if they would scan sites witht this -- especially for sites that install stuff through holes in IE -- and put a little icon on search results that return an infected site. That way you could at least have a heads up before you clicked on a search result about what you were getting into. It would also be great for Firefox, when everyone gets to see how many sites are exploiting IE.
Transporter_ii
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
that snags a random payload off this site! Thanks Metasploit!
BTW, Dupe, Dupity Dupe, Dupe.
Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
Perhaps it should be mandatory for the editors to at least skim the blurbs of every story that is posted. Hell I do that and it only takes me a good 5 minutes a day.
Editors, do you realise there is an option in your preferences that will make it so every section is displayed on the Main page. Do that, and then take five minutes each day to skim through them. Then when you get a story submission that you recognize as having been already posted you can save the five minutes it would take to post it.
Sorry Google can't do it, McAfee already bought that startup - http://www.siteadvisor.com/.
I just bought a new PC, and i have no viruses yet.
what MS has to say about this.
This is outright competition for their closed source malware search engine IE.
enignE hcraeS erawlaM ecruoS nepO
"reality has a well-known liberal bias" - Steven Colbert
I don't need a search engine to find malware.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
Just thought you might like to know that this is broken at the moment.
Sure, the poster made a grammatical error, but his thought/idea was communicated right? It's not like you read it and became so confused you couldn't understand his post. So I would really like to ask... What motivated you to point it out and offer nothing to the topic or discussion at hand?
- the bag of snakes locator
- the shard of glass necktie finder
- the kick in the crotch searcher
Seriously, if this were part of your search results as a heads up of what to avoid I can see it being quite valuable. But, short of research or bad intentions... why do i want to find live malware?
They should try this thing on Slashdot... it's quite obvious that the infamous worm Dupe.W32 has infected it.
From McAfee's security report:
Seriously, I like this story, it's an innovative use of Google... but each time I read it, it becomes slightly less innovative. My bet's on 5 posts before it's done.
I do this on a daily basis for my Windows laptop, I search through my running processes to find strange things, search them on Google, then cross-reference them from my browser history, then I interrogate my wife to find out why she visited some of the stupidest sites on the internet. That's about when I remember she's a MySpace user, and no matter what I do that laptop is screwed.
I got into Linux for the free beer, but nobody seems to have any
CowboyNeal writes: "Metasploit creator HD Moore has released an open-source search engine that finds Slashdot dupes through Google queries. From the article: 'The new DupeDot project provides a Web interface that allows anyone to enter the name of a new article and find Google results on /. for the exact same article.' The tool then searches for appropriate responses and posts a response to the new article on Slashdot proclaiming it to be a dupe. Afterwards the article shows up again."
My spoon is too big.
"to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables" we should be able to do it the other way around too. enter the url for websites we suspect first then list if the websites host malicious executables. imo its more useful that way :)
Everything is possible. The impossible just takes longer.
How Many More Times.....
....
post-ing the same storee!!!
bom bee da bum
SING IT!
So, oss malware? Is it free-as-in-beer or free-as-in-speech malware? Do I still need to accept an EULA to infect my friend's PCs or is it all GNU'D?
Warning: Corny karma killing post above.
the dupes are part of what makes Slashdot, well, Slashdotty.
This is a Vista feature, right? Is it also command line so we can set it to run every day?
I can't believe they didn't implement that button. That was like my favorite button. 'I'm feeling unlucky ~ Downloads the first virus found'? Would have been awesome.
Do I smell an idea I should forward to marketing...?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
pray tell WTF difference is this from another virus kit? this dude's life is going to be a screaming hell when everybody tees off on him.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Sounds like this thing's just a few modules short of obsoletizing us all; give this thing a "beowulf cluster" module and a "in Soviet Russia" module and it'd be pretty well self-contained. Any day now it'll be welcoming it's overlord self...
This space intentionally left (almost) blank.
I see that they fit into McAfee's quality pretty well.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Sounds rather like McAfee SiteAdvisor for IE and Firefox.
SiteAdvisor tests e-mail, downloads, and links. Give an e-mail address to Slashdot and you can expect 6.9 e-mails per week. Reports are detailed and comments can be posted.
The scam artist's best weapons are always psychological. The defenses woven into Firefox are to him never more than a minor inconvenience.
(Unless McAfee has already done so since another poster notes they do something similar.)
--C
McAfee's automated scans can't and won't red-flag a corporate home page simply because the company is on your personal black list. You might, however, take the time to post a comment.
1. It looks like there's a copy of "Worm.Bagle.Z" on GCC's server:
gcc.gnu.org / ml/gcc-prs/2004-05/msg00008 / the_message.scr
(don't open the URL from Windows, or at all. My AV detected the file as "W32.Beagle.gen", right after I downloaded it).
2. Search the engine for "worm" or "trojan" and you'll get tons of them.
You got a -1. Ha Ha.
You're right, google shouldn't block the sites. Instead browsers like Firefox can use that information to increase security settings (disable scripting, etc.) when visiting a site that has been labeled as containing malware. This could be implemented as a plugin for Firefox.
Is it like I am a webmaster and I am blocking visits from the blacklisted websites?
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Duh!
Bon mot. =)
Yep, it is. Congrats, you win the prize: a PS3 running Vista. This offer expires in 30 days.
Does it locate the Windows Genuine dis-Advantage malware?
Many programms include spyware modules. Use anti-spyware for protect your privacy.
As for me, I like professional anti-spy software like PrivacyKeyboard by Raytown Corporation LLC.
You can download it here: http://download.softsecurity.com/1/14/prvkbd.zip (~4MB)
Anti-Spyware: Efficiency of the Means of Defense
How long will it be before there is no such thing but and open source AV? There is just no way a closed source AV will be able to adapt as fast as the virus-sphere. especially when you read about these highly targeted Trojans coming from China and Russia. http://www.securityfocus.com/news/11222 I have Clam AV on an Astaro box (linux based UTM) and I've always been pleased with the perfromance.