Slashdot Mirror

← Back to Stories (view on slashdot.org)

Open Source Malware Search Engine

Posted by ryuzaki0 on from the in-case-your-computer-isn't-infected-already dept.

chr0.ot writes "Metasploit creator HD Moore has released an open-source search engine that finds live malware samples through Google queries. From the article: 'The new Malware Search project provides a Web interface that allows anyone to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables.' The tool then searches for actual malware signatures and uses the signature output from ClamAV to find the name of the malware. This is then used in conjunction with a PE signature matching method to form a Google query. Afterwards the malware can then be downloaded directly from Google."

28 of 123 comments (clear)

  1. So.. by michaelhood · · Score: 5, Funny

    Let me get this straight.. now Google is good for porn AND viruses?

    How do the other engines stay in business?!?

    1. Re:So.. by Anonymous Coward · · Score: 5, Funny
      ..now Google is good for porn AND viruses?

      So, basically, the Internet is exactly like real sex now, only easier to get.
    2. Re:So.. by cp.tar · · Score: 2, Funny

      Dunno... I still have to pay for the Internet connection.

      --
      Ignore this signature. By order.
  2. Finding malware with search engine? by broothal · · Score: 5, Insightful

    I wonder how they got that idea. I've never heard of it before.

    1. Re:Finding malware with search engine? by The+Ultimate+Fartkno · · Score: 3, Funny

      I bet the editor of this story lives in Belleville. /obscure?

    2. Re:Finding malware with search engine? by Anonymous Coward · · Score: 5, Informative

      Netsense search isn't open source, as is pointed out in the article.

      Also, this program supposedly highlights how relatively little malware Google actually indexes, contrary to the two earlier articles you cite. Thus this is an additional development, not a dupe.

    3. Re:Finding malware with search engine? by kkuehl · · Score: 3, Informative

      HD acknowledges that is where he got the idea. The point of his release is that it is opensource and available to anyone, unlike the websense version.

    4. Re:Finding malware with search engine? by Anonymous Coward · · Score: 2, Funny

      I wonder if there's any way to use Google to find dup... triplicates.

  3. Microsoft Version! by LiquidCoooled · · Score: 3, Funny

    Clippy:
    It looks like your searching for viruses,
    well your in the right place.

    ps, anyone else notice that slashdot is like waiting for a bus, you wait for hours with no updates then 4 come along all at once.
    Hope the problems have been fixed now.

    --
    liqbase :: faster than paper
  4. I wish google would incorporate this into searches by transporter_ii · · Score: 5, Interesting

    I in no way think that google should block sites, but it would be nice if they would scan sites witht this -- especially for sites that install stuff through holes in IE -- and put a little icon on search results that return an infected site. That way you could at least have a heads up before you clicked on a search result about what you were getting into. It would also be great for Firefox, when everyone gets to see how many sites are exploiting IE.

    Transporter_ii

    --
    Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
  5. So I am going to write a virus by The+Ape+With+No+Name · · Score: 2, Funny

    that snags a random payload off this site! Thanks Metasploit!

    BTW, Dupe, Dupity Dupe, Dupe.

    --
    Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
    1. Re:So I am going to write a virus by mysticgoat · · Score: 3, Informative

      How can an article whose content says the earlier article was bogus be a dupe of the earlier article?

      How can the initial announcement of a freely available tool be a dupe of the announcement of something that is not for public release?

      Conclusion: there are a lot idjits on slashdot who have learned to waggle their fingers on the keyboard and therefore think they are clever. Oh so clever.

      Slashdot has become the proving ground for kids who wanna grow up to be one of the million monkeys...

  6. Re:I wish google would incorporate this into searc by lifgrd1979 · · Score: 3, Informative

    Sorry Google can't do it, McAfee already bought that startup - http://www.siteadvisor.com/.

  7. Thank God! by skinnygmg · · Score: 3, Funny

    I just bought a new PC, and i have no viruses yet.

    1. Re:Thank God! by Ash-Fox · · Score: 5, Insightful
      I just bought a new PC, and i have no viruses yet.
      How do you know?
      --
      Change is certain; progress is not obligatory.
    2. Re:Thank God! by pNutz · · Score: 3, Informative

      I just bought a new PC, and i have no viruses yet.

      How do you know?

      How could he know?

      --
      Death and danger are my various breads and various butters.
  8. I wonder... by Anonymous Coward · · Score: 3, Funny

    what MS has to say about this.
    This is outright competition for their closed source malware search engine IE.

  9. I use Windows by Cro+Magnon · · Score: 5, Funny

    I don't need a search engine to find malware.

    --
    Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
    1. Re:I use Windows by houghi · · Score: 2, Funny

      Indeed. In Soviet America malware searches you.

      --
      Don't fight for your country, if your country does not fight for you.
    2. Re:I use Windows by Opportunist · · Score: 3, Funny

      That's right, Windows provides this service to you, free of extra charge, it's bundled into the system and can't be removed easily, despite some claims by other malware writers who claim they can't make business because of that!

      Just click start - search...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  10. the other way around? by luag · · Score: 2, Interesting

    "to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables" we should be able to do it the other way around too. enter the url for websites we suspect first then list if the websites host malicious executables. imo its more useful that way :)

    --
    Everything is possible. The impossible just takes longer.
  11. Re:Since we're off on a tangent anyway by Filip22012005 · · Score: 4, Funny

    I've got in the habit now when reading slashdot of if I can't understand a post, reading it as if i was speaking it (but silently of course).

    I'm trying to read this sentence as if you were speaking it. And you sound sort of silly.

    --
    When the policeman of the tie, rule you violate, hello punishment of the kitty?
  12. Re:Since we're off on a tangent anyway by rowama · · Score: 2, Funny

    I've got in the habit now when reading slashdot of if I can't understand a post, reading it as if i was speaking it.

    Didja read or speak this before posting? Improper verb usage, mangled propositional phrase, missing punctuation.

    FTR, I'm not a grammar nazi, but you, by claiming such, opened you'reself up for a little good-natured criticism.

    Regards.

  13. Re:I guess I don't understand by doti · · Score: 2, Informative
    I do this on a daily basis for my Windows laptop, I search through my running processes to find strange things, search them on Google


    You really should try the excelent ProcessExplorer from SysInternals.
    --
    factor 966971: 966971
  14. Re:Since we're off on a tangent anyway by rowama · · Score: 2, Funny

    Your being too kind.

    Since I don't normally like to engage in the karma-damaging activity of trolling, I was hoping to get some bang-for-the-buck out of my post. Thus, I left two juicy pieces of bait (i.e., grammatical errors) in my post, and promptly started meta-moderating my heart out to counter the impending down-mod.

    BTW, "my particular dialect" must mean english is an auxiliary language for you. Kudos on that and never apologize for the occasional mess-up. I am not among those who are multilingual, so I envy you.

    Regards.

  15. Re:First it was a dupe... by Ash+Vince · · Score: 3, Informative

    Actually, no it isnt. Although morons who dont read the full article might thinks it was.

    The previous stories

    (http://it.slashdot.org/article.pl?sid=06/07/15/12 53240 and http://it.slashdot.org/article.pl?sid=06/07/11/131 220)

    were referring to another security research co who did something similar and then refused to share it.
    This story is about someone not liking that they wont share, going a little bit further than they did and then putting it on a website and enabling it to the full.

    I looked at the previous (Websense) story on friday or whenever but found it a little annoying that there was nothing to back up the article. This time someone has actually posted a working link to a project and source code.

    --
    I dont read /. to RTFA, I read /. to offend people in ignorance.
  16. Re:Since we're off on a tangent anyway by mooingyak · · Score: 2, Funny

    Your being too kind.

    Usually it's not worth the effort, but given this thread I just had too...

    That should be:

    You're being too kind.

    --
    William of Ockham had no beard. The most likely explanation is that it was chewed off by squirrels every morning.
  17. You win! by rowama · · Score: 2, Funny

    Yep, it is. Congrats, you win the prize: a PS3 running Vista. This offer expires in 30 days.