Slashdot Mirror

← Back to Stories (view on slashdot.org)

Open Source Malware Search Engine

Posted by ryuzaki0 on from the in-case-your-computer-isn't-infected-already dept.

chr0.ot writes "Metasploit creator HD Moore has released an open-source search engine that finds live malware samples through Google queries. From the article: 'The new Malware Search project provides a Web interface that allows anyone to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables.' The tool then searches for actual malware signatures and uses the signature output from ClamAV to find the name of the malware. This is then used in conjunction with a PE signature matching method to form a Google query. Afterwards the malware can then be downloaded directly from Google."

18 of 123 comments (clear)

  1. So.. by michaelhood · · Score: 5, Funny

    Let me get this straight.. now Google is good for porn AND viruses?

    How do the other engines stay in business?!?

    1. Re:So.. by Anonymous Coward · · Score: 5, Funny
      ..now Google is good for porn AND viruses?

      So, basically, the Internet is exactly like real sex now, only easier to get.
  2. Finding malware with search engine? by broothal · · Score: 5, Insightful

    I wonder how they got that idea. I've never heard of it before.

    1. Re:Finding malware with search engine? by The+Ultimate+Fartkno · · Score: 3, Funny

      I bet the editor of this story lives in Belleville. /obscure?

    2. Re:Finding malware with search engine? by Anonymous Coward · · Score: 5, Informative

      Netsense search isn't open source, as is pointed out in the article.

      Also, this program supposedly highlights how relatively little malware Google actually indexes, contrary to the two earlier articles you cite. Thus this is an additional development, not a dupe.

    3. Re:Finding malware with search engine? by kkuehl · · Score: 3, Informative

      HD acknowledges that is where he got the idea. The point of his release is that it is opensource and available to anyone, unlike the websense version.

  3. Microsoft Version! by LiquidCoooled · · Score: 3, Funny

    Clippy:
    It looks like your searching for viruses,
    well your in the right place.

    ps, anyone else notice that slashdot is like waiting for a bus, you wait for hours with no updates then 4 come along all at once.
    Hope the problems have been fixed now.

    --
    liqbase :: faster than paper
  4. I wish google would incorporate this into searches by transporter_ii · · Score: 5, Interesting

    I in no way think that google should block sites, but it would be nice if they would scan sites witht this -- especially for sites that install stuff through holes in IE -- and put a little icon on search results that return an infected site. That way you could at least have a heads up before you clicked on a search result about what you were getting into. It would also be great for Firefox, when everyone gets to see how many sites are exploiting IE.

    Transporter_ii

    --
    Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
  5. Re:I wish google would incorporate this into searc by lifgrd1979 · · Score: 3, Informative

    Sorry Google can't do it, McAfee already bought that startup - http://www.siteadvisor.com/.

  6. Thank God! by skinnygmg · · Score: 3, Funny

    I just bought a new PC, and i have no viruses yet.

    1. Re:Thank God! by Ash-Fox · · Score: 5, Insightful
      I just bought a new PC, and i have no viruses yet.
      How do you know?
      --
      Change is certain; progress is not obligatory.
    2. Re:Thank God! by pNutz · · Score: 3, Informative

      I just bought a new PC, and i have no viruses yet.

      How do you know?

      How could he know?

      --
      Death and danger are my various breads and various butters.
  7. I wonder... by Anonymous Coward · · Score: 3, Funny

    what MS has to say about this.
    This is outright competition for their closed source malware search engine IE.

  8. I use Windows by Cro+Magnon · · Score: 5, Funny

    I don't need a search engine to find malware.

    --
    Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
    1. Re:I use Windows by Opportunist · · Score: 3, Funny

      That's right, Windows provides this service to you, free of extra charge, it's bundled into the system and can't be removed easily, despite some claims by other malware writers who claim they can't make business because of that!

      Just click start - search...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  9. Re:Since we're off on a tangent anyway by Filip22012005 · · Score: 4, Funny

    I've got in the habit now when reading slashdot of if I can't understand a post, reading it as if i was speaking it (but silently of course).

    I'm trying to read this sentence as if you were speaking it. And you sound sort of silly.

    --
    When the policeman of the tie, rule you violate, hello punishment of the kitty?
  10. Re:So I am going to write a virus by mysticgoat · · Score: 3, Informative

    How can an article whose content says the earlier article was bogus be a dupe of the earlier article?

    How can the initial announcement of a freely available tool be a dupe of the announcement of something that is not for public release?

    Conclusion: there are a lot idjits on slashdot who have learned to waggle their fingers on the keyboard and therefore think they are clever. Oh so clever.

    Slashdot has become the proving ground for kids who wanna grow up to be one of the million monkeys...

  11. Re:First it was a dupe... by Ash+Vince · · Score: 3, Informative

    Actually, no it isnt. Although morons who dont read the full article might thinks it was.

    The previous stories

    (http://it.slashdot.org/article.pl?sid=06/07/15/12 53240 and http://it.slashdot.org/article.pl?sid=06/07/11/131 220)

    were referring to another security research co who did something similar and then refused to share it.
    This story is about someone not liking that they wont share, going a little bit further than they did and then putting it on a website and enabling it to the full.

    I looked at the previous (Websense) story on friday or whenever but found it a little annoying that there was nothing to back up the article. This time someone has actually posted a working link to a project and source code.

    --
    I dont read /. to RTFA, I read /. to offend people in ignorance.