Slashdot Mirror
Online Services Let Virus Writers Check Their Work
An anonymous reader writes "Former Washington Post Security Fix blogger Brian Krebs has launched a new blog at krebsonsecurity.com, and his first story highlights a pair of underground antivirus scanning services that cater to virus writers. Scanning services like virustotal.com scan submitted files against dozens of antivirus products, and share the results with each of the vendors so that all benefit from learning about threats they don't yet detect. But there are number of budding online services that allow customers to pay per scan, and promise that the results will never get reported back to the antivirus companies. One service even tests how well web site 'exploit packs' are detected, while others promise additional layers of protection. 'The service claims that it will soon be rolling out advanced features, such as testing malware against anti-spyware and firewall programs, as well as a test to see whether the malware functions in a virtual machine.'"
As I've said before on this subject, there's a whole economy around spam, website exploits and malware, you've got people who will QA your malware for you to check for bugs and these services that will run them against common AV software and suggest ways to evade them. Then you can sell your malware to someone who will use the network of compromised sites they bought off someone else to build botnets which they then sell time on to other people who are using them to send spam emails and perform DDOS attacks on behalf of *other* people.
The big AV companies have created a market of people who are behind a wall, but one that only exists as based on the guardianship of the AV maker. We know they are untrustworthy, and their very presence and size encourages this type of activity. Having a fairly consolidated market with a few vendors having a major share allows "hackers" to target those programs thus making these services useful to a wannabe testing out his exploit.
...selling to both sides in a war.
It would seem to me that, since most malware writers are essentially in competition with each other (as can be seen by past examples of malware that removes other, competing forms) that using a service like this would be against the best wishes of the attacker. I can only imagine that anyone who would provide a service like this would also be diversified enough to have their own stable of malware, and would gain value from having a copy of everything that gets submitted to them.
For your security, this post has been encrypted with ROT-13, twice.
lol- you suck!
You can also check out our site VirusZoo, that lets you safely test different viruses and malware on a shared virtual machine.
It's more for fun than a serious tool...
http://www.viruszoo.com/
Maybe it's a Y2K10 glitch? Who knows. Best to try doing things to get your karma back up and hope this bad luck passes.
This is the only logical conclusion.
...these people should not be hunted down and set to Gitmo for some water boarding then a firing squad?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Brian Krebs now has a blog. He has written some of the most consistently interesting, unique and accurate coverage of the internet [in]security world in the past few years. Subscribed.
Good Lord. We need to cut to the chase and just ban Windows from the Internet as unsafe at any speed.
http://rocknerd.co.uk
Would it be possible to legally hold the company to their agreement? Having built up a few botnets several years ago (just for the sake of doing it, no spam/DDoS), I wouldn't trust them. It makes sense that the authors of malicious code wouldn't risk their creation on what could be a sting by AV companies without some sort of legal ramifications... Also, I couldn't imagine it would be *too* difficult to create your own antivirus sand beach for newly-created viruses to test themselves in. A lot of the aforementioned AV's are cheap or free for the sake of the advantages they would give and the edge one's malware could have.
I'm no malware writer : but I have to ask...how hard would it be to make self-modifying undetectable code? Essentially you'd have your malware executable, however many bytes of assembled code that do stuff. Then you'd insert various dummy instructions that are randomly chosen but cancel each other out throughout the code. (so you might have an add instruction followed by a subtract instruction, etc). Every time the malware installs itself on a new PC, it randomly creates a new set of dummy instructions.
So the malware would still have a constant codebase that is doing the work, but wouldn't the dummy instructions prevent anti-virus/anti-malware software from being able to "see" the executable? In a similar manner, any registry entries that the malware needs would be randomly chosen character strings. The server address that the malware uses to communicate with would be scrambled via a randomly chosen encryption key as well.
What I'm describing isn't hard at all : a basic project that a junior or senior cs student could easily complete.
Hanging is good swords are good you need to do this in a "green manner"
Any person using FTFY or editing my postings agrees to a US$50.00 charge
If you buy all those packages (besides pirating) at the virustotal.com, it will cost far less than $6000 which a Rolex costs.
That mob leader wears Rolex watch you know, it is not like he won't be able to buy dozens of antivirus, virtual machine solution.
The days of "hacking for a bottle of Vodka" is really over, if ever existed.
Virustotal should be a security organization's free service with costs shared by AV vendors rather than being a "underground" (???) service. It does nothing rather than doing a real life check of current antiviruses. If I was a AV vendor who trusts their solution, I would even donate a blade to them. Being the only vendor finding a virus in suspected file can't be more decision making than anything including 1000s of white papers.
PS: If a black hat trusts to that file scanner, he is more than dumb since the virustotal or any offline file checker (including clam or stuff OS X users keep buying) doesn't have heuristics which can be only performed on a up and running windows OS.
AV makers should include a clause in the EULA, that: the software may not be used to provide a virus scanning service for more than one third party. You may not scan a file for another person without purchasing an additional license to be permanently assigned to each person.
And then they can send their army of lawyers at any "paid AV scanning website" that doesn't have an agreement with them.
Markets happen whether they're intended or not. They're as natural as water flowing downhill, even in ostensibly destructive fields. Capitalism is not more a "choice" than gravity is: what matters is how you deal with it.
Clearly, we don't have enough incentives to either 1) discourage these people from writing malware, or 2) encouraging them to do other things.
There is an economy, but the players are all using layers upon layers of aliases. Inevitable is a fresh mask on carnivore and this is merely one of them. How could you possibly trust a service NOT to report a ZDE? Find one, submit and see if it shows up in other scanners or see if there are reports of anyone out there using it. The service could be a front for carnivore, a front for a virus broker, or a front for a majority vendor. The simple rule is this: if there is money to be made and this is the only principle protecting the submission, it is INEVITABLE that someone else will offer more. And if the price per submission is affordable, and the functions advertized then its certainly not underground but engaging in some simple advertizing.
Most hackers have heard of honeypots...
I remove malware for a living. Because I work in strangers' houses in unfamiliar neighborhoods, I also carry a large powerful handgun.
If I met someone who credibly claimed to be an author or distributor of malware, I fear I might "lose" several 80-cent bullets...
The title says it all.
Vista and 7 are much less prone to malware infestation. Since Vista came out, I've seen less than a dozen compromised Vista computers... virtually all of my malware work is on XP.
That market is disappearing.
click
Help stamp out iliturcy.
Is it really so dangerous to send new malwares to virustotal? I don't think so.
Here are two scans results of the same malware:
http://www.virustotal.com/analisis/8997c271747fbb83d870ffe9f6ad034d
http://www.virustotal.com/analisis/a5b12389a3f23687c787eeb0a2ab12bf
The first was scanned on 2008.11.11 with detection rate of 6/36, the second scan was performed on 2009.03.18 with detection rate 9/39. One of the 3 new AV vendors detecting it were new in virustotal at all, and two of them detect it because they have already found what the malware is about. Although this is only one case, I bet everybody can find such examples in a very short time.
It is said that the samples are sent real-time to AV vendors. But it looks like they do nothing with the samples for months...
SymbolNOBODY: You said what's quoted below from you, here -> http://slashdot.org/comments.pl?sid=1476008&cid=30428430
"It's tolerated (perhaps encouraged) in part because these annoying actors are otherwised engaged in improving Linux. Major Debian and BSD contributors, for example, use slashdot as a workspace for their human-machine interaction side experiments, of which APK is probably one. In addition many of these trolls post links which, if you follow them, will completely hose a Windows machine. This is part of the game. - by symbolset (646467) on Monday December 14, @01:15AM (#30428430) Journal
I took offense to the BOLDED part... & ALL you EVER seem to have is "ad hominem" based attacks on people, not the points they make. So, "symbolNOBODY": The day you can make something like this (& that got you PAID for it, & that has done as well for others online):
http://www.tcmagazine.com/forums/index.php?s=b861a743aa23c4568b7d73e07ef7ecec&showtopic=2662
That's also gone over 250.000 views worldwide in 1++ yrs.' time online, & across 15 forums where that guide for Windows Security has been made either an:
1.) "Sticky/Pinned" thread
2.) An "Essential Guide"
3.) Rates 5/5 stars (etc.)
AND, gets "feedback" like this from users that have applied it:
----
http://www.xtremepccentral.com/forums/showthread.php?t=28430
PERTINENT QUOTE/EXCERPT:
"...recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual. Now I don't recommend this for the average joe, but it if can work for a kids PC it can work for anything! Now, i substituted OpenDNS and activated the Adult Content filter with them for this kids computer. I know its not perfect, but will catch over 99.5% of said sites."
and
http://www.xtremepccentral.com/forums/showthread.php?s=10f9ba9ad5ff990aaae1e7ec91f593a2&t=28430&page=3
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local. (except AVG updater, needed system local)"
Thronka - forums member @ xtremepccentral.com
----
THEN, when you have done so, on THAT account? THEN, you can talk (and, ESPECIALLY about that which you said about myself which I quoted from you above shows YOU, libelling ME, clearly. It's clearly immaterial & outright b.s. from you, vs. the kind of feedback my guide on securing Windows gets, quoted above from others? It CLEARLY disproved your outright b.s., period...)
Also?
When you have done all of this as I have over time in this Art & Science of computing:
"My Na