Slashdot Mirror
Online Services Let Virus Writers Check Their Work
An anonymous reader writes "Former Washington Post Security Fix blogger Brian Krebs has launched a new blog at krebsonsecurity.com, and his first story highlights a pair of underground antivirus scanning services that cater to virus writers. Scanning services like virustotal.com scan submitted files against dozens of antivirus products, and share the results with each of the vendors so that all benefit from learning about threats they don't yet detect. But there are number of budding online services that allow customers to pay per scan, and promise that the results will never get reported back to the antivirus companies. One service even tests how well web site 'exploit packs' are detected, while others promise additional layers of protection. 'The service claims that it will soon be rolling out advanced features, such as testing malware against anti-spyware and firewall programs, as well as a test to see whether the malware functions in a virtual machine.'"
As I've said before on this subject, there's a whole economy around spam, website exploits and malware, you've got people who will QA your malware for you to check for bugs and these services that will run them against common AV software and suggest ways to evade them. Then you can sell your malware to someone who will use the network of compromised sites they bought off someone else to build botnets which they then sell time on to other people who are using them to send spam emails and perform DDOS attacks on behalf of *other* people.
The big AV companies have created a market of people who are behind a wall, but one that only exists as based on the guardianship of the AV maker. We know they are untrustworthy, and their very presence and size encourages this type of activity. Having a fairly consolidated market with a few vendors having a major share allows "hackers" to target those programs thus making these services useful to a wannabe testing out his exploit.
...selling to both sides in a war.
It would seem to me that, since most malware writers are essentially in competition with each other (as can be seen by past examples of malware that removes other, competing forms) that using a service like this would be against the best wishes of the attacker. I can only imagine that anyone who would provide a service like this would also be diversified enough to have their own stable of malware, and would gain value from having a copy of everything that gets submitted to them.
For your security, this post has been encrypted with ROT-13, twice.
You can also check out our site VirusZoo, that lets you safely test different viruses and malware on a shared virtual machine.
It's more for fun than a serious tool...
http://www.viruszoo.com/
Brian Krebs now has a blog. He has written some of the most consistently interesting, unique and accurate coverage of the internet [in]security world in the past few years. Subscribed.
Would it be possible to legally hold the company to their agreement? Having built up a few botnets several years ago (just for the sake of doing it, no spam/DDoS), I wouldn't trust them. It makes sense that the authors of malicious code wouldn't risk their creation on what could be a sting by AV companies without some sort of legal ramifications... Also, I couldn't imagine it would be *too* difficult to create your own antivirus sand beach for newly-created viruses to test themselves in. A lot of the aforementioned AV's are cheap or free for the sake of the advantages they would give and the edge one's malware could have.
I'm no malware writer : but I have to ask...how hard would it be to make self-modifying undetectable code? Essentially you'd have your malware executable, however many bytes of assembled code that do stuff. Then you'd insert various dummy instructions that are randomly chosen but cancel each other out throughout the code. (so you might have an add instruction followed by a subtract instruction, etc). Every time the malware installs itself on a new PC, it randomly creates a new set of dummy instructions.
So the malware would still have a constant codebase that is doing the work, but wouldn't the dummy instructions prevent anti-virus/anti-malware software from being able to "see" the executable? In a similar manner, any registry entries that the malware needs would be randomly chosen character strings. The server address that the malware uses to communicate with would be scrambled via a randomly chosen encryption key as well.
What I'm describing isn't hard at all : a basic project that a junior or senior cs student could easily complete.
But these people may be US citizens. Your procedure only applies to foreigners.
Wouldn't execution by robot, virus or worm be more fitting?
I could lock them in a room with my dogs. They would gas the SOBs
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
If you buy all those packages (besides pirating) at the virustotal.com, it will cost far less than $6000 which a Rolex costs.
That mob leader wears Rolex watch you know, it is not like he won't be able to buy dozens of antivirus, virtual machine solution.
The days of "hacking for a bottle of Vodka" is really over, if ever existed.
Virustotal should be a security organization's free service with costs shared by AV vendors rather than being a "underground" (???) service. It does nothing rather than doing a real life check of current antiviruses. If I was a AV vendor who trusts their solution, I would even donate a blade to them. Being the only vendor finding a virus in suspected file can't be more decision making than anything including 1000s of white papers.
PS: If a black hat trusts to that file scanner, he is more than dumb since the virustotal or any offline file checker (including clam or stuff OS X users keep buying) doesn't have heuristics which can be only performed on a up and running windows OS.
Markets happen whether they're intended or not. They're as natural as water flowing downhill, even in ostensibly destructive fields. Capitalism is not more a "choice" than gravity is: what matters is how you deal with it.
Clearly, we don't have enough incentives to either 1) discourage these people from writing malware, or 2) encouraging them to do other things.
There is an economy, but the players are all using layers upon layers of aliases. Inevitable is a fresh mask on carnivore and this is merely one of them. How could you possibly trust a service NOT to report a ZDE? Find one, submit and see if it shows up in other scanners or see if there are reports of anyone out there using it. The service could be a front for carnivore, a front for a virus broker, or a front for a majority vendor. The simple rule is this: if there is money to be made and this is the only principle protecting the submission, it is INEVITABLE that someone else will offer more. And if the price per submission is affordable, and the functions advertized then its certainly not underground but engaging in some simple advertizing.
Most hackers have heard of honeypots...
No, they should instead share a cell with men who have enlarged their penises, taken Viagra and are looking for a new relationship.
Software freedom is more important than software safety, just like everywhere else.
On a proprietary OS platform, it's only appropriate that the antivirus programs contain license restrictions against using them for evil, or using them to circumvent other users' need to buy their own copy and update subscriptions.
These programs already contain very restrictive EULAs. It's logical for them to contain a restriction against this type of abuse.
Otherwise... someone could just write a free "stub AV" everyone installs on their desktop, that uses an outsourced, online scanner to actually do all the file checking.
Then the manufacturer of the AV scanner loses all their business to the "outsourced AV programs"...
This is proprietary software. They profit by selling copies of the software, not by enabling as much freedom as possible.
Don't fool yourself into thinking you have software freedom, or software freedom principles, somehow apply to someone else's closed source, "pay for use, but restricted" software product.
All commercial AVs are in that category... in general, basically all AVs are in that category (except the likes of ClamAV)
Why not just make sure you DONT get infected?
Being infected with malware, like falling for the various scams spread by spam, depends on a high level of stupidity and/or incompetence and i have very little sympathy for such people.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Do you think underground vendors who are already doing questionable things like selling malware and selling infected machines, will really care about using an unlicensed av product?
Most likely all the av they use are pirated anyway...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I have no doubt underground vendors are willing to do questionable things.
But it would at least help to force them to actually go underground, rather than use a public exposed website for anonymous scanning (without sample sharing), make their service harder for novices to access, increase the price.
And reduce the "legitimacy" or "credibility" of the service designed to facilitate malware authors.
The DMCA and various DMCA-inspired laws passed by various countries and the notion of 'takedown letters' really sucks, but maybe it can be put to one good use ...
The title says it all.
Vista and 7 are much less prone to malware infestation. Since Vista came out, I've seen less than a dozen compromised Vista computers... virtually all of my malware work is on XP.
That market is disappearing.
Why not just make sure you DONT run windows?
Being infected with windows, like falling for the various scams spread by microsoft, depends on a high level of stupidity and/or incompetence and i have very little sympathy for such people.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Yes, because an anti-virus scanner running on a single computer uses negligible resources, and a service that scanned people's computers remotely would scale wonderfully and make a huge zero-cost profit :-P
Wait, so you're saying that freedom is useless unless I have full freedom? I disagree, every small bit of freedom is a good thing. I don't think my software principles apply to proprietary AVs, I think an AV that respects them even slightly more is better than an equivalent one that doesn't.
click
Help stamp out iliturcy.