Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I develop my own viruses for 'scientific' purposes, namely to see if they pass the test of Virustotal.com. They all do, except for one or two scanners. Is this considered something you should report to Microsoft/McAfee/etc? If yes, how?

share|improve this question
1  
With respect to 'how' I'd suggest studying this kind of thing and the links at the end of the doc: icann.org/en/system/files/files/… That should also help you investigate if it's a 'yes' as well. – Ed Daniel Mar 13 at 14:58
37  
btw: Which scanners do detect your viruses? – marstato Mar 13 at 21:10
2  
When you upload to Virustotal, it gets sent to the AV companies. Sorry, no source handy, just my recollection. – Micheal Mar 14 at 2:21
14  
Making a virus that avoids AV detection is actually pretty simple. The real deal is exploiting bugs in applications / OS to allow something you shouldn't be supposed to do - for example, a non-administrator running your "virus" elevated. With all the RnD into heuristics, most of AV detection is still based on matching the file to a list of known viruses - that's why it's so important to keep your AV detection files up to date. If you use AV in the first place, of course :) – Luaan Mar 14 at 8:20
8  
is a bash script that simply runs rm -rf / a virus? – Petah Mar 15 at 11:37

That's a pointless exercise.

Most malware scanners match on fragments of binary code (aka virus signatures), and they look for MD5 hashes of known infected code. Unless the virus you wrote has been deployed into the wild, there isn't a chance they'll have your code's exact signatures on file.

The scanners that do trigger a match are most likely those using heuristics, which scan for "suspicious" behavior. For example, very few programs legitimately need to request the OS grant them the privilege to "Act as a debugger", yet that's fairly common behavior in malware, so if they find it they'll flag it.

Reporting your custom viruses to McAfee won't help anyone - not McAfee, not the public. If they don't identify your code as a virus, it's because their scanners don't have very effective heuristics (which they already know, and won't learn from your code among the hundreds of viruses they analyze per day.) And developing a match takes a researcher time and effort, which costs McAfee money. There is no value to McAfee to waste money on a virus that nobody can get, because as a white hat you won't allow it to be released.

share|improve this answer
49  
@JohnDoe I think John might have gone a little far pointing out that you have to be careful about your white hat status. Just saying you're white hat doesn't make you white hat. Instead, making sure any code you write can't be used for malicious purposes is the critical action. Maybe he overplayed and implied you aren't careful with your code, when what he was probably trying to say is, "Just in case, please do us all a favor and be very careful with your code". – Todd Wilcox Mar 13 at 16:22
71  
The important part of the answer which could be made clearer is that "virus scanners" are nothing but blacklists of known, found-in-the-wild virus code and code fragments. Some AV tools also detect suspicious/virus-like behavior, but they're likely to have lots of false positives and break things the user may want to work. – R.. Mar 13 at 16:49
6  
The only exception I would make to the above is if you are wanting to share a proof of concept of virus that takes advantage of an undiscovered exploit. Then I would submit samples and code with the appropriate security researchers and/or the affected software vendors to help aid in protecting the public. – baconface Mar 14 at 23:57

you should not, actually - there's nothing obliging you to do so. You said you're white hat, so you're not intended to rob a bank using your code, and your personal research results are your very own and private unless you wish to publish them somewhere.

share|improve this answer
1  
What if OP wants to help AV publishers to strengthen their heuristics so he'll feel safer using the products himself? Even if OP only cared about himself, he might want to report his finding. Maybe he'll even get a dollar or two, or even a job offer. – Kay Mar 14 at 17:25
5  
@Kay sounds reasonable, and I propose for OP to publish it in his blog or in security-related journal. He'll have at least +1 scientific publication, and the reach will be not just the AV makers, but a much broader security researchers community. – Alexey Vesnin Mar 14 at 17:57
1  
@Kay Sharing is always a good idea and benefits community. Still I find that any kind of publishing is philosophically probably a selfish act even though it would be generally deemed selfless. – Mikuz Mar 16 at 9:51
1  
@Mikuz taking care about yourself is good, and there's no shame to write your name next to your achievemnts – Alexey Vesnin Mar 16 at 11:51
2  
@Alexey Vesnin Yes, I totally support all this kind of behaviour. Also, I find that it's good for people to take care of themselves and be selfish. This is getting way out of topic though. – Mikuz Mar 16 at 11:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.