Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:

enter image description here

This got me to thinking, what differentiates that from software piracy?

If I download the torrent for Adobe Photoshop CS then I am pirating that software - deemed by many countries to be illegal. If anti-virus software uploads that same copy of Adobe Photoshop CS to their servers for analysis then how is that any different?

It's possible that this is a moot point - software vendors understand and allow this particular type of 'piracy' or in certain countries this comes under "fair use".

But what about malware authors?

A piece of malware is just a piece of software and the author of that software is afforded the same rights as any software author. Could a malware author take the anti-virus company to court for 'pirating' their software? This doesn't just apply to software like the BlackHole Kit but what about state sponsored malware like Stuxnet?

So this is my question. Are anti-virus companies afforded special protection from copyright laws and if not could these be used against them, especially by corporate or state malware authors?

share|improve this question
    
Do you know that F-Secure isn't licensed? Their corpus of clean Adobe files could come from the installation of Photoshop that their designers use. –  user185 Sep 28 '12 at 12:35
    
Even still - if I own a company wide license for Adobe am I allowed to store and distribute the install files on a separate system? I'm not sure. –  Andy Smith Sep 28 '12 at 13:03
    
I wonder how many malware authors will show up in court to sue AV companies? –  NULLZ Jun 7 '13 at 15:25
add comment

4 Answers

up vote 12 down vote accepted

Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). To take the fair use criteria one by one:

  • Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a malware assessment based on the original software. They're not creating a copy just to have an extra copy; they use the copy to produce something novel. This factor heavily favors the analysts.

  • Nature of the copied work: The piece of malware is a published, creative work that rightfully enjoys copyright protection. This factor favors the malware authors.

  • Amount and substantiality: The analysts use the whole software in their analyses. This factor favors the malware authors.

  • Effect upon work's value: Virtually none, which favors the analysts. In fact, the work has little legitimate market, since its primary use is illegal. (While it may be the case that AV vendors reduce the value of malware by building defenses against it, this is not the same as harm caused by creating a substitute work. Wikipedia sumarizes it aptly: "Courts recognize that certain kinds of market harm do not oppose fair use, such as when a parody or negative review impairs the market of the original work.")

While factors #2 and #3 are in favor of the malware authors, the transformative use of the malware lends tremendous legal weight to the fair use argument in favor of the analysts. Only a judge can make a final ruling on fair use, but I suspect that a reasonable judge would rule in favor of copying malware for analytic purposes.

EDIT: This answer considers the legality of copying from a limited, copyright-only perspective. There are other statutes beyond copyright (e.g., ACTA, DMCA) that may be violated when copying malware or legitimate software without permission from the copyright holder. Even if a use is protected by fair use, the fair use defense protects against copyright infringement only, not other violations that may also occur during (or be necessary for) the act of a fair use.

(For example, you may want to include a few seconds of a movie in a video report for your cinematography class, but your copy of the movie only plays in a proprietary player that does not allow exporting snippets of the film. If you download a tool for circumventing the "no exporting of snippets" restriction of your player, then you have violated the DMCA, even though your ultimate goal was probably fair use.)

In short: the analysts' copyright infringement is probably legally defensible under fair use, but analysts may still be in violation of other statutes that are separate from traditional copyright.

share|improve this answer
2  
I personally can go with this, but in the USA fair use is only something that can be discovered through lititgation. You have to go to trial to find out. Without a trial, you're skirting legality at best. Further, fair use is something you plead AFTER YOU ADMIT TO COPYRIGHT VIOLATION. It's not usable up front. –  Bruce Ediger Sep 28 '12 at 14:09
1  
@BruceEdiger Yes, I completely agree. Until a malware author steps forward and brings a case against an AV vendor (hah), we'll never have definitive case law on the issue. As I said in my answer, we can merely speculate how such a fair use defense might be made and assessed by a hypothetical judge. –  apsillers Sep 28 '12 at 15:03
1  
@BruceEdiger Malware is an open ended term that at least in my mind includes adware and spyware. There are several instances in the past 5 to 10 years where adware companies have unsuccessfully sued anti virus companies for detecting their "software". –  stoj Sep 28 '12 at 15:42
    
We're not discussing detecting malware, we're discussing possession of a huge amount of copies of software, possibly in contravention of international treaties, like ACTA. In the USA since 1976, and elsewhere since the Berne Convention was ratified, any intellectual property is automatically copyrighted by the creator. It strikes me that most of the posters here are arguing good intent, but most copyright law does not allow the consideration of intent or state of mind. Mere possession is illegal. –  Bruce Ediger Sep 28 '12 at 16:59
    
@BruceEdiger I'm only considering intent inasmuch as it's a component of the "purpose and character" fair use factor. That said, fair use is strictly a copyright infringement defense; it does not apply to laws that are outside the domain of pure copyright (e.g., ACTA). I'm afaid I don't know the provisions of ACTA well enough to offer any specific speculation in that arena; I'll research it. In the meantime, I have offered a provisional edit about legal concerns beyond traditional copyright infringement. –  apsillers Sep 28 '12 at 17:11
show 2 more comments

It classes as fair use for research purposes according to the DMCA. However you should note that in practice this law tends to only really apply to large companies, independent researches or even ones linked to large universities are running the risk of being sued for doing the exact same thing.

share|improve this answer
add comment

It shouldn't be an issue.

Yes, if you buy Photoshop and upload parts of it to a company server, that's copyright infringement. But AV companies don't need to copy the entirety of Photoshop and keep it. Developers can install a legitimate instance of Photoshop on a single machine. Once they've analysed it, they can store the analysis instead. E.g. hashes of all the files, which might be used to identify Photoshop files and check for potentially malicious modifications. There will be grey areas - and the Photoshop EULA will claim that any deep analysis is illegal - but they're not black enough to be really worrisome.

With malware - yes, we can assume that any creative work is copyrighted, and without a license you have no right to copy it. IANAL. However, in order to obtain damages the malware author would have to claim authorship of it in court. For black software, this would usually be undesirable. And there are legal concepts like "clean hands" - if the software was installed illegally, then I suspect objecting to AV activities would be laughed out of court.

I think I can contrive some darker grey areas. Consider an expensive penetration-testing tool which is "stolen" and incorporated into a "malicious attack tool". Security companies want to analyze the attack tool, but they may have to infringe the copyright of the pen-testing tool in order to use it... but I think it's a much narrower problem than your concern.

share|improve this answer
add comment

Because there is no illegality in analyzing pirated software. It's illegal to use it and illegal to spread it. It might even be illegal or against EULA to edit software (cracking it often edits some files or binaries).

Also your second comment is a bit weird. Software normally comes with a license you need to accept explicitly or implicitly when using software. It should be readily available to anyone on request. That's rather problematic with Stuxnet since no-one will ever say "Hey I wrote that piece of software that was able to destroy your Nuclear plant and refineries". There is no such thing as an official corporate/state malware author, because no one in their right mind will openly say "I build operational malware for a living". The only place that may openly advertise this, is academics or researchers.

While malware authors in principle would get the same rights, you can't say that it's illegal to analyse it. Software authors do not hold the same rights as for instance artists (writers, painters,...).

But just having it and analyzing it is in principle not illegal as far as I'm aware.

EDIT:

Also this is a legal matter, so the biggest factor will be the intent of the person obtaining the software.

share|improve this answer
    
So let's say I seed an Adobe Photoshop CS torrent but never install it. How does this compare to F-Secure automatically grabbing the installer and spreading it around their network of analysts? You say they never "use" it but will they not execute the software in sandboxes? That may well just be a Virtual Machine, how is that different from me executing it? –  Andy Smith Sep 28 '12 at 9:41
3  
The point I'm trying to make is that in some cases "analysis" and "use" are no different. Also it isn't the EULA that protects a piece of software - it's copyright law. –  Andy Smith Sep 28 '12 at 9:49
1  
Do not forget that law and rights are not binary but often very interpretable. –  Lucas Kauffman Sep 28 '12 at 9:52
3  
You guys need to look into the "intent" issue. In newer laws in the USA, "intent" (or "mens rea") is often very explicitly LEFT OUT of consideration. Just doing something, copying a file or even possession, is enough to make you guilty. The DMCA does this sort of thing, as do a lot of the more recent copyright laws. –  Bruce Ediger Sep 28 '12 at 14:06
1  
»no one in their right mind will openly say "I build operational malware for a living"« of course there are some who will. FinFisher, Digitask,... –  CodesInChaos Oct 12 '12 at 10:52
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.