82

I develop my own viruses for 'scientific' purposes, namely to see if they pass the test of Virustotal.com. They all do, except for one or two scanners. Is this considered something you should report to Microsoft/McAfee/etc? If yes, how?

17
  • 1
    With respect to 'how' I'd suggest studying this kind of thing and the links at the end of the doc: icann.org/en/system/files/files/… That should also help you investigate if it's a 'yes' as well.
    – Ed Daniel
    Mar 13, 2016 at 14:58
  • 38
    btw: Which scanners do detect your viruses?
    – marstato
    Mar 13, 2016 at 21:10
  • 2
    When you upload to Virustotal, it gets sent to the AV companies. Sorry, no source handy, just my recollection.
    – h4ckNinja
    Mar 14, 2016 at 2:21
  • 16
    Making a virus that avoids AV detection is actually pretty simple. The real deal is exploiting bugs in applications / OS to allow something you shouldn't be supposed to do - for example, a non-administrator running your "virus" elevated. With all the RnD into heuristics, most of AV detection is still based on matching the file to a list of known viruses - that's why it's so important to keep your AV detection files up to date. If you use AV in the first place, of course :)
    – Luaan
    Mar 14, 2016 at 8:20
  • 9
    is a bash script that simply runs rm -rf / a virus?
    – Petah
    Mar 15, 2016 at 11:37

2 Answers 2

135

That's a pointless exercise.

Most malware scanners match on fragments of binary code (aka virus signatures), and they check MD5 hashes of known infected code against their blacklists. Unless the virus you wrote has been deployed into the wild and is already on their blacklist, there isn't a chance they'll have your code's exact signatures on file.

The scanners that do trigger a match are most likely those using heuristics, which scan for "suspicious" behavior. For example, very few programs legitimately need to request the OS grant them the privilege to "Act as a debugger", yet that's fairly common behavior in malware, so if they find it they'll flag it.

Reporting your custom viruses to McAfee won't help anyone - not McAfee, not the public. If they don't identify your code as a virus, it's because their scanners don't have very effective heuristics (which they already know, and won't learn from your code among the hundreds of viruses they analyze per day.) And developing a match takes a researcher time and effort, which costs McAfee money. There is no value to McAfee to waste money on researching a virus that nobody can get, and adding it to their blacklists, because as a white hat you won't allow it to be released.

3
  • 51
    @JohnDoe I think John might have gone a little far pointing out that you have to be careful about your white hat status. Just saying you're white hat doesn't make you white hat. Instead, making sure any code you write can't be used for malicious purposes is the critical action. Maybe he overplayed and implied you aren't careful with your code, when what he was probably trying to say is, "Just in case, please do us all a favor and be very careful with your code". Mar 13, 2016 at 16:22
  • 72
    The important part of the answer which could be made clearer is that "virus scanners" are nothing but blacklists of known, found-in-the-wild virus code and code fragments. Some AV tools also detect suspicious/virus-like behavior, but they're likely to have lots of false positives and break things the user may want to work. Mar 13, 2016 at 16:49
  • 7
    The only exception I would make to the above is if you are wanting to share a proof of concept of virus that takes advantage of an undiscovered exploit. Then I would submit samples and code with the appropriate security researchers and/or the affected software vendors to help aid in protecting the public.
    – Bacon Brad
    Mar 14, 2016 at 23:57
4

you should not, actually - there's nothing obliging you to do so. You said you're white hat, so you're not intended to rob a bank using your code, and your personal research results are your very own and private unless you wish to publish them somewhere.

5
  • 1
    What if OP wants to help AV publishers to strengthen their heuristics so he'll feel safer using the products himself? Even if OP only cared about himself, he might want to report his finding. Maybe he'll even get a dollar or two, or even a job offer.
    – Kijewski
    Mar 14, 2016 at 17:25
  • 5
    @Kay sounds reasonable, and I propose for OP to publish it in his blog or in security-related journal. He'll have at least +1 scientific publication, and the reach will be not just the AV makers, but a much broader security researchers community. Mar 14, 2016 at 17:57
  • 1
    @Kay Sharing is always a good idea and benefits community. Still I find that any kind of publishing is philosophically probably a selfish act even though it would be generally deemed selfless.
    – Lindlof
    Mar 16, 2016 at 9:51
  • 1
    @Mikuz taking care about yourself is good, and there's no shame to write your name next to your achievemnts Mar 16, 2016 at 11:51
  • 2
    @Alexey Vesnin Yes, I totally support all this kind of behaviour. Also, I find that it's good for people to take care of themselves and be selfish. This is getting way out of topic though.
    – Lindlof
    Mar 16, 2016 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .