How do I figure out if a piece of software contains malware?

Question

My question is a bit complicated; I'm trying to evaluate if Selenium is contains malware. I know a lot of people on SO use it and I'm not too worried about it, but I work for a conservative Asian company and right now they're pretty strict about installing new software for fear of viruses. So really the question is, how do I prove it's safe/convince them that it is? My boss is pretty excited about me using this to improve my efficiency, but idk that his bosses will see the potential risk as worth it.

Answer 1

It's an extremely difficult task to say if piece of software is "safe" or not. However, after reading your comments your after if it's contains malware?

I'd recommend you start:

1. Virus Total - Virus Scanner online
2. COMODO - Valkyrie - Signature database
3. COMODO - CAMAS - Analyse of the process

However, you are relying on virus scanners and existing known hashes for bad malware and common behaviour.

You could furthermore safe guard yourself by using Virtual Machine (VirtualBox/VMWare) or Sandbox (Sandboxie) software to isolate your host from the potentially malicious software.

Configuring an harden sandbox:

• Network - Limit the application to website(s) you know it requires access to, in your case US government websites
• File - What write access does it require? If any?
• Registry - Same again.

Now, let's assume you was running some malicious software the scope of the attack has been greatly reduced.

Answer 2

Unfortunately this is not usually possible.

In many cases, the software is signed, so that you can verify the company who authored the software. However, in your case you are getting the software directly from the author so you know who they are.

As you understand, even knowing the author, there is still a risk that Malware was included by the author. Many larger companies will not do this because they have so much to lose, but it is technically possible.

It may be wise to do some research to see if other users have reported issues.

There is no practical way to scan for 'unknown' malware. Anti-virus programs can only scan from a database of previously reported malware. (also you would have to disable auto-update features)

So the bottom line is

• Either you trust the creators enough to run the software. (and install their updates)
• Or, you restrict the scope in which the software can run.

Restricting the scope means

1. Run on a separated VM, which has no access to any of your operational systems.
2. Restrict internet access so that potential malware cannot call home.
3. Optionally run on a separate physical computer as well, but this is probably overkill.

Following these steps will limit the risk associated with running malware, but is quite distinct from your original request to detect whether malware is present.

Some final points:

• Is it better for the software to be open source or not? That's worth considering, but not in this answer.

• It is technically possible to de-compile the program and inspect it manually, but this is not practical.

• You could write your own tools that serve a similar purpose.