3

My question is a bit complicated; I'm trying to evaluate if Selenium is contains malware. I know a lot of people on SO use it and I'm not too worried about it, but I work for a conservative Asian company and right now they're pretty strict about installing new software for fear of viruses. So really the question is, how do I prove it's safe/convince them that it is? My boss is pretty excited about me using this to improve my efficiency, but idk that his bosses will see the potential risk as worth it.

  • 1
    Rephrase your question. What are you trying to achieve? What is your definition of "safe". Selenium webdriver itself is an open source project. It is maintain by group of developer and google also contribute some code. HOWEVER, if you load selenium and go to UNKNOWN website that contains malverstisement, it is NOT safe. And it is NOT selenium fault. – mootmoot Aug 19 '16 at 14:13
  • My usage of Selenium would be copying URLs from a US government site that contains links to other websites, paste those URLs into the search field on owler.com, clicking on the first search result, and then copying various metrics (such as revenue, # of employees) from the company's profile and pasting those into an excel document. This intended for use with Excel-VBA. But the technicalities are barely relevant to convincing management, I'm looking for answers from people who have faced restrictive IT politicies before and gotten past that. – xxxRxxx Aug 19 '16 at 14:16
  • Am I right if I interpret your question to be "How do I figure out if a piece of software contains malware?" That is a much more limited question than figuring out if something is "safe. – Anders Aug 19 '16 at 14:20
  • 1
    Yes, I'm just going to change the title since your phrasing is less ambiguous. I am aware that web automation contains the possibility of visiting sites that serve malware, and that's not my current challenge. – xxxRxxx Aug 19 '16 at 14:24
  • So it is about Web contents scrapping. (don't tell us what kind of site you are going, we are not interested) In such case, can't you just use must more appropriate tools such as python requests and beautifulsoup? Unless you need to "click" on particular button, selenium is overkill for web content scraping. – mootmoot Aug 19 '16 at 14:31
3

It's an extremely difficult task to say if piece of software is "safe" or not. However, after reading your comments your after if it's contains malware?

I'd recommend you start:

  1. Virus Total - Virus Scanner online
  2. COMODO - Valkyrie - Signature database
  3. COMODO - CAMAS - Analyse of the process

However, you are relying on virus scanners and existing known hashes for bad malware and common behaviour.

You could furthermore safe guard yourself by using Virtual Machine (VirtualBox/VMWare) or Sandbox (Sandboxie) software to isolate your host from the potentially malicious software.

Configuring an harden sandbox:

  • Network - Limit the application to website(s) you know it requires access to, in your case US government websites
  • File - What write access does it require? If any?
  • Registry - Same again.

Now, let's assume you was running some malicious software the scope of the attack has been greatly reduced.

2

Unfortunately this is not usually possible.

In many cases, the software is signed, so that you can verify the company who authored the software. However, in your case you are getting the software directly from the author so you know who they are.

As you understand, even knowing the author, there is still a risk that Malware was included by the author. Many larger companies will not do this because they have so much to lose, but it is technically possible.

It may be wise to do some research to see if other users have reported issues.

There is no practical way to scan for 'unknown' malware. Anti-virus programs can only scan from a database of previously reported malware. (also you would have to disable auto-update features)

So the bottom line is

  • Either you trust the creators enough to run the software. (and install their updates)
  • Or, you restrict the scope in which the software can run.

Restricting the scope means

  1. Run on a separated VM, which has no access to any of your operational systems.
  2. Restrict internet access so that potential malware cannot call home.
  3. Optionally run on a separate physical computer as well, but this is probably overkill.

Following these steps will limit the risk associated with running malware, but is quite distinct from your original request to detect whether malware is present.

Some final points:

  • Is it better for the software to be open source or not? That's worth considering, but not in this answer.

  • It is technically possible to de-compile the program and inspect it manually, but this is not practical.

  • You could write your own tools that serve a similar purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.