42

I accidentally, the other day, went to a dodgy site, and today I discovered that in my cache there lay a text file. And after reading the contents of the file, I have deduced that it is the source code for some potentially new malware which exploits a vulnerability in a security program.

Now I want to submit it to my anti-virus vendor, however, do I just submit it as a text file (as they would have to compile it in order to get a virus signature and I don't know how automated the process is), or should I stick it in my IDE, build it and then send the built version to them, or how should I send it to them? In the most safe and responsible manner that is.

  • 42
    What does your anti-virus vendor say the correct way for submitting potential new viruses is? The question is probably best answered by them. – Neil Smithline Sep 3 '15 at 15:54
  • 43
    should I stick it in my IDE, build it do not do that, at least not on your personal machine. Even the source code could have something to exploit bugs in IDEs or compilers. – André Borie Sep 3 '15 at 15:56
  • 16
    @ParanoidPanda To repeat, we didn't mean what the malware does itself, but the possibilty that the compiler doing something unexpected when compiling it. Triggering bugs in software doesn't need big files. A single bit may be enough. As long as you don't study the compiler code too, you can´t possibly know what will happen with certain inputs. (And for every major language, reviewing the compiler code with sufficient precision is way to much for one person) – deviantfan Sep 3 '15 at 20:36
  • 9
    @deviantfan It would but be a n extreme niche business model for a malware author to produce source code that attacks a specific IDE/compiler - something that is not necessarily widespread - and do so by source code that gets accidentally downloaded into the cache. – Hagen von Eitzen Sep 3 '15 at 21:17
  • 9
    @HagenvonEitzen: even better, they did so by source code for an unrelated exploit of some security flaw, when presumably they could have put this underhanded compiler exploit into code that did something useful, such as answering a question on StackOverflow related to that language. Obviously they have a keen sense of irony, since they've written malware that selectively targets software developers interested in security exploits who poke about in their browser cache :-) – Steve Jessop Sep 4 '15 at 2:36
32

should I stick it in my IDE, build it and then send the built version to them

That's not a good option. Unless there's some reason to believe that the malware author and you have a dev environment in common that the AV vendor cannot reasonably access, the AV vendor can do this themselves and will if they think it would help. It's highly likely they can do a better job of considering the question, "what might the released malware look like and how can we detect the full variety of malware we're likely to see attacking this flaw?" than you can, because it's squarely in their line of work.

Consider: that in your hands, since you are not malicious, this becomes proof of concept exploit code. It might have been intended to be malware, and you did not discover the flaw yourself, but leaving aside the details of credit and priority, you're in basically the same position regarding disclosure as you would be in if you had discovered the flaw yourself and written this code to prove it exploitable.

At the least you should:

  • Search for recognisable short sections of the code online to make sure this specific source code is not already published. I know you've deduced otherwise, but I can't shake the nagging feeling that maybe this is proof of concept exploit code and not malware.

  • Go through the flaw disclosure process of the vendor of the "security program" that this code exploits. If they don't have a process, email or otherwise contact them and ask. Do whatever you can within this process to convey your conclusion that a working exploit for the flaw is already in the wild.

  • If that gets no satisfactory response then go to one or more AV vendors. Find out how your chosen vendor prefers to receive malware submissions or use an existing list of contact details. Since this is a somewhat unusual case, in that you have source to submit rather than just a malicious binary, I advise leaning toward anything that looks like there might be a human on the other end.

  • Don't focus just on the AV you happen to use: if you can persuade any (major) AV vendor to recognise the issue then others including yours will follow. Bigger AV vendors are also better placed to convince the vendor of the flawed software to do something about it than, no offence to you, some random person. If you can identify from press coverage any security researchers who have previously discovered flaws in the same software, or software from the same vendor, include them in your list of people to contact. They have already dealt with the disclosure process that failed to satisfy you.

  • If that still gets no satisfactory response, then as an absolute last resort, submit a compiled binary version[*] of the suspected malware as above, and hope that their routine for submitted binaries does a better job than they did with the source.

[*] you've already compiled it, so the ship has sailed on any concerns that it might exploit your compiler as well as being code to exploit this security program. For that matter, it might exploit your text editor, and you already looked at it with that. It might exploit your network stack, and you already downloaded it. Such is life.

  • 2
    Notice that the environment can be reproduced inside a Virtual machine, with the network card disabled. This will help to prevent your real machine from being infected. Why did I say "help to prevent" instead of "preventing"? Well, the virus code will still be in the real RAM and can exploding the Virtual machine software to write outside it's sandboxed RAM address space and infect your computer in general. – Ismael Miguel Sep 4 '15 at 8:52
67

I'm afraid your compiled binary will differ a lot from the actual malware that can be found in the wild. Different compilers and command-line flags will produce completely different binaries, and the malware binary may be further optimized/obfuscated using additional tools or even manually.

Submitting them your compiled binary is likely to be counter-productive and will only waste everyone's time. Instead, if you can't directly submit the source code file (because their form expects a binary, etc), try to get in touch with a human and give them the source.

  • 75
    As a developer, there is no way they would not want the source code! Especially if the source code has comments, but even without, this is still very useful. – corsiKa Sep 3 '15 at 19:21
14

The most common solution for dealing with malware files is to compress them (e.g. in a zip file). However, since many AV tools now look inside archives, you may need to thwart attempts at automated inspection -- the simplest solution is to just put a password on the zip file (which encrypts the contents).

As a rule, the password is distributed right alongside malware sample, since you're trying to prevent it from being opened by machines, but not by humans. Frequently the password will be some sort of warning text, like "malware" or "this is a virus" or something, so as to make it absolutely clear to any humans that the contents may be harmful.

  • Well the reason I have a problem with automated inspection is that it may turn a blind eye to something it can't execute, I have no problem with it having a look though. My real problem is that I don't know how to get it to the AV, I guess I should just build it and submit it though... – user67447 Sep 3 '15 at 17:19
  • Actually, if the code is detected as malicious by machines, then in this circumstance that's a win. Getting AV to detect it is a large part of the goal of submitting it to an AV vendor, so if it already does then great... – Steve Jessop Sep 4 '15 at 2:46
  • 1
    @paranoidpanda they're pretty bright and can figure it out. They literally do this stuff every day. A binary signature is less valuable than source anyway, since code is getting good at hiding its signature. If they have the source then they can generate more useful signatures. – tylerl Sep 4 '15 at 6:31
0

I don't know which is the AV vendor you want to send it to (actually, I'm not sure why you would want to restrict your submission to a single AV vendor)

What you need to do is to contact with the AV vendor. They will have some email / mailing list / forum / chat… available. Explain that you have a malicious source code and want to submit it to them. Your problem is in getting the file to a human (assuming nobody will ever take even a light look at non-executable binaries submitted to them, which seems an error from their part), -or sometimes, to the right department-, which will then ensure it arrives to the right person.

Note though that the source code you found may not be malicious, their analysts are too busy to process your sample (but be sure they will keep it archived just in case it's useful in the future), or the AV company may even not bother (they have no obligation to look into your submissions, after all).

  • The OP says that the exploit is for a specific security program, the issue is submitting the code to that vendor. – schroeder Sep 3 '15 at 23:16
  • @schroeder it's not clear to me that the affected security program is from his AV vendor. I didn't think in that possibility until after your comment. But given that he says that «The vendor is aware of the issue», I think he already contacted that software vendor (which ignored him) and is now trying to contact his antivirus vendor. – Ángel Sep 3 '15 at 23:24
  • VirusTotal would be one place to submit it to. It would tell if AV vendors already know about it. – user79537 Sep 4 '15 at 1:20
  • @HexTitan: I tried submitting the text file, and a compiled binary (that I compiled) to VirusTotal, however all the AVs said that both were safe, but perhaps as has been said, my compiled version may be very different from the actual malware in the wild. – user67447 Sep 4 '15 at 14:19
  • @ParanoidPanda Fair enough. :) – user79537 Sep 5 '15 at 0:13
0

If you are using Avast AntiVirus, once you've opened the User Interface, there should be a contact information somewhere. Even an e-mail addy will do. Just copy and paste and send it off. One way or another an employee will send it where it needs to go.
Now for a safety measure, in case that malware did something "Behind the curtains" it is a good idea to run a boot-time scan. (An option available in most AV).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy