5 ms·

Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse 'this is for education, i'm not responsible for what

Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse 'this is for education, i'm not responsible for what you do with it', but some don't even bother with that, and atleast my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet

Cthulhu_ 4y ago
Personal take: It's better to have malware code stay online and open, than to disappear into obscurity. This being open source also means that anti-malware companies can analyze the code and write detectors and counters to it. Removing it would just mean it gets hidden from the 'good guys' as well.
- GekkePrutser 4y ago
  Not just anti malware companies. I work for an enterprise and I regularly use such malware proof of concepts to make sure our antimalware and EDR (endpoint detection and response) systems actually do detect these. Or if we have to sharpen the detection rules to make them work better. These disclosures are invaluable. Most companies modify their detection rules because generic rules tend to cause false positives that could potentially overwhelm the SOC (security operations center). It really depends on your environment a lot.
- bediger4000 4y ago
  The 1990s "antivirus" industry was able to suppress most malware source and executable distribution. You could only find it in small print run zines, or the very occasional book. All that led to was people typing the source in themselves. The result was a proliferation of minor variants. My guess is the suppression held back the tide of Windows malware a year or two, but also gave MSFT a few years of fat, dumb and happy ignorance. Nimda, Code Red, Word macro viruses, etc hit Windows hard. If jokey small threats had been as available as they are today, MSFT might have been able to ramp up rather than get buried.
jhugo 4y ago
They could also write it from scratch themselves; having the source code available doesn't make it that much easier. Defence doesn't come from trying to scrub all records of the attackers' methods.
DeWilde 4y ago
Do you think it would make it harder to find for people specialize in making malware like this?
SV_BubbleTime 4y ago
> Why does github let these repos for Malware stay up? Sad state of affairs when people routinely ask for more censorship on what was supposed to be the freest technology to ever exist. Since Linux is open source, how about not only “allowing” things like this to stay up, but encouraging everyone know about them?
NavinF 4y ago
Taking the repos down would only inconvenience legitimate researchers. All the sketchy users discuss on forums and either post the code inline or upload to a random VPS.
dangerface 4y ago
> my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet I did this and it passed every anti virus on virustotal. I could have wrote the virus myself in a weekend but I thought it was funny that anti virus can't detect a virus thats modified ever so slightly I think we just need a better way of scanning for this stuff.
yarg 4y ago
This sort of thing can be useful for white-hats.
surge 4y ago
Exploit DB etc, already exist. They're used for penetration tests as well, to simulate a real attacker, better to have something that you can work off of as a model to detect then let the attacks be the secrets of criminal organizations and state actors. You train like you fight, you can't do research and build detections if you don't have some examples.

Cthulhu_ 4y ago

Personal take: It's better to have malware code stay online and open, than to disappear into obscurity. This being open source also means that anti-malware companies can analyze the code and write detectors and counters to it. Removing it would just mean it gets hidden from the 'good guys' as well.

GekkePrutser 4y ago
Not just anti malware companies. I work for an enterprise and I regularly use such malware proof of concepts to make sure our antimalware and EDR (endpoint detection and response) systems actually do detect these. Or if we have to sharpen the detection rules to make them work better. These disclosures are invaluable. Most companies modify their detection rules because generic rules tend to cause false positives that could potentially overwhelm the SOC (security operations center). It really depends on your environment a lot.
bediger4000 4y ago
The 1990s "antivirus" industry was able to suppress most malware source and executable distribution. You could only find it in small print run zines, or the very occasional book. All that led to was people typing the source in themselves. The result was a proliferation of minor variants. My guess is the suppression held back the tide of Windows malware a year or two, but also gave MSFT a few years of fat, dumb and happy ignorance. Nimda, Code Red, Word macro viruses, etc hit Windows hard. If jokey small threats had been as available as they are today, MSFT might have been able to ramp up rather than get buried.

jhugo 4y ago

They could also write it from scratch themselves; having the source code available doesn't make it that much easier. Defence doesn't come from trying to scrub all records of the attackers' methods.

DeWilde 4y ago

Do you think it would make it harder to find for people specialize in making malware like this?

SV_BubbleTime 4y ago

> Why does github let these repos for Malware stay up? Sad state of affairs when people routinely ask for more censorship on what was supposed to be the freest technology to ever exist. Since Linux is open source, how about not only “allowing” things like this to stay up, but encouraging everyone know about them?

NavinF 4y ago

Taking the repos down would only inconvenience legitimate researchers. All the sketchy users discuss on forums and either post the code inline or upload to a random VPS.

dangerface 4y ago

> my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC/detections for the attack method aren't good yet I did this and it passed every anti virus on virustotal. I could have wrote the virus myself in a weekend but I thought it was funny that anti virus can't detect a virus thats modified ever so slightly I think we just need a better way of scanning for this stuff.

yarg 4y ago

This sort of thing can be useful for white-hats.

surge 4y ago

Exploit DB etc, already exist. They're used for penetration tests as well, to simulate a real attacker, better to have something that you can work off of as a model to detect then let the attacks be the secrets of criminal organizations and state actors. You train like you fight, you can't do research and build detections if you don't have some examples.