|
It seems like a scraper which could manage submitting to and checking virustotal would be a good idea. Also, perhaps wikileaks / virustotal could come to sort of agreement to scan things and flag them while still making assets available to researchers whom still need raw docs, but with large virus warnings which intercept downloads to a warning landing page confirmation if there's no referrer (direct, deep linking). Finally, the other issue is that not all malware (past, current or future) is known. We ran Windows Servers (NT, 2003) boxes directly on the internet (before I forced them to offer departmental firewalls) and these boxes had already attracted all sorts of multi-vendor unseen malware, rootkits and backdoors long before I got there. After deploying WOLF to a number of boxes, Mark Russinovich was like "yea, you should probably take [the IT sec depts advice]" by just get firewalls and then format all these boxes back to clean image, fully-patched and strong, production-usable, security policy state. Most IT folks don't conduct forensics research... they see strange behavior, try to find a scanner/remover (maybe 80% success), or partially remove it and continue despite unprovable to fully remove all traces... Or they wipe the boxes, start over and guess/pray that the same 'sploit doesn't exist twice. There's just too many unknown variants of existing sploits and too many new sploits to have much faith in antivirus (it's reactive, last line-of-defense security). Antivirus is an opposite Bloom filter... it'll tell you if you're pwned or may not pwned. It's a good to have, just not a complete holistic security posture. |
0. If I had budget authority, I would've ordered something which could grab memory and disk images on a live system and sign-up multiple .edu researchers & symantec security group and equivalent shops under NDA to analyze them.
1. And I would've yanked all those janky (R)ILO (aka RMSA, aka DRAC) cards with their always outdated Linux / Java / PHP "wifi router"-like whatever embedded systems.
2. Finally, I would've spent some cash on honeynet setups and cc: to item 0.
Edit^2: Props to Josh Wieder for taking sounding the sec awareness alarm. I would only do active sec research on untrusted materials within a decent hypervisor's VM on a virtual desktop (VDI) which has "nonpersistence" on all storage, so it's clean on every power cycle.