Open Source Malware Search Engine

chr0.ot writes "Metasploit creator HD Moore has released an open-source search engine that finds live malware samples through Google queries. From the article: 'The new Malware Search project provides a Web interface that allows anyone to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables.' The tool then searches for actual malware signatures and uses the signature output from ClamAV to find the name of the malware. This is then used in conjunction with a PE signature matching method to form a Google query. Afterwards the malware can then be downloaded directly from Google."

So..

Let me get this straight.. now Google is good for porn AND viruses?

How do the other engines stay in business?!?

Re:So..

..now Google is good for porn AND viruses?

So, basically, the Internet is exactly like real sex now, only easier to get.

Finding malware with search engine?

I wonder how they got that idea [slashdot.org]. I've never heard of it before [slashdot.org].

Re:Finding malware with search engine?

I bet the editor of this story lives in Belleville. /obscure?

Re:Finding malware with search engine?

Netsense search isn't open source, as is pointed out in the article.

Also, this program supposedly highlights how relatively little malware Google actually indexes, contrary to the two earlier articles you cite. Thus this is an additional development, not a dupe.

Microsoft Version!

Clippy:
It looks like your searching for viruses,
well your in the right place.

ps, anyone else notice that slashdot is like waiting for a bus, you wait for hours with no updates then 4 come along all at once.
Hope the problems have been fixed now.

Re:Since we're off on a tangent anyway

I've got in the habit now when reading slashdot of if I can't understand a post, reading it as if i was speaking it (but silently of course).

I'm trying to read this sentence as if you were speaking it. And you sound sort of silly.

First it was a dupe...

Now it's a tripe.

Headline can be misread as...

A search engine for open source malware?

-phozz

I wish google would incorporate this into searches

I in no way think that google should block sites, but it would be nice if they would scan sites witht this -- especially for sites that install stuff through holes in IE -- and put a little icon on search results that return an infected site. That way you could at least have a heads up before you clicked on a search result about what you were getting into. It would also be great for Firefox, when everyone gets to see how many sites are exploiting IE.

Transporter_ii

So I am going to write a virus

that snags a random payload off this site! Thanks Metasploit!

BTW, Dupe, Dupity Dupe, Dupe.

Re:So I am going to write a virus

How can an article whose content says the earlier article was bogus be a dupe of the earlier article?

How can the initial announcement of a freely available tool be a dupe of the announcement of something that is not for public release?

Conclusion: there are a lot idjits on slashdot who have learned to waggle their fingers on the keyboard and therefore think they are clever. Oh so clever.

Slashdot has become the proving ground for kids who wanna grow up to be one of the million monkeys...

Thank God!

I just bought a new PC, and i have no viruses yet.

Re:Thank God!

I just bought a new PC, and i have no viruses yet.

How do you know?

I wonder...

what MS has to say about this.
This is outright competition for their closed source malware search engine IE.

I use Windows

I don't need a search engine to find malware.

Re:I use Windows

That's right, Windows provides this service to you, free of extra charge, it's bundled into the system and can't be removed easily, despite some claims by other malware writers who claim they can't make business because of that!

Just click start - search...

and coming soon...

- the bag of snakes locator
- the shard of glass necktie finder
- the kick in the crotch searcher

Seriously, if this were part of your search results as a heads up of what to avoid I can see it being quite valuable. But, short of research or bad intentions... why do i want to find live malware?

I guess I don't understand

I do this on a daily basis for my Windows laptop, I search through my running processes to find strange things, search them on Google, then cross-reference them from my browser history, then I interrogate my wife to find out why she visited some of the stupidest sites on the internet. That's about when I remember she's a MySpace user, and no matter what I do that laptop is screwed.

the other way around?

"to enter the name of a known virus or Trojan and find Google results for Web sites hosting malicious executables" we should be able to do it the other way around too. enter the url for websites we suspect first then list if the websites host malicious executables. imo its more useful that way :)

AWRIGHT!! an OS infector! w00t!

pray tell WTF difference is this from another virus kit? this dude's life is going to be a screaming hell when everybody tees off on him.

gcc, worm, trojan

1. It looks like there's a copy of "Worm.Bagle.Z" on GCC's server:
gcc.gnu.org / ml/gcc-prs/2004-05/msg00008 / the_message.scr
(don't open the URL from Windows, or at all. My AV detected the file as "W32.Beagle.gen", right after I downloaded it).

2. Search the engine for "worm" or "trojan" and you'll get tons of them.

what is the use case?

Is it like I am a webmaster and I am blocking visits from the blacklisted websites?

Obvious question

Does it locate the Windows Genuine dis-Advantage malware?

Anti-Spyware

Many programms include spyware modules. Use anti-spyware for protect your privacy.
As for me, I like professional anti-spy software like PrivacyKeyboard by Raytown Corporation LLC.
You can download it here: http://download.softsecurity.com/1/14/prvkbd.zip [softsecurity.com] (~4MB)

Anti-Spyware: Efficiency of the Means of Defense [trap17.net]

Open Source AV

How long will it be before there is no such thing but and open source AV? There is just no way a closed source AV will be able to adapt as fast as the virus-sphere. especially when you read about these highly targeted Trojans coming from China and Russia. http://www.securityfocus.com/news/11222 [securityfocus.com] I have Clam AV on an Astaro box (linux based UTM) and I've always been pleased with the perfromance.

Careful...Skynet...Matrix...DupeDot...

...The tool then searches for appropriate responses and posts a response to the new article on Slashdot proclaiming it to be a dupe...

Sounds like this thing's just a few modules short of obsoletizing us all; give this thing a "beowulf cluster" module and a "in Soviet Russia" module and it'd be pretty well self-contained. Any day now it'll be welcoming it's overlord self...

Re:I'm feeling Lucky

Most "free" file shareing programs have had this implemented for a long long time ;)

Re:Ducking Fupes

An offtopic reply to an offtopic post:

Personally, I'm rather tired of reading comment after comment pointing out that a given article is a dupe - I think the tagging system is sufficient to identify dupitude (hey, you're allowed to make up words in english). If the article's a dupe, don't read it, and by all means, don't comment - just ignore it like the articles that don't interest you.