RE: Get your computer viruses here!

["Jason Geffner" <jasongef () microsoft com>]

> We wouldnt have techniques like binary diffing or call graph
comparison / analysis if it wasnt for malware.

 

As far as I know, those techniques were developed mainly for patch
analysis and vulnerability research, not for malware analysis.

 

> Also the idea of software protections (packing and encoding) that come
out of malware are useful for copyright protection and other "binary
security" needs.

 

Again, AFAIK, most modern packing and encoding techniques stemmed from
copyright protection and were then applied to malware, not the other way
around.

 

As usual, the thoughts and views expressed in this E-mail are mine, not
Microsoft's, etc.

 

- Jason

 

________________________________

From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org]
On Behalf Of val smith
Sent: Wednesday, December 28, 2005 12:24 PM
To: Blue Boar
Cc: funsec () linuxbox org
Subject: Re: [funsec] Get your computer viruses here!

 

So my slight disagreement there is that its beneficial in the sense that
security people can learn from it. We wouldnt have techniques like
binary diffing or call graph comparison / analysis if it wasnt for
malware. And those methods are useful for much more than malware.

Also the idea of software protections (packing and encoding) that come
out of malware are useful for copyright protection and other "binary
security" needs.

Again this is a rather subjective subject (ahah). You could make the
analogy that a biological virus has no good uses however we have begun
using them for genetic therapies and they have greatly helped us to
understand how many other biologic processes work. 

This whole idea of publically available malware however is a "new" thing
and I guess it defies analogy.

I do see the difference between malware and a tool (i hope) but the
langauge necessary to talk about this subject is hard and any comparison
or anallogy that can be drawn will be flawed. 

Thanks for the perspective though, I will think about it some more.

V.

On 12/28/05, Blue Boar <BlueBoar () thievco com> wrote:

val smith wrote:
> I guess what you haven't convinced me of yet is how "malware" is any
> different from any other object in existance which can be used for
both
> good or evil. I could stand on the corner selling rocks which people 
> could use to study or to bash someone over the head with. How is that
> much different?

Again, not that I disapprove of your project in general, but I'm a
little disappointed that you don't see the differences between "malware"

and "tool".

-Malware has no good applications.  The definition is that it is
something you don't want running on your machine.  There are no good
uses for it.  Good guys need to analyze it, so once it exists they need 
for it to be available to them, but they don't use it for its intended
purpose.

-Malware isn't like a vulnerability, technique or exploit.  Those
already existed, and were just waiting to be discovered.  Malware isn't 
a problem and doesn't exist until someone creates it.  It's pure new
problem.

There's no beneficial use for malware, just a need to study it.

                                                BB

 

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.