SourceFinder software stalks malware in the wild

guest · Nov 16, 2020

SourceFinder software stalks malware in the wild
November 16, 2020
https://news.ucr.edu/articles/2020/11/16/sourcefinder-software-stalks-malware-wild

The best defense against malware is a good offense: inoculating computers against malicious programs.
Unfortunately, security researchers often don’t know about a piece of malware until it has already done a lot of damage. Trying to reverse engineer malware can be extremely difficult without any insight into the original program.

Computer scientists at UC Riverside have developed a tool called SourceFinder that locates online malware source code repositories with 89% accuracy. Access to the source code will help security specialists and anti-virus software developers understand threats and design defenses.

"The study emerged serendipitously as we were studying the rapid growth of Internet of Things malware and identifying the publicly available malware source codes they are based on,” said Ahmad Darki, a recent UC Riverside Ph.D. recipient who came up with the idea for the project.
Click to expand...

Like developers of legal software, hackers often share their malicious creations in public archives such as GitHub.
"In most of the cases, malware authors seem to be notorious hackers who are persistent across different online forums marketing their attack tools,” said second author Risul Islam, a UCR doctoral student.

"The implications are huge: Having such a large database of malware can really help security
researchers develop better defenses," said co-author Michalis Faloutsos, a professor of computer science and engineering. "It is an ugly war, and hackers have the first-mover advantage. We need all the information we can get to be prepared ahead of time.”
Click to expand...

The researchers also identified trends among malware repositories:

Since 2010, the number of new malware repositories per year has more than tripled every four years.

Ransomware repositories, the malware responsible for blackmailing users and stealing personal information, emerged in 2014 and took off in 2017.

Most malware targets Windows and Linux operating systems, but there has been a notable increase in the number of repositories for MacOS and Internet of Things, or IoT, devices recently.

Keyloggers, which monitor the keyboard keystrokes and can steal passwords, are the most common type of malware among the repositories the group found.

Click to expand...

arXiv: SourceFinder: Finding Malware Source-Code from Publicly Available Repositories
(PDF): https://arxiv.org/pdf/2005.14311

Log in or Sign up

SourceFinder software stalks malware in the wild

guest Guest

Log in or Sign up

SourceFinder software stalks malware in the wild

guest Guest

Useful Searches