Malware Search Engine

Do you remember the post about Google indexing EXE files? Since then many things have happened. Websense, a company that develops web security solutions, has created a tool to identify malicious binaries in Google's index (Mining for malcode with Google - not a permalink).

"Our results show that we were able to collect thousands of pieces of malicious binaries, mostly posted to newsgroups with false names that would normally trick a user, we found many on forum sites, as well as regular personal, educational, compromised, and underground sites. We also found several pieces of spyware on poker and casino sites. We found variants of the Bagel, and Mytob worms, various trojans, and many other malicious binaries. While we do not believe that the fact that Google is indexing binary file contents is a large threat this is further evidence of rise in websites being used as an method of storing and distributing malicious code."


As Websense didn't release the tool, H. D. Moore, creator of Metasploit (a tool for penetration testing, exploit development, and vulnerability research), went on his own and developed a Malware search engine. You just have to type the name of a virus and you can find the queries that produce malware as search results. Some examples: MyDoom, Klez, BadTrans and other worms and trojans. H. D. Moore used some Ruby scripts and Google API to search for almost 300 malware signatures.

Google indexes some headers and sections from the binary, which tell the dynamic linker how to map the file into memory. They start like this:
"WINDOWS EXECUTABLE
32bit for Windows 95 and Windows NT
Technical File Information:
Image File Header
Signature: 00004550
Machine: Intel 386
Number of Sections: 0003
Time Date Stamp: 3b7dc821
Symbols Pointer: 00000000"

When performing a query with Malware Search or directly with Google, click "View as HTML" to see what was indexed by Google. If you click on the title, you'll download the (potentially) dangerous file. This is not a very big issue, because the queries that trigger EXE files are not too common.