Pimping up VTchromizer

Among the goodies offered by VirusTotal to the community we can find VTchromizer. VTchromizer is a Google Chrome browser extension that simplifies the process of scanning Internet resources with VirusTotal. It allows you to scan links (including links to files) directly with VirusTotal's web application. It will scan the submitted URLs with URL scanners and the content downloaded from the scanned site with VirusTotal's antvirus solutions.

Some days ago Kyle Creyts from Lastline sent us an email asking us for permission to publish a small Chrome extension that made use of VirusTotal:

This extension makes a new "Get VT analysis" context menu entry when you select text and right click on it.
It's quite simple to use. You select the text of a hash in your browser, right click on it, and select "Get VT analysis for %s" from the context menu (where %s is the hash). I have it set up to use the selection length to validate that the input is a valid {md5,sha1,sha256} hash. I could easily add the ability to validate the character range (hex).

We love when the community builds tools with VirusTotal, we are absolutely in favour  of promoting third-party altruist efforts that will improve the overall end-user security. Hence, we strongly encourage Kyle to publish his extension, it is a really good idea.

It is such a good idea that we did not hesitate to include that functionality in our own official extension:

https://chrome.google.com/webstore/detail/vtchromizer/efbjojhplkelaegfbieplglfidafgoka

As of version 1.2, whenever you select a text and right-click on it a context menu will appear that allows you to check the selected text with VirusTotal:

• If the selection is an md5, sha1 or sha256 hash the extension will display the VirusTotal report for the file with that hash.
• If the selection is any other text the extension will look for any comments in VirusTotal Community tagged with the given term.

This is in addition to the traditional feature that allows you to right-click on any link and submit it for scanning.

Thanks for the idea Kyle! As usual, if you have any suggestions or feature requests please do not hesitate to contact us, we will be more than happy to consider and implement them.

Read More

VirusTotal += Netcraft

Netcraft Toolbar is one of the most known antiphishing/antimalware browser toolbars out there. The Netcraft team describes its software as follows:

The Toolbar community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community against phishing attacks. Once the first recipients of a phishing mail have reported the target URL, it is blocked for community members as they subsequently access the URL. Widely disseminated attacks (people construct phishing attacks send literally millions of emails in the expectation that some will reach customers of the bank) simply mean that the phishing attack will be reported and blocked sooner.
The Netcraft Toolbar also:

• Traps suspicious URLs containing characters which have no common purpose other than to deceive.

• Enforces display of browser navigational controls (toolbar & address bar) in all windows, to defend against pop up windows which attempt to hide the navigational controls.

• Clearly displays sites' hosting location, including country, helping you to evaluate fraudulent urls (e.g. the real citibank.com or barclays.co.uk sites are unlikely to be hosted in the former Soviet Union).

Taking all of this into account we are really excited to announce that Netcraft has been integrated in VirusTotal, you will now see it as another URL scanner in VirusTotal's URL scanning service.

With this addition we have already over 30 URL scanners and are looking forward to be in the forties as soon as possible, so if you have an interesting malicious URL dataset or URL scanner please do not hesitate to contact us, we will be more than happy to include you!

Thank you Netcraft team!

Read More

VirusTotal += Webutation

It has been a while since we last included a domain characterization dataset, we have just added Webutation and we would like to give them a really warm welcome.

The Webutation team describes its service as follows:

Webutation is an open community about Website Reputation and

• collects user feedback and customer experience about websites.
• tests websites against spyware, spam and scams with smart scanning technology in realtime.
• queries
• Google Safebrowsing against badware and phising fraud (which is used in Firefox as well and updates every half hour).
• Website Antivirus which scans sites against adware (popups), spyware (outgoing links) and viruses.
• WOT which collects some reviews about websites.
• Norton Safe Web
• as well as many other website feedback resources.

It is clear that this will surely enhance the information rendered in the additional information section of VirusTotal reports, it is precisely there where this tool appears because it characterizes domains rather than URLs, example:

https://www.virustotal.com/url/5ab7fdaa6cc0cbc8e17965044afe3c47266819335a9fa5533004113664bbb4ef/analysis/1348486392/

As it happened with the other domain characterization engines, the data returned by Webutation can be used for building customized scoring systems for full URLs.

Webutation, once again, thanks for your collaboration!

Read More

VirusTotal += Kingsoft

We welcome Kingsoft as a new engine working at VirusTotal. Kingsoft Security is a chinese antivirus company that has been in the market since year 2000, and now is the fifth largest Internet software company in that country.

This specific engine we've integrated is heavily based on cloud technology.

Read More

An update from VirusTotal

Our goal is simple: to help keep you safe on the web. And we’ve worked hard to ensure that the services we offer continually improve. But as a small, resource-constrained company, that can sometimes be challenging. So we’re delighted that Google, a long-time partner, has acquired VirusTotal. This is great news for you, and bad news for malware generators, because:

• The quality and power of our malware research tools will keep improving, most likely faster; and
• Google’s infrastructure will ensure that our tools are always ready, right when you need them.  

VirusTotal will continue to operate independently, maintaining our partnerships with other antivirus companies and security experts. This is an exciting step forward. Google has a long track record working to keep people safe online and we look forward to fighting the good fight together with them.   

VirusTotal Team

For press inquiries, please contact press@google.com.

Read More

VirusTotal += Sucuri SiteCheck

It has been a while since we last added some new analyzer to our URL scanning engine, today we are excited to announce that Sucuri SiteCheck has become part of our small family. This is how the Sucuri team describes their service:

Sucuri SiteCheck is highly sophisticated and designed to identify a number of different malware types: Obfuscated JavaScript injections, Cross Site Scripting (XSS), Website Defacements, Hidden & Malicious iFrames, PHP Mailers, Phishing Attempts, Malicious Redirects, Backdoors (e.g., C99, R57, Webshells), Anomalies, Drive-by-Downloads, IP Cloaking, Social Engineering Attacks. There are a number of blacklisting authorities that monitor for malware, SPAM, and phishing attempts. Sucuri SiteCheck leverages the APIs for the following authorities to alert you when you’ve been flagged: Sucuri, Google Safe Browsing, Norton, AVG, Phish Tank (Phishing Specifically), McAfee SiteAdvisor.

We are extremely grateful to Sucuri, you should now see them on our URL reports, just as an example:

https://www.virustotal.com/url/78f6ade26461d84b32b857529613abbd8c9e1306fa3a4e6b9e9c8ff11dd1d82d/analysis/

You may read more about their technology at their services site.

Welcome on board Sucuri!

Read More

AV Comparative Analyses, Marketing, and VirusTotal: A Bad Combination

[originally written in 2007 (deprecated & offline blog), I have recovered it because remains a topical issue]

I have read today this piece of news:

"An experiment conducted at the end of March by independent security-industry benchmark website VirusTotal.com attempted to simulate a malicious attack using a long-known source of malicious code on computers. Competing with 32 rivals, only Finjan's Vital Security Web Appliance detected and blocked the malicious code in VirusTotal's tests. The computers running other products were all comprised [sic] - resulting in potential data loss and theft."

This paragraph may lead to confusion, whether that was the result intended or not, and that is why we feel compelled to declare the following at VirusTotal:

• VirusTotal has not conducted any experiment or test related to AV comparative analyses.

• VirusTotal has no notice whatsoever of the malicious code they refer to in this piece of news.

• VirusTotal has never tested nor tried Finjan's security solutions.

Generally speaking, even though it may seem obvious, we must state that all anti-malware products have detection problems due to the tremendous proliferation and diversification of malware nowadays. Likewise, any product may detect a new sample on its own, either because of its heuristics or because they are the first ones to generate a specific signature. This is why it seems totally inadequate and opportunistic to claim the superiority of a product based on the result of a sole malware sample.

We are rather tired of repeating that VirusTotal was not designed as a tool to perform AV comparative analyses, but as a tool that checks suspicious samples with several AV programs and helps AV labs by forwarding them the malware they failed to detect. Those who use VirusTotal to perform AV comparative analyses should know that they are making many implicit errors in the methodology, the most obvious being:

• VirusTotal AV engines are commandline versions, so depending on the product, they will not behave quite like the desktop versions: for instance, in such cases when desktop solutions use techniques based on behavioral analysis and count on personal firewalls that may decrease entry points and mitigate propagation, etc.

• In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups.

In general, it is not an easy task to perform a responsible and reliable AV comparative analysis; it requires having a malware collection that is both representative (nowadays it should be larger than the In-The-Wild collection) and authentic (ZOO collections are riddled with false viruses and corrupt executables). Besides, given the implementation of new AV technologies, in the case of desktop AV products, it would be necessary to execute those samples one by one in real environments with each of the resident products to see their detection capabilities and their prevention. As of today, there is no AV comparative analysis in the world that meets these basic requirements.

Read More