Should We Preserve Malware for Study?

[Logethica]

Should We Preserve Malware for Study?:

Malware has been called a “pervasive feature of the internet” by the head of the British Library’s digital preservation team. A multi-billion-dollar industry exists to control its spread. Though it is part of the texture of digital life, libraries, museums and archives tasked with preserving the past are not saving malware for future generations. They are likely (and rightly) afraid: It can destroy data, which librarians and archivists are bound to protect.

Without long-term preservation, though, viruses and worms themselves will be difficult to analyze, research or write about. Cultural heritage institutions should seek to archive malware in ways that render it safely accessible to researchers and historians.

Our research has addressed two separate but connected concerns: First, how would an institution create a malware archive? And second, how should archivists, who have already encountered malware-infected hard drives and disks in their collections, handle these items? If an archivist chooses to remove the infection, what might we lose? And if the malware is not removed, how can the infected data be stored and accessed safely?

A recent history of malware appears in the new film “Zero Days,” a documentary about the Stuxnet worm that destroyed Iranian nuclear equipment. “Zero Days” reveals that researchers not only examined Stuxnet’s code to discover how it worked, but also looked at current geopolitics to determine why it was created.

Without efforts to save code and other items that add context, researchers may lose the ability to conduct similar analysis in the future—and to check the work of the past. Information related to historical malware can disappear from the internet. For example, anti-virus firms have removed publicly accessible information about malware from their websites.

Highlighting a seldom recognized aspect of computing history, a malware archive could spark the creation of new cultural histories. By preserving malware, we can understand how we got from the Morris worm in 1988 to Stuxnet to July’s Democratic National Committee email hack—and beyond.

Read the complete article at the link at the top of the page

This Poll is Unlimited choice..Please choose all of the statements that you agree with.

 

[hjlbx]

The preservation of malware samples is not just for the sake of posterity. Sometimes old malware needs a "re-visit" to confirm:

1. soft vulnerabilities have truly been fixed by a vendor
2. to make sure what existing protections are present in a security soft actually work against older malware

Too often vendors break protections against old malware and\or never implement an effective fix for a vulnerability in the first place.

 

[DardiM]

Thanks for the share

I think some important malware analysis from different families, period, should be archive, with details of main parts.
No specially the files.

 

[NekoHr]

I think some important malware analysis from different families, period, should be archive, with details of main parts.
No specially the files.

I think we should keep files, analysis is ok but it is not actual item.

Look at it from historical perspective, would you rather have a description and analysis of old sword or an actual sword. Think about new things you can learn years after first analysis was done as technology and knowledge increase.

If we take this historical route further. We have museums and displayed in them actual weapons that could hurt someone but it is still available to trained personnel to study and general public to look at.

 

[DJ Panda]

@hjlbx hit it right on the target. Exactly what I was thinking. Only thing I am concerned with is what would happen if the malware got into the wrong or uneducated hands?

 

[hjlbx]

@hjlbx hit it right on the target. Exactly what I was thinking. Only thing I am concerned with is what would happen if the malware got into the wrong or uneducated hands?

Well... they can put the malware vault into permanent lock-down mode like they do at Kernelmode. But, eventually, someone who doesn't know what they are doing will somehow manage to get their hands on it and proceed to infect 8 states and two foreign nations... LOL.

 

[Aura]

Checked every "Yes" option. I'm the kind of person who likes when things are documented, stored, archived, organized, etc. so having a Malware Archive that contains all the malicious samples ever encountered (or at least, the "original" sample and not the 10,000,000 slighty modified variants (only those with major modifications) sounds like a good idea to me. It should also be accessible to every IT Security vendors, though I have doubts regarding companies like Hacking Team (or other companies that makes hacks, exploits, malware, etc. for government-usage).

 

[ElectricSheep]

I'm no expert, but I suppose having an archive of samples, etc could be useful for referencing, etc. Such as identifying the origins of a copy of an original sample or something like that. At least, it's all good reference!

 

[jamescv7]

Well like other documented research, the information should always be preserve and can be use for numerous purpose.

Remember that those samples holds unique behavior on how attacks occur, range it cover and implementation through its code. Very hard nowadays to find unique presence since everything came to be copy and paste algorithms.

 

[Deleted member 178]

no samples, no studies, no improvements, no threats... "and we shall have... peace"