Hackers are Using Google's Antivirus Tool to Test their Attacks

Google's VirusTotal Site, Can be Very Handy if you're Worried about Malware; Upload a File and Dozens of Antivirus Tools will Check to See if it's Malicious. However, it's Now Clear that, this Website Can Hinder as Much as it Helps. Security Research, Brandon Dixon, has Spotted Several Big Hacking Teams Using VirusTotal to Test Attacks before Launch, including 2 Linked to State-Sponsored Operations. They Effectively Treat it like a Debugging Tool -- if One or More Scanners Detect a Pre-Release Virus, the Developers Tweak their Code until it Slips Under the Radar. In Some Cases, they've Even Put Old Malware through the Site to Make it Dangerous Again.


Some Malware Groups are Smarter than Others about Hiding their Tracks and Dixon's Discovery May Get the Less Clever Outfits to Mask their Activities. However, the Revelations could still Help Google and Security Software Producers Catch Abuse of Testing Services by Making it Easier to Spot Suspicious Behavior; they Could Even Prevent Attacks by Tracking the Code and Building Appropriate Safeguards. We've Reached Out to Google to See What it Can do. Whatever it's Doing, your Best Defense May Simply be to Take a Cautious Attitude. Be Wary of Files and Websites you Didn't Ask to See, Even if your Antivirus Apps Give them the All-Clear.




Info Source:

http://www.wired.com/2014/09/how-hackers-use-virustotal