Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 9 down vote favorite
1

Malware uses interesting techniques for hiding themselves from anti-malware software and more. They can "polymorph" themselves: practically change the code while it continuing to mean pretty much the same to the executing machine, making antivirus definitions invalid etc.

I wonder if there is anything (non-malicious) developers could learn from studying the source of such, or reversing them and studying whatever you get from that process if the source isn't available, that could be useful outside this (dark?) realm.

I am not interested in writing malware. (at least not for non-educational purposes) This question isn't meant to be a question about how to write malware or such, but what you could learn from already written malware.

Also, maybe a bit unethical (I hope not), would there be any gains from writing your own piece of malware, just for better understanding of vulnerabilities/exploits/security, or the underlying operating system?

share|improve this question
10  
There's nothing unethical about writing malware if you don't use it on others, just like there's nothing unethical about learning martial arts or how to shoot a gun if you don't go using such skills on random strangers you find in alleyways. – FrustratedWithFormsDesigner Apr 27 '11 at 20:03
2  
@FrustratedWithFormsDesigner I agree that there's nothing unethical about knowing how to write malware, or writing it yourself as a thought experiment, but that once you actually have written it it may well be unethical if you don't properly secure your experiments. After all, if someone less ethical than you breaks into your system, they'll have access to your trove of dirty tricks. I'm not going to make a moral proclamation about whether this makes you culpable for anything bad they do with it, but it's something to consider regardless. – scriptocalypse Apr 27 '11 at 20:18
5  
@scriptocalypse: Indeed. Similarly, someone could break into your house, steal your gun/crossbow/sword, and go commit some awful crime with it. If you're going to have dangerous toys around, make sure you secure them! – FrustratedWithFormsDesigner Apr 27 '11 at 20:30
hmm do you have a link to this technique, as this is the first I've heard of it. Most anlysis is based upon Heuristics approach, i.e. regardless of what a program does, the final "End" actions are what you would be looking out for, e.g. deleting files, sending SMTP mail e.t.c. I've heard of Stubs, RootKit OS hooks, but all these can be detected. – Darknight Apr 27 '11 at 20:31
1  
@Darknight: Anything can be broken. The antivirus or the malware. See en.wikipedia.org/wiki/Polymorphic_code#Malicious_code for the polymorphim thing. – Anto Apr 27 '11 at 20:35

4 Answers

up vote 7 down vote accepted

Absolutely.

Of course, a stupid sife-effect of the DMCA is that because you'd have to reverse-engineer malware, you couldn't legally share what you learnt.

The most significant things you'd learn are:

  • What bugs malware exploits, so you'd know what you should protect against.
  • How much trust you should really put in a given OS / application / API
  • Undocumented APIs

And of course, it all depends what you know already. If you have never tinkered directly with the stack, then I'd expect this to come up

share|improve this answer
If I'm in Finland, I'm not under the DMCA, right? Though there could be some equivalent law here. – Anto Apr 27 '11 at 20:28
I use DMCA as a blanket term, as most WIPO signatories have vaguely equivalent legislation. IANAL – Phil Lello Apr 27 '11 at 20:31
Under the DCMA, is action taken against you by the government, or by the author of the malware? – Andrew Grimm Apr 28 '11 at 5:05
Again IANAL, but generally the DMCA variants make it a criminal offense, so technically it's the police. Of course, the chance of it going to court is remote - in much the same way that if A steals from B what B stole from C, B is unlikely to report the theft. But the DMCA angle is a bit off topic. – Phil Lello Apr 28 '11 at 21:29
up vote 6 down vote

Offense and defense are two sides of the same coin--I would think studying malware would be helpful to anyone trying to defend against attack.

share|improve this answer
up vote 3 down vote

Writing a licensing component is not too far removed from such studies. The effort that malware writers have to do, in order to evade analysis and decompilation is the same effort that a licensing component needs to perform in order to evade pirates and cracking rings. While the vast majority of software users are honest (and will pay for their software), there are a lot of others who think nothing of using your software without payment. There are also some folks who perceive their own value based on how many "cracks" they make - whether they use your software or not. The availablity of such cracks and key generators can tempt folks who normally would be honest.

share|improve this answer
up vote 1 down vote

IMO most programmers don't need help/encouragement to come up with "new and interesting techniques". Yes, there is plenty you could learn, but it would not be as valuable as, for example, knowledge of the business domain you're working in...unless you're working on security, of course.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.