Feeds

Desktop search and malware: friend or foe?

Double-edged sword

Internet Security Threat Report 2014

Anti-virus experts are experimenting with desktop search as a way of scanning for viral code. Both Google Search and Apple's Spotlight technology come with programming hooks (APIs) that allow their functions to be extended. Using these APIs, executable files might be scanned for malicious signatures.

Andy Payne and Oliver Oliver Schmelzle of security firm WholeSecurity have developed a prototype malware scanner based on Google Desktop Search. In a presentation at last week's Virus Bulletin conference in Dublin, the duo demonstrated the prototype. Admittedly, this is more of an experiment into what's possible than a serious product development project: a lack of full file indexing and kernel system access makes the approach impractical at present.

Conventional anti-virus scanning tools are much more thorough and faster. But as desktop search becomes a core operating system component the potential to use it for security applications increases. Payne said desktop search could be applied to other applications such as searching email inboxes for spam and filtering it automatically. It is unclear if this approach would prove any better than email plug-ins such as SpamBayes - this was beyond the scope of WholeSecurity's research - but it is an interesting idea. As desktop search becomes more pervasive it could be applied to more security functions such as auditing and compliance tools or within anti-phishing technology.

Desktop search also carries potential security risks. Search events might be used to trigger adware pop-ups or virus writers might create malicious indexer plug-ins, making it easier to harvest data from compromised machines, Payne warned. Sidebar user interface interference might also possible, as least theoretically. "Malware could be created that infects as it indexes. What's good for finding might be good for infecting too," he said.

The two sides of desktop search mirror the use of Google queries by both penetration testers and hackers to search for security holes in online systems. Google hacking, as it has become known, has been around for at least two years or more and security researchers are now beginning to grapple with the same sorts of issues on the desktop. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.