A Dutch company known as the Frame4 Group has created what’s almost the computing equivalent of a Center for Disease Control lab. The Malware Distribution Project is, according to its own site, the “world’s biggest private malware archive.”
|Enormous Malware Archive Creates Stir|
Don’t jump to the conclusion that the project’s run by a bunch of supervillains; the malware samples are supposed to be “offered for the purposes of analysis, testing and malware research.”
Also, customers are screened, and a monthly access fee of about $1,235 should act to keep out some of the riffraff.
It actually seems possible that the Malware Distribution Project could be of great help to the security community. When you consider that medical researchers don’t have to wander from house to house, asking people if they have cancer, every time they want to start a new experiment, certain practices start to seem a little outdated.
There is a potential for problems, though. One nightmare scenario relates to the Malware Distribution Project’s figurative walls failing and everything getting out. Having all of that malware run amuck at once – particularly if security researchers’ computers were the first things it’d come across – would be bad.
Then there’s the possibility that some unpleasant person would gain access to the Malware Distribution Project’s archive and just sort of go on a shopping spree. This way, some relatively stupid hacker might be able to get his (or her) hands on the most sophisticated viruses in existence.
As you might imagine, the Malware Distribution Project is definitely proving divisive.
Anyway, at last count, the repository contained a whopping 3,336,503 files.
UPDATE (10-13-09): Anthony Aykut, the Managing Director of Frame4 Security Services, got in touch with SecurityProNews this morning to pass along some information. In an email, he wrote, “[T]he malware is neither downloadable via the web site or accessible in any other way via the www; in fact, the (secure) servers where the malware is stored (or analyzed/processed) is not even connected to the outside world.”
Aykut also stressed that nothing is sold to the public, and added, “Largely due to the security measure(s) mentioned above, and also based on to the fact that the storage media are protected by biometric devices, getting access to the MD:Pro archive is, well, pretty impossible.”