I've just been reviewing a paper that explains how to create malware more or less automatically. I won't get into the details of how nor which conference as it's confidential.

It's not the first time I review such papers, and I want you to know, that if I am in the review board, such a submission will never get accepted whatsoever. I strongly feel against it.

Android malware alone, we have between 6,000 and 10,000 new samples PER DAY. Do you really think we need more?

#ethics #malware 1/4

Submitting such a paper is just IRRESPONSIBLE. We, malware analysts and other anti-malware jobs, spend hours trying to secure lives / money of your family, friends, colleagues, companies.

Trying to help malware authors feels like spitting on our jobs. Or shooting in your leg. To correlate it to current events in France, it's just like lighting a fire in front of fire-fighters. Will you tell people who lost their house, their life that it's fun to "try"?

#malware #paper #research #ethics 2/4

By the way, I personally enjoy this "community service" part of my job : combating malware, and helping - a bit - the population gives sense to my work.

I know that some researchers and hackers will argue that "it's good to know how to create malware for science", to learn to fight it more efficiently.

I believe there are more secure way to do so. Do you spread the plague to test how efficiently your vaccine works? No. Same for malware.

#malware #creation #ethics 3/4

If you really insist on "creating malware for science", please pay attention to contain it (air-gapped, strict container), use a void payload (no impact) and present your research in closed conferences with no picture and no recording.

But again, please don't. Use your intelligence to fight malware. It's very interesting too, and it requires lots of brains and skills! Want to prove your value? Far more efficient.

Don't give in the dark side ;P 4/4

@cryptax This sounds like blaming the messenger. If the research is valid, rejecting it won't shield you from the consequences in the long run. I'd rather see this as a call to action for improving automation and scalability of analysis.

@buherator it's not the messenger, it's the researcher. The research is valid - technically - but not ethical. Publishing the research helps the "dark side". They don't need help.

If the researcher wants to improve automation, then s/he's not reaching the goal, but doing the opposite.