Thursday, October 12, 2006

Malware clusterbomb movie

At my startup RobotGenius, Inc., we've been building new technologies to fight malware, spyware and adware. Our "Spyberus" software installs at the driver layer between the Windows OS and the physical hard drive. It tracks all file modifications, and stores a history of all files on the system, allowing users to trace any infection back to its source (even to the web site or media it came from), and to reverse it with a few clicks.

We have an automated farm of PCs crawling the entire web, downloading, installing, and classifying all Windows executables based on their behavior. There are about a million executables on the internet, about .5% of which are malware. Soon we'll have data on every executable and a complete list of sites which distribute malware. You may see the data someday as security warnings in search results from your favorite search engine :-)

For now, you can enjoy the following movie, which shows a clusterbomb attack. The user downloads an innocuous seeming toolbar application, which initially only does a few nasty things, like modify the Windows hosts file, but after a pre-set delay starts jamming all sorts of downloaded malware code onto the machine. If Spyberus were not already installed on the machine, the user would probably have to wipe the hard drive completely and reinstall Windows. But as you can see, Spyberus allows for a quick and painless reversal of the infection.

4 comments:

rz said...

The product looks very good!

I have a question, though: What's going to be the marketing plan?
I mean, I'd install it and probably so would most fellow computer-nerds. But, it seems that it is aimed to the users (eg my mom) who may actually click on the phishing links and such. Typically, it is difficult to get such users to install firefox, update windows or run spybot (still thinking of mom here), so why would it be any easier to get them to install spyberus. Maybe the hope is to get M$ to buy you guys out and build it into windows? ;-)

Steve Hsu said...

It may be that companies understand the value proposition better than most consumers, as they know how much time and money they have to spend cleaning infected machines. You are right that Spyberus would make a nice addition (as a feature) to existing security products :-)

Anonymous said...

It may be that companies understand the value proposition better than most consumers...

I assume you guys might get bought out by Micro$oft for a nice sum.

Steve Hsu said...

I think our data on which urls distribute malware is something users would like to see as part of their search results. I think it can be a competitive differentiator for Google/Yahoo/MSN/Ask...

Blog Archive

Labels