VirusTotal launches Monitor tool to fight false positives

VirusTotal says Monitor is a win for both antivirus vendors and software developers alike.

Popular malware aggregation repository VirusTotal has launched its Monitor tool, intended to mitigate the process by which legitimate files are labeled as malicious.

Created in 2004, and now owned by Chronicle, a subsidiary of Alphabet Inc., VirusTotal works by aggregating over 70 antivirus scanners that can detect and flag malicious files that users upload.

But the scanners are not always accurate, and some software developers have had their creations mistakenly flagged as malware, creating what is known as a false positive. According to VirusTotal, false positives can lead to reputation damage for the antivirus vendor, a loss of access and trust for end users, and a drop in revenue for software publishers.

VirusTotal’s Monitor tool was created to combat these issues. It works by allowing developers to upload their software to a private cloud, the contents of which are scrutinized by VirusTotal’s dozens of scanners.

If a file is flagged as malicious, then both the software developer and the antivirus vendor are automatically notified, and the vendor is given access to the file and its metadata. The metadata, which includes the company behind the software and its contact information, can then be used to connect with the software developer and correct the false positive.

VirusTotal says Monitor is a win for both antivirus vendors and software developers alike. With it, vendors will have access to more information about a file than before, and, because the tool is an automated process, developers will no longer have to interact with 70 different vendors if an issue arises.

The tool comes after VirusTotal announced in January that it would include a new graphing feature to aid investigations by helping chart relationships across files, URLs, domains and IP addresses.

VirusTotal has also made headlines for its applications in identifying, and in some cases, helping, cyber criminals. In 2014, several high-profile hacking groups were caught using the tool to hone malicious code by running it through VirusTotal’s antivirus scanners.

In February, evidence posted to VirusTotal’s public repository suggested that the same hackers behind the Olympic Destroyer malware that targeted this year’s Olympic Winter Games in Pyeongchang, South Korea, also penetrated computer systems belonging to Atos, the company that hosted the cloud infrastructure for the Olympic Games, in December 2017.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure