It Hurt Itself in Confusion: No Distribute Scanners and Stealthy Malware
summary
No‑distribute scanners let criminals test malware stealth by scanning against dozens of AV engines without feedback to vendors; Scan4You ran eight years with ~30,000 users and its operator got 14 years in prison, and DynCheck (online since 2016) offers static and dynamic reports. Researchers examine nine NDSs, find only two offer true dynamic analysis, and show Bore hit 1/31 AVs statically and 3/23 dynamically. Prices range from $0.01 per static AV check to $50–$300/month, APIs enable integration and periodic scans and domain‑blacklist checks, and dynamic scanning requires many VM snapshots so it’s costly.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:42Scan for You
- 3:42No Distribute Scanners
- 7:22Static vs Dynamic Analysis
- 14:36Pricing Models
- 17:30Stages of NDS
- 18:11Cycle test
- 18:50Signature
- 20:04Advertising
- 20:57AV Monitor
- 24:25Key Points
related talks
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?
01h 00mSecurity Theatre
30mDeception at Scale: How Malware Abuses Trust
37mDynamic Image Scanning Through System Tracing
51mHelpful Hackers
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...- 41mWill Large-Scale Automated Scanning Stop Malware on OSS Repositories?