Recently, Israeli cybersecurity company Otorio Ltd claimed that companies are leaking data such as factory blueprints to intellectual property as they are misusing Alphabet Inc.’s virus scanner tool, VirusTotal. Otorio said it found thousands of unprotected files that companies uploaded to VirusTotal for malware detection, even though they have not found any cyber-attacks involved, yet.
VirusTotal is a free website for malware scanning created by a Spanish security company named Hispasec Sistemas in June 2004. Google Inc. started to acquire it since September 2012, and now it is owned by Chronicle, a subsidiary of Alphabet Inc. It provides services like analysis of files and URLs, identification of malicious content as well as false positives. As it is one of the largest malware intelligence services in the world, more than 100 security vendors rely on it for sharing information and improving their products, according to Chronicle Security.
How Companies Misuse VirusTotal?
Otorio CEO Daniel Bren said:
“From what we found, we could design a very constructive hack. We found files that gave us a blueprint of how to infiltrate the production floor. The companies’ trademarked secrets are on those blueprints “
As VirusTotal is a free and powerful malware detection tool that can be accessed easily online, some security upload files indiscriminately without understanding the potential risk. Some people don’t realize that all files they submit to VirusTotal are saved on their servers and are fully searchable. Thus, VirusTotal also admitted that the awareness of how the service works as well as how security applications should be configured have to be raised. VirusTotal’s online terms of service states that the samples that users uploaded should be something they wish to publicly share. In addition, it warns them not to submit anything that includes confidential, commercially sensitive or personal data without permission. Therefore, it is important to understand the security tools you are using as these tools do not know specifically what your company does and what your privacy policies are.
Contact LIFARS Immediately if Your
Organization was Hit with a Data Breach