Malware Authors Leave Exploitable Bugs in Their Own Code, Researchers Find
A significant portion of leaked malware projects contain exploitable vulnerabilities, offering defenders potential avenues to disrupt malicious operations.
Researchers have uncovered a surprising trend: a vast majority of leaked malware projects contain software weaknesses that could potentially be leveraged by cybersecurity defenders. Analysis of 658 malware samples from the VX-Underground repository revealed that nearly 90 percent harbored at least one recognized software flaw, a finding that could shift the defensive playbook from solely focusing on malware's impact to exploiting its internal defects.
The study employed static analysis tools—Cppcheck, Bandit, Snyk, and Semgrep—to scan the malware code. For a comparative baseline, the same tools were run on 249 open-source projects, including popular Python and JavaScript packages, as well as security tools like nmap and sqlmap. The selection of smaller community projects for the benign comparison aimed to mirror the typical development environment of malware authors, often characterized by limited resources and smaller teams.
The analysis highlighted prevalent issues such as poor code quality, missing integrity checks, and unused variables, reflecting the often rushed and low-care development practices common in malware creation. While web-application specific risks like SQL injection were less common, a significant finding was the frequent disabling of TLS certificate validation. This deliberate omission, intended to obscure command-and-control traffic, inadvertently creates an opportunity for defenders to monitor and potentially locate infected systems by intercepting this unencrypted communication.
Historically, defenders have studied how malware exploits vulnerabilities in legitimate software. However, this research points to the efficacy of the reverse approach: exploiting flaws within the malware itself. Precedents for this strategy include the WannaCry worm's hard-coded kill switch, the successful takeovers of the Emotet and Torpig botnets through operational flaws, and the creation of ransomware decryptors by reverse-engineering key generation mistakes. The Malvuln project, for instance, already catalogs such internal malware vulnerabilities for defensive purposes.
The potential for a systematic approach is amplified by the repetition of code fragments across multiple malware families. The study found that over two-fifths of detected weaknesses originated from shared code snippets. This means a single, exploitable flaw could be present in numerous distinct threats, offering a broad attack surface for defenders to target.
Interestingly, the code quality of the malware samples, when assessed for maintainability, often fell within the same range as benign open-source projects, sometimes even scoring higher. The malware samples tended to be small, sparsely commented, and structurally simple, traits attributed to authors aiming for single-purpose, short-lived tools and to deter analysis or code forking. This consistent quality is partly linked to the Malware-as-a-Service (MaaS) market, where functional tools are expected, pushing authors toward cleaner, albeit narrow, codebases.
However, the comparison has limitations. The malware samples were predominantly written in C and C++, while the benign projects were mostly in Python and JavaScript, potentially skewing structural comparisons. Furthermore, the analysis covered only about 70 percent of the malware samples due to language support in the tooling, and the leaked samples represent only a fraction of all existing malware. The authors also refrain from endorsing hack-back practices, leaving the legal and ethical implications of directly retaliating against attackers unaddressed.
Ultimately, the research underscores that malware, like any software, is susceptible to bugs. Cataloging these internal weaknesses provides defenders with a crucial advantage, potentially enabling them to preemptively disrupt campaigns by identifying and exploiting common flaws before they are widely weaponized.