A question about malware signatures contribution

[milosdjakonovic]

Hi.
Do you accept malware signatures contribution?
If yes, how is that done: are the src/Signatures.php Signatures::$raw and Signatures::$regex what we could update?

Do you enforce limits regarding regex / raw rule length or complexity?

Last but not least, how do I as a contributor prove that the code is malware? Example, a few lines of readable and nicely formatted code (no eval|gunzip|base64_decode crap):

# pseudo - code
if [...] $_GET['username'] === md5([...]) 
move_uploaded_file($_FILES['file']['tmp_name'], $_GET['filename'])

most certainly this does not have to be malware per se, but if I add info that this file suddenly occurred as dodgy WP plugin ("WP plugin"), than it's a different call.

[marcocesarato]

Hi @milosdjakonovic, sure, we accept the contribution for malware signatures. In this case it should be an Exploit (here: https://github.com/marcocesarato/PHP-Antimalware-Scanner/blob/master/src/Exploits.php) with level => Match::WARNING because yes it's a malware, but it may also not be malware. On Exploit there are no limits regarding the limit / complexity of the regular expression but just must to be a valid regex to find a valid exploit.

In this case there are some variables like the filename/username key and check if there is others lines of code between the md5 check and move_uploaded_file.

[milosdjakonovic]

Thanks... Now I see the difference. So, Signatures.php for malware and Exploits.php for code often but not exclusively used by malware.

Consider adding mini howto for this subject in README.

[marcocesarato]

Hi @milosdjakonovic , I create a small documentation website of the program (a lot of these informations are on README yet).

Here explained in short the differences between definitions: https://marcocesarato.github.io/PHP-Antimalware-Scanner/
And here explained in short how to contribute: https://marcocesarato.github.io/PHP-Antimalware-Scanner/how-contribute/

[milosdjakonovic]

Awesome. Malware samples are on the way...