What We Can All Learn from the VirusTotal Data Leak

In 2004, a service called VirusTotal was launched and swiftly became a popular antivirus and malware scanner to help detect threats in various files and URLs. It became popular enough that it was officially acquired by Google in 2012 and ultimately assimilated into Chronicle, a cloud-based security operations suite for enterprise businesses. Despite this impressive pedigree, however, we find ourselves able to look to VirusTotal as a sobering reminder of how fickle cybersecurity can be, with the service being the source of some limited data exposure.

Let’s consider the situation, and what it helps illustrate for us.

VirusTotal Had Some Registered Customers’ Data Exposed

On July 17, VirusTotal disclosed that a database composed of some 5,600 customer names and addresses—a collection of cybersecurity experts from various law enforcement agencies, intelligence agencies, and military staff from all around the world—had been leaked. What’s worse, it was the VirusTotal service itself that enabled the leak.

It all comes down to VirusTotal’s functionality. In addition to scanning files for malware using tools from various other companies, VirusTotal also shares these samples directly with these other companies, making them available for speedy download so that they can be used to help further research efforts.

When used in this way, this is all well and good. However, if someone were to accidentally use VirusTotal to share a file that should not have been shared, dozens to hundreds of companies could suddenly find themselves receiving data they should not be able to access.

This is precisely what happened to VirusTotal when an employee accidentally uploaded the aforementioned database of Premium-level users into the VirusTotal system. Fortunately, the list was promptly removed and was only visible to their partners and corporate clientele, but it still happened in the first place.

How to Prevent a Similar Issue in Your Own Business

Protecting your own organization from such circumstances is not going to be simple and seamless, particularly because the primary source of your vulnerability comes from simple human error. To prevent this from becoming the same kind of issue that it did for VirusTotal, you need to reinforce procedure—potentially through firewall rules, endpoint security warnings to give users a chance to reconsider what they are doing, and restricting upload permissions for certain users based on their roles.

If this sounds complicated, it can be… but that’s what a managed service provider like us helps to simplify.

In addition to assisting you with setting up the requisite safeguards, we can help you maintain your business’ essential technology, supporting it and, by extension, you and your business. Learn more about what we have to offer by reaching out to us at 607.433.2200.