The virtual machine is created on the fly when the scan is requested.

MDS actually interacts with websites using an instrumented vulnerable browser hosted on a virtual machine. MDS primarily uses Behavioral Analysis to identify when a website is infected with malware. While MDS also automatically interacts with the site as a user would, navigating and following links, it uses a much different technique to detect malware. The Malware Detection Service (MDS) takes a different approach to detection. This makes the automated scanning far more cost effective. This is the same type of action that a penetration tester or malicious hacker would use to discover these vulnerabilities, but it is done in an automated way that takes a fraction of the time that it does for a human. If the web application responds in a given way, WAS can determine that the application is vulnerable to the specific attack used. While interacting with the site, WAS injects hostile payloads and then observes how the web application responds. The WAS scanner will request pages, login and follow links to new pages, posting forms as it goes. Qualys WAS works by interacting with a web application or website just as a user would, but does so in a fully automated way. Malware Detection Dashboard Advanced Detection Methods Now that we’ve outlined the integration at a high level, lets go into a little more detail about how each type of scanning is performed, and how they are integrated in WAS 3.0. Although the services are integrated, the way the scanning is executed and the threats that are identified by vulnerability scanning and malware detection are very different.

With WAS 3.0, Qualys has integrated this malware detection capability into the WAS solution to make it easy for organizations to configure both types of scans from WAS. Qualys has offered the Malware Detection Service as both a freemium solution for individuals and as an Enterprise Edition for larger organizations that need to protect a large number of websites. In announcing Qualys WAS 3.0, organizations now have away to address the need to detect not only web application vulnerabilities, but also malware that may infect these same web properties. The Verizon 2012 Data Breach Investigation Report notes: “Out of the 855 incidents this year, 81% leveraged hacking, 69% included malware, and an impressive 61% of all breaches featured a combination of hacking techniques and malware.“ The combination of threats presents organizations with a new challenge when trying to identify both web application vulnerabilities and malware that may exist on their sites. The relationship between website vulnerabilities and malware is one that is likely to continue to increase. Many times a vulnerability in a website is exploited to setup the malware that a legitimate website may then deliver. During that time there has also been an increase in the use of malware hosted on websites to infect unsuspecting users. In the last 10 years hackers have routinely taken advantage of web application vulnerabilities to successfully breach organizations.

Burp suite vulnerability scanner