For those not familiar, VirusTotal is a Google-owned site that allows anyone to upload any binary so it can be scanned by numerous anti-virus engines. Many third-party products also integrate the VirusTotal API so that binaries are automatically uploaded based on system scans. The way VirusTotal makes money is that they charge subscription fees so that other users can download the binaries that were uploaded. So my question is, doesn't this violate the copyright of the binary authors?
Now, obviously malware authors are not going to claim ownership of their binaries but a lot of other non-malicious binaries get uploaded to VirusTotal. And because anti-virus engines are not perfect they will mark legitimate software as malware. When a binary is marked as malware, according to VirusTotal, it will send that sample to other third parties as part of a sharing program.
- VirusTotal allows anyone to upload any binary regardless of the EULA of the software.
- VirusTotal facilitates sharing of the binary again regardless of the EULA.
- VirusTotal profits off the uploaded binaries by charging a subscription fee.
- VirusTotal provides no recourse available when legitimate software is marked as malware, only to contact each individual anti-virus company to report the false positive.
Putting aside the benefits of helping to identify malware, it seems to me that VirusTotal is in violation of copyright laws.