badthings.info

What It Is

BadThings.info is a resource site focused on Linux-based IoT malware research, with its core output coming from a lifecycle study of more than 166K IoT malware samples. The site provides a USENIX Security paper, slides, video, as well as a sample repository, metadata, static/dynamic analysis traces, and in-house analysis tools. Its goal is to help the research community continue conducting IoT malware research.

Core Capabilities and Scope

In terms of protection type, this is not an EDR, gateway, or cloud security service, but rather a collection of research datasets and analysis tools. The content includes 166K+ Linux IoT malware corpora collected in 2019, static, dynamic, and network analysis artifacts, along with metadata analysis based on VirusTotal AV detections, labels, and in-the-wild names, further normalized with AVClass. Deployment mainly involves downloading samples and analysis files, while tool build and usage instructions are hosted on GitHub. The main page does not describe SaaS, private deployment, centralized management, or alerting. For integrations, the text explicitly mentions VirusTotal, AVClass, YARA, Ghidra, hexdump, binutils, binary emulation, and dynamic analysis toolchains.

Pricing and Compliance

The page does not mention commercial pricing, subscriptions, payment methods, or licensing terms. It only states that tools, analysis artifacts, and malware binaries are released to the research community. Compliance certifications, data usage restrictions, and sample access review processes are also not described in the main text. Because the materials involve real malware binaries, users should prepare their own isolated lab environments and comply with the security management requirements of their organization and jurisdiction.

Pros and Cons

Its strengths are the large sample scale and complete research pipeline: it provides not only the research methodology from the paper, but also metadata, static/dynamic traces, and tools. This makes it useful for reproducing research, developing YARA rules, and evaluating IoT malware detection capabilities. The drawbacks are that it lacks the deployment guides, console, alerts, technical support, and SLA commonly found in enterprise products. It also does not specify update frequency or download requirements. For teams without malware analysis experience, the onboarding risk and operational complexity are relatively high.

Who It’s For and Access from China

It is suitable for universities, threat intelligence teams, IoT security labs, and malware reverse engineers. It is not a good fit for enterprises looking to buy a ready-to-use protection service. The source text does not provide enough information to assess access from mainland China, and no payment methods are mentioned. For commercial alternatives, consider VirusTotal, MalwareBazaar, enterprise threat intelligence platforms, or vendor solutions with IoT security capabilities.