Building a Malware Museum

Building a Malware Museum

Speakers: Mikko Hypponen

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=u7-OFXLLsmU

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Mikko%20Hypponen%20-%20Building%20a%20Malware%20Museum.pdf

Overview

Mikko Hypponen's DEF CON 33 keynote is equal parts cultural manifesto and preservation call-to-arms. The longtime Chief Research Officer at WithSecure argues that the security community is the only group with both the technical capability and the cultural context to preserve the digital artifacts of its own era — particularly malware, demo-scene productions, vintage games, and early computing ephemera. His talk traces the arc from a Commodore 64 purchased on 23 March 1984 to today's AI-generated culture, weaving personal history with hard-won observations about digital decay, institutional failure, and the urgent need for intentional preservation before the window closes permanently.

Background

▶ Watch: Opening argument: digital culture is uniquely fragile and worth preserving (2:00)

Hypponen opened by grounding the audience in his own origin story: he started on a CPM machine at school, moved to a Commodore 64 at home, and has been working in computer security long enough that many of the artifacts he discusses are things he personally encountered at their creation. That biographical depth matters because the talk is ultimately about lived experience — about the difference between remembering culture and preserving it.

The core problem he identifies is a paradox: the digital age has made it easier than ever to create and distribute culture, but vastly harder to ensure that culture survives even a few decades. Physical artifacts — books, vinyl records, film reels — degrade slowly and predictably. Digital files depend on specific hardware, specific operating systems, specific software stacks. When any layer in that stack disappears, the cultural object disappears with it, regardless of how many copies exist as raw bits.

He draws an analogy to the fire at the Notre-Dame cathedral in Paris. A massive global response poured money and attention into restoration. But when digital cultural artifacts disappear — entire genres of early video games, the first generation of interactive fiction, vintage application software — there is no equivalent alarm, no public outpouring, no restoration effort. The loss is silent and invisible, and often irreversible by the time anyone notices.

Key Findings

▶ Watch: The Malware Museum: history and mission of the project (11:16)

The Internet Archive is under legal assault. Hypponen dedicates significant time to the legal threats facing the Internet Archive, the single most important institution for digital preservation currently operating. Publishers and rights holders have pursued litigation that threatens the Archive's core book-lending and web-preservation functions. He frames this not as a copyright dispute but as a civilizational risk: if the Archive is dismantled or severely curtailed, humanity loses its most comprehensive backup of the early web.

Emulation is cultural preservation, not piracy. Running a game in an emulator is, in many jurisdictions, legally murky or outright prohibited even when the original hardware is extinct and no commercial copy exists. Hypponen challenges the audience to separate legal status from cultural value. The emulation community has done more for digital preservation than most formal institutions, and treating it primarily as a piracy threat is a category error.

Malware is primary-source history. One of the most original arguments in the talk: the malware of the 1980s, 1990s, and early 2000s is historical documentation. Brain, the first PC virus, written by two brothers in Pakistan in 1986, was not just a threat — it was an artifact that reveals what a 360KB floppy-based computing ecosystem looked like, what the concerns of early crackers were, what the culture of the demoscene valued. Discarding these artifacts is like burning first editions.

The Malware Museum itself. Hypponen and collaborators worked with the Internet Archive to build a browser-playable collection of early DOS malware — specifically the ones that contained visual payloads (bouncing balls, falling letters, Cascade's tumbling characters). Users can execute these in a sandboxed DOSBox environment in their browsers. The collection lets the world experience the aesthetic sensibilities, technical creativity, and cultural context of an era that no longer exists. It is both a security archive and an art gallery.

The demoscene is UNESCO-recognized intangible cultural heritage. Finland was the first country to have the demoscene recognized by UNESCO. This matters because it establishes a precedent that digital creativity has cultural value deserving institutional protection — not just as data, but as craft and community.

AI changes the preservation calculus. Toward the end of the talk, Hypponen pivots to what AI-generated content means for cultural preservation going forward. AI produces vast quantities of plausible cultural artifacts, but these are often untraceable — no author, no date, no provenance. This makes future preservation even harder. The signal-to-noise problem for future historians will be orders of magnitude worse than what archivists face today.

Technical Deep Dive

▶ Watch: The first PC virus: Brain (1986) demonstrated in emulation (15:44)

The practical layer of the talk centers on how the Malware Museum actually works. The key technical insight is that old DOS malware, even when nominally dangerous, is trivially safe in a modern sandboxed environment: it was written for a computing ecosystem so architecturally different from current systems that it cannot cause harm even if it executes. This means visual-payload malware can be made browser-runnable with relatively low risk.

The implementation uses DOSBox, the well-established x86/DOS emulator, compiled to WebAssembly and embedded in Internet Archive pages. Each sample is the original binary. Users interact with them in real time in their browsers, watching animations that the original authors intended as calling cards, signatures, or demonstrations of skill.

Hypponen discusses the challenge of finding these samples. WithSecure's virus library goes back to the earliest PC era, but the collection is maintained as a security archive, not a cultural one — samples are stored in ways optimized for analysis, not experience. Preparing them for public display required categorization, metadata enrichment, and decisions about which to include (visual payload samples were prioritized because they are inherently safe and immediately legible as cultural artifacts).

He also touches on the challenge of running non-malware vintage software — games, applications, demo productions. The legal situation is different (malware has no copyright holder to object), and the technical infrastructure varies by platform. The Commodore 64, Amiga, Atari ST, and early Mac ecosystems each require different emulators, different BIOS images with their own legal status, and different community expertise.

Demo / Proof of Concept

▶ Watch: Exhibition highlight: original CRT displays and real hardware demos (20:14)

While this talk does not include an offensive security demonstration in the traditional sense, Hypponen does live-demonstrate the Malware Museum itself. The audience watches original 1980s and 1990s DOS malware execute in-browser, with visual payloads — the famous Cascade virus causing letters to "fall" down the screen, the Walker virus displaying a walking figure, various boot-sector viruses showing their authors' credits. The effect is striking: objects that were once genuinely threatening, running harmlessly as interactive history in a modern browser. The demo makes the cultural argument concrete in a way that description alone cannot.

Defensive Implications

▶ Watch: State-sponsored malware: Russian cyberweapon in the museum collection (29:18)

The defensive implications here are cultural and institutional rather than technical:

• Contribute to preservation efforts. Security researchers who have old malware collections, vintage software archives, or documentation of early systems are in a unique position to contribute material that nowhere else exists. Formal institutions do not have this material; the community does.

• Support the Internet Archive. Hypponen is explicit: if the Internet Archive loses its legal battles, the consequences for digital preservation will be severe. The security community should understand this as a threat to shared cultural infrastructure.

• Advocate for emulation rights. Current copyright law in many jurisdictions does not adequately protect emulation and preservation activities. The security community, which understands both the technical realities and the institutional failures, is well-positioned to advocate for reform.

• Separate malware history from operational threat. Organizations and researchers who hold historical malware collections should think carefully before destroying them. A virus from 1988 poses no operational risk in 2025, but it may be the only surviving instance of a significant artifact.

• Think about AI provenance now. As AI-generated content becomes ubiquitous, the community should develop standards for documenting provenance — who made something, when, with what tools — before the lack of that metadata makes future preservation impossible.

Key Takeaways

1. Digital culture is uniquely fragile because it depends on specific, perishable hardware and software stacks that the market has no incentive to maintain.
2. The security community is the custodian of a significant portion of early digital culture — particularly malware, exploits, and tools — that no other institution has preserved.
3. The Malware Museum demonstrates that even operational threats can be safely archived and publicly accessible using modern sandboxing and emulation.
4. The Internet Archive is the most critical single institution for digital preservation, and the legal threats it faces represent a genuine civilizational risk.
5. The demoscene's UNESCO recognition establishes a precedent that digital art and craft communities deserve cultural protection, not just technical documentation.
6. AI-generated content creates a future preservation crisis that needs to be addressed with provenance standards now, not retrospectively.

About the Speaker(s)

▶ Watch: Museum partnerships: institutional preservation in Tampere, Finland (38:14)

Mikko Hypponen has spent more than three decades in computer security. He is the Chief Research Officer at WithSecure (formerly F-Secure), based in Helsinki, Finland. He has tracked some of the most significant malware in history, testified before the European Parliament on cybercrime and surveillance, and has been a recurring presence at DEF CON and other major security conferences for many years. He is one of the most recognized figures in the global security community, known for combining deep technical knowledge with a broad view of the social and historical dimensions of computing. His personal collection of vintage computers — including the original Commodore 64 he purchased in 1984 — reflects the same preservation instinct that motivates this talk.