🚀 go-pugleaf

Jason Stokes wrote:

> Incidently, I understand it's reasonably easy to create a polymorphic
> virus which is undetectable by conventional checksum-based virus
> scanning techniques... isn't it?

Yes.  I wrote one of the earliest of these when i was young and
foolish.  You basically code each part of the unpack routine a
few different ways.  You then randomly choose one way for each
function and trivially encode the remaining unused functions
with a random key.

Detection with a pattern scanner requires reverse-engineering
the code (so you can have each alternative of one particular
function as the pattern).  A nice counter-touch is to use
code fragments that have the same patterns as in popular packages.

A similar method uses p-code with changing opcodes.

It has been years sense I've written any 8088 assembler and
I am happy to have left that era behind.


Writing a scanner that unpacked messages and scanned
the result as part of the MTA message handling package
would be very handy.  The most popular viruses are not
the complex ones, and viruses tend to be spread through
particular agents (eg: by just one or two silly users).
Detecting a simple virus and educating the user slows 
the spread of the complex viruses as effectively as it
slows the simple viruses.

There are two difficult parts.  (1) the corpus of public
domain virus fragments is not as comprehsive as it
once was.  (2) the huge variety of encoding, archive,
and compression formats.

In the long run, you want virus checking as part of
the "save" function in Netscape, etc.  Puting the
checking in the MTA is useful from an administrators
point of view, but it fails for encrypted messages.
Why not write a routine for Mozilla that looks for
a shared library, say libscanvirus.o, and loads it
if present.  Then call some entry points in the shared
library when saving or uploading a file.


> So glad I'm using an OS that's almost totally immune to viruses.

It's not actually that immune.  If you are happy not to
attempt to gain root, then you can propogate a virus
using ~/.emacs files pretty readily.  It's hardly
likely to be noticed amoungst the crud in your typical
.emacs.