🚀 go-pugleaf

steveb@inst-sun1.tmc.edu (Steve Bednarczyk) writes:

>  I just installed a small security card called the GATEKEEPER made
> by JDR Microdevices ($49). It intercepts the BIOS and will not allow
> the boot to continue until a password is entered by the keyboard.
> You cannot boot from a floppy or the hard drive. It can be disabled
> by removing the card however. I bought a security padlock/case bolt
> assembly to keep the case from being removed.
>  I agree that these measures can be defeated by a determined person
> but I hope that they will just find an easier target. Oh. The really
> sensitive material has been encrypted using Norton Diskreet DES.
> If they get through that - I'll offer them a raise in salary and put
> them on my security committee :}

Hmm, let me see... If I were THEY (i.e., if I needed to attack your
machine), I would write a simple master boot sector virus (like
Stoned) and will infect with it any diskette that I am giving to you.
Sooner or later, you'll forget one of them in drive A: when rebooting
the machine. Then the virus will infect your hard disk. From this
point, it's relatively easy for it to intercept the loading of
Norton's device driver, the password request, and your response from
the keyboard. The virus will save the password (trivially encoded) in
its body. Therefore, each diskette, infected with it, will contain
your password (encoded, so it won't be obvious). I then need only to
get an infected diskette from you, which is really easy - I just have
to ask you to access -any- diskette which is not write-protected with
the DIR command. Once I get the diskette, I can decode your password.
The virus on your disk could be even designed to automatically remove
itself some time after it has obtained the password and has written it
onto several diskettes...

OK, so will you accept me in your security committee and how about my
salary? :-)

(Note: this is only a hypothetical attack, to show how a computer virus
could be used to defeat the security (in fact, the secrecy) of a
system. In the real life I am fighting viruses and not writing
them...)

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany