🚀 go-pugleaf

HISVIRD.CVP   920905
 
                    MacMag virus - "Data" Virus
 
The most widely distributed early reports of the MacMag virus were
undoubtedly those relating to its appearance on the Compuserve
system.  In a sense this notoriety is unfair: even those reports
from Compuserve were prompted by the notice to Compuserve from
someone who had first downloaded the file from Genie.  Compuserve
had nothing to do with the production of the file, and it was
uploaded and distributed through other systems as well.  However,
the fact remains that the MacMag virus did get some distribution via
a Hypercard "stack" that was, for a time, posted on Compuserve.
 
Hypercard was the first widely available implementation of the
"hypertext" or "hypermedia" concept.  The basic idea is that related
information is "linked" so that associated data can be seen
together, or at least accessed quickly.  An example might be that in
reading email you might come across an unfamiliar term and be able
to get a definition of it.  At a higher level, when reading a news
report of some conflict, you would be able to quickly "pull up" a
map of the area, political history, studies of the ethnic groups
involved and economic data about the products and exports of the
area.  Hypercard was also seen as a development tool.
 
In any case, Hypercard "stacks" are essentially data bases with
internal "link" information.  As such, the initial report of the
fact that "NEWAPP.STK", supposedly a file of information on new
Apple products, actually altered system data met with skepticism. 
Even then it was "known" that viral program could not spread via
data files.  When this fact was confirmed, it was erroneously
reported that MacMag was an example of a virus that could.  (I've
been guilty of this, myself.)  In fact, the NEWAPP.STK might better
be described as a "dropper".
 
Semantics aside, how could a data file affect the system at all?
 
Well, more and more programs have "macro", "script" or interpreter
capability.  Thus the distinction between data and program blurs. 
Hypercard stacks have "commands" as well as data associated with
them.  Generally, these commands only govern the ability to "flip"
from one "card" to another.  However, an extended command set, XCMD,
allowed for additional functions beyond those normally available in
Hypercard.  This was used to affect the system changes.
 
Other systems, such as Lotus 1-2-3, have macro capabilities
associated within data files.  In theory, it is possible for a virus
to be able to switch forms from "object" to macro in the same way
that multipartite viri switch from file to boot sector format. 
However, the viral code would be of considerable size.  To date no
such virus has been seen.
 
copyright Robert M. Slade, 1992   HISVIRD.CVP   920905

===================
Vancouver          ROBERTS@decus.ca         | "Power users think
Institute for      Robert_Slade@sfu.ca      |  'Your PC is now
Research into      rslade@cue.bc.ca         |  Stoned' is part of
User               p1@CyberStore.ca         |  the DOS copyright
Security           Canada V7K 2G6           |  line." R. Murnane