🚀 go-pugleaf

fc@turing.duq.edu (Fred Cohen) writes:
>I am surprised that so many well respected Virus-L readers and writers
>failed to understand the implication of creating 1500 viruses per day
>that are not detected by existing scanners.  The point is that the
>number or percentqge of viruses detected is not as important as the
>eff of the product.

I am surprised that you fail to understand what the readers and writers
are saying.  The fact is, we already know that a scanner will not detect
a new virus.  I could sit down and write a virus that any signature-based
scanner couldn't detect.  So what if you can do it, too?
   I know what the implications are:  scanners are limited.  We already
know that.  Everyone seems to know that.  Why do you think that your 
statement is so enlightening?  It's old news.

>	Of the CARO collection of over 1500 viruses, only a small
>portion have ever been found at a substantial number of sites, and
>many are collector-only viruses that have never appeared in the wild.
>
>	I am quite astounded by the concept that creating viruses in
>the privacy of my home should offend anti-virus types.  In fact, I
>have had automated virus generation systems running for several years.
>At one point, I was trying to create ecosystems by randomly generating
>tens of thousands of candidates per day, many of which were successful
>viruses.  Why does this offend other researchers?  And I take it from
>some of the comments that these researchers have NEVER created a virus
>of their own to explore the concept!  It's sad that people who have
>never tried it feel free to condemn it.  Or have they done it and
>simply don't have the integrity to admit it?

Maybe they have the intergrity not to spread these viruses around.  You
say that "only a small portion have ever been founf at a substantial
number of sites".  I read this statement as meaning that you have created
these viruses, and only a few of them have "gotten out".  To me, that is
irresponsible.  If you want to create research viruses, fine.  But if
you let them spread, than that is *not* fine.

>	ASP has already introduced one virus-based commercial product
>(which has never been detected as a virus by any scanner) which
>operates quite well, and we are in the process of creating another
>virus-based product designed to operate in LANs.  Our users don't seem
>to be offended by the optimization of resource utilization, automated
>distribution and installation, high reliability, and small space used
>by our products based on viruses, but it seems to offend the
>anti-virus community that all of their overblown claims about all
>viruses being bad are being undercut by benevolent viruses that are
>safe and reliable.  In fact, most of our viruses work on far more
>systems than most virus defenses, and they don't spread where they are
>not supposed to go.  They are easy to control and remove, they are
>compatable with every DOS based system we have seen to date, and they
>have never generated any unintended side-effects.  Kinda blows the
>whole "all viruses are bad" thing, huh!

Excuse me?  Since when did viruses have to be "bad" to be a virus?  Look
in the FAQ...there's a sentence there refutes the "belief" that a virus
has to be "bad" or "malicious" to be a virus.

>	NEW PRODUCT ANOUNCEMENT - BENEVOLENT VIRUSES IN LANS
>	AUTOMATE MUCH OF LAN MANAGEMENT - ANTI-VIRUS COMMUNITY
>	SHUDDERS - SCANNER PRODUCTS MUST ADAPT TO DIFFERENTIATE
>	BETWEEN KNOWN GOOD VIRUSES AND VARIENTS CREATED BY BAD
>	VIRUS WRITERS - FOR DETAILS CONTACT ASP

Do you even know how a scanner works?  From the above statement, I am
beginning to doubt if you really do.  Unless you are talking about
heuristic methods, which are still in the experimental phase.  And
integrity-based systems let you specify which files are to be ignored
and which are to be checked.

- -- 
John Mechalas                      | If you think my opinions are Purdue's, then
mechalas@expert.cc.purdue.edu      |      you vastly overestimate my importance.
Purdue University Computing Center |             Help put a ban on censorship :)
General Consulting                 |                       #include disclaimer.h