🚀 go-pugleaf

Malte_Eppert@f6002.n491.z9.virnet.bad.se (Malte Eppert) writes:

>  > BTW, the integrity checking seemed -very- weak to me, but I have
>  > not tested it completely...

> By default TBCHECK checks only the entry point of an executed file.
> (You can set it to check the whole file's CRC, but that's documented
> to be real slow.)  That's what I think to be the weakness, but could
> you explain why?

It is a security problem, indeed, and a major one. Checking only the
entry point of the files is -very- insecure, because it is possible to
infect a file, without modifying any of the following: size, date,
time, attributes, entry point.

However, I was thinking about other security problems. TbCheck uses a
CRC with a fixed generator, and this can be easily subverted. It
doesn't know about PATH companions. It doesn't know about the DOS file
fragmentation attack. And so on...

I would strongly suggest to any aspiring authors of integrity checking
packages to take a careful look at my paper "Possible Attacks Against
Integrity Checking Programs And How to Prevent Them". The paper has
been published in the proceedings of the 2nd International Anti-Virus
Conference, organized by Virus Bulletin, September 1992, in Edinburgh.
An improved version of the paper has been published in the proceedings
of the 2nd EICAR conference in Munich, December 1992. The improved
version of the paper is available for anonymous ftp from our site as

ftp.informatik.uni-hamburg.de:/pub/virus/texts/viruses/attacks.zip

The archive contains the paper in both LaTeX and ASCII format.

> Are there many link viruses (guess that's what
> TBCHECK is written for) which don't touch the entry point at infection
> time?

I can think about at least two - LeapFrog and Emmie. The point is that
it -is- possible to do it, there -are- viruses that are doing it,
therefore, the integrity checkers -must- take into account this
possibility.

> BTW: I managed to have Armageddon infect a file after I allowed the
> virus to go TSR, though I've activated the whole product palette.
> What's that - a special way to put its code into a file, which TB
> doesn't recognize?

I'm afraid that I do not understand the question... There's nothing
special with Armagedon - it just prepends itself to the COM files -
like the Jerusalem virus does...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany