🚀 go-pugleaf

pjc@melb.bull.oz.au (Paul Carapetis) writes:

> I have neither the extent of education or the wealth of experience
> that is possessed by the esteemed Dr. Cohen, but am I alone in my
> skepticism of the above concept?

The common misunderstanding on this question arises from the fact that
Dr. Cohen uses the term "virus" in a broader sense than most of us.
For his exact definition you should look in his Ph.D. thesis or in his
paper "Computational Aspects of Computer Viruses", published in
"Computers & Security". Look at the mathematical definition; the
natural-language one is just as inexact as everybody else's. In
general, he usually calls a "virus" any program that spreads in any
way. Like the XCOPY program, for instance...

> The subject of benevolent viruses (or "good" viruses) has arisen on
> this forum many times in the past and, indeed, amongst some other
> professionals at various courses and conventions that I have attended
> (including a very informative course given by Prof. Eugene Spafford).
> Discussions on said subject always ended with the decision that it
> seemed impossible to ensure the integrity of the benevolent viruses
> and that should these be modified to become malevolent, they could be
> far more dangerous than the usual "run-of-the-mill" virus as they
> would be propagated with the users' knowledge.

This is a result of the misunderstanding of the definitions. I know at
least three anti-virus packages, which are "benevolent viruses",
according to Dr. Cohen's definition. The supervisor installs them on
the LAN server -once- and each time a user logs in, the package
automatically installs (or updates) itself on the user's workstation.
Therefore, the package propagates from the server to the workstations
like a virus (or like a worm, if we want to be precise).

There's nothing bad in the above. Only the supervisor can install the
package and by definition the supervisor has the full right to decide
under what conditions the users are allowed to log in. These
conditions may include a requirement that the workstation that is
granted access to the LAN runs the latest version of a particular
anti-virus software. Therefore, there are no ethical problems involved
- - if you don't like that policy, don't use that LAN.

In fact, this ability makes the anti-virus packages that I mentioned
more competitive, compared to the other, similar ones. Several people
will prefer to have the ability to update all installations
automatically, instead of going from PC to PC and doing it manually.

> I may be a die-hard skeptic, but I still have trouble believing that
> Dr.  Cohen has created a benevolent virus that is immune to
> modification - maybe, if you deem my inquiry warrants a response Fred,
> you could put my (and probably many other peoples') mind(s) at ease on
> this matter.

The integrity problem could probably be solved with the usage of
some kind of public-key authentication scheme...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany