🚀 go-pugleaf

Fred Cohen has brought up the point that virus design techniques can
be used for beneficial purposes. In his example he describes a
network product that installs itself without the user ever having to
know its there.

Instead of discussing a variety of basic problems involving
distribution and maintance of a viral based system, all of which are
system specific and a nit picker could find ways to solve each and I
could come up with a new problem ad inifnitum ad nightem. Instead I
will discuss one major, system non-specific, problem:SECURITY.

For a destructive program to do damage, it must be executed in one
form or another. The nature of the program, virus, trojan, or just
badly writen, is not relevant. The first line of defense against
these types of programs is through tracking and control of all
executable programs. Viruses, by their very nature, are a wildcard.
The only effective means of executable control is to keep absolute
control over access to the executables. That way accurate records
can be kept on file size, content, check codes, etc. A virus, by
it's very nature, denies this ability. For a virus to be effective
it must be executed. How is it to be executed? 

If the purpose of the program is to automatically cause some
'change' in various computers, then the program must execute from a
loader or an infected file. If its being launched from a loader then
the need for the distribution system is nullified. Assuming the goal
is to still keep absolute system security, then the loader will be
'allowed' in by the administrator but the virus it is loading won't
be allowed to attach itself to another program, just make the change
for the single user that activated the loader. If this is an
effective means of distribution then why use a virus at all? 

If, on the other hand, the loader can not be trusted, then a virus
may come in to play. If I can't be sure that all my users will
execute the loader and update their system then I can have a virus
go through and infect all sorts of executables until I finally hit
one a user will execute and thus have their system updated. Leaving
aside the question of how effective this sort of distribution
mechanism is, there is the question of executable integrity. If the
virus distribution system is to work it must be able to violate
system security. It must be able to infect the system executable
files. This means that file size, content, checksum codes, and so on
will all change in an unpredictable manner. This quickly turns
system security into system guessing. An unacceptable situation.

In conclusion, a system that changes in an unpredictable manner,
that uses hard to track mechanisms of change, is a security
nightmare. Just as self modifying programs have been given a very
bad reputation for very good reasons, a viral based distribution
system deserves a similarly bad reputation.

			Yaron (The Jester) Goland
- -- 
			The Jester-PGP Ver2 upon Request
"You can lead a herring to water, but you have to walk really fast,
or he'll die."-Stolen from my Evil Mistress (TM)
               NWILSON@MIAVX1.ACS.MUOHIO.EDU