Trojan horses in data files

Article View: comp.virus

Article #4645

#4645

From: VANVLECK_TOM
Date: Thu, 27 Jun 1991 06:57

18 lines
1306 bytes

Mac and PC applications that read structured data files might be
tricked into executing a trojan horse by an ill-formed input file.
Given garbage input, word processors, picture displayers, and
spreadsheets sometimes crash by executing an illegal instruction.  If
the bytes making up this instruction come from the data file, the data
file can act as a virus installer.

I don't know if a DIR A: command can be tricked in this way; proving
that it can't be, no matter what's on the floppy in drive A, would be
a hard job unless the code is thoroughly defensive.

I do not believe such a trojan horse data file exists today.
We should
- - change scanners to scan all files, not just code
- - identify applications that are vulnerable to this attack and
  suggest they be repaired or avoided

Tom Van Vleck           <vanvleck_tom@tandem.com>

Technical Details

Message-ID: <0011.9106281824.AA04058@ubu.cert.sei.cmu.edu>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!uunet!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!uunet!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: VANVLECK_TOM@tandem.com
Newsgroups: comp.virus
Subject: Trojan horses in data files
Message-ID: <0011.9106281824.AA04058@ubu.cert.sei.cmu.edu>
Date: 27 Jun 91 06:57:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 18
Approved: krvw@sei.cmu.edu