🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4904

GateKeeper

#4904
From: Chris Johnson
Date: Thu, 08 Jun 1989 21:14
41 lines
2488 bytes
>Though this is probably old news, I'd recommend adding GateKeeper to
>your INITs.  Though it's absolutely transparent for all disc writes
>you tell it to allow, it forbids completely any writes it doesn't know
>to be authorised.  As soon as I discovered how effective it is, I
>removed Vaccine from my system: GateKeeper is much more thorough (as
>it checks the writing of *any* resource, not just CODE) and much less
>intrusive.
>
>Best of luck with your disinfection.
>
>Alastair Milne

If you liked GateKeeper 1.1, you'll really like GateKeeper 1.1.1.
It's been in testing (in various stages of completion) for several
months now and should be available in the next few weeks.  One
(potentially) troublesome bug has been fixed and a good number of
enhancements have been added.  More details on 1.1.1 later.

By the way, you're right that GateKeeper doesn't *just* protect CODE
resources, but it's not true that it protects *all* resources.
Protecting all resources is unnecessary (besides, you wouldn't want to
have to grant privileges to every program that modifies one of its own
'STR ' resources).  What GateKeeper does do is protect every type of
resource known to contain executable code (there're about 26 of them,
running from INIT and CODE (which you might expect viruses to attack)
to others like 'snth' and 'MBDF' (which you might not)).  [Anyone
interested in the exact list can check GateKeeper's 'Type' 1
resource.]  Fortunately, most of these protections are unnecessary
against the current crop of viruses (and let's hope it stays that
way), but the protections are there just the same (to help make sure
it *does* stay that way).

In response to another question I noticed a few articles down,
GateKeeper is available for anonymous ftp from Sumex, Simtel,
emx.utexas.edu and rascal.ics.utexas.edu.  If these won't work for
you, you can always send me (Chris Johnson) mail as
chrisj@emx.utexas.edu and I'll send you a copy.

Cheers,
- ----Chris (Johnson)
- ----Author of GateKeeper
Technical Details
Message-ID: <0003.8906091203.AA01152@ubu.CC.Lehigh.EDU>
Path: arc1-ca.pugleaf.net!utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!ubu.cc.lehigh.edu!virus-l

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!ubu.cc.lehigh.edu!virus-l
From: chrisj@emx.utexas.edu (Chris Johnson)
Newsgroups: comp.virus
Subject: GateKeeper
Message-ID: <0003.8906091203.AA01152@ubu.CC.Lehigh.EDU>
Date: 8 Jun 89 21:14:25 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Reply-To: VIRUS-L@IBM1.CC.Lehigh.EDU
Lines: 41
Approved: virus-l@ubu.cc.lehigh.edu