🚀 go-pugleaf

fc@turing.duq.edu (Fred Cohen) writes:

> 	I think that an alternative to off-line checksums is access
> control. This has worked in IT for several years, and defeats all of the
> other attacks against the crypto-checksum I am aware of. 

I disagree, for several reasons:

1) As you admit yourself, access control requires the proper hardware
that is able to provide memory protection, and proper software that
actually uses these possibilities that the hardware provides... In
practice it means - not an MS-DOS, or MacOS, or AmigaDOS, etc. system.
But the current viruses are a problem exactly in these systems - if
you switch to something else, they are not (at least not yet) a
problem. Not that they are impossible - they are just not a problem.
However, what to do with the -current- systems? They are going to be
with us at least for the next ten years...

2) Wasn't it you who has proven that discretionary access controls are
unable to stop the virus spread, unless they limit the sharing or the
transitivity of the information flow? They can at most slow down the
spreading of the virus, or limit to a cluster of users (if POSets are
implemented)...

3) Access controls do not prevent at least one of the virus attacks
against integrity checkers I can thin of. They are unable to stop the
slow viruses. In fact, the first slow virus was developed exactly as
an attack against monitoring programs and only afterwards it was
noticed that it is also very effective against integrity checkers...

Maybe something could be done by introducing strongly typed labeled
objects and strict distinction between code and data... I've heard
that such systems tend to be pretty clumsy and unusable...

> >Actually, that definition isn't useful.  If the "environment" includes
> >a user typing "copy", then any file is a virus.

> 	I disagree strongly.  You are right that under my definition, if
> the environment is such that all programs are always copied, then all
> sequences of symbols are viruses.  I published this result in 1985 in
> some detail, and showed a Turing machine example where all sequences are
> viruses.  You are not right that just because one user copies one
> program one time, it makes the copied program a virus.  The reason is
> that the copied program won't necessarily copy itself when you run the
> copy.  That is the reason we have the `ad infinitum' at the end of the
> linguistic version of the definition.  To qualify as a virus, given a
> proper environment, the program must ALWAYS reproduce. 

Well, consider the following example:

Program: XCOPY.EXE

Proper environment: 
	a) MS-DOS computer, which is turned on, contains the file 
XCOPY.EXE in the current directory on the current drive and has a
formatted empty diskette in drive A:
	b) user, typing XCOPY XCOPY.EXE A:

Under this "proper environment" the program XCOPY.EXE always
reproduces itself. So - is the program XCOPY.EXE a virus in this
environment?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany