🚀 go-pugleaf

celustka@sun.felk.cvut.cs (Celustkova-k336-doktorand(Richta)) writes:
>Hi boys and girls, (a day of inspiration,huh ?)
>
>Just one of those days...Two examples of good use of (possible bad)
>viruses come to my mind :
>
>1. Viruses written to improve an A-V product
>
>The logic is simple. It is better that I write virus which can do this
>or that and have prepared solution to implement in my A-V product than
>wait that such virus arises in wild and then react. That means if I
>know that today exist viruses which could be stealthy, tunneling or
>polymorfic why shouldn't I write virus which is all that and design my
>A-V product to recognize such virus before it really appears in wild.
>(Well, maybe it is not commercial, I don't know). 

Developing solutions for anticipated problems is quite reasonable; however,
the following statement isn't:

>If such virus *by
>accident* escape from my lab I already have a response and there is no
>ethical problem at all.

No problems if it "accidently escapes"...
 - unless of course you developed the virus and it "escaped by accident" 
     before you had your A-V program properly detecting it.  
 - unless you think about the fact that most people will not use *your* A-V
     program, they'll use someone else's, or maybe even no protection at all.
 - unless you consider that and you will create a lot of work for 
     other A-V writers, and damage to others in the meantime.

These problems are both technical and ethical problems that you must
confront before doing this kind of work, IMHO.  

>2. Viruses built in an A-V product (it's just an idea, don't blame me if it
>is not applicable in reality)
>
>Suppose that we have an A-V product which in regular intervals or
>randomly send a virus in system. Virus (fast infector) infects only
>programs which checksum doesn't correspond to previously calculated
>values. If no such program is found virus deletes itself or removes
>from memory. If changed program found virus activates scanner to check
>if there is any known virus.  If known virus is found message is sent
>to the user. If program is changed and no known virus is found the
>message is sent to the user to make decision.  

     This sounds fine and good for a strictly contained system owned by an
A-V writer (note the dangers mentioned in my previous comment above),
but will be *absolutely, fundamentally worthless* in an A-V product
as you describe, because you are describing a system in which the 
virus is discovered (and hopefully removed) only *after* files have been
damaged.  The point of having A-V products is to prevent the damage in 
the first place.
  
     So now my financial records which I hadn't backed up for a
month or two (or more...) are damaged: my A-V virus says the checksum has
changed.  Well, I'm glad that I caught that virus, even though it destroyed
the data file I was trying to protect! :-)

     The reason why many A-V products are TSRs is to catch viruses *as* they
enter the system, not *after* they enter the system.  Your A-V virus
seems to fall short in this regard.

>						If decision is to leave
>program as is, virus cuts itself from the program.  The whole process
>(except messages) takes place in background. There is no need for all
>A-V program (which is combination of I-checker and scanner) to be TSR,
>only virus is occasionally TSR. There is slight similarity in this
>idea with reaction of human immunity system. Anyone has ethical
>problem with her/his own immunity system ?

I understand your comparison is tongue-in-cheek, but you really are comparing
apples and oranges here.  In the immune system, a few cells can die, but
your body can still function properly.  Computer data files and programs 
are much less forgiving of a few errors.

>Cheeeers,
>
>Suzana                                                                   

Happy New Year everyone!

  --Greg
    grweiss@phoenix.princeton.edu