85 lines
4.2 KiB
Plaintext
85 lines
4.2 KiB
Plaintext
|
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ
|
|||
|
|
<20> THE VIRUS INFORMER <20> FACT: Each day of the year a
|
|||
|
|
<20> your weekly virus newsletter <20> new virus is introduced into
|
|||
|
|
<20> by Mark E. Bishop edited by <20> the computer industry.
|
|||
|
|
<20> Alan Bechtold <20>
|
|||
|
|
<20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
CHAPTER 4: 'The Engine that Kills! A Mutating Menance!'
|
|||
|
|
Dark Avenger Mutation Engine No Threat to Protected PCs
|
|||
|
|
|
|||
|
|
|
|||
|
|
Santa Clara, CA -- May 11,1992 -- McAfee Associates confirmed today that
|
|||
|
|
users of its suite of VIRUSCAN anti-virus products have nothing to fear from
|
|||
|
|
the new generation of mutating or polymorphic viruses.
|
|||
|
|
|
|||
|
|
McAfee Associates, the nation's leading anti-virus software company, has
|
|||
|
|
been swamped with calls from concerned corporate PC users worried about the
|
|||
|
|
threat of the so-called Dark Avenger Mutation Engine.
|
|||
|
|
|
|||
|
|
"Actually, we cracked this engine some months ago and have been shipping
|
|||
|
|
product capable of detecting the Mutation Engine since March," said William
|
|||
|
|
S. McKiernan, vice president, McAfee Associates.
|
|||
|
|
|
|||
|
|
The Dark Avenger Mutation Engine, which first appeared on European bulletin
|
|||
|
|
boards a few months ago, is a new kind of virus threat. In the past, viruses
|
|||
|
|
such as the Jerusalem or the recent Michelangelo strain had distinct, single
|
|||
|
|
identities that made them relatively easy to detect and control.
|
|||
|
|
|
|||
|
|
"The Mutation Engine, however, can be used by virtually anyone to create a
|
|||
|
|
mutating virus which is very difficult to detect," said McKiernan. "The fact
|
|||
|
|
that it is widely available on bulletin boards makes it that much more
|
|||
|
|
frightening."
|
|||
|
|
|
|||
|
|
The Mutation Engine uses encryption techniques to avoid detection. Before
|
|||
|
|
a virus can become active it needs to decrypt itself. Ordinarily the code
|
|||
|
|
used for this decryption remains constant, allowing the use of standard byte
|
|||
|
|
matching techniques for detection.
|
|||
|
|
|
|||
|
|
The Mutation Engine, however, uses a special algorithm to generate a
|
|||
|
|
completely variable decryption routine each time. "The result is that no
|
|||
|
|
three bytes remain constant from one sample to the next," said Igor Grebert,
|
|||
|
|
senior programmer at McAfee Associates. "This makes detection using
|
|||
|
|
conventional string matching techniques impossible."
|
|||
|
|
|
|||
|
|
VIRUSCAN, however, has no such problem. According to McKiernan, the
|
|||
|
|
downloadable shareware contains a new generation of virus detection algorithm
|
|||
|
|
capable of statistical and numerical analysis.
|
|||
|
|
|
|||
|
|
It detects the Mutation Engine by "sensing" its presence rather than by
|
|||
|
|
attempting to actually spot it in a byte-for-byte string comparison.
|
|||
|
|
VIRUSCAN consistently detected all iterations of the Mutation Engine in tests
|
|||
|
|
done at McAfee, McKiernan said.
|
|||
|
|
|
|||
|
|
Santa Clara-based McAfee Associates first received reports of the Mutation
|
|||
|
|
Engine early this year. It is believed that the Engine is a product of the
|
|||
|
|
Bulgarian virus creator responsible for the original conventional Dark
|
|||
|
|
Avenger virus.
|
|||
|
|
|
|||
|
|
Though some viruses using the Mutation Engine have already appeared in the
|
|||
|
|
U.S., the engine is not expected to present a widespread problem for some
|
|||
|
|
time, McKiernan said. Typically the McAfee "early warning" network
|
|||
|
|
identifies new viruses months before they are a threat to the U.S. market.
|
|||
|
|
|
|||
|
|
Nevertheless, the PC world has reacted emotionally to the presence of the
|
|||
|
|
Mutation Engine. "It is clear that the game is forever changed," said
|
|||
|
|
columnist Steve Gibson in a recent issue of the computer journal InfoWorld.
|
|||
|
|
"The sophistication of the Mutation Engine is amazing and staggering."
|
|||
|
|
|
|||
|
|
The presence of the Mutation Engine on bulletin boards may be more of a
|
|||
|
|
threat than the virus itself. "You no longer have to be particularly clever
|
|||
|
|
or experienced to use it," said McKiernan. "Now if you have a modem you can
|
|||
|
|
be in the virus business overnight and the potential for proliferation is a
|
|||
|
|
sobering thought."
|
|||
|
|
|
|||
|
|
McKiernan said that conventional viruses are turning up at a rate of 10 to
|
|||
|
|
20 per week. "We expect that the Mutation Engine will increase this problem
|
|||
|
|
exponentially for those with unprotected systems," he said.
|
|||
|
|
|
|||
|
|
|
|||
|
|
- end -
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|