54 lines
2.7 KiB
Plaintext
54 lines
2.7 KiB
Plaintext
FUNGEN2.CVP 910804
|
||
|
||
Viral operations
|
||
|
||
Although the "original" definition of computer viral programs
|
||
refers to reproduction by attaching to other programs, viri that
|
||
act in this manner having been less successful than those that
|
||
use other means. In the personal computer world, boot sector
|
||
infectors have been much more effective. (Examples in the
|
||
MS-DOS community are the BRAIN and Stoned viral programs.
|
||
Examples in the Mac realm are not as clear, but the WDEF virus
|
||
could be said to be a type of boot sector infector, as the WDEF
|
||
resource is one that is run automatically as soon as any Mac
|
||
disk is inserted, although this has changed under System 7.)
|
||
|
||
In larger systems, mini and mainframe computers, network and
|
||
mail viral programs have, so far, had the greatest impact. The
|
||
Morris/Internet/UNIX worm managed to spread and reproduce using
|
||
the facility of networked machines to submit programs to each
|
||
other. (A VMS program, WANK, used many of the same techniques.)
|
||
The CHRISTMA EXEC used mainframe mail commands, and the ability
|
||
to submit programs by mail, in order to reproduce copies which
|
||
eventually flooded the network.
|
||
|
||
Network and mail viral programs carry, in a sense, their own
|
||
payload. The reproduction of the programs themselves uses the
|
||
resources of the hosts affected, and in the cases of both the
|
||
Morris and CHRISTMA worms went so far as to deny service to
|
||
users by using all available computing or communications
|
||
resources.
|
||
|
||
Most other viral programs seem to be written "for their own
|
||
sake". A kind of electronic graffiti which writes itself on
|
||
further walls. However, even these can do damage, as with the
|
||
Stoned virus, which overwrites sections of the FAT with the
|
||
original boot sector. Some appear to be written as pranks, and
|
||
others as a kind of advertising, although the potential for
|
||
damage from even "benign" viri cannot be considered funny, and
|
||
the "advertising" viri probably don't engender much goodwill.
|
||
|
||
Relatively few viral programs carry a deliberately damaging
|
||
payload. Those which do attempt to erase infected programs or
|
||
disks are, fortunately, self limiting.
|
||
|
||
The last payload, or function, which a viral program may carry,
|
||
is some kind of intelligence to enable it to evade detection.
|
||
So far the various kinds of evasive action; self-modification,
|
||
multiple encryption and "stealth" activity; have not proven to
|
||
have any advantageous "survival" characteristics. In one sense,
|
||
this is to be regretted, as it demonstrates that the majority of
|
||
computer users are not taking the most elementary precautions to
|
||
defend against viral programs.
|
||
|
||
copyright Robert M. Slade, 1991 FUNGEN2.CVP 910804 |