553 lines
21 KiB
Plaintext
553 lines
21 KiB
Plaintext
|
|
|
|
|
|
|
|
COMPUTER VIRUSES: A RATIONAL VIEW
|
|
|
|
by: Raymond M. Glath
|
|
President
|
|
|
|
RG Software Systems, Inc.
|
|
2300 Computer Ave.
|
|
Suite I-51
|
|
Willow Grove, PA 19090
|
|
(215) 659-5300
|
|
|
|
|
|
April 14, 1988
|
|
|
|
|
|
WHAT ARE COMPUTER VIRUSES?
|
|
(a.k.a. Trojan Horses, Worms, Time Bombs, Sabotage)
|
|
|
|
Any software that has been developed specifically for the purpose
|
|
of interfering with a computer's normal operations.
|
|
|
|
|
|
WHAT DO THEY DO?
|
|
|
|
There are two major categories of viruses.
|
|
|
|
Destructive viruses, that cause:
|
|
|
|
Massive destruction...
|
|
ie: Low level format of disk(s), whereby any programs
|
|
and data on the disk are not recoverable.
|
|
|
|
Partial destruction...
|
|
ie: Erasure or modification of a portion of a disk.
|
|
|
|
Selective destruction...
|
|
ie: Erasure or modification of specific files or file
|
|
groups.
|
|
|
|
Random havoc... The most insidious form of all.
|
|
ie: Randomly changing data on disk or in RAM during
|
|
normal program applications, or changing keystroke
|
|
values, or data from other input/output devices,
|
|
with the result being an inordinate amount of time
|
|
to discover and repair the problem, and damage
|
|
that may never be known about.
|
|
|
|
Non-Destructive viruses, intended to cause attention to the
|
|
author or to harass the end user.
|
|
|
|
a. Annoyances...
|
|
ie: Displaying a message, changing display colors,
|
|
changing keystroke values such as reversing the
|
|
effect of the Shift and Unshift keys, etc.
|
|
|
|
|
|
WHAT IS THE IMPACT OF A VIRUS ATTACK BEYOND THE OBVIOUS?
|
|
|
|
Lost productivity time !!!
|
|
|
|
In addition to the time and skills required to re-construct
|
|
damaged data files, viruses can waste a lot of time in many other
|
|
ways.
|
|
|
|
With either type of virus, the person subjected to the attack as
|
|
well as many support personnel from the attacked site and from
|
|
various suppliers, will sacrifice many hours of otherwise
|
|
productive time:
|
|
|
|
Time to determine the cause of the attack.
|
|
The removal of the virus code from the system.
|
|
The recovery of lost data.
|
|
The detective work required to locate the original source of
|
|
the virus code.
|
|
|
|
Then, there's the management time required to determine how
|
|
this will be prevented in the future.
|
|
|
|
|
|
WHO DEVELOPS VIRUSES?
|
|
|
|
This individual, regardless of his specific motivation, will most
|
|
probably want to see some form of publicity resulting from his
|
|
handiwork. Anywhere from a "Gotcha" message appearing on the
|
|
computer's screen after the attack, to major press coverage of
|
|
that particular virus' spread and wake of damage.
|
|
|
|
Some of the reasons for someone to spend their time developing a
|
|
virus program are:
|
|
|
|
A practical joke.
|
|
A personal vendetta against a company or another person.
|
|
ie: a disgruntled employee.
|
|
The computer-literate political terrorist.
|
|
Someone trying to gain publicity for some cause or
|
|
product.
|
|
The bored, un-noticed "genius," who wants attention.
|
|
The mentally disturbed sociopath.
|
|
|
|
|
|
IS THE THREAT REAL?
|
|
|
|
Yes, however thus far the destructive ones have primarily been in
|
|
the Academic environment. Several attacks have been documented by
|
|
the press, and, from first hand experience, I can attest to the
|
|
fact that those reported do exist. We have seen some of them and
|
|
successfully tested our Disk Watcher product against them.
|
|
|
|
Reputable individuals have reported additional viruses to us, but
|
|
these have not reached the scale of distribution achieved by the
|
|
now infamous "Lehigh," "Brain," "Israeli," and "MacIntosh"
|
|
viruses.
|
|
|
|
We do expect the situation to worsen due to the attention it's
|
|
received. Taking simple lessons from history, a new phenomenon,
|
|
once given attention, will be replicated by individuals who
|
|
otherwise have no opportunity for personal attention.
|
|
|
|
Now that there are products for defense from viruses, the virus
|
|
writers have been given a challenge; and for those people who
|
|
have always wanted to anonymously strike out at someone but
|
|
didn't know of a method to do so, the coverage has provided a
|
|
"How To" guide.
|
|
|
|
|
|
HOW DOES A VIRUS GET INTO YOUR COMPUTER SYSTEM?
|
|
|
|
A virus may be entered into a system by an unsuspecting user who
|
|
has been duped by the virus creator (Covert entry), or it may be
|
|
entered directly by the creator. (Overt entry.)
|
|
|
|
Examples of Covert entry of a virus into a computer
|
|
system.
|
|
|
|
A "carrier" program such as a "pirate" copy of a
|
|
commercial package that has been tampered with, is
|
|
utilized by the un-suspecting user, and thus
|
|
enters the virus code into the system.
|
|
|
|
Other types of carriers could be programs from
|
|
Bulletin Boards that have been either tampered
|
|
with or specifically designed as viruses, but
|
|
disguised as useful programs. There has even been
|
|
a destructive virus disguised as a "virus
|
|
protection" program on a BBS.
|
|
|
|
The user unknowingly acquires an "infected" disk
|
|
and uses it to boot the system.
|
|
|
|
The virus has been hidden in the system files and
|
|
then hides itself in system RAM or other system
|
|
files in order to reproduce, and later, attack.
|
|
|
|
|
|
Examples of Overt entry into a computer system.
|
|
|
|
An individual bent on harassing the user or
|
|
sabotaging the computer system, modifies an
|
|
existing program on that computer or copies a
|
|
virus program onto someone's disk during their
|
|
absence from their work station.
|
|
|
|
|
|
HOW DOES A VIRUS SPREAD?
|
|
|
|
A virus may reproduce itself by delaying its attack until it has
|
|
made copies of itself onto other disks (Active reproduction,) or
|
|
it may depend entirely on unsuspecting users to make copies of it
|
|
and pass them around (Passive reproduction). It may also use a
|
|
combination of these methods.
|
|
|
|
|
|
WHAT TRIGGERS THE VIRUS ATTACK?
|
|
|
|
Attacks begin upon the occurrence of a certain event, such as:
|
|
|
|
On a certain date.
|
|
At a certain time of day.
|
|
When a certain job is run.
|
|
After "cloning" itself n times.
|
|
When a certain combination of keystrokes occurs.
|
|
When the computer is restarted.
|
|
|
|
One way or another, the virus code must put itself into a
|
|
position to either start itself when the computer is turned on,
|
|
or when a specific program is run.
|
|
|
|
|
|
HOW DOES ONE DISTINGUISH A VIRUS FROM A "BUG" IN A PROGRAM OR A
|
|
HARDWARE MALFUNCTION?
|
|
|
|
This can be a tough one. With the publicity surrounding viruses,
|
|
many people are ready to believe that any strange occurrence
|
|
while computing may have been caused by a virus, when it could
|
|
simply be an operational error, hardware component failure, or a
|
|
software "bug."
|
|
|
|
While most commercial software developers test their products
|
|
exhaustively, there is always the possibility that some
|
|
combination of hardware; mix of installed TSR's; user actions; or
|
|
slight incompatibilities with "compatible" or "clone" machines or
|
|
components; can cause a problem to surface.
|
|
|
|
We need to remember some key points here:
|
|
|
|
1. Examine the probabilities of your having contacted a virus.
|
|
|
|
2. Don't just assume that you've been attacked by a virus and
|
|
abandon your normal troubleshooting techniques or those
|
|
recommended by the product manufacturers.
|
|
|
|
3. When in doubt contact your supplier or the manufacturer for
|
|
tech support.
|
|
|
|
4. Having an effective "Virus Protection" system installed may
|
|
help you determine the cause of the problem.
|
|
|
|
|
|
HOW CAN YOU AVOID COMING IN CONTACT WITH VIRUSES?
|
|
|
|
1. Know and be comfortable with the source of your software
|
|
acquisitions.
|
|
|
|
If you use a BBS (Bulletin Board,) verify that the BBS is
|
|
reputable and that it has satisfactory procedures in
|
|
place to check out its software as well as provisions
|
|
to prevent that software from being modified.
|
|
|
|
Do not use illegitimate copies of software.
|
|
|
|
Be sure that the developer of the software you're using
|
|
is a professional. Note that many "Shareware" products
|
|
are professionally produced. You needn't stop using
|
|
them. Just be sure that you have a legitimate copy of
|
|
the program if you choose to use these products.
|
|
|
|
Don't accept free software that looks too good to be
|
|
true.
|
|
|
|
2. Install a professional virus protection package on your
|
|
computer that will alert you to any strange goings on.
|
|
|
|
3. Provide physical security for your computers.
|
|
ie: Locked rooms; locks on the computers; etc.
|
|
|
|
4. If you're unsure of a disk or a specific program, run it in an
|
|
isolated environment where it will not be able to do any
|
|
damage.
|
|
|
|
ie: Run the program on a "diskette only" computer, and keep
|
|
a write-protect tab on your "System Disk."
|
|
|
|
Run the program with "Virus Protection" software
|
|
installed.
|
|
|
|
5. Establish and maintain a sound Back-Up policy.
|
|
|
|
DO NOT USE ONLY ONE SET OF BACK-UP DISKS THAT ARE
|
|
CONTINUOUSLY WRITTEN OVER.
|
|
|
|
Use at least three complete sets of back-up disks that are
|
|
rotated in a regular cycle.
|
|
|
|
|
|
DO YOU NEED SOME FORM OF PROTECTION FROM VIRUSES?
|
|
|
|
It couldn't hurt !!! You do lock the door to your home
|
|
when you go out, right?
|
|
|
|
Plan in advance the methods you'll use to ward off virus attacks.
|
|
It's a far more effective use of management time to establish
|
|
preventative measures in a calm environment instead of making
|
|
panic decisions after a virus attack has occurred.
|
|
|
|
|
|
IS THERE ANY SOLUTION AVAILABLE THAT'S ABSOLUTELY FOOLPROOF?
|
|
|
|
No !!!
|
|
|
|
Any security system can be broken by someone dedicated and
|
|
knowledgeable enough to put forth the effort to break the system.
|
|
|
|
|
|
WHAT LEVEL OF PROTECTION DO YOU NEED?
|
|
|
|
This of course depends on many factors, such as:
|
|
|
|
1. The sensitivity of the data on your PC's.
|
|
2. The number of personnel having access to your PC's.
|
|
3. The security awareness of computing personnel.
|
|
4. The skill levels of computing personnel.
|
|
5. Attitudes, ethics, and morale of computing personnel.
|
|
|
|
A key point of consideration is the threshold for the amount of
|
|
security you can use versus its impact on normal productivity.
|
|
|
|
Human nature must also be considered. If you were to install 10
|
|
locks on your front door and it cost you 5 minutes each time you
|
|
enter your home, I'll bet that the first time that it's
|
|
raining... and you have 3 bags of groceries... you'll go back to
|
|
using the one lock you always used.
|
|
|
|
|
|
HOW CAN A SOFTWARE PRODUCT PROTECT AGAINST VIRUSES?
|
|
|
|
There are several approaches that have been developed.
|
|
|
|
One form is an "inoculation" or "signature" process, whereby the
|
|
key files on a disk are marked in a special way and periodically
|
|
checked to see if the files have been changed. Depending on the
|
|
way in which this is implemented, this method can actually interfere
|
|
with programs that have built-in integrity checks.
|
|
|
|
Another method is to "Write Protect" specific key areas of the
|
|
disk so that no software is permitted to change the data in those
|
|
places.
|
|
|
|
We at RG Software Systems, Inc. believe that preventative
|
|
measures are the most effective. The Disk Watcher system provides
|
|
multiple lines of defense: A "Batch" type program automatically
|
|
checks all active disk drives for the presence of certain hidden
|
|
virus characteristics when the computer is started, and a TSR
|
|
(Terminate and Stay Resident) program monitors ongoing disk
|
|
activity throughout all processing. The "Batch" program
|
|
can also be run on demand at any time to check the disk in a
|
|
specific drive.
|
|
|
|
The TSR program, in addition to its other "Disaster
|
|
Prevention" features, contains a series of proprietary algorithms
|
|
that detect the behavior characteristics of a myriad of virus
|
|
programs, and yet produce minimal overhead in processing time
|
|
and "false alarm" reports. Disk Watcher is uniquely able to tell
|
|
the difference between legitimate IO activity and the IO activity
|
|
of a virus program.
|
|
|
|
When an action occurs indicative of a virus attempting to reproduce itself;
|
|
alter another program; set itself up to be automatically run the next
|
|
time the system is started; or attempting to perform a massively damaging
|
|
act; Disk Watcher will automatically "pop up." The user will then have
|
|
several options, one of which is to immediately stop the computer before any
|
|
damage can be done. Detection occurs BEFORE the action takes place.
|
|
|
|
Other options allow the user to tell Disk Watcher to continue the
|
|
application program and remember that this program is permitted
|
|
to perform the action that triggered the "pop up."
|
|
|
|
Some very important features of Disk Watcher are:
|
|
|
|
Whenever the user selects the "Stop the Computer" option, the
|
|
Application screen image and the Disk Watcher screen image will be
|
|
sent to the system printer before the machine is stopped, so that
|
|
an effective analysis of the problem may be done.
|
|
|
|
Disk Watcher performs an integrity check on itself whenever it runs.
|
|
|
|
The "Destructive" viruses that produce "selective" file
|
|
destruction or "Random Havoc" are the most difficult to defend
|
|
against. The best measures are to prevent them from getting into
|
|
the system in the first place.
|
|
|
|
|
|
WHICH VIRUS PROTECTION PACKAGE IS RIGHT FOR YOU?
|
|
|
|
Since the first reports of virus attacks appeared in the press, a
|
|
number of "Virus Prevention" products have quickly appeared on
|
|
the market, produced by companies wishing to take advantage of a
|
|
unique market opportunity. This is to be expected. RG Software
|
|
Systems, Inc. is one of them with our Disk Watcher product.
|
|
|
|
It should be pointed out, however, that as of this writing, only
|
|
a little over 2 months has transpired since the first major
|
|
stories appeared.
|
|
|
|
Those companies that have had to build a product from scratch
|
|
during this limited amount of time have had to design the
|
|
defensive system, write the program code, write the user's
|
|
manual, design the packaging, "Alpha" test, "Beta" test, and
|
|
bring their product through manufacturing to market. A monumental
|
|
task in a miraculously short period of time.
|
|
|
|
Companies that have had products on the market that include virus
|
|
protection, or products that were enhanced to include virus
|
|
protection, such as Disk Watcher, have had extra time and field
|
|
experience for the stabilization of their products.
|
|
|
|
As a professional in this industry, I sincerely hope that the
|
|
quickly developed products are stable in their released form.
|
|
|
|
The evaluation points listed below are usually applied as a
|
|
standard for all types of software products:
|
|
|
|
|
|
*Price
|
|
*Performance
|
|
*Ease of Use
|
|
*Ease of Learning
|
|
*Ease of Installation
|
|
*Documentation
|
|
*Copy Protection
|
|
*Support
|
|
|
|
A "Virus Protection" package, like a security system for your
|
|
home, requires a close scrutiny. You want the system to do the
|
|
job unobtrusively, and yet be effective.
|
|
|
|
TWELVE SPECIAL CONSIDERATIONS FOR VIRUS PROTECTION PACKAGES:
|
|
|
|
1. Amount of impact the package may have on your computer's
|
|
performance.
|
|
|
|
If the package is "RAM Resident," does it noticeably slow
|
|
down your machine's operations?
|
|
If so, with what type of operation? Are program start-
|
|
ups slowed? Are database operations slowed?
|
|
|
|
|
|
2. Level of dependency on operator intervention.
|
|
|
|
Does the package require the operator to perform certain
|
|
tasks on a regular basis in order for it to be
|
|
effective? (Such as only checking for virus conditions
|
|
on command.)
|
|
Does the package require much time to install and keep
|
|
operational? ie: Each time any new software is
|
|
installed on the system, must the protection package be
|
|
used?
|
|
|
|
3. Impact on productivity... Annoyance level.
|
|
|
|
Does the package periodically stop processing and/or require
|
|
the operator to take some action. If so, does the
|
|
package have any capability to learn its environment
|
|
and stop its interference?
|
|
|
|
4. False alarms.
|
|
|
|
How does the package handle situations that appear to be
|
|
viruses but are legitimate actions made by legitimate
|
|
programs?
|
|
Are there situations where legitimate jobs will have to be
|
|
re-run or the system re-booted because of the
|
|
protection package? How frequently will this occur?
|
|
How much additional end-user support will the package
|
|
require?
|
|
|
|
5. The probability that the package will remain in use?
|
|
|
|
Will there be any interference or usage requirements that
|
|
will discourage the user from keeping the package
|
|
active? (It won't be effective if they quickly desire
|
|
to de-install it and perhaps only pretend they are
|
|
using it when management is present.)
|
|
|
|
6. Level of effectiveness it provides in combatting viruses.
|
|
|
|
Will it be effective against viruses produced by someone
|
|
with an experience level of:
|
|
|
|
Level 1 - "Typical End User"? (Basic knowledge of using
|
|
applications and DOS commands.)
|
|
Level 2 - "Power User"? (Knowledge of DOS Command
|
|
processor, Hardware functions, BASIC
|
|
programming, etc.)
|
|
Level 3 - "Applications Programmer"? (Knowledge of
|
|
programming languages and DOS service calls.)
|
|
Level 4 - "Systems Engineer"? (Knowledge of DOS and
|
|
Hardware internal functions.)
|
|
Level 5 - "Computer Science Professor that develops
|
|
viruses for research purposes"?
|
|
|
|
Which types of intrusion will it be effective against?
|
|
|
|
"Covert Entry"?
|
|
"Overt Entry"?
|
|
|
|
Does it detect a virus attempting to spread or "clone"
|
|
itself?
|
|
|
|
Does it detect a virus attempting to place itself into a
|
|
position to be automatically run?
|
|
|
|
If a virus gets into the computer, which types of virus
|
|
damage will it detect?
|
|
|
|
"Massive Destruction"
|
|
"Partial Destruction"
|
|
"Selective Destruction"
|
|
"Random Havoc Destruction"
|
|
"Annoyance"
|
|
|
|
Does the software detect a virus before or after it has
|
|
infected a program or made its attack?
|
|
|
|
Does the publisher claim total protection from all viruses?
|
|
|
|
|
|
7. Does the software provide any assistance for "post mortem"
|
|
analysis of suspected problems?
|
|
|
|
ie: If a virus symptom is detected and the computer is
|
|
brought to a halt, is there any supporting information
|
|
for analyzing the problem other than the operator's
|
|
recall of events?
|
|
|
|
|
|
8. Impact on your machine's resources.
|
|
|
|
How much RAM is used?
|
|
Is any special hardware required?
|
|
|
|
|
|
9. Is the product compatible with:
|
|
|
|
Your hardware configuration.
|
|
Your Operating system version.
|
|
Your network.
|
|
Other software that you use, especially TSR's.
|
|
|
|
10. Can the package be used by current computing personnel
|
|
without substantial training?
|
|
|
|
What type of computing experience is required to install the
|
|
package?
|
|
|
|
11. Background of the publisher.
|
|
|
|
References... Who is using this or other products from
|
|
this publisher? How is this company perceived by its
|
|
customers? The press?
|
|
|
|
How long has the publisher been in business?
|
|
|
|
Was the product Beta Tested?... By valid, well-known
|
|
organizations or by friends of the company's owner?
|
|
|
|
Was the product tested against any known viruses?
|
|
Successfully?
|
|
|
|
What about on-going support? In what form? At what cost?
|
|
|
|
Does the company plan to upgrade its product periodically?
|
|
|
|
What is the upgrade policy? Expected costs?
|
|
|
|
12. Does the package provide any other useful benefits to the
|
|
user besides virus protection?
|
|
|
|
|