441 lines
12 KiB
Plaintext
441 lines
12 KiB
Plaintext
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
An Abbreviated Bibliography for
|
||
|
||
|
||
|
||
Computer Viruses
|
||
|
||
and
|
||
|
||
Related Security Issues
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Revised
|
||
April 18, 1990
|
||
|
||
|
||
|
||
|
||
|
||
|
||
NIST The National Institute of Standards and Technology
|
||
|
||
ABSTRACT
|
||
|
||
This document provides a list of suggested
|
||
readings about computer viruses and other
|
||
related threats to computer security. The
|
||
primary intended audience is management and
|
||
those who need access to the basic facts,
|
||
however readings are included that are also
|
||
suitable for technically-oriented individuals
|
||
who wish to learn more about the nature of
|
||
computer viruses and techniques that can be
|
||
used to reduce their potential threat. The
|
||
suggested readings range from general discus-
|
||
sions on the nature of viruses and related
|
||
threats, to technical articles which explore
|
||
the details of various viruses, the mechan-
|
||
isms they attack, and methods for controlling
|
||
these threats to computer security. Other
|
||
articles are included that deal with more
|
||
general aspects of computer security, but
|
||
which have some bearing on the problem.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
The National Institute of Standards and Technology
|
||
|
||
|
||
The National Institute of Standards and Tech-
|
||
nology (NIST) has responsibility within the
|
||
Federal Government for computer science and
|
||
technology activities. The programs of the
|
||
NIST National Computer Systems Laboratory
|
||
(NCSL) are designed to provide ADP standards,
|
||
guidelines, and technical advisory services
|
||
to improve the effectiveness of computer
|
||
utilization and security, and to perform
|
||
appropriate research and development efforts
|
||
as foundation for such activities and prog-
|
||
rams. Copies of this paper as well as other
|
||
publications may be obtained from the follow-
|
||
ing address:
|
||
|
||
National Institute of Standards and Technology
|
||
|
||
Computer Security Management and Evaluation Group
|
||
|
||
Computer Security Division
|
||
A216, Technology
|
||
Gaithersburg, MD 20899
|
||
|
||
|
||
BASIC TERMS
|
||
|
||
|
||
The following list provides general definitions for basic terms
|
||
used throughout the literature. Some of the terms are relatively
|
||
new and their definitions are not widely agreed upon, thus they
|
||
may be used differently elsewhere.
|
||
|
||
Computer Virus: A name for
|
||
software written to cause some
|
||
form(s) of damage to a comput-
|
||
ing system. Computer viruses
|
||
copy their instructions to
|
||
other programs; the other pro-
|
||
grams may continue to copy the
|
||
instructions to more programs.
|
||
Depending on the author's mo-
|
||
tives, the instructions may
|
||
cause many different forms of
|
||
damage, such as deleting files
|
||
or crashing the system. Com-
|
||
puter viruses are so named be-
|
||
cause of their functional sim-
|
||
ilarity to biological viruses,
|
||
in that they can spread rapid-
|
||
ly throughout a host system.
|
||
The term is sometimes used in
|
||
a general sense to cover many
|
||
different types of harmful
|
||
software, such as Trojan hor-
|
||
ses or network worms.
|
||
|
||
Network Worm: A name for a
|
||
program or command file that
|
||
uses a computer network as a
|
||
means for causing damage to
|
||
computing systems. From one
|
||
system, a network worm may at-
|
||
tack a second system by first
|
||
establishing a network connec-
|
||
tion with the second system.
|
||
The worm may then spread to
|
||
other systems in the same man-
|
||
ner. A network worm is simil-
|
||
ar to a computer virus in that
|
||
its instructions can cause
|
||
many different forms of
|
||
damage. However, a worm is a
|
||
self-contained program that
|
||
spreads to other systems,
|
||
whereas a virus spreads to
|
||
programs within the same sys-
|
||
tem (a worm could do that as
|
||
well).
|
||
|
||
Malicious Software: A general
|
||
term for computer viruses,
|
||
network worms, Trojan horses,
|
||
and other software designed to
|
||
deliberately circumvent
|
||
established security
|
||
mechanisms or codes of ethical
|
||
conduct or both, to adversely
|
||
affect the confidentiality,
|
||
integrity, or availability of
|
||
computer systems and networks.
|
||
|
||
Unauthorized User(s): A user
|
||
who knowingly uses a system in
|
||
a non-legitimate manner. The
|
||
user may or may not be an
|
||
authorized user of the system.
|
||
The actions of the user
|
||
violate established security
|
||
mechanisms or policies, or
|
||
codes of ethical conduct, or
|
||
both.
|
||
|
||
Trojan Horse: A name for a
|
||
program that disguises its
|
||
harmful intent by purporting
|
||
to accomplish some harmless
|
||
and possibly useful function.
|
||
For example, a Trojan horse
|
||
program could be advertised as
|
||
a calculator, but it may
|
||
actually perform some other
|
||
function when executed such as
|
||
modifying files.
|
||
|
||
Back Door: An entry point to
|
||
a program or system that is
|
||
hidden or disguised, perhaps
|
||
created by the software's
|
||
author for maintenance or
|
||
other convenience reasons.
|
||
For example, an operating sys-
|
||
tem's password mechanism may
|
||
contain a back door such that
|
||
a certain sequence of control
|
||
characters may permit
|
||
|
||
access to the system manager
|
||
account. Once a back door be-
|
||
comes known, it can be used by
|
||
unauthorized users or
|
||
malicious software to gain
|
||
entry and cause damage.
|
||
|
||
Time Bomb, Logic Bomb:
|
||
Mechanisms used by some
|
||
examples of malicious software
|
||
to cause damage after a
|
||
predetermined event. In the
|
||
case of a time bomb, the event
|
||
is a certain system date,
|
||
whereas for a logic bomb, the
|
||
event may vary. For example,
|
||
a computer virus may infect
|
||
other programs, yet cause no
|
||
other immediate damage. If
|
||
the virus contains a time bomb
|
||
mechanism, the infected
|
||
programs would routinely check
|
||
the system date or time and
|
||
compare it with a preset
|
||
value. When the actual date
|
||
or time matches the preset
|
||
value, the destructive
|
||
aspects of the virus code
|
||
would be executed. If the
|
||
virus contains a logic bomb,
|
||
the triggering event may be a
|
||
certain sequence of key
|
||
strokes, or the value of a
|
||
counter.
|
||
|
||
Anti-Virus Software: Software
|
||
designed to detect the occur-
|
||
rence of a virus. Sold as
|
||
commercial products and as
|
||
shareware, anti-virus programs
|
||
can scan software for known
|
||
viruses or monitor a system's
|
||
behavior and raise alarms when
|
||
activity occurs that is typi-
|
||
cal of certain types of
|
||
computer viruses.
|
||
|
||
Isolated System: A system
|
||
that has been specially
|
||
configured for determining
|
||
whether applicable programs
|
||
contain viruses or other types
|
||
of malicious software. The
|
||
system is generally
|
||
disconnected from any computer
|
||
networks or linked systems,
|
||
and contains test data or data
|
||
that can be restored if
|
||
damaged. The system may use
|
||
anti-virus or other monitoring
|
||
software to detect the
|
||
presence of malicious
|
||
software.
|
||
|
||
Computer Security: The tech-
|
||
nological safeguards and
|
||
management procedures that can
|
||
be applied to computer
|
||
hardware, programs, data, and
|
||
facilities to assure the
|
||
availability, integrity, and
|
||
confidentiality of computer
|
||
based resources and to assure
|
||
that intended functions are
|
||
performed without harmful side
|
||
effects.
|
||
SUGGESTED READINGS
|
||
|
||
|
||
Adler, Marc, "Infection Protection: Antivirus Software" PC
|
||
Magazine, April 25, 1989.
|
||
|
||
Arkin, Stanley et al., "Prevention and Prosecution of High-Tech
|
||
Crime," Matthew Bender Press Co., 1989.
|
||
|
||
Brenner, Aaron, "LAN Security", LAN Magazine, August 1989.
|
||
|
||
Bunzel, Rick, "Flu Season," Connect, Summer 1988.
|
||
|
||
Cohen, Fred, "Computer Viruses," Proceedings of the 7th DoD/NBS
|
||
Computer Security Conference, 1984.
|
||
|
||
Computer Viruses - Proceedings of an Invitational Symposium, Oct
|
||
10/11, 1988, Deloitte, Haskins, and Sells, 1989.
|
||
|
||
Denning, Peter J., "Computer Viruses," American Scientist, Volume
|
||
76 May-June 1988.
|
||
|
||
Denning, Peter J., "The Internet Worm," American Scientist,
|
||
Volume 77, March-April 1989.
|
||
|
||
Dewdney, A. K., "Of Worms, Viruses and Core Wars," Scientific
|
||
American, March 1989.
|
||
|
||
Dvorak, John, "Virus Wars: A Serious Warning," PC Magazine, Feb
|
||
29, 1988.
|
||
|
||
Federal Information Processing Standards Publication 112,
|
||
Password Usage, National Bureau of Standards, May 1985.
|
||
|
||
Fiedler, David and Hunter, Bruce M., "Unix System Administra-
|
||
tion," Hayden Books, 1987.
|
||
|
||
Fites, P.F., M.P.J. Kratz, and A.F. Brebner, "Control and
|
||
Security of Computer Information Systems," Computer Science
|
||
Press, 1989.
|
||
|
||
Fitzgerald, Jerry, "Business Data Communications: Basic Concepts,
|
||
Security, and Design," John Wiley and Sons, Inc., 1984.
|
||
|
||
Gasser, Morrie, "Building a Secure Computer System," Van Nostrand
|
||
Reinhold, New York, 1988.
|
||
|
||
Grampp, F. T. and Morris, R. H., "UNIX Operating System
|
||
Security," AT&T Bell Laboratories Technical Journal, October
|
||
1984.
|
||
|
||
Greenberg, Ross, "Know Thy Viral Enemy," Byte Magazine, June
|
||
1989.
|
||
|
||
Hatkin, Martha E, and Robert B. J. Warner, "Smart Card Technol-
|
||
ogy: New Methods for Computer Access Control," NIST Special
|
||
Publication 500-157, National Institute of Standards and Tech-
|
||
nology, September 1988.
|
||
|
||
Hoffman, Lance, "Modern Methods for Computer Security and
|
||
Privacy," Prentice-Hall, 1977.
|
||
|
||
Honan, Patrick, "Avoiding Virus Hysteria," Personal Computing,
|
||
May 1989.
|
||
|
||
Kurzban, Stanley A., "Viruses and Worms--What Can You Do?," ACM
|
||
SIG Security, Audit, & Control, Volume 7 Number 1, Spring 1989.
|
||
|
||
Lipner, S. and S. Kalman, "Computer Law,", Merrill Publishing
|
||
Co., 1989.
|
||
|
||
McAfee, John, "The Virus Cure," Datamation, Volume 35, Number 4,
|
||
February 15, 1989.
|
||
|
||
McLellan, Vin, "Computer Systems Under Siege," The New York
|
||
Times, January 17, 1988.
|
||
|
||
Murray, William H., "Epidemiology Application to Computer
|
||
Viruses," Computers and Security, Volume 7, Number 2, April 1988.
|
||
|
||
Parker, T., "Public domain software review: Trojans revisited,
|
||
CROBOTS, and ATC," Computer Language, April 1987.
|
||
|
||
Pfleeger, Charles, P., "Security in Computing," Prentice-Hall,
|
||
1989.
|
||
|
||
Pozzo, Maria M., and Terence E. Gray, "An Approach to Containing
|
||
Computer Viruses," Computers and Security, Volume 6, Number 4,
|
||
August 1987.
|
||
|
||
Rubenking, Neil, "Infection Protection," PC Magazine, April 25,
|
||
1989.
|
||
|
||
Schnaidt, Patricia, "Fasten Your Safety Belt," LAN Magazine,
|
||
October 1987.
|
||
|
||
Shoch, John F., and Jon A. Hupp, "The Worm Programs--Early
|
||
Experience with a Distributed Computation," Communications of the
|
||
ACM, Volume 25, Number 3, March 1982.
|
||
|
||
Spafford, Eugene H., "The Internet Worm Program: An Analysis,"
|
||
Purdue Technical Report CSD-TR-823, November 28, 1988.
|
||
|
||
Spafford, Eugene H., Kathleen A. Heaphy, and David J. Ferbrache,
|
||
"Computer Viruses - Dealing with Electronic Vandalism and
|
||
Programmed Threats," ADAPSO Software Industry Division Report,
|
||
1989.
|
||
|
||
Stefanac, Suzanne, "Mad MACS," Macworld, November 1988.
|
||
|
||
Steinauer, Dennis D., NBS Special Publication 500-120, Security
|
||
of Personal Computer Systems: A Management Guide, National Bureau
|
||
of Standards, January 1985.
|
||
|
||
Stohl, Clifford, "The Cuckoo's Egg," Doubleday, 1989.
|
||
|
||
Thompson, Ken, "Reflections on Trusting Trust (Deliberate
|
||
Software Bugs)," Communications of the ACM, Vol 27, August 1984.
|
||
|
||
Tinto, Mario, "Computer Viruses: Prevention, Detection, and
|
||
Treatment," National Computer Security Center C1 Tech. Rpt. C1-
|
||
001-89, June 1989.
|
||
|
||
Wack, John P., and Lisa J. Carnahan, "Computer Viruses and
|
||
Related Threats: A Management Guide," NIST Special Publication
|
||
500-166, National Institute of Standards and Technology, August
|
||
1989.
|
||
|
||
White, Steve R., David M. Chess, and Chengi Jimmy Kuo, "Coping
|
||
with Computer Viruses and Related Problems," Research Report
|
||
Number RC 14405, International Business Machines Corporation,
|
||
Yorktown Heights, New York, 1989, adapted and distributed as
|
||
"Coping with Computer Viruses and Related Problems," Form G320-
|
||
9913, International Business Machines Corporation, September
|
||
1989.
|
||
|
||
Witten, I. H., "Computer (In)security: infiltrating open sys-
|
||
tems," Abacus (USA), Summer 1987.
|
||
|
||
ELECTRONIC FORUMS:
|
||
|
||
VIRUS-L is a moderated mail forum for discussing computer virus
|
||
issues; comp.virus is a non-digested Usenet counterpart. Infor-
|
||
mation on accessing anti-virus, documentation, and back-issue
|
||
archives is distributed periodically on the list. Send subscrip-
|
||
tion requests to: LISTSERV@LEHIIBM1.BITNET. In the body of the
|
||
message, enter "SUB VIRUS-L your name"
|
||
|
||
RISKS-FORUM Digest is a moderated mail forum for discussing
|
||
computer security issues as well as risks associated with other
|
||
forms of technology. Send subscription requests to:
|
||
RISKS-Request@CSL.SRI.COM.
|
||
|
||
The NIST Security Bulletin Board is a repository of computer
|
||
security information open to the general public. Users can
|
||
download files, send messages, participate in forums, and access
|
||
security alert information. Dial
|
||
(301) 948-5717 at 2400/1200/300 BPS, parity none, 1 stop bit, 8-
|
||
bit characters.
|
||
|