460 lines
26 KiB
Plaintext
460 lines
26 KiB
Plaintext
|
||
Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg Page 1 of 8
|
||
|
||
|
||
|
||
Computer Virus Myths
|
||
|
||
(8th Edition, March 1992)
|
||
|
||
by Rob Rosenberger
|
||
with Ross M. Greenberg
|
||
|
||
|
||
A number of myths have surfaced about the threat of computer "viruses".
|
||
There are myths about how widespread they are, how dangerous they are, and
|
||
even myths about what a computer virus really is. We'd like the facts to
|
||
be known.
|
||
|
||
The first thing to learn is that a virus is a malicious programming tech-
|
||
nique in the realm of "Trojan horses." All viruses are Trojan horses, but
|
||
few Trojan horses can be called a virus.
|
||
|
||
That having been said, it's time to go over the terminology we use when we
|
||
lecture:
|
||
|
||
BBS Bulletin Board System. If you have a modem, you can call
|
||
a BBS and leave messages, transfer computer files back &
|
||
forth, and learn a lot about computers. (What you're
|
||
reading right now, for example, most likely came to you
|
||
from a BBS.)
|
||
|
||
Bug an accidental flaw in the logic of a program which makes
|
||
it do things it shouldn't really be doing. Programmers
|
||
don't mean to put bugs in their program, but they always
|
||
creep in. Programmers tend to spend more time debugging
|
||
their programs than they do writing them in the first
|
||
place. Inadvertent bugs have caused more data loss than
|
||
all the viruses combined.
|
||
|
||
Hacker someone who really loves computers and who wants to push
|
||
them to the limit. Hackers have a healthy sense of curi-
|
||
osity: they try doorknobs just to see if they're locked,
|
||
and they tinker with a piece of equipment until it's "just
|
||
right." The computer revolution itself is a result of
|
||
hackers.
|
||
|
||
Shareware a distribution method for quality software available on a
|
||
"try before you buy" basis. You pay for the program only
|
||
if you find it useful. Shareware programs can be down-
|
||
loaded from BBSs and you are encouraged to give evaluation
|
||
copies to friends. Many shareware applications rival the
|
||
power of off-the-shelf counterparts, at just a fraction of
|
||
the price. (You must pay for the shareware you continue
|
||
to use -- otherwise you're stealing software.)
|
||
|
||
Trojan horse a generic term describing a set of computer instructions
|
||
purposely hidden inside a program. Trojan horses tell a
|
||
program to do things you don't expect it to do. The term
|
||
comes from a legendary battle in which the ancient city of
|
||
|
||
Computer Virus Myths Page 2 of 8
|
||
|
||
|
||
|
||
Troy received the gift of a large wooden horse. The
|
||
"gift" secretly held soldiers in its belly, and when the
|
||
Trojans rolled it into their fortified city....
|
||
|
||
Virus a term for a very specialized Trojan horse which spreads
|
||
to other computers by secretly "infecting" programs with a
|
||
copy of itself. A virus is the only type of Trojan horse
|
||
which is contagious, like the common cold. If it doesn't
|
||
meet this definition, then it isn't a virus.
|
||
|
||
Worm a term similar to a Trojan horse, but there is no "gift"
|
||
involved. If the Trojans had left that wooden horse out-
|
||
side the city, they wouldn't have been attacked. Worms,
|
||
on the other hand, can bypass your defenses without having
|
||
to deceive you into dropping your guard. An example is a
|
||
program designed to spread itself by exploiting bugs in a
|
||
network software package. Worms are usually released by
|
||
someone who has normal access to a computer or network.
|
||
|
||
Wormers the name given to the people who unleash destructive
|
||
Trojan horses. Let's face it, these people aren't angels.
|
||
What they do hurts us. They deserve our disrespect.
|
||
|
||
Viruses, like all Trojan horses, purposely make a program do things you
|
||
don't expect it to do. Some viruses are just an annoyance, perhaps only
|
||
displaying a "Peace on earth" greeting. The viruses we're worried about
|
||
are designed to destroy your data (the most valuable asset of your com-
|
||
puter!) and waste your valuable time in recovering from an attack.
|
||
|
||
Now you know the difference between a virus and a Trojan horse and a bug.
|
||
Let's get into some of the myths:
|
||
|
||
"All purposely destructive code comes as a virus."
|
||
Wrong. Remember, "Trojan horse" is the general term for purposely
|
||
destructive code. Very few Trojan horses actually qualify as viruses. Few
|
||
newspaper or magazine reporters have a real understand of computer crimes,
|
||
so they tend to call almost anything a virus.
|
||
|
||
"Viruses and Trojan horses are a recent phenomenon."
|
||
Trojan horses have been around since the first days of the computer;
|
||
hackers toyed with viruses in the early 1960s as a form of amusement. Many
|
||
different Trojan horse techniques emerged over the years to embezzle money,
|
||
destroy data, etc. The general public didn't know of this problem until
|
||
the IBM PC revolution brought it into the spotlight. Banks still hush up
|
||
computerized embezzlements (as they did during the 1980s) because they
|
||
believe customers will lose faith in their computer systems if the word
|
||
gets out.
|
||
|
||
"Viruses are written by hackers."
|
||
Yes, hackers have purposely unleashed viruses, but so has a computer
|
||
magazine publisher. And according to one trusted military publication, the
|
||
U.S. Defense Department develops them as weapons. Middle-aged men wearing
|
||
business suits created Trojan horses for decades before the advent of com-
|
||
|
||
Computer Virus Myths Page 3 of 8
|
||
|
||
|
||
|
||
puter viruses. We call people "wormers" when they abuse their knowledge of
|
||
computers. You shouldn't fear hackers just because they know how to write
|
||
viruses. This is an ethics issue, not a technology issue. Hackers know a
|
||
lot about computers; wormers abuse their knowledge. Hackers (as a whole)
|
||
got a bum rap when the mass media corrupted the term.
|
||
|
||
"Viruses infect 25% of all IBM PCs every month."
|
||
If 25% suffer an infection every month, then 100% would have a virus
|
||
every four months assuming the user took no preventive measures -- in other
|
||
words, every IBM PC would suffer an infection three times per year. This
|
||
astronomical estimate surfaced after virus expert (and antivirus vendor)
|
||
Dr. Peter Tippett published "The Kinetics of Computer Virus Replication," a
|
||
complex thesis on how viruses might spread in the future. Computer viruses
|
||
exist all over the planet, yes -- but they won't take over the world. Only
|
||
about 400 different viruses exist at this time and some of them have been
|
||
completely eliminated "from the wild." (Of course, virus experts retain
|
||
copies even of "extinct" viruses in their archives.) You can easily reduce
|
||
your exposure to viruses with a few simple precautions. Yes, it's still
|
||
safe to turn on your computer!
|
||
|
||
"Only 400 different viruses? But most experts talk about them in the thou-
|
||
sands."
|
||
The virus experts who "originate" these numbers tend tto work for
|
||
antivirus firms. They count even the most insignificant variations of
|
||
viruses as part of the grand total for advertising purposes. When the
|
||
Marijuana virus first appeared, for example, it displayed the word
|
||
"legalise," but a miscreant later modified it to read "legalize." Any pro-
|
||
gram capable of detecting the original virus will detect the version with
|
||
one letter changed -- but antivirus companies count them as "two" viruses.
|
||
Such obscure differentiations quickly add up.
|
||
|
||
"Viruses could destroy all the files on my disks."
|
||
Yes, and a spilled cup of coffee will do the same thing. If you have
|
||
adequate backup copies of your data, you can recover from any virus or
|
||
coffee problem. Backups mean the difference between a nuisance and
|
||
a disaster. It is safe to presume there has been more accidental loss of
|
||
data than loss by viruses and Trojan horses.
|
||
|
||
"Viruses have been documented on over 300,000 computers (1988)."
|
||
"Viruses have been documented on over 400,000 computers (1989)."
|
||
"Viruses have been estimated on over 5,000,000 computers (1992)."
|
||
These numbers come from John McAfee, a self-styled virus fighter who
|
||
craves attention and media recognition. If we assume it took him a mere
|
||
five minutes to adequately document each viral infection, it would have
|
||
taken four man-years of effort to document a problem only two years old by
|
||
1989. We further assume McAfee's statements include every floppy disk ever
|
||
infected up to that time by a virus, as well as all of the computers
|
||
participating in the Christmas and InterNet worm attacks. (Worms cannot be
|
||
included in virus infection statistics.)
|
||
McAfee prefers to "estimate" his totals these days. Let's assume we
|
||
have about 100 million computers of all types & models in use around the
|
||
world. McAfee's estimate means 1 out of every 20 computers on the planet
|
||
supposedly has a virus. It sounds like a pretty astronomical number to
|
||
most other virus experts.
|
||
|
||
Computer Virus Myths Page 4 of 8
|
||
|
||
|
||
|
||
"Viruses can hide inside a data file."
|
||
Data files can't wreak havoc on your computer -- only an executable pro-
|
||
gram file can do that (including the one that runs when you first turn on
|
||
your computer). If a virus infected a data file, it would be a wasted
|
||
effort. But let's be realistic: what you think is 'data' may actually be
|
||
an executable program file. For example, a "batch file" qualifies as text
|
||
on an IBM PC, yet the MS-DOS operating system treats it just like a pro-
|
||
gram.
|
||
|
||
"BBSs and shareware programs spread viruses."
|
||
Here's another scary myth drummed up in the big virus panic, this one
|
||
spouted as gospel by many "experts" who claim to know how viruses spread.
|
||
"The truth," says PC Magazine publisher Bill Machrone, "is that all major
|
||
viruses to date were transmitted by [retail] packages and private mail sys-
|
||
tems, often in universities." (PC Magazine, October 11, 1988.) Machrone
|
||
said this back in 1988 and it still applies to this day. Almost 50 retail
|
||
companies so far have admitted spreading infected master disks to tens of
|
||
thousands of customers since 1988 -- compared to only five shareware
|
||
authors who have spread viruses on master disks to less than 100 customers.
|
||
Machrone goes on to say "bulletin boards and shareware authors work extra-
|
||
ordinarily hard at policing themselves to keep viruses out." Reputable
|
||
sysops check every file for Trojan horses; nationwide sysop networks help
|
||
spread the word about dangerous files. Yes, you should beware of the soft-
|
||
ware you get from BBSs and shareware authors, but you should also beware of
|
||
the retail software you find on store shelves. (By the way, many stores
|
||
now have software return policies. Do you know for sure you were the only
|
||
one who used those master disks?)
|
||
|
||
"My computer could be infected if I call an infected BBS."
|
||
BBSs can't write information on your disks -- the communications soft-
|
||
ware you use performs this task. You can only transfer a dangerous file to
|
||
your computer if you let your software do it. And there is no "300bps sub-
|
||
carrier" that lets a virus slip through a high speed modem. A joker named
|
||
Mike RoChenle (IBM's "micro channel" PS/2 architecture, get it?) started
|
||
the 300bps myth when he left a techy-joke message on a public BBS. Unfor-
|
||
tunately, a few highly respected journalists were taken in by the joke.
|
||
|
||
"So-called 'boot sector' viruses travel primarily in software downloaded
|
||
from BBSs."
|
||
This common myth -- touted as gospel even by Australia's Computer Virus
|
||
Information Group -- expounds on the mythical role computer bulletin boards
|
||
play in spreading viruses. Boot sector viruses can only spread by direct
|
||
contact and "booting" the computer from an infected disk. BBSs deal exclu-
|
||
sively in program files and have no need to pass along copies of disk boot
|
||
sectors. Bulletin board users therefore have a natural immunity to boot-
|
||
sector viruses when they download software.
|
||
We should make a special note about "dropper" programs developed by
|
||
virus researchers as an easy way to transfer boot sector viruses among
|
||
themselves. Since they don't replicate, "dropper" programs don't qualify
|
||
as a virus in and of themselves. Such programs have never been discovered
|
||
on any BBS to date and have no real use other than to transfer infected
|
||
boot sectors.
|
||
|
||
Computer Virus Myths Page 5 of 8
|
||
|
||
|
||
|
||
"My files are damaged, so it must have been a virus attack."
|
||
It also could have happened because of a power flux, or static elec-
|
||
tricity, or a fingerprint on a floppy disk, or a bug in your software, or
|
||
perhaps a simple error on your part. Power failures and spilled cups of
|
||
coffee have destroyed more data than all viruses combined.
|
||
|
||
"Donald Burleson was convicted of releasing a virus."
|
||
Newspapers all over the country hailed a Texas computer crime trial as a
|
||
"virus" trial. The defendent, Donald Burleson, was in a position to
|
||
release a destructive Trojan horse on his employer's mainframe computer.
|
||
This particular software couldn't spread to other computers, so it couldn't
|
||
possibly have qualified as a virus. Davis McCown, the prosecuting attor-
|
||
ney, claims he "never brought up the word virus" during the trial. So why
|
||
did the media call it one?
|
||
1. David Kinney, an expert witness testifying for the defense, claimed
|
||
Burleson had unleashed a virus. The prosecuting attorney didn't argue
|
||
the point and we don't blame him -- Kinney's bizarre claim probably
|
||
helped sway the jury to convict Burleson, and it was the defense's
|
||
fault for letting him testify.
|
||
2. McCown gave reporters the facts behind the case and let them come up
|
||
with their own definitions. The Associated Press and USA Today, among
|
||
others, used such vague definitions that any program would have
|
||
qualified as a virus. If we applied their definitions to the medical
|
||
world, we could safely label penicillin as a biological virus (which
|
||
is, of course, absurd).
|
||
3. McCown claims many quotes attributed to him were "misleading or fab-
|
||
ricated" and identified one in particular which "is total fiction."
|
||
Reporters sometimes print a quote out of context, and McCown appar-
|
||
ently fell victim to it. (It's possible a few bizarre quotes from
|
||
David Kinney or John McAfee were accidentally attributed to McCown.)
|
||
|
||
"Robert Morris Jr. released a benign virus on a defense network."
|
||
It may have been benign but it wasn't a virus. Morris, the son of a
|
||
chief computer scientist at the U.S. National Security Agency, decided one
|
||
day to take advantage of a bug in the Defense Department's networking soft-
|
||
ware. This tiny bug let him send a worm through the network. Among other
|
||
things, Morris's "InterNet" worm sent copies of itself to other computers
|
||
in the network. Unfortunately, the network clogged up in a matter of hours
|
||
due to some bugs in the worm module itself. The press originally called it
|
||
a "virus," like it called the Christmas worm a virus, because it spread to
|
||
other computers. Yet Morris's programs didn't infect any computers. A
|
||
few notes:
|
||
1. Reporters finally started calling it a worm a year after the fact, but
|
||
only because lawyers in the case constantly referred to it as a worm.
|
||
2. The worm operated only on Sun-3 & Vax computers which employ a UNIX
|
||
operating system and were specifically linked into the InterNet net-
|
||
work at the time.
|
||
3. The 6,200 affected computers cannot be counted in virus infection
|
||
statistics (since they weren't infected).
|
||
4. It cost way less than $98 million to clean up the attack. An official
|
||
Cornell University report claims John McAfee, the man behind this wild
|
||
estimate, "was probably serving [him]self" in an effort to drum
|
||
up business. People familiar with the case estimated the final figure
|
||
at under $1 million.
|
||
|
||
Computer Virus Myths Page 6 of 8
|
||
|
||
|
||
|
||
5. Yes, Morris could easily have added some infection code to make it a
|
||
worm/virus if he'd had the urge.
|
||
6. The network bug exploited in the attack has since been fixed.
|
||
7. Morris went to trial for launching the InterNet worm and received a
|
||
federal conviction. The Supreme Court refused to hear the case, so
|
||
his conviction stands.
|
||
|
||
"The U.S. government planted a virus in Iraq military computers during the
|
||
Gulf War."
|
||
U.S. News & World Report published a story in early 1992 accusing the
|
||
National Security Agency of replacing a computer chip in a printer bound
|
||
for Iraq just before the Gulf War with a secret computer chip containing a
|
||
virus. The magazine cited "two unidentified senior U.S. officials" as
|
||
their source, saying "once the virus was in the [Iraqi computer] system,
|
||
...each time an Iraqi technician opened a 'window' on his computer screen
|
||
to access information, the contents of the screen simply vanished." How-
|
||
ever, the USN&WR story shows amazing similarities to a 1991 April Fool's
|
||
story published by InfoWorld magazine. Most computer experts dismiss the
|
||
USN&WR story as a hoax -- an "urban legend" innocently created by the Info-
|
||
World joke. Some notes:
|
||
1. USN&WR has refused to retract the story, but it did issue a "clarifi-
|
||
cation" stating "it could not be confirmed that the [virus] was ulti-
|
||
mately successful." The editors broke with tradition and refused to
|
||
publish any of the numerous letters readers submitted about the virus
|
||
story.
|
||
2. Ted Koppel, a well-known American news anchor, opened one of his
|
||
"Nightline" broadcasts with a report on the alleged virus. Koppel's
|
||
staff politely refers people to talk with USN&WR about the story's
|
||
validity.
|
||
3. InfoWorld didn't label their story as fiction, but the last paragraph
|
||
identified it as an April Fool's joke.
|
||
|
||
"Viruses can spread to all sorts of computers."
|
||
All Trojan horses are limited to a family of computers, and this is
|
||
especially true for viruses. A virus designed to spread on IBM PCs cannot
|
||
infect an IBM 4300 series mainframe, nor can it infect a Commodore C64, nor
|
||
can it infect an Apple Macintosh.
|
||
|
||
"My backups will be worthless if I back up a virus."
|
||
No, they won't. Let's suppose a virus does get backed up with your
|
||
files. You can restore important documents and databases -- your valuable
|
||
data -- without restoring an infected program. You just reinstall programs
|
||
from master disks. It's tedious work, but not as hard as some people
|
||
claim.
|
||
|
||
"Antivirus software will protect me from viruses."
|
||
There is no such thing as a foolproof antivirus program. Trojan horses
|
||
and viruses can be (and have been) designed to bypass them. Antivirus
|
||
products themselves can be tricky to use at times, and they occasionally
|
||
have bugs. Always use a good set of backups as your first line of defense;
|
||
rely on antivirus software as a second line of defense.
|
||
|
||
Computer Virus Myths Page 7 of 8
|
||
|
||
|
||
|
||
"Read-only files are safe from virus infections."
|
||
This common myth among IBM PC users has been printed even in some com-
|
||
puter magazines. Supposedly, you can protect yourself by using the DOS
|
||
ATTRIB command to set the read-only attribute on program files. However,
|
||
ATTRIB is software -- and what it can do, a virus can undo. The ATTRIB
|
||
command seldom halts the spread of viruses.
|
||
|
||
"Viruses can infect files on write-protected disks."
|
||
Here's another common IBM PC myth. If viruses can modify read-only
|
||
files, people assume they can modify write-protected floppies. However,
|
||
the disk drive itself knows when a floppy is protected and refuses to write
|
||
to it. You can physically disable an IBM PC drive's write-protect sensor,
|
||
but you can't override it with a software command.
|
||
|
||
|
||
|
||
We hope this dispels the many computer virus myths. Viruses DO exist, they
|
||
ARE out there, they WANT to spread to other computers, and they CAN cause
|
||
you problems. But you can defend yourself with a cool head and a good set
|
||
of backups.
|
||
|
||
The following guidelines can shield you from Trojan horses and viruses.
|
||
They will lower your chances of being infected and raise your chances of
|
||
recovering from an attack.
|
||
|
||
1. Implement a procedure to regularly back up your files and follow it
|
||
religiously. Consider purchasing a user-friendly program to take the
|
||
drudgery out of this task. (There are plenty to choose from.)
|
||
2. Rotate between at least two sets of backups for better security (use
|
||
set #1, then set #2, then set #1...). The more sets you use, the
|
||
better protected you are. Many people take a "master" backup of their
|
||
entire hard disk, then take "incremental" backups of those files which
|
||
changed since the last time they backed up. Incremental backups might
|
||
only require five minutes of your time each day.
|
||
3. Download files only from reputable BBSs where the sysop checks every
|
||
program for Trojan horses. If you're still afraid, consider getting
|
||
programs from a BBS or "disk vendor" company which gets them direct
|
||
from the authors.
|
||
4. Let newly uploaded files "mature" on a BBS for one or two weeks before
|
||
you download it (others will put it through its paces).
|
||
5. Consider using a program that searches, or "scans," disks for known
|
||
viruses. Almost all infections to date involved viruses known to
|
||
antivirus companies. A recent copy of any "scanning" program will in
|
||
all probability identify a virus before it gets the chance to infect
|
||
your computer -- and as they say, "an ounce of prevention is worth a
|
||
pound of cure." A "scanning" program can dramatically lower your
|
||
chaces of getting infected by a computer virus in the first place.
|
||
(But remember: there is no perfect antivirus defense.)
|
||
6. Consider using a program that creates a unique "signature" of all the
|
||
programs on your computer. Run this program once in awhile to see if
|
||
any of your software applications have been modified -- either by a
|
||
virus or by a fingerprint on a floppy disk or perhaps even by a stray
|
||
gamma ray.
|
||
|
||
Computer Virus Myths Page 8 of 8
|
||
|
||
|
||
|
||
7. DON'T PANIC if your computer starts acting weird. It may be a virus,
|
||
but then again maybe not. Immediately turn off all power to your com-
|
||
puter and disconnect it from any local area networks. Reboot from a
|
||
write-protected copy of your master DOS disk. Do NOT run any programs
|
||
on a "regular" disk (you might activate a Trojan horse). If you don't
|
||
have adequate backups, try to bring them up to date. Yes, you might
|
||
back up a virus as well, but it can't hurt you if you don't use your
|
||
normal programs. Set your backups off to the side. Only then can you
|
||
safely hunt for problems.
|
||
8. If you can't figure out what's wrong and you aren't sure what to do
|
||
next, turn off your computer and call for help. Consider calling a
|
||
local computer group before you call for an expert. If you need a
|
||
professional, consider a regular computer consultant first. Some
|
||
"virus removal experts" charge prices far beyond their actual value.
|
||
9. [Consider this ONLY as a last resort.] If you can't figure out what's
|
||
wrong and you are sure of yourself, execute both a low-level and a
|
||
high-level format on all your regular disks. Next, carefully re-
|
||
install all software from the master disks (not from the backups).
|
||
Make sure the master disks have write-protect tabs! Then, carefully
|
||
restore only the data files (not the program files) from your backup
|
||
disks.
|
||
|
||
We'd appreciate it if you would mail us a copy of any Trojan horse or virus
|
||
you discover. (Be careful you don't damage the data on your disks while
|
||
trying to do this!) Include as much information as you can and put a label
|
||
on the disk saying it contains a malicious program. Send it to Ross M.
|
||
Greenberg, P.O. Box 908, Margaretville, NY 12254. Thank you.
|
||
|
||
Ross M. Greenberg is the author of both shareware and retail virus
|
||
detection programs. Rob Rosenberger is the author of various phone
|
||
productivity applications. (Products are not mentioned by name because
|
||
this isn't the place for advertisements.) They each write for national
|
||
computer magazines. These men communicated entirely by modem while
|
||
writing this treatise.
|
||
|
||
Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg
|
||
|
||
|
||
Rosenberger can be reached electronically on CompuServe as [74017,1344], on
|
||
GEnie as R.ROSENBERGE, on InterNet as `74017.1344@compuserve.com', and on
|
||
various national BBS linkups. Greenberg can be reached on MCI and BIX as
|
||
`greenber', on UseNet as `c-rossgr@microsoft.com', and on CompuServe as
|
||
[72461,3212].
|
||
|
||
You may give copies of this treatise to anyone if you pass it along in its
|
||
entirety. Publications may reprint it at no charge if they give due credit
|
||
to the authors and send two copies to: Rob Rosenberger, P.O. Box 643,
|
||
O'Fallon, IL 62269.
|
||
|