238 lines
9.6 KiB
Plaintext
238 lines
9.6 KiB
Plaintext
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Computer Viruses and Trojan Horses;
|
||
A Guide to Protecting Your Computer
|
||
|
||
by Ted Landberg
|
||
3/8/88
|
||
|
||
|
||
This bulletin discusses software called viruses and trojan horses
|
||
and what precautionary steps you should take to prevent harm to
|
||
your computer based information.
|
||
|
||
|
||
Introduction
|
||
|
||
Recent newspaper and magazine articles have publicized several
|
||
incidences of malicious software known as computer viruses and
|
||
trojan horses. Serious questions are being raised about how
|
||
computer-based information can be protected from this type of
|
||
software. Presently, there are no absolute safeguards from this
|
||
malicious software short of isolating your computers, however
|
||
adequate protection can be achieved by employing a combination of
|
||
traditional safeguards and some common sense about where and who
|
||
you get software from.
|
||
|
||
|
||
What is a virus?
|
||
|
||
A computer virus has been described as a set of "extra" computer
|
||
instructions capable of replicating itself into other files,
|
||
usually programs. This self-replicating code is hidden in a
|
||
"host" program, referred to as a trojan horse. When the "host"
|
||
program is executed, so are the "extra instructions. A program
|
||
can be a trojan horse i.e. have "extra" instructions that may or
|
||
may not be a virus (self-replicating).
|
||
|
||
Trojan horses and viruses can be malicious. Examples of
|
||
malicious action include deleting data files, or rendering
|
||
computer systems unavailable by modifying software libraries.
|
||
This type of software presents a distinct threat to the
|
||
integrity of computer systems.
|
||
|
||
|
||
How do these virus programs enter a computer system?
|
||
|
||
Generally, viruses enter a computer system by using an appealing
|
||
program as a 'host' to harbor the self replicating computer
|
||
instructions. The host can be one of the operating system tools
|
||
such as compilers, editors, file utilities or one of the
|
||
embedded macro languages found in spreadsheets or data base
|
||
management software, and sometimes even in games.
|
||
|
||
|
||
1 Computer Viruses
|
||
|
||
|
||
|
||
|
||
|
||
Distribution of malicious software depends on getting an
|
||
unsuspecting user to accept a program where visual inspection of
|
||
the product is difficult, and the author or source can remain
|
||
anonymous. Public or private conferencing systems, timesharing
|
||
networks and electronic bulletin boards as well as user group
|
||
software exchanges and computer "flea markets" meet these
|
||
requirements.
|
||
|
||
|
||
What should I do to protect myself?
|
||
|
||
Isolating the computer system from contact with outside sources
|
||
of software is the best way to insure the integrity of the
|
||
system. This is very difficult for multi-user systems and not a
|
||
particularly attractive solution if the computer is going to
|
||
continue be useful over time.
|
||
|
||
One alternative approach is to detect the existence of malicious
|
||
or self replicating computer instructions. This requires some
|
||
knowledge of the target of the attack and the means used by a
|
||
virus to self replicate. A generic solution is difficult, but
|
||
several programs have been developed for identifying certain
|
||
types of computer instructions that could present risks.
|
||
|
||
These programs check for extraneous file operations including
|
||
opens, closes, reads and writes that bypass operating system
|
||
functions. A partial list of available software products is
|
||
found in Appendix A.
|
||
|
||
Another solution is to stop the virus from replication by
|
||
preventing the rewriting of 'infected' files. Confining programs
|
||
to libraries on storage devices with 'write disable' hardware is
|
||
one approach. Many large scale computer peripheral devices have
|
||
such a switch, however these features are rarely found on
|
||
desktop computers. An alternative to a hardware 'write disable'
|
||
switch is a software 'read only' feature. Unfortunately, these
|
||
options are found only on mini and mainframe computer operating
|
||
systems. The "read-only" attribute in MS-DOS is not an effective
|
||
protection mechanism because File Allocation Tables (FAT) can be
|
||
changed from user written programs.
|
||
|
||
Popular microcomputer operating systems allow execution of
|
||
computer instructions that can directly address and operate
|
||
storage devices bypassing normal operating system calls. Thus
|
||
there is a constant exposure of disk storage devices and their
|
||
file directories to destruction or modification.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
2 Computer Viruses
|
||
|
||
|
||
|
||
|
||
|
||
|
||
A Five Point Program
|
||
|
||
There is no single set of solutions. Each installation must
|
||
assemble its own procedures for containing the problem. However
|
||
this 5 step process is suggested.
|
||
|
||
1. Education
|
||
|
||
All users of computers should be told about the existence of
|
||
Trojan Horses and Computer Viruses, what they are and how
|
||
to tell whether their system has been infected. Be frank
|
||
when discussing the threat of computer viruses.
|
||
|
||
2. Backup and recovery procedures.
|
||
|
||
Develop easy procedures for routine backup of important
|
||
computer files. Make backup hardware (i.e. tape units)
|
||
readily available to all users. Users connected to LANs
|
||
should use automatic backup features. Suggest file
|
||
organization structures that facilitate backup and recovery
|
||
of disks that have been ruined by computer viruses.
|
||
|
||
3. Isolate Software Libraries
|
||
|
||
On larger computer systems, consolidate libraries into 'Read
|
||
Only' directories. In general system or shared software
|
||
should have limited update and write attribute privileges.
|
||
|
||
4. Implement Software Library Management Procedures
|
||
|
||
Enforce program testing, version control, and quality
|
||
assurance checking for all software libraries. Use software
|
||
library management tools to control and audit programs.
|
||
Assign responsibility for testing public domain software and
|
||
providing "approved" copies of that kind of software. Known
|
||
source of software, inspect distribution media and
|
||
documentation for tapering, and develop a "master copy"
|
||
system.
|
||
|
||
5. Develop an Virus Alert Procedure
|
||
|
||
Getting the word out about potential or known viruses can
|
||
contain or minimize the eventual spread and harmful effects
|
||
of a computer virus. Notices, telephone trees to ADP
|
||
coordinators, phone or electronic mail are all good
|
||
vehicle. Procedures for containment and eradication should
|
||
be thought out before hand. These procedures usually
|
||
require shutting system down, reformatting disk or tape
|
||
storage media and re-building software libraries with a
|
||
known uninfected copies.
|
||
|
||
|
||
3 Computer Viruses
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Appendix A
|
||
|
||
|
||
Virus Detection Tools
|
||
|
||
|
||
|
||
All Software Listed below is in the Public Domain and available
|
||
off of the NBS/ICST Security Bulletin Board (301) 948-5717 or
|
||
5718.
|
||
|
||
|
||
|
||
CHK4BOMB Checks for "write" instructions to absolute
|
||
disk sectors.
|
||
|
||
|
||
BOMBSQUAD A memory resident program that intercepts
|
||
read, write and verifies to floppy or hard
|
||
disks. Sends message on suspected
|
||
operations.
|
||
|
||
|
||
FLUSHOT3 Monitors COMMAND.COM file for writes and
|
||
updates. Will not allow a write to the
|
||
COMMAND.COM file. Note: some earlier
|
||
versions of this program had their own virus
|
||
in it.
|
||
|
||
|
||
HDSENTRY Protects hard disks from malicious writes
|
||
during testing of uncertified software.
|
||
|
||
|
||
EARLY Checks programs for incidence of use of OUT
|
||
instruction, INT 13H and DOS INT 26H.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
4 Computer Viruses
|
||
|