Internet Info 1994 March/Internet Info CD-ROM (Walnut Creek) (March 1994).iso/security/doc/clippings/911230-01

Text File | 1992-01-09 | 4.9 KB | 101 lines

Source: RISKS DIGEST 12.72
Message-ID: <[e-mail]>
Date: Mon, 30 Dec 91 13:16:29 PST
From: "John Markoff" <[e-mail]>
Subject: Recent Novell Software Contains a Hidden Virus

By JOHN MARKOFF  (from the New York Times, 20 Dec 1991)

  The nation's largest supplier of office-network software for
personal computers has sent a letter to approximately 3,800 customers
warning that it inadvertently allowed a software virus to invade
copies of a disk shipped earlier this month.
  The letter, sent on Wednesday to customers of Novell Inc., a Provo,
Utah, software publisher, said the diskette, which was mailed on Dec.
11, had been accidentally infected with a virus known by computer
experts as "Stoned 111."
  A company official said yesterday that Novell had received a number
of reports from customers that the virus had invaded their systems,
although there had been no reports of damage.
  But a California-based computer virus expert said that the potential
for damage was significant and that the virus on the Novell diskette
frequently disabled computers that it infected.

 'Massive Potential Liabilities'

  "If this was to get into an organization and spread to 1,500 to
2,000 machines, you are looking at millions of dollars of cleanup
costs," said John McAfee, president of McAfee & Associates, a Santa
Clara, Calif. antivirus consulting firm. "It doesn't matter that only
a few are infected," he said.  "You can't tell. You have to take the
network down and there are massive potential liabilities."
  Mr. McAfee said he had received several dozen calls from Novell
users, some of whom were outraged.

  The Novell incident is the second such case this month. On Dec. 6,
Konami Inc., a software game manufacturer based in Buffalo Grove, 111.
wrote customers that disks of its Spacewrecked game had also become
infected with an earlier version of the Stoned virus. The company said
in the letter that it had identified the virus before a large volume
of disks had been shipped to dealers.

Source of Virus Unknown

  Novell officials said that after the company began getting calls
earlier this week, they traced the source of the infection to a
particular part of their manufacturing process. But the officials said
they had not been able to determine how the virus had infected their
software initially.

  Novell's customers include some of nation's largest corporations.
The software, called Netware, controls office networks ranging from
just two or three machines to a thousand systems.
  "Viruses are a challenge for the marketplace," said John Edwards,
director of marketing for Netware systems at Novell. "But we'll keep
up our vigilance. He said the virus had attacked a disk that contained
a help encyclopedia that the company had distributed to its customers.

Servers Said to Be Unaffected

  Computer viruses are small programs that are passed from computer to
computer by secretly attaching themselves to data files that are then
copied either by diskette or via a computer network. The programs can
be written to perform malicious tasks after infecting a new computer,
or do no more than copy themselves from machine to machine.
  In its letter to customers the company said that the Stoned 111
virus would not spread over computer networks to infect the file
servers that are the foundation of networks. File servers are special
computers with large disks that store and distribute data to a network
of desktop computers.
  The Stoned 111 virus works by attaching itself to a special area on
a floppy diskette and then copying itself into the computer's memory
to infect other diskettes.
  But Mr. McAfee said the program also copied itself to the hard disk
of a computer where it could occasionally disable a system. In this
case it is possible to lose data if the virus writes information over
the area where a special directory is stored.

  Mr. McAfee said that the Stoned 111 virus had first been reported in
Europe just three months ago. The new virus is representative of a
class of programs known as "stealth" viruses, because they mask their
location and are difficult to identify. Mr. McAfee speculated that
this was why the program had escaped detection by the company.

Steps Toward Detection

  Novell has been moving toward adding new technology to its software
to make it more difficult for viruses to invade it, Mr. Edwards said.
Recently, the company licensed special digital-signature software that
makes it difficult for viruses to spread undetected. Novell plans to
add this new technology to the next major release of its software, due
out at the end of 1992.

  In the past, courts have generally not held companies liable for damages in
cases where a third party is responsible, said Susan Nycum, a Palo Alto,
Calif., lawyer who is an expert on computer issues.  "If they have been prudent
it wouldn't be fair to hold them liable," she said. "But ultimately it may be a
question for a jury."

[Also noted by Werner Uhrig <[e-mail]>]