NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/comp/os/msdos/misc/6791

Internet Message Format | 1992-12-31 | 5.2 KB

Path: sparky!uunet!gatech!enterpoop.mit.edu!eru.mt.luth.se!kth.se!sunic!isgate!complex!frisk
From: [e-mail] (Fridrik Skulason)
Newsgroups: comp.os.msdos.misc
Subject: Re: Virus Advice needed
Message-ID: <[e-mail]>
Date: 31 Dec 92 15:10:27 GMT
References: <[e-mail]> <[e-mail]> <[e-mail]> <[e-mail]> <[e-mail]>
Organization: Frisk Software International, Iceland
Lines: 99

[e-mail] (victor porguen) writes:

>> There are only a few cases of diskettes actually being infected
>> in the original duplication process, but there have been quite a
>> few isolated cases of stores accepting returned software, and
>> re-shrinkwrapping it.

>Such unrelated, widely separate and different processes cannot be
>logically connected in any quantitative sense as above.

I was not trying to connect them in any way.  Let my try to make this a bit
clearer:

   1)  Massive distribution of viruses because of infected "masters" is
       rare, but has happened in a few cases.  The number of diskettes
       in those cases may be less than 100, or in the tens of thousands,
       but fortunately this happens only rarely.

   2)  There are occasional, isolated cases of shrink-wrapped software
       found to be infected (for example if somebody opens a package,
       write-protects the diskette and scans it).  When this happens,
       other packages from the same batch are examined, and if they
       are clean, it is most likely that the package was opened before,
       the software infected, (accidentally or not), returned and re-wrapped.

Neither of those processes is responsible for most of the virus-infections
we see, however.  "Borrowed" software from friends, diskettes transferred
between home computers and office computers, and just plain carelessness
account for the majority of infections.

>As far as inclusion of computer "viruses" into disks, viruses
>are incorporated at various stages of a disk's life and as a result
>of a variety of actions and processes.

True, but it is generally possible to see if the virus was present
when the disk was originally duplicated, or added later.

>inferences are often wrong.  Especially in the virus/antivirus
>business,  were crazy rumors are often started and encouraged by
>vendors of antivirus software, obviously in their own interest,

I hope you did not mean this as an insult, but be careful.  As for the "crazy
rumors", there have been a few cases like that, yes, but vendors are in
general careful.  I would rather say that the media has on occasions blown
things quite out of proportion...the "DataCrime" and "Michelangelo"
hysteria was mostly due to totally irresponsible reporting.

>and usually without any substantiation that can be independently
>verified.  Until somebody can show me verifiable figures, I'll
>continue calling it what it is: bullshit.

I don't fully understand what are you calling "bullshit". The fact that
shrink-wrapped software is occasionally, (but very rarely) found to be
infected ?

Now, about the BBSes..

>But I _have_ heard some interesting stories about how some of them
>went about getting sudden hoards of initial "samples" and/or
>restocking their supplies.

Well, the sad fact is that not all people are reliable.  Respectable
producers are careful regarding who they give viruses to, but there are
exceptions.  Of course, things were a lot more relaxed a few years ago -
I started my own virus collection (now containing around 2000 viruses) simply
by writing to one vendor and asking for samples...I received most of the 20
viruses that were known at that time.

The Vx BBSes are a problem - isolated "leaks" of viruses from members of
the anti-virus community have happened (too frequently) in the past,
but it was not until the BBSes started that they started to accumulate.

Now it seems that anybody can get hundreds of different viruses from the
various Vx BBSes - unfortunately very little can be done about it, as they
do not seem to be breaking any laws.

>Many of the viruses in the collections
>of the virus exchange BBSs are so called "research viruses", given
>by their authors to one antivirus vendor or another. Some of them
>have been secretely "marked" with special strings encrypted within
>their code.  All of a sudden, they show up on one of those virus-
>exchange BBSs, still carrying the encrypted name of the antivirus
>vendor they were made for!

True, this has happened.  The reason is of course that the researcher gives
the samples to another researcher (with only a few exceptions, the anti-virus
vendors exchange their virus collections quire freely), who gives it to
another, and so on...until the viruses finally end up in the hands of somebody
non-trustworthy.

Many of the vendors are cooperating to do something about this, because too
many viruses floating around will lead to more new viruses being created,
and contrary to what some people seem to think, anti-virus vendors do not
benefit (financially or otherwise) from a flood of new viruses.

--
--
Fridrik Skulason      Frisk Software International     phone: [phone]
Author of F-PROT      E-mail: [e-mail]         fax:   [phone]