Shareware 1 2 the Maxx

home *** CD-ROM | disk | FTP | other *** search

/ Shareware 1 2 the Maxx / sw_1.zip / sw_1 / VIRUS / MYTHS_V8.ZIP / VIRUS_MY.THS

Wrap

Text File | 1992-03-03 | 27KB | 460 lines

Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg Page 1 of 8 Computer Virus Myths (8th Edition, March 1992) by Rob Rosenberger with Ross M. Greenberg A number of myths have surfaced about the threat of computer "viruses". There are myths about how widespread they are, how dangerous they are, and even myths about what a computer virus really is. We'd like the facts to be known. The first thing to learn is that a virus is a malicious programming tech- nique in the realm of "Trojan horses." All viruses are Trojan horses, but few Trojan horses can be called a virus. That having been said, it's time to go over the terminology we use when we lecture: BBS Bulletin Board System. If you have a modem, you can call a BBS and leave messages, transfer computer files back & forth, and learn a lot about computers. (What you're reading right now, for example, most likely came to you from a BBS.) Bug an accidental flaw in the logic of a program which makes it do things it shouldn't really be doing. Programmers don't mean to put bugs in their program, but they always creep in. Programmers tend to spend more time debugging their programs than they do writing them in the first place. Inadvertent bugs have caused more data loss than all the viruses combined. Hacker someone who really loves computers and who wants to push them to the limit. Hackers have a healthy sense of curi- osity: they try doorknobs just to see if they're locked, and they tinker with a piece of equipment until it's "just right." The computer revolution itself is a result of hackers. Shareware a distribution method for quality software available on a "try before you buy" basis. You pay for the program only if you find it useful. Shareware programs can be down- loaded from BBSs and you are encouraged to give evaluation copies to friends. Many shareware applications rival the power of off-the-shelf counterparts, at just a fraction of the price. (You must pay for the shareware you continue to use -- otherwise you're stealing software.) Trojan horse a generic term describing a set of computer instructions purposely hidden inside a program. Trojan horses tell a program to do things you don't expect it to do. The term comes from a legendary battle in which the ancient city of Computer Virus Myths Page 2 of 8 Troy received the gift of a large wooden horse. The "gift" secretly held soldiers in its belly, and when the Trojans rolled it into their fortified city.... Virus a term for a very specialized Trojan horse which spreads to other computers by secretly "infecting" programs with a copy of itself. A virus is the only type of Trojan horse which is contagious, like the common cold. If it doesn't meet this definition, then it isn't a virus. Worm a term similar to a Trojan horse, but there is no "gift" involved. If the Trojans had left that wooden horse out- side the city, they wouldn't have been attacked. Worms, on the other hand, can bypass your defenses without having to deceive you into dropping your guard. An example is a program designed to spread itself by exploiting bugs in a network software package. Worms are usually released by someone who has normal access to a computer or network. Wormers the name given to the people who unleash destructive Trojan horses. Let's face it, these people aren't angels. What they do hurts us. They deserve our disrespect. Viruses, like all Trojan horses, purposely make a program do things you don't expect it to do. Some viruses are just an annoyance, perhaps only displaying a "Peace on earth" greeting. The viruses we're worried about are designed to destroy your data (the most valuable asset of your com- puter!) and waste your valuable time in recovering from an attack. Now you know the difference between a virus and a Trojan horse and a bug. Let's get into some of the myths: "All purposely destructive code comes as a virus." Wrong. Remember, "Trojan horse" is the general term for purposely destructive code. Very few Trojan horses actually qualify as viruses. Few newspaper or magazine reporters have a real understand of computer crimes, so they tend to call almost anything a virus. "Viruses and Trojan horses are a recent phenomenon." Trojan horses have been around since the first days of the computer; hackers toyed with viruses in the early 1960s as a form of amusement. Many different Trojan horse techniques emerged over the years to embezzle money, destroy data, etc. The general public didn't know of this problem until the IBM PC revolution brought it into the spotlight. Banks still hush up computerized embezzlements (as they did during the 1980s) because they believe customers will lose faith in their computer systems if the word gets out. "Viruses are written by hackers." Yes, hackers have purposely unleashed viruses, but so has a computer magazine publisher. And according to one trusted military publication, the U.S. Defense Department develops them as weapons. Middle-aged men wearing business suits created Trojan horses for decades before the advent of com- Computer Virus Myths Page 3 of 8 puter viruses. We call people "wormers" when they abuse their knowledge of computers. You shouldn't fear hackers just because they know how to write viruses. This is an ethics issue, not a technology issue. Hackers know a lot about computers; wormers abuse their knowledge. Hackers (as a whole) got a bum rap when the mass media corrupted the term. "Viruses infect 25% of all IBM PCs every month." If 25% suffer an infection every month, then 100% would have a virus every four months assuming the user took no preventive measures -- in other words, every IBM PC would suffer an infection three times per year. This astronomical estimate surfaced after virus expert (and antivirus vendor) Dr. Peter Tippett published "The Kinetics of Computer Virus Replication," a complex thesis on how viruses might spread in the future. Computer viruses exist all over the planet, yes -- but they won't take over the world. Only about 400 different viruses exist at this time and some of them have been completely eliminated "from the wild." (Of course, virus experts retain copies even of "extinct" viruses in their archives.) You can easily reduce your exposure to viruses with a few simple precautions. Yes, it's still safe to turn on your computer! "Only 400 different viruses? But most experts talk about them in the thou- sands." The virus experts who "originate" these numbers tend tto work for antivirus firms. They count even the most insignificant variations of viruses as part of the grand total for advertising purposes. When the Marijuana virus first appeared, for example, it displayed the word "legalise," but a miscreant later modified it to read "legalize." Any pro- gram capable of detecting the original virus will detect the version with one letter changed -- but antivirus companies count them as "two" viruses. Such obscure differentiations quickly add up. "Viruses could destroy all the files on my disks." Yes, and a spilled cup of coffee will do the same thing. If you have adequate backup copies of your data, you can recover from any virus or coffee problem. Backups mean the difference between a nuisance and a disaster. It is safe to presume there has been more accidental loss of data than loss by viruses and Trojan horses. "Viruses have been documented on over 300,000 computers (1988)." "Viruses have been documented on over 400,000 computers (1989)." "Viruses have been estimated on over 5,000,000 computers (1992)." These numbers come from John McAfee, a self-styled virus fighter who craves attention and media recognition. If we assume it took him a mere five minutes to adequately document each viral infection, it would have taken four man-years of effort to document a problem only two years old by 1989. We further assume McAfee's statements include every floppy disk ever infected up to that time by a virus, as well as all of the computers participating in the Christmas and InterNet worm attacks. (Worms cannot be included in virus infection statistics.) McAfee prefers to "estimate" his totals these days. Let's assume we have about 100 million computers of all types & models in use around the world. McAfee's estimate means 1 out of every 20 computers on the planet supposedly has a virus. It sounds like a pretty astronomical number to most other virus experts. Computer Virus Myths Page 4 of 8 "Viruses can hide inside a data file." Data files can't wreak havoc on your computer -- only an executable pro- gram file can do that (including the one that runs when you first turn on your computer). If a virus infected a data file, it would be a wasted effort. But let's be realistic: what you think is 'data' may actually be an executable program file. For example, a "batch file" qualifies as text on an IBM PC, yet the MS-DOS operating system treats it just like a pro- gram. "BBSs and shareware programs spread viruses." Here's another scary myth drummed up in the big virus panic, this one spouted as gospel by many "experts" who claim to know how viruses spread. "The truth," says PC Magazine publisher Bill Machrone, "is that all major viruses to date were transmitted by [retail] packages and private mail sys- tems, often in universities." (PC Magazine, October 11, 1988.) Machrone said this back in 1988 and it still applies to this day. Almost 50 retail companies so far have admitted spreading infected master disks to tens of thousands of customers since 1988 -- compared to only five shareware authors who have spread viruses on master disks to less than 100 customers. Machrone goes on to say "bulletin boards and shareware authors work extra- ordinarily hard at policing themselves to keep viruses out." Reputable sysops check every file for Trojan horses; nationwide sysop networks help spread the word about dangerous files. Yes, you should beware of the soft- ware you get from BBSs and shareware authors, but you should also beware of the retail software you find on store shelves. (By the way, many stores now have software return policies. Do you know for sure you were the only one who used those master disks?) "My computer could be infected if I call an infected BBS." BBSs can't write information on your disks -- the communications soft- ware you use performs this task. You can only transfer a dangerous file to your computer if you let your software do it. And there is no "300bps sub- carrier" that lets a virus slip through a high speed modem. A joker named Mike RoChenle (IBM's "micro channel" PS/2 architecture, get it?) started the 300bps myth when he left a techy-joke message on a public BBS. Unfor- tunately, a few highly respected journalists were taken in by the joke. "So-called 'boot sector' viruses travel primarily in software downloaded from BBSs." This common myth -- touted as gospel even by Australia's Computer Virus Information Group -- expounds on the mythical role computer bulletin boards play in spreading viruses. Boot sector viruses can only spread by direct contact and "booting" the computer from an infected disk. BBSs deal exclu- sively in program files and have no need to pass along copies of disk boot sectors. Bulletin board users therefore have a natural immunity to boot- sector viruses when they download software. We should make a special note about "dropper" programs developed by virus researchers as an easy way to transfer boot sector viruses among themselves. Since they don't replicate, "dropper" programs don't qualify as a virus in and of themselves. Such programs have never been discovered on any BBS to date and have no real use other than to transfer infected boot sectors. Computer Virus Myths Page 5 of 8 "My files are damaged, so it must have been a virus attack." It also could have happened because of a power flux, or static elec- tricity, or a fingerprint on a floppy disk, or a bug in your software, or perhaps a simple error on your part. Power failures and spilled cups of coffee have destroyed more data than all viruses combined. "Donald Burleson was convicted of releasing a virus." Newspapers all over the country hailed a Texas computer crime trial as a "virus" trial. The defendent, Donald Burleson, was in a position to release a destructive Trojan horse on his employer's mainframe computer. This particular software couldn't spread to other computers, so it couldn't possibly have qualified as a virus. Davis McCown, the prosecuting attor- ney, claims he "never brought up the word virus" during the trial. So why did the media call it one? 1. David Kinney, an expert witness testifying for the defense, claimed Burleson had unleashed a virus. The prosecuting attorney didn't argue the point and we don't blame him -- Kinney's bizarre claim probably helped sway the jury to convict Burleson, and it was the defense's fault for letting him testify. 2. McCown gave reporters the facts behind the case and let them come up with their own definitions. The Associated Press and USA Today, among others, used such vague definitions that any program would have qualified as a virus. If we applied their definitions to the medical world, we could safely label penicillin as a biological virus (which is, of course, absurd). 3. McCown claims many quotes attributed to him were "misleading or fab- ricated" and identified one in particular which "is total fiction." Reporters sometimes print a quote out of context, and McCown appar- ently fell victim to it. (It's possible a few bizarre quotes from David Kinney or John McAfee were accidentally attributed to McCown.) "Robert Morris Jr. released a benign virus on a defense network." It may have been benign but it wasn't a virus. Morris, the son of a chief computer scientist at the U.S. National Security Agency, decided one day to take advantage of a bug in the Defense Department's networking soft- ware. This tiny bug let him send a worm through the network. Among other things, Morris's "InterNet" worm sent copies of itself to other computers in the network. Unfortunately, the network clogged up in a matter of hours due to some bugs in the worm module itself. The press originally called it a "virus," like it called the Christmas worm a virus, because it spread to other computers. Yet Morris's programs didn't infect any computers. A few notes: 1. Reporters finally started calling it a worm a year after the fact, but only because lawyers in the case constantly referred to it as a worm. 2. The worm operated only on Sun-3 & Vax computers which employ a UNIX operating system and were specifically linked into the InterNet net- work at the time. 3. The 6,200 affected computers cannot be counted in virus infection statistics (since they weren't infected). 4. It cost way less than $98 million to clean up the attack. An official Cornell University report claims John McAfee, the man behind this wild estimate, "was probably serving [him]self" in an effort to drum up business. People familiar with the case estimated the final figure at under $1 million. Computer Virus Myths Page 6 of 8 5. Yes, Morris could easily have added some infection code to make it a worm/virus if he'd had the urge. 6. The network bug exploited in the attack has since been fixed. 7. Morris went to trial for launching the InterNet worm and received a federal conviction. The Supreme Court refused to hear the case, so his conviction stands. "The U.S. government planted a virus in Iraq military computers during the Gulf War." U.S. News & World Report published a story in early 1992 accusing the National Security Agency of replacing a computer chip in a printer bound for Iraq just before the Gulf War with a secret computer chip containing a virus. The magazine cited "two unidentified senior U.S. officials" as their source, saying "once the virus was in the [Iraqi computer] system, ...each time an Iraqi technician opened a 'window' on his computer screen to access information, the contents of the screen simply vanished." How- ever, the USN&WR story shows amazing similarities to a 1991 April Fool's story published by InfoWorld magazine. Most computer experts dismiss the USN&WR story as a hoax -- an "urban legend" innocently created by the Info- World joke. Some notes: 1. USN&WR has refused to retract the story, but it did issue a "clarifi- cation" stating "it could not be confirmed that the [virus] was ulti- mately successful." The editors broke with tradition and refused to publish any of the numerous letters readers submitted about the virus story. 2. Ted Koppel, a well-known American news anchor, opened one of his "Nightline" broadcasts with a report on the alleged virus. Koppel's staff politely refers people to talk with USN&WR about the story's validity. 3. InfoWorld didn't label their story as fiction, but the last paragraph identified it as an April Fool's joke. "Viruses can spread to all sorts of computers." All Trojan horses are limited to a family of computers, and this is especially true for viruses. A virus designed to spread on IBM PCs cannot infect an IBM 4300 series mainframe, nor can it infect a Commodore C64, nor can it infect an Apple Macintosh. "My backups will be worthless if I back up a virus." No, they won't. Let's suppose a virus does get backed up with your files. You can restore important documents and databases -- your valuable data -- without restoring an infected program. You just reinstall programs from master disks. It's tedious work, but not as hard as some people claim. "Antivirus software will protect me from viruses." There is no such thing as a foolproof antivirus program. Trojan horses and viruses can be (and have been) designed to bypass them. Antivirus products themselves can be tricky to use at times, and they occasionally have bugs. Always use a good set of backups as your first line of defense; rely on antivirus software as a second line of defense. Computer Virus Myths Page 7 of 8 "Read-only files are safe from virus infections." This common myth among IBM PC users has been printed even in some com- puter magazines. Supposedly, you can protect yourself by using the DOS ATTRIB command to set the read-only attribute on program files. However, ATTRIB is software -- and what it can do, a virus can undo. The ATTRIB command seldom halts the spread of viruses. "Viruses can infect files on write-protected disks." Here's another common IBM PC myth. If viruses can modify read-only files, people assume they can modify write-protected floppies. However, the disk drive itself knows when a floppy is protected and refuses to write to it. You can physically disable an IBM PC drive's write-protect sensor, but you can't override it with a software command. We hope this dispels the many computer virus myths. Viruses DO exist, they ARE out there, they WANT to spread to other computers, and they CAN cause you problems. But you can defend yourself with a cool head and a good set of backups. The following guidelines can shield you from Trojan horses and viruses. They will lower your chances of being infected and raise your chances of recovering from an attack. 1. Implement a procedure to regularly back up your files and follow it religiously. Consider purchasing a user-friendly program to take the drudgery out of this task. (There are plenty to choose from.) 2. Rotate between at least two sets of backups for better security (use set #1, then set #2, then set #1...). The more sets you use, the better protected you are. Many people take a "master" backup of their entire hard disk, then take "incremental" backups of those files which changed since the last time they backed up. Incremental backups might only require five minutes of your time each day. 3. Download files only from reputable BBSs where the sysop checks every program for Trojan horses. If you're still afraid, consider getting programs from a BBS or "disk vendor" company which gets them direct from the authors. 4. Let newly uploaded files "mature" on a BBS for one or two weeks before you download it (others will put it through its paces). 5. Consider using a program that searches, or "scans," disks for known viruses. Almost all infections to date involved viruses known to antivirus companies. A recent copy of any "scanning" program will in all probability identify a virus before it gets the chance to infect your computer -- and as they say, "an ounce of prevention is worth a pound of cure." A "scanning" program can dramatically lower your chaces of getting infected by a computer virus in the first place. (But remember: there is no perfect antivirus defense.) 6. Consider using a program that creates a unique "signature" of all the programs on your computer. Run this program once in awhile to see if any of your software applications have been modified -- either by a virus or by a fingerprint on a floppy disk or perhaps even by a stray gamma ray. Computer Virus Myths Page 8 of 8 7. DON'T PANIC if your computer starts acting weird. It may be a virus, but then again maybe not. Immediately turn off all power to your com- puter and disconnect it from any local area networks. Reboot from a write-protected copy of your master DOS disk. Do NOT run any programs on a "regular" disk (you might activate a Trojan horse). If you don't have adequate backups, try to bring them up to date. Yes, you might back up a virus as well, but it can't hurt you if you don't use your normal programs. Set your backups off to the side. Only then can you safely hunt for problems. 8. If you can't figure out what's wrong and you aren't sure what to do next, turn off your computer and call for help. Consider calling a local computer group before you call for an expert. If you need a professional, consider a regular computer consultant first. Some "virus removal experts" charge prices far beyond their actual value. 9. [Consider this ONLY as a last resort.] If you can't figure out what's wrong and you are sure of yourself, execute both a low-level and a high-level format on all your regular disks. Next, carefully re- install all software from the master disks (not from the backups). Make sure the master disks have write-protect tabs! Then, carefully restore only the data files (not the program files) from your backup disks. We'd appreciate it if you would mail us a copy of any Trojan horse or virus you discover. (Be careful you don't damage the data on your disks while trying to do this!) Include as much information as you can and put a label on the disk saying it contains a malicious program. Send it to Ross M. Greenberg, P.O. Box 908, Margaretville, NY 12254. Thank you. Ross M. Greenberg is the author of both shareware and retail virus detection programs. Rob Rosenberger is the author of various phone productivity applications. (Products are not mentioned by name because this isn't the place for advertisements.) They each write for national computer magazines. These men communicated entirely by modem while writing this treatise. Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg Rosenberger can be reached electronically on CompuServe as [74017,1344], on GEnie as R.ROSENBERGE, on InterNet as `74017.1344@compuserve.com', and on various national BBS linkups. Greenberg can be reached on MCI and BIX as `greenber', on UseNet as `c-rossgr@microsoft.com', and on CompuServe as [72461,3212]. You may give copies of this treatise to anyone if you pass it along in its entirety. Publications may reprint it at no charge if they give due credit to the authors and send two copies to: Rob Rosenberger, P.O. Box 643, O'Fallon, IL 62269.