Hacker 2/HACKER2.mdf/virus/virusl2/virusl2.67

Text File | 1995-01-03 | 17KB | 412 lines

VIRUS-L Digest              Monday, 20 Mar 1989         Volume 2 : Issue 67

Today's Topics:
A New VIRUS Conference
(Mac) nVIR by Association
Re: nVIR2 (??) (Mac)
I need help with viruses (Mac)
File lock protection (Mac)
nVir2 on the Mac
Viruses in media

---------------------------------------------------------------------------

Date:    Fri, 17 Mar 89 07:46 CST
From:    Ken  De Cruyenaere <[e-mail]> 204-474-8340
Subject: A New VIRUS Conference

   The Computer Security Institute has put together a pretty interesting
   sounding conference in early May.  Details follow:

           COMPUTER VIRUSES '89 at the IBM & DEC Users Conference
               May 1-3, 1989 * Hyatt Regency O'Hare * Chicago
                  Sponsored by Computer Security Institute

                              PROGRAM OVERVIEW

* Partial list of speakers addressing virus-related topics:

     Eugene H. Spafford, Purdue University, will present an in-depth
          analysis of the Internet worm incident.

     Michael Karels, head of UNIX development at UC Berkeley and an
          Internet worm "swat team" member, will discuss how UNIX is
          meeting the virus challenge.

     Kenneth R. van Wyk, creator of Lehigh University's VIRUS-L bulletin
          board, who led the fight against the Lehigh virus, will talk
          about lessons learned.

     Richard D. Pethia, Carnegie Mellon University, will describe the
          first DARPA CERT (Computer Emergency Response Team), which he
          heads.

     Davis McCown, prosecutor in the "Texas Virus Trial" which
          convicted Donald Gene Burleson in September 1988, will
          recount the investigation, the trial, and what was learned.

- -----------------------------------------------------------------------------
* "Live" demonstrations of viruses, hacking, bulletin boards:

     Ross Greenberg, author of FLU_SHOT+, will demo viruses and describe
          PC Magazine's evaluation of 11 anti-virus products.

     Thomas V. Sobczak of Application Configured Computers will
          demonstrate hacking, underground bulletin boards, virus
          behavior, and public domain solutions.

     John McAfee, Computer Virus Industry Association, will demonstrate
          virus and anti-virus programs and present new statistical
          information on viruses.

- -----------------------------------------------------------------------------
* Information on new security-related products:

     CA-ACF2/VAX and CA-Top Secret/VAX, which can help unify security and
          access control in mixed IBM-DEC shops.

     ClydeSentry, LJK/Security, Secure Pak, and The Security Toolkit,
          for assessing and monitoring security in DEC environments.

- -----------------------------------------------------------------------------
* Exhibition -- A wide range of computer security products will be
displayed during this two-day show.

* Workshop Orientation -- 42 half-day sessions

* Discounts:  40% air travel discounts with United
             35-40% discount on Hyatt Regency O'Hare room rates


For more information, Contact:
                   Van McGuirk
                   Computer Security Institute
                   360 Church Street
                   Northborough, MA 01532
                   [phone]
- ---------------------------------------------------------------------
Ken De Cruyenaere - Computer Security Coordinator
Computer Services - University of Manitoba - Winnipeg, Manitoba, Canada
Bitnet: [e-mail]               [phone]

------------------------------

Date:         Fri, 17 Mar 89 09:17:08 EST
From:         Joe McMahon <[e-mail]>
Subject:      (Mac) nVIR by Association

The nVIR virus must be executed in SOME way for it to infect a system.
Inserting a disk causes SYSTEM code to be executed, but none from the
inserted disk. I suggest you track this person down, and have him/her
do it again, with you watching. See if there are any funky INITs or
suchlike that s/he's using.

  --- Joe M.

------------------------------

Date:     Fri, 17 Mar 89 12:20:05 PST
From:     [e-mail]  (Commander Spock)
Subject:  Re: nVIR2 (??) (Mac)

Chances are you have nVIR, Type B, and someone who has a cute sense of
humor has simply renamed the resource ID.  If you can afford to spend
about $70, go out to a retail store and purchase a copy of "Virex" by
HJC Software.  It should alleviate the problem.

Hope this helps!

Robert S. Radvanovsky      [e-mail] (Internet)
California Polytechnic Univ. [e-mail]                 (BITNET)
Pomona, California

P.S. Any questions?  Send them to me!  I'll try to help you as much as
possible.

------------------------------

Date:    Fri, 17 Mar 89 18:07 EST
From:    "Sonja Kueppers [phone]" <[e-mail]>
Subject: I need help with viruses (Mac)

I am a lowly student employee of the Center for Academic Computing at
Penn State University, and I need help in convincing my bosses that it
is NOT necessary to add any other search strings to Virus Detective
2.1.1.  Everyone here seems convinced that search strings like DATA ID
- -4001 and atpl ID 128, both of which are redundant to CODE JStart 7026
for our purposes-all we are trying to do is find the viruses anywhere
on the system disk so that we know to recopy the disk.

If you have any information which would help me convince my bosses of
this, please send it to me!  Thanks!
- -Sonja

------------------------------

Date: Sat, 18 Mar 89 13:56:48 EST
From: [e-mail] (Joe Sieczkowski)
Subject: File lock protection (Mac)


>Set the file locked bit will prevent a virus from using the high level
>write routines to change the file.
>...
>To write to the locked file the virus writer on the Mac would probably
>have to use low level routines and do sector read/writes with manual
>update of the catalog.

I'm no MAC expert but I don't even think low level routines are necessary.
ie,
  if file locked then
      unlock file
      infect/change file
      lock file
  else
      infect/change file

Joe

------------------------------

Date: 18 Mar 89 20:37 +0100
From: Markus Mueller <[e-mail]>
Subject: nVir2 on the Mac

> is infected by a form
> of the nVir virus which we have not previously encountered.  We have
> numerous public domain virus programs (AntiPan, Interfereon, VirusRX,
> VirusDetectve, Ferret, KillScoresUs, AntiVirus, and Vaccine) but none
> of them has been able to adequately deal with the strain of nVir we

Looks like the same strain of nVIR that we have seen a couple of times
at ETH Zurich. Unlike the regular vNIR, this strain does not maintain
an nVIR 2 resource but hides that information somewhere else, causing
all disinfection programs to fail. The only way to get rid of this
nVIR strain is to reload all infected applications from clean copies.

   Markus Mueller
   Communications Systems Group
   Eidgenoessische Technische Hochschule
   CH-8092 Zurich
   Switzerland

   Switch : [e-mail]
   ARPA   : [e-mail]
   UUCP   : [e-mail]
   X.400  : G=markus;S=mueller;OU=inf;O=ethz;P=ethz;A=arcom;C=ch

------------------------------

Date:     Sat, 18 Mar 89 17:42 EST
From:     Dimitri Vulis <[e-mail]>
Subject:  Viruses in media

Reprinted without permission from _The Office: Magazine of Information
Systems and Management_, March 1988. I have omitted about 50% of the
paper (that was not false and/or misleading):

>                The Computer Virus: is There a Real Panacea?
>
>What first began as a prank has since reached the point where everyone
>has cause to worry.
>
>                             By Scott W. Cullen
>
>You are sitting at your computer, working on an important report.
>Suddenly, the information on screen disappears and is replaced by the
>word ``Goodbye.''  Within seconds, this message vanishes from your
>view. You try to retrieve data only to discover it is gone, along with
>all the other files stored on that disk. You have just been attacked
>by a computer virus, and you are not alone.  It is estimated that
>nearly 350,000 computers were infected by some type of virus last
>year.

The introduction, and the accompanying cartoon, are a rip-off of the
Time magazine article.

>...
>
>A virus is a self-replicating block of code that enters a computer via
>diskette, over telephone lines, or manually. The one characteristic of
>a virus that distinguishes it from other codes is that it spreads the
>infection just as humans spread a biological virus---by contact. As
>healthy diskettes and programs come in contact with the disk drive of
>an infected computer, the virus, in the form of a format code, merges
>into that disk causing an infection.

A meaningless use of buzzwords.

>According to Jon David, a Tappan, N.Y.-based computer consultant,
>``Viruses usually affect specific operating environments. When those
>environments change, a virus may act differently. It may pose no
>danger in one but wreak havoc in another.''
>
>A virus may destroy data, reformat a disk, weak out its drive, or
>flash a harmless message on screen. ``The most insidious problem is a
>virus that spreads itself and causes occasional errors,'' says Larry
>DeMartin, president of Computer Integrity Corp.
>
>Many viruses are self-replicating, often consuming significant space
>in a computer's memory and eventually jamming the machine. Even
>computers utilizing voice synthesizers have been stricken with audible
>disturbances. A virus not only affects PCs; it can attack mainframes
>and minicomputers.

That is, the same virus infects PCs, minis and mainframes?

>Most viruses have what is described as a Trojan Horse feature or
>trigger that instructs it to act at a predetermined time or event such
>as a specific number of program executions. This may happen the same
>day or years later.

That's not what I mean by a Trojan horse...

>...
>
>The first virus was created in the 1960s as a game. Kept secret for
>nearly 20 years, the formula was reveled in a 1983 speech by Ken
>Thompson, a software engineer who wrote the first version of the Unix
>computer operating system.  One year later, a columnist for a
>scientific journal mailed readers, who sent in a $2 postage fee,
>guidelines for creating their own viruses. Since that time, malicious
>hackers have been hovering over keyboards honing unhealthy programs.

I don't think I have to comment on this...

>One of the first destructive viruses to gain notoriety was the
>``Pakistani Virus,'' which first appeared in early 1986. Created by a
>computer store owner in Lahore, Pakistan, as retribution against users
>who made illegal copies of his customized programs, the virus was
>inserted in brand-name software and later sold to American tourists.
>Because these customers often exchanged disks or made bootleg copies
>for friends, the virus spread to nearly 100,000 floppy disks, often
>wiping out data.

I don't know where the number came from. The story differs
significantly from what has been reported by others.

>...
>
>The media blitz following the November 1988 epidemic affecting users
>of the low-security InterNet message exchange network turned a hacker
>into a celebrity and spawned a score of imitators. Some of these
>hackers even broke into the same network less than a month after the
>earlier incident. Apparently network users were circulating
>information on methods to prevent unauthorized access, and
>inadvertently tipped off hackers to the formula for plugging into
>unprotected networks.
>
>Shared information networks such a InterNet are designed for easy
>access and are more susceptible to a virus that those providing
>sensitive information.  Even though these networks are harder to
>penetrate because of the complex series of access codes or passwords,
>computer experts believe that no system or network is virus-proof.
>``There is always an entry point, even in a diskless system with no
>outside connection,'' explains Del Jones, president, National LAN
>Laboratory...

No comment.

>...
>
>Computer security methods vary. Perhaps the most drastic is turning
>off a machine and leaving it off. Another alternative is disconnecting
>it from telephone lines. Securing operations by restricting or
>monitoring computers and their facilities access is a more reasonable
>means of protection which many organizations have adopted. ``Companies
>are not afraid of virus attack, but of using system use,'' said Mr.
>David.
>
>An infected computer can be costly. According to the Computer Virus
>Industry Assn., an organization made up of software manufacturers who
>make anti-virus products, the cost to clean up last November's
>InterNet virus was estimated at about $96 million. Of 50,000 possible
>computers, 6200 were infected and shut down for nearly 16 hours. The
>group says it took an average of 12 programmers at each site some 36
>hours to evaluate every compute that may have been infected. The cost
>of each immobilized computer was put at $372 per hour, the association
>reported.

Somebody ought to do something about this CVIA. As far as I know, 6000
was a very rough estimate. All these exact numbers look very
suspicious.

>...
>
>The past five months have seen heavy interest in anti-viral products.
>After last year's highly-publicized incident, manufacturers of these
>programs experiences as much as a 50% sales increase.
>
>Some 30 products are available, ranging from detective programs which
>screen software for viruses, to recovery/corrective products which
>help a system recover from a virus attack by purging it. These
>programs cost from $10 to several hundred dollars.

That's unfortunate, since most of them are worthless/harmful.

>...
>
>Some programs require users to boot-up once in the morning, others
>require this more frequently. ``The more checking you do, the more
>secure you are,'' said Mr. David, ''and if you get protection that
>costs five minutes of time in the morning, it's worth it.''
>
>According to Mr. DeMartin, programs used the most often should be
>checked frequently. One such product checks for any program
>modification and also indicates direct human tampering, hard disk
>errors and operating system failures. Mr. DeMartin believes that a
>virus deserves its own protection mechanism because all previous
>computer diseases could be cured by yesterdays back-up tape.

Again, meaningless use of buzzwords.

>...
>
>                Sidebar: How to Reduce the Risk of Infection
>
>All software should be purchased from known, reputable sources and be
>in its original shrink-wrap or sealed diskette containers when
>received.
>
>New software should be reviewed carefully by a system manager and
>quarantined on an isolated computer before installation on a
>distributed system. This will reduce the risk of contamination.
>
>A back-up copy of software and data should be made at least one a
>month, with the back-up copy stored for at least one year before
>reuse. This will allow restoration of a system that has been
>contaminated by a ``time-released'' virus. A plan that includes
>``grandfathered'' rotation of back-up copies will further reduce risk.
>
>System administrators should restrict access to programs and data on a
>``need-to-use'' basis. This isolates problems and facilitates
>diagnosis.
>
>Many ``shareware'' and ``freeware'' programs are invaluable
>applications.  However, they are the prime entry point for system
>viruses. Skeptical review of such programs is prudent. Also, extended
>preliminary quarantine is essential before introducing these programs
>on a distributed system
>
>System managers should make plans for quick removal from service of
>all copies of a suspect program, and immediately back up all related
>data. These plans should be made known to users.

Meaningless buzzwords; apparently, this refers to networks rather than
PCs.

I am not aware of any reliable statistics comparing the number of
virus infections via shrink-wrapped software with that via software
downloaded from bulletin boards. My personal estimate is that a
shrink-wrapped disk, especially one from a large, badly managed
company, is approximately 3 times as likely to be infected with a
virus than a program picked at random from a reputable BBS.

- -DV

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253