Monster Media 1994 #1/monster.zip/monster/UTILS2/PC_CLK.ZIP/VIRUS.DOC

Text File | 1994-02-01 | 22KB | 362 lines

     Copyright (c) 1988,90 Rob Rosenberger & Ross M. Greenberg       Page 1 of 6


                                 Computer Virus Myths

                                  by Rob Rosenberger
                                with Ross M. Greenberg


     A number of myths have popped up recently about the threat of computer
     "viruses".  There are myths about how widespread they are, how dangerous
     they are, and even myths about what a computer virus really is.  We'd like
     the facts to be known.

     The first thing to learn is that a virus is a malicious programming
     technique falling in the realm of "Trojan horses."  All viruses are Trojan
     horses, but few Trojan horses can be called a virus.

     That having been said, it's time to go over the terminology we use when we
     lecture:

     BBS     Bulletin Board System.  If you have a modem, you can call a BBS and
             leave messages, transfer computer files back & forth, and learn a
             lot about computers.  (What you're reading right now, for example,
             most likely came to you from a BBS.)

     Bug     an accidental flaw in the logic of a program which makes it do
             things it shouldn't really be doing.  Programmers don't mean to put
             bugs in their program, but they always creep in.  Programmers tend
             to spend more time debugging their programs than they do writing
             them in the first place.  Inadvertent bugs have caused more data
             loss than all the viruses combined.

     Hacker  someone who really loves computers and who wants to push them to
             the limit.  Hackers have a healthy sense of curiosity: they try
             doorknobs just to see if they're locked, and they tinker with a
             piece of equipment until it's "just right."  The computer revolu-
             tion itself is a result of hackers.

     Shareware
             a distribution method for quality software available on a "try
             before you buy" basis.  You pay for the program only if you find it
             useful.  Shareware programs can be downloaded from BBSs and you are
             encouraged to give evaluation copies to friends.  Many shareware
             applications rival the power of off-the-shelf counterparts, at just
             a fraction of the price.  (You must pay for the shareware you
             continue to use ── otherwise you're stealing software.)

     Trojan
     horse   a generic term describing a set of computer instructions purposely
             hidden inside a program.  Trojan horses tell a program to do things
             you don't expect it to do.  The term comes from a legendary battle
             in which the ancient city of Troy was offered the "gift" of a large
             wooden horse that secretly held soldiers in its belly.  The Trojans
             rolled it into their fortified city....

     Virus   a term for a very specialized Trojan horse which spreads to other
             computers by secretly "infecting" programs with a copy of itself.
             A virus is the only type of Trojan horse which is contagious, like

     Computer Virus Myths                                            Page 2 of 6


             the common cold.  If it doesn't meet this definition, then it isn't
             a virus.

     Worm    a term similar to a Trojan horse, but there is no "gift" involved.
             If the Trojans had left that wooden horse outside the city, they
             wouldn't have been attacked.  Worms, on the other hand, can bypass
             your defenses without having to deceive you into dropping your
             guard.  An example is a program designed to spread itself by
             exploiting bugs in a network software package.  Worms are usually
             released by someone who has normal access to a computer or network.

     Wormers the name given to the people who unleash destructive Trojan horses.
             Let's face it, these people aren't angels.  What they do hurts us.
             They deserve our disrespect.

     Viruses, like all Trojan horses, are purposely designed to make a program
     do things you don't expect it to do.  Some viruses are just an annoyance,
     perhaps only displaying a "Peace on earth" greeting.  The viruses we're
     worried about are designed to destroy your data (the most valuable asset of
     your computer!) and waste your valuable time in recovering from an attack.

     Now you know the difference between a virus and a Trojan horse and a bug.
     Let's get into some of the myths:

     "All purposely destructive code comes as a virus."
        Wrong.  Remember, "Trojan horse" is the general term for purposely
     destructive code.  Very few Trojan horses are actually viruses.

     "Viruses and Trojan horses are a recent phenomenon."
        Trojan horses have been around since the first days of the computer.
     Hackers toyed with viruses in the early 1960s as a form of amusement.  Many
     different Trojan horse techniques were developed over the years to embezzle
     money, destroy data, etc.  The general public wasn't aware of this problem
     until the IBM PC revolution brought it out into the spotlight.  Banks were
     still covering up computerized embezzlements six years ago because they
     believed they'd lose customers if word got out.

     "Viruses are written by hackers."
        Yes, hackers have written viruses.  So has a computer magazine pub-
     lisher.  Trojan horses were written for decades by middle-aged men wearing
     business suits.  We call people "wormers" when they abuse their knowledge
     of computers.  You shouldn't be afraid of hackers just because they know
     how to write viruses.  This is an ethics issue, not a technology issue.
     Hackers know a lot about computers; wormers abuse this knowledge.  Hackers
     (as a whole) got a bum rap when the mass media corrupted the term.

     "Computer viruses are reaching epidemic proportions."
        Wrong again.  Viruses may be spread all over the planet but they won't
     take over the world.  There are about 150 or so known "strains" at this
     time and some of them have been completely eliminated.  Your chances of
     being infected are slim if you take the proper precautions.  Yes, it's
     still safe to turn on your computer!

     "Viruses could destroy all the files on my disks."
        Yes, and a spilled cup of coffee will do the same thing.  If you have
     adequate backup copies of your data, you can recover from any virus/coffee
     attack.  Backups mean the difference between a nuisance and a disaster.  It

     Computer Virus Myths                                            Page 3 of 6


     is safe to presume there has been more accidental loss of data than loss by
     viruses and Trojan horses.

     "Viruses have been documented on over 400,000 computers."
        This statistic comes from John McAfee, a self-styled virus fighter who
     seems to come up with all the quotes the media love to hear.  If you assume
     it takes five minutes to adequately document a viral infection, you have to
     wonder where Mr. McAfee got almost four man-years to document a problem
     which is less than four years old.  We further assume his statistics
     include every floppy disk ever infected with a virus, as well as all of the
     computers participating in the Christmas & InterNet worm attacks.  (Worms
     cannot be included in virus infection statistics.)  The press doesn't
     really understand computer crimes, so they tend to call almost anything
     a virus.

     "Viruses can be hidden inside a data file."
        Data files can't wreak havoc on your computer ── only an executable
     program file can do that.  If a virus were to infect a data file, it would
     be a wasted effort.  But let's be realistic: what you think is 'data' may
     actually be an executable program file.  For example, batch files are text
     files, yet the MSDOS operating system treats them like a program.

     "Most BBSs are infected with viruses."
        Here's another scary myth drummed up in the big virus panic.  Very few
     BBSs are really infected.  It's possible a dangerous file may be available
     on a BBS but it doesn't mean the BBS itself is infected.  If a BBS were
     knowingly infected with a virus, it wouldn't stay open too long after word
     got out, would it?

     "BBSs and shareware programs spread viruses."
        "The truth," says PC Magazine publisher Bill Machrone, "is that all
     major viruses to date were transmitted by [retail] packages and private
     mail systems, often in universities."  (PC Magazine, October 11, 1988.)
     The Peace virus, for example, made its way into a retail product sold to
     thousands of customers.  Machrone goes on to say "bulletin boards and
     shareware authors work extraordinarily hard at policing themselves to keep
     viruses out."  Reputable sysops check every file for Trojan horses; nation-
     wide sysop networks help spread the word about dangerous files.  You should
     be wary of the software you get from BBSs, that's true ── but you should
     also be wary of the software you get from store shelves.  (By the way, some
     stores now have return policies for software.  Do you know for sure you
     were the first person to use those master disks?)

     "My computer could be infected if I call an infected BBS."
        BBSs can't write information on your disks ── that's handled by the
     communications software you use.  You can only transfer a dangerous file if
     you let your software do it.  (This might be different if your computer is
     hooked up to a network, but it requires special hardware & software.)  And
     there is no "300bps subcarrier" that lets a virus slip through a high speed
     modem.  The rumor was started by a joker named Mike RoChenle (IBM's "micro
     channel" PS/2 architecture, get it?) who left a techy-joke message on a
     public BBS.  Unfortunately, a few highly respected journalists were taken
     in by this joke.

     Computer Virus Myths                                            Page 4 of 6


     "My files are damaged, so it must have been a virus attack."
        It also could have been caused by a power flux, or static electricity,
     or a fingerprint on a floppy disk, or a bug in your software, or perhaps a
     simple error on your part.  Power failures and spilled cups of coffee have
     destroyed more data than all the viruses combined.

     "Donald Burleson was convicted of releasing a virus."
        A recent Texas computer crime trial was hailed all over the country as a
     "virus" trial.  Donald Burleson was in a position to release a complex,
     destructive worm on his employer's mainframe computer.  This particular
     worm couldn't spread to other computers, so it couldn't possibly have been
     a virus.  Davis McCown, the prosecuting attorney, claims he "never brought
     up the word virus" in the trial.  So why did the media call it one?
      1. David Kinney, a witness testifying for the defense (oddly enough),
         claimed he believed Burleson unleashed a virus.  The prosecuting
         attorney didn't argue the point and we don't blame him ── Kinney's
         bizarre claim probably helped sway the jury to convict Burleson, and it
         was the defense's fault for letting him testify.
      2. McCown gives reporters the facts behind the case and lets them come up
         with their own definitions.  The Associated Press and USA Today, among
         others, used such vague definitions that any program could be called a
         virus.  If we applied their definitions to the medical world, we could
         safely claim penicillin is a biological virus (which is, of course,
         absurd).
      3. McCown claims many quotes attributed to him "are misleading or fab-
         ricated" and identified one in particular which "is total fiction."
         Reporters sometimes print a quote out of context, and McCown apparently
         fell victim to it.  (It's possible a few bizarre quotes from David
         Kinney or John McAfee were accidentally attributed to McCown.)

     "Robert Morris Jr. released a benign virus on a defense network."
        It may have been benign, but it wasn't a virus.  Morris, the son of a
     chief computer scientist at the National Security Agency, allegedly became
     bored and took advantage of a bug in the Defense Department's networking
     software.  This tiny bug let him send a worm through the network.  Among
     other things, Morris's "InterNet" worm was able to send copies of itself to
     other computers in the network.  Due to some bugs in the worm module
     itself, the network became clogged in a matter of hours.  The press
     originally called it a "virus," like it called the Christmas worm a virus,
     because it spread to other computers.  Yet it didn't infect any computers.
     A few notes:
      1. Reporters finally started calling it a worm (a year after the fact),
         but only because lawyers in the case were constantly referring to it as
         such.  The difference between a worm and a virus is subtle, but
         profound.
      2. This worm worked only on Sun-3 & Vax computers which run a UNIX
         operating system and were specifically linked into the InterNet network
         at the time.
      3. The 6,200 affected computers cannot be counted in any virus infection
         statistics (they weren't infected).
      4. It cost way less than $96 million to clean up the attack.  An official
         Cornell University report claims the group behind this wild estimate
         "was probably serving itself" in an effort to drum up business.  People
         familiar with the case estimated the final figure to be under
         $1 million.
      5. Yes, Morris could easily have added some infection code to make it a
         worm/virus if he'd had the urge.

     Computer Virus Myths                                            Page 5 of 6


      6. The network bug exploited in the attack has since been fixed.
      7. Morris went to trial for launching the InterNet worm and was recently
         handed a federal conviction.

     "Viruses can spread to all sorts of computers."
        All Trojan horses are limited to a family of computers, and this is
     especially true for viruses.  A virus designed to spread on IBM PCs cannot
     infect an IBM 4300-series mainframe, nor can it infect a Commodore C64, nor
     can it infect an Apple MacIntosh.

     "My backups will be worthless if I back up a virus."
        No, they won't.  Let's suppose a virus does get backed up with your
     files.  You can restore important documents and databases without restoring
     an infected program.  You just reinstall programs from master disks.  It's
     tedious work but it's not as hard as people claim.

     "Anti-virus software will protect me from viruses."
        There is no such thing as a foolproof anti-virus program: Trojan horses
     and viruses can be (and have been) designed to bypass them.  Anti-virus
     products themselves can be tricky to use at times.  You may make a crucial
     mistake deciding whether to let a "flagged" event occur.  Your first line
     of defense should always be a good set of backups.  Anti-virus software is
     a good second line of defense.

     "Read-only files are safe from virus infections."
        This is a common myth among IBM PC users, and it has even been published
     (erroneously) in some computer magazines.  Supposedly, you can protect
     yourself by using the DOS ATTRIB command to set the read-only attribute on
     program files.  However, ATTRIB is software ── and what it can do, a virus
     can undo.  The ATTRIB command seldom halts the spread of viruses.

     "Viruses can infect files on write-protected disks."
        Here's another common IBM PC myth.  If viruses can modify read-only
     files, people assume they can modify write-protected floppies.  What they
     don't realize is the disk drive itself knows when a floppy is protected and
     refuses to write to it.  You can physically disable the drive's sensor but
     you can't override it with a software command.



     We hope this dispels the many computer virus myths.  Viruses DO exist, many
     of them will destroy files, and all of them can spread to other computers.
     But you can defend yourself with a cool head and a good set of backups.

     The following guidelines can shield you from Trojan horses and viruses.
     They will lower your chances of being infected and raise your chances of
     recovering from an attack.

      1. Set up a procedure to regularly back up your files and follow it
         religiously.  Consider purchasing a user-friendly program to take the
         drudgery out of this task.  (There are plenty to choose from.)
      2. Rotate between at least two sets of backups for better security (use
         set #1, then set #2, then set #1...).  The more sets you use, the
         better protected you are.  Many people take a "master" backup of their
         entire hard disk, then take "incremental" backups of those files which
         changed since the last time they backed up.  Incremental backups might
         only require five minutes of your time each day.

     Computer Virus Myths                                            Page 6 of 6


      3. Download files only from reputable BBSs where the sysop checks every
         program for Trojan horses.  If you're still afraid, consider getting
         programs from a BBS or "disk vendor" company which gets them direct
         from the authors.
      4. Let newly uploaded files "mature" on a BBS for one or two weeks before
         you download it (others will put it through its paces).
      5. Consider using a program that creates a unique "signature" of all the
         programs on your computer.  Run this program once in awhile to see if
         any of your applications have been modified ── either by a virus or by
         a stray gamma ray.
      6. DON'T PANIC if your computer starts acting weird.  It may be a virus,
         but then again maybe not.  Immediately turn off all power to your
         computer and disconnect it from any local area networks.  Reboot from a
         write-protected copy of your master DOS disk.  Do NOT run any programs
         on a "regular" disk (you might activate a Trojan horse).  If you don't
         have adequate backups, try to bring them up to date.  Yes, you might
         back up a virus as well, but it can't hurt you if you don't use your
         normal programs.  Set your backups off to the side.  Only then can you
         safely hunt for problems.
      7. If you can't figure out what's wrong and you aren't sure what to do
         next, turn off your computer and call for help.  Consider calling a
         local computer group before you call for an expert.  If you need a
         professional, consider a regular computer consultant first.  Some
         "virus removal experts" sell their services for prices far in excess of
         their actual value.
      8. [This should only be considered as a last resort.]  If you can't figure
         out what's wrong and you are sure of yourself, execute both a low-level
         and a high-level format on all your regular disks.  Next, carefully re-
         install all software from the master disks (not from the backups).
         Then, carefully restore only the data files (not the program files)
         from your backup disks.

     We'd appreciate it if you would mail us a copy of any Trojan horse or virus
     you discover.  (Be careful you don't damage the data on your hard disk
     while trying to do this!)  Include as much information as you can and put a
     label on the disk saying it contains a malicious program.  Send it to Ross
     M. Greenberg, 594 Third Avenue, New York, NY 10016.  Thank you.

       Ross M. Greenberg is the author of both shareware and retail virus
       detection programs.  Rob Rosenberger is the author of various phone
       bill analysis applications.  (Products are not mentioned by name
       because this isn't the place for advertisements.)  They each write for
       national computer magazines.  These men communicated entirely by modem
       while writing this treatise.

              Copyright (c) 1988,90 Rob Rosenberger & Ross M. Greenberg


     Rosenberger can be reached electronically on CompuServe as [74017,1344], on
     GEnie as R.ROSENBERGE, on InterNet as `[e-mail]', and on
     various national BBS linkups.  Greenberg can be reached on MCI and BIX as
     `greenber', on UseNet as `[e-mail]', and on CompuServe as
     [72461,3212].

     You may give copies of this to anyone if you pass it along in its entirety.
     Publications may reprint this for free if they obtain prior written per-
     mission.  Write to Rob Rosenberger, P.O. Box 643, O'Fallon, IL 62269.