NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/comp/org/eff/talk/8187

Text File | 1992-12-30 | 1.7 KB | 34 lines

Newsgroups: comp.org.eff.talk
Path: sparky!uunet!unislc!erc
From: [e-mail] (Ed Carp)
Subject: Re: Virus design
X-Newsreader: TIN [version 1.1 PL6]
References: <[e-mail]>
Message-ID: <[e-mail]>
Organization: Unisys Corporation SLC
Date: Wed, 30 Dec 1992 22:32:59 GMT
Lines: 22

Pete Hardie ([e-mail]) wrote:

: If I understand the Internet Worms methodology correctly, it would have been
: very much the same.  Morris used bugs in programs to get his (wholly self-
: contained) worm running on the new system.  Most, if not all, virus detection
: software assumes that the virus is not a self-contained entity, but a code
: fragment that lives w/in another program executable.

Which brings up another thread: the self-mutating virus.  All the virus scanners
I know of work by scanning your system for a signature generated by the virus
when it installs itself on your system.  This, of course, is to prevent the
virus from installing itself more than once.  But what if, when installing
itself on another system, it changed the signature in a pseudo-random way
(just for that system - a unique signature for that system, not just that virus)
to avoid virus scanners?  We could see viruses that mutate everytime they
replicate themselves.  How would one stop them without checking every possible
digital signature?  Interesting question, methinks.
--
Ed Carp            [e-mail], [e-mail]    801/538-0177
1935 will go down in history.  For the first time, a civilized nation has
full gun registration.  Our streets will be safer, our police more efficient,
and the world will follow our lead into the future.  --Adolf Hitler