ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/SWVSAF11.ZIP/MANUAL4.ASC

Text File | 1990-11-21 | 12.3 KB | 253 lines

Section 2:  Background Information


What is a virus

A computer virus is a computer program that copies all or part of itself to
other programs, and causes them to do the same. It may or may not do other
things. Sometimes computer viruses are hidden deep within other, useful
programs.

Computer viruses need not be bad.  It is interesting to note that it is
possible to create computer viruses to perform quite useful functions.  For
example, military intelligence organizations could write a virus that would
spread throughout large computing networks and utilize otherwise idle
computer time to attempt to decrypt captured information in the interests of
national security.  This would permit tens of thousands of computers to work
on the problem simultaneously.  Once one of the computers solved the
problem, another virus could be sent throughout the network to cease all of
the remaining activity.



How NOT to detect a virus

All computer viruses must spread to other programs or, by definition, they
are not viruses.  This tendency to spread to other programs is the ONLY
thing computer viruses have in common.  The methods viruses use to
accomplish this spreading, and the programs they target to spread into, vary
so much as to be completely unpredictable.  Viruses can spread to any file,
all files, or only to a certain kind of file.  Viruses can spread to
executable sections of storage that are not normally considered files, such
as the boot record or partition table. Viruses can use a wide variety of
tricks to try to spread.  Since legitimate, non-viral programs sometimes use
the same instructions as viruses for authorized activities, it is
unproductive to try to detect the presence of a virus by looking for
specific methods of spreading, or by looking at files to see if they contain
certain kinds of instructions.



Viral infection and file changes

When computer viruses spread, they modify other programs.  As few other
programs do this, the only reliable way of detecting viral infection is to
detect changes in files, and then determine if the changes are authorized.

THERE IS NO WAY ANY VIRUS CAN INFECT ANY PROGRAM WITHOUT CHANGING THAT
PROGRAM SOMEWHERE.

The changes could be very subtle, and by clever use of patches or
compression, it may be possible to avoid changing the size of a file, but
there will always be some change.  This creates the need for a reliable way
of detecting file changes.  The most obvious way to detect file changes is
to carry out a bit-by-bit (or byte-by-byte) comparison of two files, one of
which has been exposed to possible contamination, and the other of which has
not.

Unfortunately, this type of direct comparison of two copies of every file
isn't practical, because it requires on-line access to an extra copy of
everything.  Some other method is needed.




Digital Signatures

Virus detection isn't the first problem that has illustrated the need for
some reliable method of detecting changes in digital information.  For
decades, programmers have been using signatures of digital data to detect
corruption or errors in files.

Checksums

The simplest and fastest form of "digital signature" is a checksum.
Checksums record a summary of a file by treating every element of the file
as a binary number, and then adding up all the binary numbers to get a
"grand total".  Programs can easily determine if the file has been changed
by recalculating the checksum and comparing the result with the previous
checksum.

If a virus makes a change to a file, its checksum will also change, unless
the virus is smart enough to know how to compensate.  Unfortunately, since
it is quite easy for programmers to do this, checksums are not sufficiently
robust to detect changes in the face of a clever attack.

Because of this, SafeWord Virus-Safe does not rely on checksums.

Message Authentication Codes

Banks have a similar problem when they receive a message requesting an
electronic funds transfer.  Before wiring money in response to an electronic
message, a bank wants to be absolutely sure that the message was not
tampered with in transit.

To this end, banks rely on a digital signature technique that has been
established by the American National Standards Institute, known as ANSI
standard X9.9.  The International Standards Organization has recommended two
techniques. One of these is functionally equivalent to ANSI X9.9, and is
known as ISO 8731-1. The other ISO recommendiation is a slightly different
digital signature technique, known as ISO standard 8731-2.  Both of these
techniques result in a digital signature called a :Message Authentication
Code", or MAC.

MACs rely upon cryptography to certify that the information was in a
particular state when the signature was taken.

ANSI X9.9 and the Data Encryption Standard

The National Institute of Standards and Technology, or NIST, (formerly the
National Bureau of Standards, or NBS) of the United States government has
published a description of an approved method of encrypting data which they
call the "Data Encryption Standard", or "DES".  This encryption method has
been exhaustively tested, and it is believed by cryptographic experts to be
secure enough to resist attack by anyone who does not know the encrypting
cipher, even if they have a copy of the published DES specification in hand.
The Federal government of the United States has required use of DES in
certain situations.  Many government agencies and some commercial
organizations must, by law, use DES when they handle certain types of
sensitive or valuable data.

ANSI Standard X9.9 describes a way of using DES to calculate a MAC that is
believed to be impossible to forge.

ISO 8731-2

Another significant authentication algorithm is ISO 8731-2, recently adopted
as an International Standard by the International Standards Organization,
and which has been implemented to cryptographically authenticate
international wholesale banking funds transfers.  Although not nearly so
widely tested as DES, it consumes far less computer time and there is no
confirmed report of its ever having been broken.

Cyclic Redundancy Check

Another technique for obtaining a digital sign¼ature is the Cyclic
Redundancy Check, or CRC.  This technique is similar to a checksum, but it
is more sophisticated in that it can detect more subtle changes.  Checksums
rely on addition, which is insensitive to the order of the added numbers,
and generally cannot detect swapping of two adjacent bytes, for example.
CRCs can detect byte and bit swapping because they use more sophisticated,
position-dependent logic.  Because of their reliability, CRC tests are
frequently used in floppy disk controllers in order to determine whether
information has been correctly retrieved from disks.




Hybrid Digital Signatures

MACs with CRCs

DES encryption is very complex, and makes major demands on a personal
computer.  As a result, DES encryption takes longer than other encryption
methods, although Enigma Logic's software implementation of the DES
algorithm on a PC is the fastest commercially known.

The ISO 8731-2 algorithm is considerably faster than DES-based
authentication, but it is not fast enough to completely solve the
performance problem.

And although CRCs are much harder to fool than checksums, it is still
possible for a programmer to forge a CRC by including extra bytes that
compensate for the changes resulting from viral contamination.  The logic
and mathematics behind CRC calculation are well understood and documented
within the public domain, and a skilled programmer would have little
difficulty in compromising any security mechanism that relied exclusively
upon CRC-based change detection.

If DES and ISO-based MACs are too slow to be practical, and CRCs are not
secure enough, what do we do to create a fast, secure system? SafeWord
Virus-Safe handles this problem through an innovative and sophisticated set
of tools, each used at the discretion of the user.  You can specify DES MAC
checking, ISO MAC checking, CRC signatures, or hybrid mixtures involving DES
and CRC, or ISO and CRC.  Usually it is practical to specify a hybrid
mixture where a small percentage of the file is examined with a
sophisticated MAC, and the remainder is examined with a high-speed CRC
algorithm.  In these hybrid cases, sophisticated cryptographic techniques
are used to assure that attackers cannot predict which bytes are examined by
which method.  Furthermore, using a technique that cryptographers call
"cipher-block chaining", the results of all cryptographic calculations are
carried forward into all subsequent calculations.  This makes the CRC
results much harder to predict.  The result of all of this is a digital
signature that is nearly as strong as a DES or ISO MAC and nearly as fast as
calculating a CRC.


Turbo mode

SafeWord Virus-Safe also offers a mode for checking files, called "Turbo",
that checks only the first 512 and last 512 bytes of a file using CRC, and
adds to that the length of the file.  Most viruses are classified as
"appenders".  That is, they add themselves to the end of a target program.
For the virus to activate, it must alter instructions somewhere in the
program to point to the virus code.  This usually happens at the beginning
of the program.  Therefore, to speed up the process of checking, especially
large programs, we have created Turbo mode, which runs very quickly.

Virus-Safe and the Editor both now keep track of the size of each file in
the Checklist.  Whenever there is a signature difference, among other
information written to the Audit trail are the old and new file sizes.  This
will help the user determine which virus has struck the PC, since many
viruses are known simply by their individual lengths.



Optimizing SafeWord Virus-Safe

SafeWord Virus-Safe can examine your files so thoroughly that it is
virtually impossible for file corruption or unauthorized modi¡fication to
remain undetected.  But examining files takes time and decreases your
productivity; the more thorough the examination, the more time it takes.

So we've given you the option of deciding how often and how thoroughly your
files are examined.  By making certain choices when your SafeWord Virus-Safe
software is installed and when it runs, you will be able to specify the
following rules for examination of every file on your system:

1- Whether or not a file should be examined at all

2- When to examine the file (at boot time or when it is executed)

3- How frequently to examine the file (every time, every other time, etc),

and

4- How thoroughly to examine the file (the ratio of MAC to CRC, or just a
CRC of the first and last 512 bytes).

For example, consider a programmer with SafeWord Virus-Safe installed in
memory, who uses the program DEBUG.COM frequently.  He'll want to have DEBUG
examined, but if he uses it 40 times a day he won't want to have it examined
each time.  Instead, he will want it examined at least several times per
week, and he will want to know that the examination is thorough when it is
done.  He could therefore specify a thorough, non-forgeable,
cryptographically based examination every 25th time DEBUG is used.  Thus, 24
times out of 25, he won't be delayed at all when he needs DEBUG, but every
25th attempt to debug something will result in a few seconds of delay while
SafeWord Virus-Safe checks the program for corruption.

As another example, consider a bank, with SafeWord Virus-Safe installed in
memory, that infrequently uses an audit package to record high-value
electronic funds transfers.  Because of the risks involved in high-value
funds transfers, the bank wants to have the audit package examined every
time it is used.  Since the package is used infrequently, the productivity
impact is small, even if a thorough, non-forgeable, cryptographically based
examination is performed that requires several extra seconds.

Other program and data files at the bank, not directly related to management
of client funds, can be set up in a more routine manner.  For example, these
less critical programs can be examined only when the PC is booted, using a
high-speed technique that runs ten times as fast but doesn't offer the level
of security of a MAC.