NetNews Usenet Archive 1992 #18/NN_1992_18.iso/spool/comp/virus/3609

Internet Message Format | 1992-08-19 | 6.2 KB

Path: sparky!uunet!mcsun!uknet!doc.ic.ac.uk!ibmassc!yktnews!admin!newsgate.watson.ibm.com!news.ans.net!malgudi.oar.net!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: victor charlie (PC)
Message-ID: <[e-mail]>
Date: 18 Aug 92 12:47:18 GMT
Sender: [e-mail]
Lines: 122
Approved: [e-mail]

[e-mail] (James Roy) writes:

> It takes a radically different approach to virus control than McAfee's
> products.  It is a generic product which looks for virus activity and
> can detect all viruses even those previously unknown.

It is very dangerous to make claims that a single anti-virus program
is able (in its current state) to detect any possible viruses -
including the currently unknown ones... In all cases I have seen,
programs which made such claims could be easily bypassed just by a
combination of the currently existing virus techniques. Some of them
could be bypassed even by some of the existing viruses...

>   - a quick (3 second) routine which runs bait files and checks key
>   files and areas to detect active viruses.

This can be circumvented in different ways:

1) The "bait file" technique is not able to detect boot sector
infectors, non-resident, or companion viruses.

2) If the names of the generated bait files are easily predictable, a
targeted virus can easily avoid to infect them.

3) A virus which infects only sometimes, or only files with particular
properties, may just not want to infect the bait files.

> Once detected the signature
>   of the virus is captured in real time and a reboot is forced to purge
>   it from memory.  Because of this feature you do not have to depend on
>   updates from the developer nor risk extensive damage to your files due
>   to a virus unknown to the version of the scanner you have;

This method (on-the-fly scan string capturing) fails miserably with
polymorphic viruses. As to the damage - if the user is "lucky" enough,
the payload of the virus may trigger and cause significant damage -
which would not happen, had the virus been previously detected by a
scanner.

>   - an audit routine that allows you to record encrypted checksums of
>   all your executable files and later run a comparison.  This will
>   detect all changes to files and allow you to track down elusive
>   viruses;

An integrity checker, that is. This is a very powerful tool for virus
detection, but there are some pitfalls:

1) If an intelligent stealth virus is active in memory during the
integrity check, the integrity checker will be unable to spot the
modifications.

2) There are several possible virus attacks against integrity checking
programs, that a virus could use. Companion viruses and DOS-file
fragmentation are two of them. Most of these attacks can be easily
stopped by the integrity checking software, but the producers of this
software must know about them and take some steps to stop them.
Sincerely, do you know what the DOS-file fragmentation attack consists
in, and does the integrity checking part of your product take care of
it?

3) A specific kind of viruses - the so-called slow viruses, cannot be
stopped by integrity checking programs. I mean, there is no practical
way to do it, not that they are theoretically unstoppable. More
exactly, I do not know about any practical way to stop them.

> VC is a highly secure product designed to foil viruses which may be
> specifically written to attack it.

Viruses, written to specifically attack a particular product, usually
do not spread very far, but they are particularly dangerous against
this product, if they are well implemented. Why do you think that your
product is so secure? What steps does it take to prevent a targeted
attack?

> It currently does not use a TSR due to the vulnerability of TSR virus
> monitors to such targeted viruses.  VC's checks are easily put into your
> applications menu or batch files which allow it to be run automatically
> (and silently) frequently during your computing day.

A (rather stupid) targeted attack I can think of would be to inspect
the programs started from CONFIG.SYS and AUTOEXEC.BAT, "scan" them for
the "scan string" of your program, and delete them, or even better -
replace them with the virus.

BTW, how does your product react if the database of file checksums
suddenly disappears? There are at least two viruses, which attack
integrity checkers in this way, and they do it rather successfully...

> It is, one might say, a scanner in reverse.  Rather than relying on
> scanning new files for viruses which the scanner knows about, VC is run
> after a new application is run to see if any viruses have gone active.

Problem is, this is quite unreliable, if the virus is already active
and smart enough...

> VC does have a scanner which it updates itself.  One can use it for
> scanning new files but it is primarily for used for tracking down a
> virus once detected by the method described above.

> Given the stealth viruses and polymorphic viruses which are out there,
> scanners are becoming more and more limited in their effectiveness.

I wholeheartly agree with the second paragraph, but think that it is
in contradiction with the first. Scanning for a "captured" on-the-fly
signature is still scanning. OK, this is an "auto-updating" scanner,
but it still fails (even more often than the "normal" scanners) with
the polymorphic and with some stealth viruses.

Please, do not think that with the above criticisms I am trying to
underestimate your product. I agree that it is probably a stronger
line of defense against viruses than any scanner-only based defense.
However, I cannot agree with the claims that it can "detect all
viruses - known or unknown", although I can accept that it is able to
detect whole classes of unknown viruses.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev           Virus Test Center, University of Hamburg
Tel.:[phone], Fax: [phone]       Fachbereich Informatik - AGN
** PGP public key available by finger. **     Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: [e-mail]     D-2000 Hamburg 54, Germany