460 lines
26 KiB
Plaintext
460 lines
26 KiB
Plaintext
|
|
Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg Page 1 of 8
|
|
|
|
|
|
|
|
Computer Virus Myths
|
|
|
|
(8th Edition, March 1992)
|
|
|
|
by Rob Rosenberger
|
|
with Ross M. Greenberg
|
|
|
|
|
|
A number of myths have surfaced about the threat of computer "viruses".
|
|
There are myths about how widespread they are, how dangerous they are, and
|
|
even myths about what a computer virus really is. We'd like the facts to
|
|
be known.
|
|
|
|
The first thing to learn is that a virus is a malicious programming tech-
|
|
nique in the realm of "Trojan horses." All viruses are Trojan horses, but
|
|
few Trojan horses can be called a virus.
|
|
|
|
That having been said, it's time to go over the terminology we use when we
|
|
lecture:
|
|
|
|
BBS Bulletin Board System. If you have a modem, you can call
|
|
a BBS and leave messages, transfer computer files back &
|
|
forth, and learn a lot about computers. (What you're
|
|
reading right now, for example, most likely came to you
|
|
from a BBS.)
|
|
|
|
Bug an accidental flaw in the logic of a program which makes
|
|
it do things it shouldn't really be doing. Programmers
|
|
don't mean to put bugs in their program, but they always
|
|
creep in. Programmers tend to spend more time debugging
|
|
their programs than they do writing them in the first
|
|
place. Inadvertent bugs have caused more data loss than
|
|
all the viruses combined.
|
|
|
|
Hacker someone who really loves computers and who wants to push
|
|
them to the limit. Hackers have a healthy sense of curi-
|
|
osity: they try doorknobs just to see if they're locked,
|
|
and they tinker with a piece of equipment until it's "just
|
|
right." The computer revolution itself is a result of
|
|
hackers.
|
|
|
|
Shareware a distribution method for quality software available on a
|
|
"try before you buy" basis. You pay for the program only
|
|
if you find it useful. Shareware programs can be down-
|
|
loaded from BBSs and you are encouraged to give evaluation
|
|
copies to friends. Many shareware applications rival the
|
|
power of off-the-shelf counterparts, at just a fraction of
|
|
the price. (You must pay for the shareware you continue
|
|
to use -- otherwise you're stealing software.)
|
|
|
|
Trojan horse a generic term describing a set of computer instructions
|
|
purposely hidden inside a program. Trojan horses tell a
|
|
program to do things you don't expect it to do. The term
|
|
comes from a legendary battle in which the ancient city of
|
|
|
|
Computer Virus Myths Page 2 of 8
|
|
|
|
|
|
|
|
Troy received the gift of a large wooden horse. The
|
|
"gift" secretly held soldiers in its belly, and when the
|
|
Trojans rolled it into their fortified city....
|
|
|
|
Virus a term for a very specialized Trojan horse which spreads
|
|
to other computers by secretly "infecting" programs with a
|
|
copy of itself. A virus is the only type of Trojan horse
|
|
which is contagious, like the common cold. If it doesn't
|
|
meet this definition, then it isn't a virus.
|
|
|
|
Worm a term similar to a Trojan horse, but there is no "gift"
|
|
involved. If the Trojans had left that wooden horse out-
|
|
side the city, they wouldn't have been attacked. Worms,
|
|
on the other hand, can bypass your defenses without having
|
|
to deceive you into dropping your guard. An example is a
|
|
program designed to spread itself by exploiting bugs in a
|
|
network software package. Worms are usually released by
|
|
someone who has normal access to a computer or network.
|
|
|
|
Wormers the name given to the people who unleash destructive
|
|
Trojan horses. Let's face it, these people aren't angels.
|
|
What they do hurts us. They deserve our disrespect.
|
|
|
|
Viruses, like all Trojan horses, purposely make a program do things you
|
|
don't expect it to do. Some viruses are just an annoyance, perhaps only
|
|
displaying a "Peace on earth" greeting. The viruses we're worried about
|
|
are designed to destroy your data (the most valuable asset of your com-
|
|
puter!) and waste your valuable time in recovering from an attack.
|
|
|
|
Now you know the difference between a virus and a Trojan horse and a bug.
|
|
Let's get into some of the myths:
|
|
|
|
"All purposely destructive code comes as a virus."
|
|
Wrong. Remember, "Trojan horse" is the general term for purposely
|
|
destructive code. Very few Trojan horses actually qualify as viruses. Few
|
|
newspaper or magazine reporters have a real understand of computer crimes,
|
|
so they tend to call almost anything a virus.
|
|
|
|
"Viruses and Trojan horses are a recent phenomenon."
|
|
Trojan horses have been around since the first days of the computer;
|
|
hackers toyed with viruses in the early 1960s as a form of amusement. Many
|
|
different Trojan horse techniques emerged over the years to embezzle money,
|
|
destroy data, etc. The general public didn't know of this problem until
|
|
the IBM PC revolution brought it into the spotlight. Banks still hush up
|
|
computerized embezzlements (as they did during the 1980s) because they
|
|
believe customers will lose faith in their computer systems if the word
|
|
gets out.
|
|
|
|
"Viruses are written by hackers."
|
|
Yes, hackers have purposely unleashed viruses, but so has a computer
|
|
magazine publisher. And according to one trusted military publication, the
|
|
U.S. Defense Department develops them as weapons. Middle-aged men wearing
|
|
business suits created Trojan horses for decades before the advent of com-
|
|
|
|
Computer Virus Myths Page 3 of 8
|
|
|
|
|
|
|
|
puter viruses. We call people "wormers" when they abuse their knowledge of
|
|
computers. You shouldn't fear hackers just because they know how to write
|
|
viruses. This is an ethics issue, not a technology issue. Hackers know a
|
|
lot about computers; wormers abuse their knowledge. Hackers (as a whole)
|
|
got a bum rap when the mass media corrupted the term.
|
|
|
|
"Viruses infect 25% of all IBM PCs every month."
|
|
If 25% suffer an infection every month, then 100% would have a virus
|
|
every four months assuming the user took no preventive measures -- in other
|
|
words, every IBM PC would suffer an infection three times per year. This
|
|
astronomical estimate surfaced after virus expert (and antivirus vendor)
|
|
Dr. Peter Tippett published "The Kinetics of Computer Virus Replication," a
|
|
complex thesis on how viruses might spread in the future. Computer viruses
|
|
exist all over the planet, yes -- but they won't take over the world. Only
|
|
about 400 different viruses exist at this time and some of them have been
|
|
completely eliminated "from the wild." (Of course, virus experts retain
|
|
copies even of "extinct" viruses in their archives.) You can easily reduce
|
|
your exposure to viruses with a few simple precautions. Yes, it's still
|
|
safe to turn on your computer!
|
|
|
|
"Only 400 different viruses? But most experts talk about them in the thou-
|
|
sands."
|
|
The virus experts who "originate" these numbers tend tto work for
|
|
antivirus firms. They count even the most insignificant variations of
|
|
viruses as part of the grand total for advertising purposes. When the
|
|
Marijuana virus first appeared, for example, it displayed the word
|
|
"legalise," but a miscreant later modified it to read "legalize." Any pro-
|
|
gram capable of detecting the original virus will detect the version with
|
|
one letter changed -- but antivirus companies count them as "two" viruses.
|
|
Such obscure differentiations quickly add up.
|
|
|
|
"Viruses could destroy all the files on my disks."
|
|
Yes, and a spilled cup of coffee will do the same thing. If you have
|
|
adequate backup copies of your data, you can recover from any virus or
|
|
coffee problem. Backups mean the difference between a nuisance and
|
|
a disaster. It is safe to presume there has been more accidental loss of
|
|
data than loss by viruses and Trojan horses.
|
|
|
|
"Viruses have been documented on over 300,000 computers (1988)."
|
|
"Viruses have been documented on over 400,000 computers (1989)."
|
|
"Viruses have been estimated on over 5,000,000 computers (1992)."
|
|
These numbers come from John McAfee, a self-styled virus fighter who
|
|
craves attention and media recognition. If we assume it took him a mere
|
|
five minutes to adequately document each viral infection, it would have
|
|
taken four man-years of effort to document a problem only two years old by
|
|
1989. We further assume McAfee's statements include every floppy disk ever
|
|
infected up to that time by a virus, as well as all of the computers
|
|
participating in the Christmas and InterNet worm attacks. (Worms cannot be
|
|
included in virus infection statistics.)
|
|
McAfee prefers to "estimate" his totals these days. Let's assume we
|
|
have about 100 million computers of all types & models in use around the
|
|
world. McAfee's estimate means 1 out of every 20 computers on the planet
|
|
supposedly has a virus. It sounds like a pretty astronomical number to
|
|
most other virus experts.
|
|
|
|
Computer Virus Myths Page 4 of 8
|
|
|
|
|
|
|
|
"Viruses can hide inside a data file."
|
|
Data files can't wreak havoc on your computer -- only an executable pro-
|
|
gram file can do that (including the one that runs when you first turn on
|
|
your computer). If a virus infected a data file, it would be a wasted
|
|
effort. But let's be realistic: what you think is 'data' may actually be
|
|
an executable program file. For example, a "batch file" qualifies as text
|
|
on an IBM PC, yet the MS-DOS operating system treats it just like a pro-
|
|
gram.
|
|
|
|
"BBSs and shareware programs spread viruses."
|
|
Here's another scary myth drummed up in the big virus panic, this one
|
|
spouted as gospel by many "experts" who claim to know how viruses spread.
|
|
"The truth," says PC Magazine publisher Bill Machrone, "is that all major
|
|
viruses to date were transmitted by [retail] packages and private mail sys-
|
|
tems, often in universities." (PC Magazine, October 11, 1988.) Machrone
|
|
said this back in 1988 and it still applies to this day. Almost 50 retail
|
|
companies so far have admitted spreading infected master disks to tens of
|
|
thousands of customers since 1988 -- compared to only five shareware
|
|
authors who have spread viruses on master disks to less than 100 customers.
|
|
Machrone goes on to say "bulletin boards and shareware authors work extra-
|
|
ordinarily hard at policing themselves to keep viruses out." Reputable
|
|
sysops check every file for Trojan horses; nationwide sysop networks help
|
|
spread the word about dangerous files. Yes, you should beware of the soft-
|
|
ware you get from BBSs and shareware authors, but you should also beware of
|
|
the retail software you find on store shelves. (By the way, many stores
|
|
now have software return policies. Do you know for sure you were the only
|
|
one who used those master disks?)
|
|
|
|
"My computer could be infected if I call an infected BBS."
|
|
BBSs can't write information on your disks -- the communications soft-
|
|
ware you use performs this task. You can only transfer a dangerous file to
|
|
your computer if you let your software do it. And there is no "300bps sub-
|
|
carrier" that lets a virus slip through a high speed modem. A joker named
|
|
Mike RoChenle (IBM's "micro channel" PS/2 architecture, get it?) started
|
|
the 300bps myth when he left a techy-joke message on a public BBS. Unfor-
|
|
tunately, a few highly respected journalists were taken in by the joke.
|
|
|
|
"So-called 'boot sector' viruses travel primarily in software downloaded
|
|
from BBSs."
|
|
This common myth -- touted as gospel even by Australia's Computer Virus
|
|
Information Group -- expounds on the mythical role computer bulletin boards
|
|
play in spreading viruses. Boot sector viruses can only spread by direct
|
|
contact and "booting" the computer from an infected disk. BBSs deal exclu-
|
|
sively in program files and have no need to pass along copies of disk boot
|
|
sectors. Bulletin board users therefore have a natural immunity to boot-
|
|
sector viruses when they download software.
|
|
We should make a special note about "dropper" programs developed by
|
|
virus researchers as an easy way to transfer boot sector viruses among
|
|
themselves. Since they don't replicate, "dropper" programs don't qualify
|
|
as a virus in and of themselves. Such programs have never been discovered
|
|
on any BBS to date and have no real use other than to transfer infected
|
|
boot sectors.
|
|
|
|
Computer Virus Myths Page 5 of 8
|
|
|
|
|
|
|
|
"My files are damaged, so it must have been a virus attack."
|
|
It also could have happened because of a power flux, or static elec-
|
|
tricity, or a fingerprint on a floppy disk, or a bug in your software, or
|
|
perhaps a simple error on your part. Power failures and spilled cups of
|
|
coffee have destroyed more data than all viruses combined.
|
|
|
|
"Donald Burleson was convicted of releasing a virus."
|
|
Newspapers all over the country hailed a Texas computer crime trial as a
|
|
"virus" trial. The defendent, Donald Burleson, was in a position to
|
|
release a destructive Trojan horse on his employer's mainframe computer.
|
|
This particular software couldn't spread to other computers, so it couldn't
|
|
possibly have qualified as a virus. Davis McCown, the prosecuting attor-
|
|
ney, claims he "never brought up the word virus" during the trial. So why
|
|
did the media call it one?
|
|
1. David Kinney, an expert witness testifying for the defense, claimed
|
|
Burleson had unleashed a virus. The prosecuting attorney didn't argue
|
|
the point and we don't blame him -- Kinney's bizarre claim probably
|
|
helped sway the jury to convict Burleson, and it was the defense's
|
|
fault for letting him testify.
|
|
2. McCown gave reporters the facts behind the case and let them come up
|
|
with their own definitions. The Associated Press and USA Today, among
|
|
others, used such vague definitions that any program would have
|
|
qualified as a virus. If we applied their definitions to the medical
|
|
world, we could safely label penicillin as a biological virus (which
|
|
is, of course, absurd).
|
|
3. McCown claims many quotes attributed to him were "misleading or fab-
|
|
ricated" and identified one in particular which "is total fiction."
|
|
Reporters sometimes print a quote out of context, and McCown appar-
|
|
ently fell victim to it. (It's possible a few bizarre quotes from
|
|
David Kinney or John McAfee were accidentally attributed to McCown.)
|
|
|
|
"Robert Morris Jr. released a benign virus on a defense network."
|
|
It may have been benign but it wasn't a virus. Morris, the son of a
|
|
chief computer scientist at the U.S. National Security Agency, decided one
|
|
day to take advantage of a bug in the Defense Department's networking soft-
|
|
ware. This tiny bug let him send a worm through the network. Among other
|
|
things, Morris's "InterNet" worm sent copies of itself to other computers
|
|
in the network. Unfortunately, the network clogged up in a matter of hours
|
|
due to some bugs in the worm module itself. The press originally called it
|
|
a "virus," like it called the Christmas worm a virus, because it spread to
|
|
other computers. Yet Morris's programs didn't infect any computers. A
|
|
few notes:
|
|
1. Reporters finally started calling it a worm a year after the fact, but
|
|
only because lawyers in the case constantly referred to it as a worm.
|
|
2. The worm operated only on Sun-3 & Vax computers which employ a UNIX
|
|
operating system and were specifically linked into the InterNet net-
|
|
work at the time.
|
|
3. The 6,200 affected computers cannot be counted in virus infection
|
|
statistics (since they weren't infected).
|
|
4. It cost way less than $98 million to clean up the attack. An official
|
|
Cornell University report claims John McAfee, the man behind this wild
|
|
estimate, "was probably serving [him]self" in an effort to drum
|
|
up business. People familiar with the case estimated the final figure
|
|
at under $1 million.
|
|
|
|
Computer Virus Myths Page 6 of 8
|
|
|
|
|
|
|
|
5. Yes, Morris could easily have added some infection code to make it a
|
|
worm/virus if he'd had the urge.
|
|
6. The network bug exploited in the attack has since been fixed.
|
|
7. Morris went to trial for launching the InterNet worm and received a
|
|
federal conviction. The Supreme Court refused to hear the case, so
|
|
his conviction stands.
|
|
|
|
"The U.S. government planted a virus in Iraq military computers during the
|
|
Gulf War."
|
|
U.S. News & World Report published a story in early 1992 accusing the
|
|
National Security Agency of replacing a computer chip in a printer bound
|
|
for Iraq just before the Gulf War with a secret computer chip containing a
|
|
virus. The magazine cited "two unidentified senior U.S. officials" as
|
|
their source, saying "once the virus was in the [Iraqi computer] system,
|
|
...each time an Iraqi technician opened a 'window' on his computer screen
|
|
to access information, the contents of the screen simply vanished." How-
|
|
ever, the USN&WR story shows amazing similarities to a 1991 April Fool's
|
|
story published by InfoWorld magazine. Most computer experts dismiss the
|
|
USN&WR story as a hoax -- an "urban legend" innocently created by the Info-
|
|
World joke. Some notes:
|
|
1. USN&WR has refused to retract the story, but it did issue a "clarifi-
|
|
cation" stating "it could not be confirmed that the [virus] was ulti-
|
|
mately successful." The editors broke with tradition and refused to
|
|
publish any of the numerous letters readers submitted about the virus
|
|
story.
|
|
2. Ted Koppel, a well-known American news anchor, opened one of his
|
|
"Nightline" broadcasts with a report on the alleged virus. Koppel's
|
|
staff politely refers people to talk with USN&WR about the story's
|
|
validity.
|
|
3. InfoWorld didn't label their story as fiction, but the last paragraph
|
|
identified it as an April Fool's joke.
|
|
|
|
"Viruses can spread to all sorts of computers."
|
|
All Trojan horses are limited to a family of computers, and this is
|
|
especially true for viruses. A virus designed to spread on IBM PCs cannot
|
|
infect an IBM 4300 series mainframe, nor can it infect a Commodore C64, nor
|
|
can it infect an Apple Macintosh.
|
|
|
|
"My backups will be worthless if I back up a virus."
|
|
No, they won't. Let's suppose a virus does get backed up with your
|
|
files. You can restore important documents and databases -- your valuable
|
|
data -- without restoring an infected program. You just reinstall programs
|
|
from master disks. It's tedious work, but not as hard as some people
|
|
claim.
|
|
|
|
"Antivirus software will protect me from viruses."
|
|
There is no such thing as a foolproof antivirus program. Trojan horses
|
|
and viruses can be (and have been) designed to bypass them. Antivirus
|
|
products themselves can be tricky to use at times, and they occasionally
|
|
have bugs. Always use a good set of backups as your first line of defense;
|
|
rely on antivirus software as a second line of defense.
|
|
|
|
Computer Virus Myths Page 7 of 8
|
|
|
|
|
|
|
|
"Read-only files are safe from virus infections."
|
|
This common myth among IBM PC users has been printed even in some com-
|
|
puter magazines. Supposedly, you can protect yourself by using the DOS
|
|
ATTRIB command to set the read-only attribute on program files. However,
|
|
ATTRIB is software -- and what it can do, a virus can undo. The ATTRIB
|
|
command seldom halts the spread of viruses.
|
|
|
|
"Viruses can infect files on write-protected disks."
|
|
Here's another common IBM PC myth. If viruses can modify read-only
|
|
files, people assume they can modify write-protected floppies. However,
|
|
the disk drive itself knows when a floppy is protected and refuses to write
|
|
to it. You can physically disable an IBM PC drive's write-protect sensor,
|
|
but you can't override it with a software command.
|
|
|
|
|
|
|
|
We hope this dispels the many computer virus myths. Viruses DO exist, they
|
|
ARE out there, they WANT to spread to other computers, and they CAN cause
|
|
you problems. But you can defend yourself with a cool head and a good set
|
|
of backups.
|
|
|
|
The following guidelines can shield you from Trojan horses and viruses.
|
|
They will lower your chances of being infected and raise your chances of
|
|
recovering from an attack.
|
|
|
|
1. Implement a procedure to regularly back up your files and follow it
|
|
religiously. Consider purchasing a user-friendly program to take the
|
|
drudgery out of this task. (There are plenty to choose from.)
|
|
2. Rotate between at least two sets of backups for better security (use
|
|
set #1, then set #2, then set #1...). The more sets you use, the
|
|
better protected you are. Many people take a "master" backup of their
|
|
entire hard disk, then take "incremental" backups of those files which
|
|
changed since the last time they backed up. Incremental backups might
|
|
only require five minutes of your time each day.
|
|
3. Download files only from reputable BBSs where the sysop checks every
|
|
program for Trojan horses. If you're still afraid, consider getting
|
|
programs from a BBS or "disk vendor" company which gets them direct
|
|
from the authors.
|
|
4. Let newly uploaded files "mature" on a BBS for one or two weeks before
|
|
you download it (others will put it through its paces).
|
|
5. Consider using a program that searches, or "scans," disks for known
|
|
viruses. Almost all infections to date involved viruses known to
|
|
antivirus companies. A recent copy of any "scanning" program will in
|
|
all probability identify a virus before it gets the chance to infect
|
|
your computer -- and as they say, "an ounce of prevention is worth a
|
|
pound of cure." A "scanning" program can dramatically lower your
|
|
chaces of getting infected by a computer virus in the first place.
|
|
(But remember: there is no perfect antivirus defense.)
|
|
6. Consider using a program that creates a unique "signature" of all the
|
|
programs on your computer. Run this program once in awhile to see if
|
|
any of your software applications have been modified -- either by a
|
|
virus or by a fingerprint on a floppy disk or perhaps even by a stray
|
|
gamma ray.
|
|
|
|
Computer Virus Myths Page 8 of 8
|
|
|
|
|
|
|
|
7. DON'T PANIC if your computer starts acting weird. It may be a virus,
|
|
but then again maybe not. Immediately turn off all power to your com-
|
|
puter and disconnect it from any local area networks. Reboot from a
|
|
write-protected copy of your master DOS disk. Do NOT run any programs
|
|
on a "regular" disk (you might activate a Trojan horse). If you don't
|
|
have adequate backups, try to bring them up to date. Yes, you might
|
|
back up a virus as well, but it can't hurt you if you don't use your
|
|
normal programs. Set your backups off to the side. Only then can you
|
|
safely hunt for problems.
|
|
8. If you can't figure out what's wrong and you aren't sure what to do
|
|
next, turn off your computer and call for help. Consider calling a
|
|
local computer group before you call for an expert. If you need a
|
|
professional, consider a regular computer consultant first. Some
|
|
"virus removal experts" charge prices far beyond their actual value.
|
|
9. [Consider this ONLY as a last resort.] If you can't figure out what's
|
|
wrong and you are sure of yourself, execute both a low-level and a
|
|
high-level format on all your regular disks. Next, carefully re-
|
|
install all software from the master disks (not from the backups).
|
|
Make sure the master disks have write-protect tabs! Then, carefully
|
|
restore only the data files (not the program files) from your backup
|
|
disks.
|
|
|
|
We'd appreciate it if you would mail us a copy of any Trojan horse or virus
|
|
you discover. (Be careful you don't damage the data on your disks while
|
|
trying to do this!) Include as much information as you can and put a label
|
|
on the disk saying it contains a malicious program. Send it to Ross M.
|
|
Greenberg, P.O. Box 908, Margaretville, NY 12254. Thank you.
|
|
|
|
Ross M. Greenberg is the author of both shareware and retail virus
|
|
detection programs. Rob Rosenberger is the author of various phone
|
|
productivity applications. (Products are not mentioned by name because
|
|
this isn't the place for advertisements.) They each write for national
|
|
computer magazines. These men communicated entirely by modem while
|
|
writing this treatise.
|
|
|
|
Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg
|
|
|
|
|
|
Rosenberger can be reached electronically on CompuServe as [74017,1344], on
|
|
GEnie as R.ROSENBERGE, on InterNet as `74017.1344@compuserve.com', and on
|
|
various national BBS linkups. Greenberg can be reached on MCI and BIX as
|
|
`greenber', on UseNet as `c-rossgr@microsoft.com', and on CompuServe as
|
|
[72461,3212].
|
|
|
|
You may give copies of this treatise to anyone if you pass it along in its
|
|
entirety. Publications may reprint it at no charge if they give due credit
|
|
to the authors and send two copies to: Rob Rosenberger, P.O. Box 643,
|
|
O'Fallon, IL 62269.
|
|
|