1. ________________ CS3235, Nov 2002 Viruses Adapted from Pfleeger[Chap 5]. A virus is a program [fragment] that can pass on malicious code [usually itself] to other non-malicious programs by modifying them. Malicious code runs under the authority of the user running the infected program. It can lie dormant, undetected until some event triggers the code to act. It must be activated by being executed before it can spread. Malicious people can make code (programs) serve as a vehicle to violate security (confidentiality, integrity, and availability). Program flaws can be exploited to achieve these ends.

2. ________________ CS3235, Nov 2002 Viruses Infected program uninfected infected

3. ________________ CS3235, Nov 2002 Types of Infection Infect a program to gain control before its first instruction. Infect to gain control before and after program execution. Instead of overwriting a program, change the file system meta data to point to itself. Infect the boot sector. –Enables virus to gain control very early in the boot process. Look at /usr/share/doc/lilo-*/doc/Technical_Guide.ps for the boot process. –Complicates detection. Infect system files used in the boot process. –CONFIG.SYS, AUTOEXEC.BAT, /etc/rc.d/…, /lib/modules… Infect main memory –TSR

4. ________________ CS3235, Nov 2002 Detection & Propagation of Viruses A virus cannot be completely invisible. Virus code must be stored somewhere and be in memory to execute. Each characteristic is a telltale pattern called a signature. On infection, the virus may change the “host” file’s size, mtime, hash value etc. (Tripwire can detect such changes) Polymorphic viruses can change infection to avoid detection. –Add harmless instructions such as NOP, a := a + 0 –Encrypt code Testing whether an arbitrary program is a virus is undecidable. –Static analysis for viruses not possible (in general).

5. ________________ CS3235, Nov 2002 Preventing & Guarding against Virus Infection Don’t share executable code with an infected source. Use only commercial software acquired from reliable, well established vendors. –Not a guarantee but vendors have a reputation to protect. Test all new software on an isolated computer. –Test without hard disk, network connectivity etc., and look for unexpected behavior. Make a bootable diskette of the OS + key utilities. Make and retain backup copies of executable system files. Use virus detectors regularly.

6. ________________ CS3235, Nov 2002 Truths and Misconceptions about Viruses Viruses can infect systems other than PCs/Windows. –PS files, Shell scripts etc. Viruses can modify “hidden” or read-only files. –Only a software notion that can be overridden. Viruses can appear in data files. Viruses can be spread in ways other than just diskettes. Viruses cannot remain in memory after a complete power off/power on reboot. Viruses cannot infect hardware. Viruses can be malevolent, benign, or benevolent. –Compression virus.

7. ________________ CS3235, Nov 2002 The Pakistani Brain Virus Boot sector virus. –Takes over the boot sector + six other sectors. –One for original boot block + 2 for itself. The rest are duplicates. Takes over the disk read “interrupt”. –Permits the virus to return the original boot block if requested. Inspects the boot sector for infection on every read.

8. ________________ CS3235, Nov 2002 Trapdoors A trapdoor is a secret, undocumented entry point into software/hardware. –Intentional. For debugging, tracing, fixing, extending software. –Unintentional. Resulting from software errors. –Undefined opcodes in machine instructions. Example: sendmail debug. –http://online.securityfocus.com/bid/1/discussion/

9. ________________ CS3235, Nov 2002 Kinds of Malicious Code Virus. Attaches itself to executable content and propagates copies of itself to other executable content. May be good or bad. (transient or resident) Trojan Horse, Logic bomb, Time bomb. No propagation. Contain unexpected additional functionality. Trigger on logic (condition), time etc. Trapdoor. Allows access to functionality. [sendmail debug] Worm. Capable of independent self existence. Usually peripatetic. Rabbit. Replicates itself to resource exhaustion. [while(1) fork;]

10. ________________ CS3235, Nov 2002 Salami Attacks A small amount of money is shaved from each computation. Number computations are subject to small errors involving rounding and truncation. For e.g., Interest on $102.87 for 31 days @ 6.5% = $.56789. Programs are too large and complex to be audited for salami attacks.