API tools faq
paste
FederationHax

Computer Security

FederationHax
Jun 11th, 2016
426
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 65.44 KB | None | 0 0
raw download clone embed print report
  1. COMPUTER SECURITY
  2. -----------------
  3.  
  4. Notes of the presentation to
  5. The Institution of Production Engineers
  6. March 21, 1990 by
  7.  
  8. E.A.Bedwell, E.D.P. Specialist
  9. ORTECH International (NRC/IRAP)
  10. 2395 Speakman Dr., Mississauga L5K 1B3
  11. (416) 822-4111, Ext. 261
  12.  
  13.  
  14. The writer wishes to thank the Institution of Production Engineers and
  15. it's President for the invitation to make this presentation, and to
  16. express sincere appreciation to David Stang, Ph.D., Director of Research,
  17. National Computer Security Association, for his contribution both to this
  18. paper and to computer security in general. And I would be very remiss if
  19. I neglected to mention the professional secretarial assistance provided by
  20. Jane Templeman, who makes our whole team tick like the NRC official time
  21. clock - the one that gives the CBC time signal.
  22.  
  23. This document is, hopefully, written softly: after all, it might be
  24. easier to digest if I have to eat my words. I do not profess to be "the
  25. expert" in the field of computer security; an expert is someone who knows
  26. more and more about less and less until s/he knows absolutely everything
  27. about nothing. I hope never to stop learning, which means (thankfully)
  28. I'll never be an expert.
  29.  
  30. INDEX PAGE
  31. ----- ----
  32. 1. Definition/Scope of "COMPUTER SECURITY" 2
  33. 2. Why Should You Be Concerned? 2
  34. 3. Types of Security Breaches 3
  35. 4. Reasons for Exposure 7
  36. 5. General Security Rules (all computer systems) 8
  37. 6. Viruses: 9
  38. 6.1 History 9
  39. 6.2 Effect 10
  40. 6.3 Why do people do it? 10
  41. 6.4 Symptoms 10
  42. 6.5 Concerns 11
  43. 6.6 Known Virus Software (1) 11
  44. 6.7 Quick Guide to Virus Names (1) 12
  45. 6.8 Table of Virus Effects 16
  46. 6.9 Virus Detector/Antidote software 19
  47. 6.10 Trojan Horses 20
  48. 7. PC Rules of Thumb 22
  49. 8. Easy Tricks for PC Security 23
  50. 9. So You're Infected (Cure) 24
  51. 10. Summary: What Can You Do? 25
  52. 11. Security Policy: Points for Consideration 26
  53. 12. To run SCAN (included on this diskette) 29
  54.  
  55. (1) David Stang, Ph.D, "Network Security in the Federal Government,",
  56. January, 1990, p.168-169 (updated by E.A.Bedwell, March, 1990)
  57.  
  58.  
  59.  
  60.  
  61.  
  62.  
  63.  
  64.  
  65.  
  66.  
  67. - 2 -
  68. Tonight's topic is "Computer Security," a subject near and dear to my
  69. heart after catching fraud a few times, and cracking system security a
  70. few times. The only unfortunate part of this evening is that I have
  71. enough material to cover an intensive 2 or 3 day seminar and I only have
  72. something over an hour, so in addition to extensive notes from this
  73. presentation, I've put an article on viruses, and a PC virus detector
  74. program on diskette for you.
  75.  
  76.  
  77. 1. SCOPE OF COMPUTER SECURITY
  78.  
  79. Computer security relates to any potential loss of information or your
  80. ability to operate, regardless of the source of the problem. Of course,
  81. all the publicity about computer security is going to the virus
  82. situation. I don't want to dissuade anyone from their concerns about
  83. viruses, because it's definitely a growing problem, and if you get hit,
  84. you'll be sorry you ever laid eyes on a computer. But, current estimates
  85. indicate that viruses represent only 3% of all the computer problems now
  86. occurring. Of course, if you're one of the 3%, like CNIB or Barclay's
  87. Bank Canada were last fall, you'll feel like you're the only one on
  88. earth. The difference between viruses and other computer security issues
  89. is apparently one of control: I hope to convince you that you have as
  90. much control over viruses and as little control over the other 97% of
  91. problems as to make them equal threats to the safety of your computer.
  92.  
  93. I'm going to get to viruses later, their prevention, detection and cure,
  94. but I'd like first like to cover the other major problems that affect
  95. computer security - the other 97% - and I'd like to start with reasons
  96. why you should be concerned about security.
  97.  
  98.  
  99. 2. WHY SHOULD YOU BE CONCERNED?
  100.  
  101. Your data is a valuable asset, just like premises, equipment, raw
  102. materials and inventory. Because so much of modern business depends on
  103. computers - financial systems, engineering design, medical diagnosis,
  104. production and safety control - the destructive potential is greater
  105. every year. There has been more than one company that's suffered great
  106. losses, and even gone under because of the loss of things like their
  107. accounts receivable records: no one is going to pay you if you don't
  108. send them a bill, and if they get word of your inability to invoice them,
  109. their darned unlikely to volunteer payment - so you're in a financial
  110. mess. The same goes for your design information, production data, the
  111. consequences if safety control systems malfunction, or even the simple
  112. loss of your customer list.
  113.  
  114. Another reason why you should be concerned is, too often, people don't
  115. think about computer security until it's too late. There's a saying in
  116. my industry that, "He who laughs last probably made a backup." Another
  117. saying is, "Experience is something you don't get until just after you
  118. needed it the most." Well, if it means the life of your company, or the
  119. loss of potentially millions of dollars, or even just the information on
  120. your home computer, it might be wise to get at least some basic knowledge
  121. before the disaster strikes.
  122.  
  123.  
  124.  
  125.  
  126.  
  127.  
  128.  
  129.  
  130.  
  131.  
  132.  
  133. - 3 -
  134.  
  135. 3. TYPES OF SECURITY BREACHES
  136.  
  137. Now that the 'why' is out of the way, let's break down the 97% of
  138. problems. These are not in a specific order, but just as they came to
  139. me. Nor have I attempted to attach percentages to each type of risk,
  140. because very few computer crimes are actually reported, so any figures
  141. that anyone could estimate would not be realistic:
  142.  
  143.  
  144. FRAUD/THEFT
  145. By far the biggest problem is fraud or theft. Some examples of this are:
  146.  
  147. CHAOS - 1987 - Hamburg -> NASA data bank info sold to USSR
  148.  
  149. Foreign exchange } famous because of big $
  150. Electronic Funds Transfer } amounts, and because of the
  151. Insider Trading } publicity they've received
  152.  
  153. Most common: Cookie jar technique - e.g., interest, income tax
  154. (aka 'Salami' technique - take a little and no one
  155. will notice)
  156.  
  157. Specific examples I've caught were in Payroll (no crash on < or =),
  158. Accounts Payable (dummy companies), Purchasing (failed reasonableness
  159. test), and Accounts Receivable (failed balance routine). These were all
  160. thefts of money.
  161.  
  162. Another example of theft which is very interesting is the 28-year-old
  163. Canadian who was arrested at UNISYS in Pittsburgh on Dec. 13/89 - what he
  164. is alleged to have stolen was NCR's trade secrets - to the tune of
  165. US$68M, which comes under a different Canadian law from monetary theft.
  166.  
  167.  
  168.  
  169. MALICIOUS DAMAGE / VANDALISM
  170. The next major type of computer security breach is the disgruntled
  171. employee syndrome. Their favourite is the logic bomb or time bomb: on a
  172. certain date or condition after they leave the company, something's going
  173. to happen, such as at the health centre in LA where all prescriptions
  174. suddenly multiplied by 2. That's really serious, even compared to the
  175. logic bomb that superzaps all your files off the face of the earth,
  176. because someone could die. At least with a superzap, you can recover if
  177. you've been backing up and have a disaster recovery plan in effect. Pure
  178. physical vandalism occurs more often at educational institutions, but is
  179. still a serious threat. I wouldn't let me near your machine if I was
  180. angry with you - my vandalism would be difficult to detect (and expensive
  181. to repair). A simple application of a magnetized screwdriver ......
  182.  
  183.  
  184.  
  185. LACK OF SECURITY PLANNING IN SYSTEM DESIGN STAGE
  186. One of the biggest logic bombs that's going to occur is on January 1/2000.
  187.  
  188. Do you know how many computer systems use a 2 digit number for the year?
  189. Do you know how much work it's going to be to adapt systems to recognize
  190. 00 as being greater than 99? My grandmother was born in 1886, and most
  191. systems show her birth year as 99. If she lives to the year 1999, I
  192. wonder if they'll start sending her the baby bonus. This time bomb is not
  193. malicious damage, it's pure lack of planning at the system design stage.
  194.  
  195.  
  196.  
  197.  
  198.  
  199.  
  200. - 4 -
  201.  
  202. (Lack of Security Planning - continued)
  203.  
  204. Things like balance checks and reasonableness tests are not built into the
  205. system from the beginning, and it's not easy to put them in later. Users
  206. must participate at the system design stage, because only they know what's
  207. reasonable and what can be balanced. Don't expect a computer technician
  208. to know everything there is to know about your job.
  209.  
  210.  
  211.  
  212.  
  213. DISTORTED SENSE OF HUMOUR
  214. Then there's the practical joker - the one who thinks it's funny to break
  215. into the system to see what he can change, or create some dumb message to
  216. appear on your screen. That's what happened at IBM when the infamous
  217. Christmas tree appeared 2 years ago (1987). The joke was three-fold -
  218. first it analyzed your electronic mail distribution lists and reproduced
  219. itself to send to everyone you normally send messages to - this clogged
  220. the system up with people reading more messages than normal. The second
  221. part was a little more technical - everyone who read the message caused a
  222. separate load of the offending program to take up space in memory, unlike
  223. most systems where two or more people who are doing the same thing are
  224. sharing one load of the software. This clogged memory up so that nothing
  225. else could run. There was one more part to this: there were delay timers
  226. built into the program so it deliberately ran very slowly. The result was
  227. that the largest computer network in the world was shut down for 4 hours.
  228. Someone must have had a great need for a power trip.
  229.  
  230.  
  231.  
  232. MISTAKE
  233. Next, there's fumble fingers: you know, the one who keys the formula in
  234. as 600 grams instead of 60 grams, or the estimated production time of 2
  235. hours instead of 2 days. Or the one who almost took me into court when
  236. he blamed "the computer" for a mistake. Without going into details about
  237. that incident, I can say that going through the grilling by several
  238. lawyers in a preliminary investigation was not the high point of my
  239. career. What saved the situation (for me and the organization) was audit
  240. trailing: every time a transaction was entered, the system recorded the
  241. terminal i.d., the user i.d., the date and the time. It also saved a copy
  242. of the record as it existed prior to the transaction taking place. A more
  243. common mistake, though, is to unlatch a diskette door before the light
  244. goes out. Few people realize that the FAT (file attributes table) is the
  245. last thing written on a disk, and you can corrupt the FAT by removing the
  246. disk too early.
  247.  
  248.  
  249. "EVERYONE DOES IT" SYNDROME
  250. Then there's everyone's favourite: copying software. Believe it or not,
  251. in Canada, that falls under the Copyright law, not under theft, but it
  252. has been successfully prosecuted. Even if you reverse engineer it and
  253. make some minor changes, it will come under the "look and feel" test of
  254. the Copyright law - if it looks and feels the same as the original, you
  255. can be prosecuted. Copying software is illegal, and your company as the
  256. registered owner could be held liable if it is detected.
  257.  
  258.  
  259.  
  260.  
  261.  
  262.  
  263.  
  264.  
  265. - 5 -
  266.  
  267. ILLEGAL ACCESS
  268. Many major computer crimes are perpetrated by illegal access: the 14-
  269. year old who broke into NASA from his basement computer room is just one
  270. example. There is password software on all larger machines, and it's not
  271. difficult to put it on PCs. On the larger machines, one of the major
  272. problems is not changing the standard passwords that are set when the
  273. machine is delivered: the standard user-level password may be USER, the
  274. standard operator password may be OPERATOR, and the standard field repair
  275. person's password may be REPAIR, and so on. Guess how I've cracked
  276. security a couple of times. In a 1988 article by Dr. Cliff Stoll in
  277. "Computers and Security,", he reported that in 10 months of systematic
  278. testing on computers attached to the US Defense Data Network (Milnet),
  279. access was gained in 13% of the attempts simply by guessing at passwords!
  280.  
  281. There should be some rules applied to passwords: not less than 7 or 8
  282. characters, must be changed at least every 60 days, don't use common
  283. things like names (another way I've broken security), don't share it
  284. under any circumstances and, for heaven's sake, don't post it on the
  285. front of your machine or leave it where someone can find it. It's your
  286. personal PIN - just like the money machine - and the information you're
  287. dealing with is worth money. Some of the most difficult passwords to
  288. break (take it from me) are "two words reversed" (e.g., boardwall,
  289. hornshoe, cuptea), or foreign language words (e.g., coupdegrace,
  290. millegrazie, caliente). Nonsense is good, too: geebleurql is nice.
  291.  
  292. If you're installing password security on a PC, consider whether you
  293. should have it so tight that there is no recourse to the DOS level or no
  294. ability to boot from the A: drive. You'd need really good password
  295. software (or a good technician on staff) if you have both of these
  296. facilities - otherwise you can lock yourself out - but it's my preference
  297. (especially for the guy who's wiped his root directory twice).
  298.  
  299.  
  300. PHYSICAL SECURITY
  301. Finally, another area that affects computer security or your ability to
  302. carry on computer operations, and one that is often overlooked, is simple
  303. physical security: keys, thermal shock, vibration, dirt, water, fire,
  304. visibility of information, steady power supply, discharge of static
  305. electricity, magnetic fields, are all relevant to security. We have one
  306. man in our network who should have (a) cabling bolted to his computer and
  307. the floor, (b) a key to his unit, and (c) dust protectors (as well as
  308. password access only without recourse to the DOS level).
  309.  
  310. When it comes to thermal shock, if you work in an area where the heat is
  311. reduced on winter weekends, I strongly recommend you leave your unit
  312. running over the weekend - just lock the keyboard. If the air
  313. conditioning is shut down, turn your unit off, and don't turn it on until
  314. the temperature is 23C or less. And please don't leave your machine
  315. sitting in the sun, or in front of an open window to attract dust. The
  316. internal temperature raises within 20 mins. or so to >30C, and the effects
  317. of thermal shock are such that it can, first, rock memory chips out of
  318. their sockets, and, worse, misalign the read heads on your disk drive so
  319. that nothing can be read.
  320.  
  321.  
  322.  
  323.  
  324.  
  325.  
  326.  
  327.  
  328.  
  329.  
  330.  
  331. - 6 -
  332.  
  333. (Physical Security - continued)
  334.  
  335. Vibration, too, is a source of problems, especially for drives. The read
  336. heads actually float over the surface of drives, not on them the way a
  337. record player needle does, and the space tolerance between is measured in
  338. Angstroms (metric version of microinches). Vibration can cause the head
  339. to hit the drive, and you can say goodbye to whatever was written there.
  340.  
  341. If you're in a particularly sensitive field, and your information is what
  342. might be called top secret to your company, you might also want to look
  343. at two protection devices: one is encryption, and the other is Tempest
  344. hardware or shielding. Encryption involves translating your data using
  345. algorithms to something unreadable, and de-coding it when you need it. It
  346. uses a "key" to choose the algorithm - dont' lose the key! It comes in a
  347. few forms: software controlled encryption, hardware based encryption, or
  348. a combination of the two. Most encryptors work with standard algorithms,
  349. but defense departments and other high-security installations prefer
  350. random algorithms. Tempest hardware, or shielding, protects against
  351. sniffing of signals. ( Signal emanation surveillance is called
  352. "sniffing.") I don't have a computer here to demonstrate this, but if
  353. you take an old battery-operated transistor radio and set the dial to the
  354. bottom of the AM band around 520, try passing it within a foot of your
  355. computer. Your ear might not pick up the individual signals, but I assure
  356. you there's equipment that does. That's why the US Army was blasting rock
  357. music around the Vatican Embassy when Noriega was there - to mask signals.
  358.  
  359. More important to the average user, though, is avoidance of electro-
  360. magnetic fields (such as ringing phones near a disk or disk drive), and
  361. having an automatic disk head 'parker' that moves the heads to a safe zone
  362. every few seconds. That way, something like a brief power failure is less
  363. likely to cause a "head crash" on the disk.
  364.  
  365. Simple visibility of information is a risk. Recently I went to a bank
  366. with a court order in hand to give me access to an account. The clerk
  367. simply turned the terminal toward me and, if I'd wanted to bother, I could
  368. have had the account numbers of two other people with identical names.
  369. There is screen saving software that will blank your screen after an
  370. inactivity duration you choose, and personnel should be made conscious
  371. that unauthorized viewing of information is a security risk. And watch
  372. what your staff throw out on paper, too.
  373.  
  374. When it comes to fire and water, there are two basic rules that everyone
  375. can follow: first, don't smoke around the PC, and second, don't feed the
  376. PC coffee and donuts. You might be able to save a keyboard or some parts
  377. with a bath in distilled water, possibly followed by drying with a warm
  378. hair dryer, but there's no guarantee. I prefer pure isopropyl alcohol -
  379. without the hairdryer so I don't get fried in the process. Don't blast a
  380. computer with a fire extinguisher if you can avoid it. If you do have a
  381. fire or a flood, though, you'd better have a tested disaster recovery
  382. plan, and your backups stored off-site.
  383.  
  384.  
  385. All of these issues are reasonably within your control: fraud, theft,
  386. disgruntled employees, practical jokers, fumble fingers, software copying
  387. and physical security, at least as much as the infamous viruses that are
  388. around, but let's take a look at why you're at risk.
  389.  
  390.  
  391.  
  392.  
  393.  
  394.  
  395.  
  396.  
  397.  
  398. - 7 -
  399.  
  400. 4. REASONS FOR EXPOSURE
  401.  
  402. Concentration of data in one place
  403.  
  404. Instantaneous adjustment
  405.  
  406. Alteration without a trace
  407.  
  408. Lack of visible records
  409.  
  410. Complexity of the system
  411.  
  412. Networking
  413.  
  414. Technical persons can befuddle
  415.  
  416. General ignorance by non-techie and management
  417.  
  418. Detection problems
  419.  
  420. Lack of training
  421.  
  422. Security checks in programs not specified
  423.  
  424. Systems not documented
  425.  
  426. Limited staff resource for programming/management
  427.  
  428. No separation of duties
  429.  
  430. Possibility of enormous losses remaining undetected
  431.  
  432. Reluctance to report - Embarrassment
  433. Lack of sufficient evidence to prosecute
  434. Cost to prosecute outweighs recovery
  435. Company policy ("Press would have a field day")
  436.  
  437.  
  438.  
  439.  
  440.  
  441.  
  442.  
  443.  
  444.  
  445.  
  446.  
  447.  
  448.  
  449.  
  450.  
  451.  
  452.  
  453.  
  454.  
  455.  
  456.  
  457.  
  458.  
  459.  
  460.  
  461.  
  462.  
  463.  
  464. - 8 -
  465.  
  466. 5. GENERAL SECURITY RULES (All Systems, big and small)
  467.  
  468. Disaster Recovery } Backup Backup Backup
  469. Plan } Restore (test it to make sure it works)
  470.  
  471. Store your backup off-site (not in your car!)
  472.  
  473. Physical security
  474.  
  475. Password for access control (don't stick your password on
  476. the front of your machine!)
  477.  
  478. Access to menu only - not to system control level
  479.  
  480. Reasonableness tests
  481.  
  482. Balance checks (rounding: up, down, (out?); cross-calculations
  483.  
  484. Audit trails - all records (terminal i.d., user i.d., date and
  485. time stamping, history record retention)
  486.  
  487. Fall-through coding (if it doesn't meet a condition, does it go to limbo)
  488.  
  489. Payroll/Accounts payable: don't pay the same # twice
  490.  
  491. Fault tolerance level supported (user friendly/hostile -
  492. balance between fault tolerance & productivity)
  493.  
  494. Call back or no answer on dial-up systems
  495.  
  496. UPS (Uninterrupted Power Supply, or allowance for graceful
  497. degradation) - or at least an automatic head parker
  498.  
  499. Logical view rights (your user 'privileges' allows access only to the
  500. data you need to see, e.g., accounting clerks don't need to see
  501. production formulae)
  502.  
  503. Multi-user environment: protection against deadly embrace
  504.  
  505. Automatic logoff on inactivity timer / Screen saver
  506.  
  507. Policy statement re purchasing/use/theft/illegal
  508. software, etc.
  509.  
  510. Encryption (?) - don't lose the key!
  511.  
  512. Shielding ("Tempest" hardware for secure systems)
  513.  
  514. Educate users
  515.  
  516.  
  517.  
  518.  
  519.  
  520.  
  521.  
  522.  
  523.  
  524.  
  525.  
  526.  
  527.  
  528.  
  529.  
  530. - 9 -
  531.  
  532. 6. VIRUSES
  533.  
  534. As in medicine, a virus needs an 'organism' to which it may attach itself,
  535. and a virus is 'contagious'.
  536.  
  537. In the case of computers, a virus is usually a destructive piece of code
  538. which attaches to a working program, such as your word processor,
  539. spreadsheet or CAD/CAM software. Viruses are usually written to detect
  540. any load of a computer file that has an extension of .EXE, .COM, .OVL,
  541. .BIN - such extensions representing executable programs. Often, the
  542. virus loads itself into memory, then loads the program you just called, so
  543. the virus is sitting at the front. Then when you exit the program, the
  544. virus code calls for the re-writing of the program back onto the disk -
  545. with the virus still sitting at the front. Other viruses simply go
  546. straight into your boot sector, so they get loaded every time you turn on
  547. your machine. Some do both.
  548.  
  549. However they 'hide', and whatever they attach to, they got to your machine
  550. on an infected diskette. If you are infected and then copy your software
  551. to use on another machine, guess what happens? Right! That's where the
  552. 'contagious' element comes in.
  553.  
  554. In 1989, more viruses were discovered than in all previous years. There
  555. were over 110 at the end of the year, and 7 were discovered in December
  556. alone. Sources have been from as far away as Pakistan and Bulgaria.
  557.  
  558. Only .004% have reported infections, but most are not reported. Consider
  559. this: if only 1% were infected, that would be 1/2 million units in the
  560. U.S. alone. At a cost ranging from $300 to $3,000 per unit to recover,
  561. the problem starts to impact the economy as well as the productivity of
  562. staff at your organization. It cost one Texas company US$10M to shut
  563. down their 3,000-unit network for 4 days to find 35 infected units.
  564.  
  565. One of the major problems with viruses is that 90% of the users who
  566. recover are re-infected within 30 days. One person at my organization
  567. was re-infected 7 times in 2 months! Most reinfections occur for one of
  568. two reasons (not necessarily in this order): your back-up was infected,
  569. or it was a virus that hid in the boot sector on track 0, and track 0 is
  570. not re-written by the standard "FORMAT" command (only a low-level format
  571. will get rid of a track 0 virus). Be careful of some new software as
  572. well: there has been more than one instance of shrink-wrapped software
  573. being infected (software companies have disgruntled employees, too, it
  574. seems).
  575.  
  576.  
  577.  
  578. 6.1 HISTORY
  579.  
  580. 1959 - Scientific American article about 'worms'
  581. 1963 - caught my first two frauds (Payroll & Accounts Payable)
  582. 1970 - Palo Alto lab - worm which directed activities
  583. 1982 - Anonymous Apple II worm
  584. 1984 - Scientific American CoreWare Series: held contest to
  585. find the most clever/difficult to detect 'bug'
  586. 1987 - Apparent change from intellectual exercise to
  587. dangerous activity.
  588.  
  589.  
  590.  
  591.  
  592.  
  593.  
  594.  
  595.  
  596. - 10 -
  597.  
  598. 6.2 EFFECT
  599.  
  600. Massive destruction: Reformatting
  601. Programs erased
  602. Data file(s) modified/erased
  603.  
  604. Partial/Selective destruction: Modification of data/disk space
  605. File allocation tables altered
  606. Bad sectors created
  607. If match with event, alter or delete
  608.  
  609. Random havoc: Altering keystroke values
  610. Directories wiped out
  611. Disk assignments modified
  612. Data written to wrong disk
  613.  
  614. Annoyance: Message
  615. Execution of RAM resident programs
  616. suppressed
  617. System suspension
  618.  
  619.  
  620.  
  621.  
  622.  
  623. 6.3 WHY DO PEOPLE DO IT?
  624.  
  625. Financial gain
  626. Publicity
  627. Intellectual exercise
  628. Terrorism/Fanaticism/Vandalism
  629. Revenge
  630. Just plain wierd
  631.  
  632.  
  633.  
  634.  
  635.  
  636. 6.4 SYMPTOMS
  637.  
  638. Change in file size (Usually on .COM, .EXE
  639. .OVL, .BIN, .SYS or .BAT files)
  640. Change in update time or date
  641. Common update time or date
  642. Decrease in available disk or memory space
  643. Unexpected disk access
  644. Printing and access problems
  645. Unexpected system crashes
  646.  
  647.  
  648.  
  649.  
  650.  
  651.  
  652.  
  653.  
  654.  
  655.  
  656.  
  657.  
  658.  
  659.  
  660.  
  661.  
  662. - 11 -
  663.  
  664.  
  665. 6.5 CONCERNS
  666.  
  667. Variety: Virus vs Bug vs Worm vs Trojan Horse vs Superzapper
  668. vs Trap Doors vs Piggybacking vs Impersonation
  669. vs Wiretapping vs Emulation
  670. Strains / Complexity / Growing Sophistication
  671. Bulletin board use and free software
  672. Largest threats from taking computer work home
  673. Kids using same machine at home
  674. Networked mainframe systems
  675. Travel/airline computers (AA wiped out early 1989)
  676. Work message systems (E-Mail)
  677. POS terminals
  678. Banking / Credit Cards / Money Machines
  679. Income Tax records
  680. Health records
  681.  
  682.  
  683. **************************************************************
  684. * Global disaster may be on the way *
  685. * No specific laws to deal with malicious programming *
  686. * No single national centre to gather data on infections *
  687. **************************************************************
  688.  
  689.  
  690.  
  691.  
  692.  
  693.  
  694.  
  695. 6.6 KNOWN VIRUS SOFTWARE
  696.  
  697. 12 viruses (and their strains) account for 90% of all PC infections:
  698. _
  699. |_| Pakistani Brain
  700. |_| Jerusalem
  701. |_| Alameda
  702. |_| Cascade (1701/1704)
  703. |_| Ping Pong
  704. |_| Stoned
  705. |_| Lehigh
  706. |_| Den Zuk
  707. |_| Datacrime (1280/1168)
  708. |_| Fu Manchu
  709. |_| Vienna (DOS 62)
  710. |_| April First
  711.  
  712.  
  713.  
  714.  
  715.  
  716.  
  717.  
  718.  
  719.  
  720.  
  721.  
  722.  
  723.  
  724.  
  725.  
  726.  
  727.  
  728. - 12 -
  729.  
  730. 6.7 QUICK GUIDE TO VIRUS NAMES (Cross referenced)
  731.  
  732. Name Synonym-1 Synonym-2 Synonym-3 Synonym-4
  733.  
  734. 1168 Datacrime-B
  735. 1184 Datacrime II
  736. 1280 Datacrime Columbus Day October 12th Friday 13th
  737. 1536 Zero Bug
  738. 1701/1704 Cascade Falling Letters Falling Tears Autumn Leaves
  739. 1704 Cascade
  740. 1704 Cascade-B
  741. 1704 Cascade-C
  742. 1704 Cascade-D
  743. 1704 Format 1704 Blackjack Falling Letters
  744. 1704 Blackjack 1704 Format Falling Letters
  745. 1808 Jerusalem Black Box/Hole Israeli PLO 1808/1813
  746. 1813 Jerusalem Black Box/Hole Israeli PLO 1808/1813
  747. 2086 Fu Manchu
  748. 2930
  749. 3066 Traceback
  750. 3551 Syslock
  751. 3555
  752. 123nhalf
  753. 405
  754. 500 Virus Golden Gate
  755. 512 Virus Friday 13th COM virus
  756. 648 Vienna DOS 62 DOS 68 Austrian
  757. AIDS VGA2CGA Taunt
  758. AIDS Info Disk
  759. Alabama
  760. Alameda Virus Yale Merritt Peking Seoul
  761. Alameda-B Sacramento Yale C
  762. Alameda-C
  763. Amstrad
  764. Anti
  765. Apple II GS LodeRunner
  766. April 1st SURIV01 SURIV02
  767. April 1st-B
  768. Ashar
  769. Austrian 648 Vienna DOS 62 DOS 68
  770. Australian Stoned New Zealand Marijuana
  771. Autumn Leaves Cascade 1701/1704 Falling Letters Falling Tears
  772. Basit virus Brain Pakistani Brain Lehore
  773. Black Box Jerusalem Israeli Black Hole 1808/1803 PLO
  774. Black Hole Jerusalem Black Box Israeli 1808/1813 PLO
  775. Black Hole Russian
  776. Blackjack 1704 1704 Format Falling Letters
  777. Bouncing Ball Vera Cruz Ping Pong Bouncing Dot Italian virus
  778. Bouncing Dot Italian virus Bouncing Ball Vera Cruz Ping Pong
  779. Brain-B Brain-HD Harddisk Brain Houston virus
  780. Brain-C
  781. Brain-HD Harddisk Brain Houston virus Brain-B
  782.  
  783.  
  784.  
  785.  
  786.  
  787.  
  788.  
  789.  
  790.  
  791.  
  792.  
  793.  
  794. - 13 -
  795.  
  796. Brain Pakistani Brain Basit virus Lehore
  797. Cascade 1701/1704 Falling Letters Falling Tears Autumn Leaves
  798. Cascade(-B-C-D) 1704
  799. Century Oregon Jan.1, 2000
  800. Century-B
  801. Chroma
  802. Clone
  803. Clone-B
  804. Columbus Day 1280/Datacrime October 12th Friday 13th
  805. COM virus 512 virus Friday 13th
  806. COM-B Friday 13th-B
  807. COM-C Friday 13th-C
  808. Cookie virus Sesame Street
  809. Dark Avenger
  810. Datacrime 1280
  811. Datacrime-B 1168
  812. Datacrime-II 1184
  813. dBASE virus
  814. Den Zuk Search Venezuelan
  815. Disk Killer Ogre
  816. Do-Nothing (don't believe it!)
  817. DOS-62 Vienna DOS-68 648 Austrian
  818. DOS-68 Vienna DOS-62 648 Austrian
  819. DOS-62 UNESCO
  820. DOS-62-B
  821. Falling Tears Cascade 1701/1704 Falling Letters Autumn Leaves
  822. Falling Letters 1704 Blackjack 1704 Format
  823. Falling Letters Cascade 1701/1704 Falling Tears Autumn Leaves
  824. Falling Letters-Boot Ping Pong B
  825. Fat 12 Swap Israeli Boot
  826. FluShot4 (a corrupted version of a virus detector - use FluShot4+)
  827. Friday 13th 1280/Datacrime Columbus Day October 12th COM
  828. Friday 13th-B COM-B 512
  829. Friday 13th-C COM-C
  830. Fumble Type
  831. Fu Manchu 2086
  832. Ghost-Boot
  833. Ghost-COM
  834. Golden Gate 500 Virus
  835. Golden Gate -B
  836. Golden Gate-C Mazatlan
  837. Golden Gate-D
  838. Harddisk Brain Brain-B Brain-HD Houston virus
  839. Holland Girl Sylvia
  840. Houston virus Brain-B Brain-HD Harddisk Brain
  841. Icelandic Disk-Crunching-virus Saratoga 2
  842. Icelandic 1 Saratoga 1
  843. Icelandic 2 System virus
  844. INIT29
  845. IRQ v. 41
  846. Israeli Friday13 Jerusalem Black Box/Hole 1808/1813 PLO
  847. Israeli Boot Swap Fat 12
  848.  
  849.  
  850.  
  851.  
  852.  
  853.  
  854.  
  855.  
  856.  
  857.  
  858.  
  859.  
  860. - 14 -
  861.  
  862. Italian virus Bouncing Ball Vera Cruz Ping Pong Bouncing Dot
  863. Jan.1, 2000 Century Oregon
  864. Jerusalem Israeli Black Box/Hole 1808/1813 PLO Friday 13th
  865. Jerusalem-B New Jerusalem
  866. Jerusalem-C
  867. Jerusalem-D
  868. Jerusalem-E
  869. Jork
  870. Key
  871. Lehigh
  872. Lehigh-2
  873. Lehore Brain Pakistani Brain Basit
  874. Lisbon
  875. LodeRunner Apple II GS
  876. MacMag Peace virus
  877. Madonna (while the nice music plays, your hard disk is being destroyed)
  878. Mailson
  879. Marijuana New Zealand Stoned
  880. Mazatlan Golden Gate-C
  881. Merritt Alameda virus Yale Peking Seoul
  882. Mix1
  883. Music virus Oropax virus
  884. New Jerusalem Jerusalem-C
  885. New Zealand Stoned Marijuana Australian
  886. New Zealand-B Stoned-B
  887. New Zealand-C Stoned-C
  888. nVIR
  889. October 12th 1280/Datacrime Columbus Day Friday 13th
  890. Ohio
  891. Ogre Disk Killer
  892. Oregon Century
  893. Oropax virus Music virus
  894. Pakistani Brain Lehore Basit Brain
  895. Palette Zero Bug
  896. Payday
  897. Peace Virus MacMag
  898. Pearson
  899. Peking Alameda virus Yale Merritt Seoul
  900. Pentagon
  901. Ping Pong Bouncing Dot Italian virus Bouncing Ball Vera Cruz
  902. Ping Pong-B Falling Letters-Boot
  903. PLO Jerusalem Friday 13th 1808/1813 Israeli
  904. Russian Black Hole
  905. Sacramento Alameda-B Yale C
  906. Saratoga 1 Icelandic 1
  907. Saratoga 2 Icelandic Disk-Crunching-virus
  908. Scores
  909. Search Den Zuk Venezuelan
  910. Seoul Alameda virus Yale Merritt Peking
  911. Sesame Street Cookie virus
  912. SF virus
  913. Shoe virus UIUC virus (see also Terse Shoe)
  914.  
  915.  
  916.  
  917.  
  918.  
  919.  
  920.  
  921.  
  922.  
  923.  
  924.  
  925.  
  926. - 15 -
  927.  
  928. Shoe virus-B
  929. Stoned New Zealand Marijuana Australian
  930. Stoned-B New Zealand-B
  931. Stoned-C New Zealand-C
  932. SUMDOS
  933. Sunday
  934. SRI (destroys anti-viral programs before it damages your system)
  935. SURIV01 April 1st
  936. SURIV02 April 1st
  937. SURIV03
  938. Swap Israeli Boot Fat 12
  939. Sylvia Holland Girl
  940. SYS
  941. Syslock 3551
  942. System virus Icelandic 2
  943. Taunt AIDS VGA2CGA
  944. Terse Shoe (see also Shoe virus)
  945. TP04VIR Vacsina
  946. TP25VIR Yankee Doodle
  947. TP33VIR Yankee Doodle
  948. TP34VIR Yankee Doodle
  949. TP38VIR Yankee Doodle
  950. TP42VIR Yankee Doodle
  951. TP44VIR Yankee Doodle
  952. TP46VIR Yankee Doodle
  953. Traceback 3066
  954. Typo (boot)
  955. Typo (COM) Fumble
  956. UIUC virus Shoe virus
  957. UNESCO DOS-62
  958. Venezuelan Den Zuk Search
  959. Vera Cruz Ping Pong Bouncing Dot Italian Virus Bouncing Ball
  960. Vacsina TP04VIR
  961. VGA2CGA AIDS Taunt
  962. Vienna DOS-62 DOS-68 648 Austrian
  963. Vienna-B
  964. Yale Alameda virus Merritt Peking Seoul
  965. Yale C Alameda-B Sacramento
  966. Yankee Doodle TP25VIR
  967. Yankee Doodle TP33VIR
  968. Yankee Doodle TP34VIR
  969. Yankee Doodle TP38VIR
  970. Yankee Doodle TP42VIR
  971. Yankee Doodle TP44VIR
  972. Yankee Doodle TP46VIR
  973. Zero Bug 1536
  974.  
  975.  
  976.  
  977.  
  978.  
  979.  
  980.  
  981.  
  982.  
  983.  
  984.  
  985.  
  986.  
  987.  
  988.  
  989.  
  990.  
  991.  
  992. - 16 -
  993.  
  994. 6.8 TABLE OF VIRUS EFFECTS (by virus name)
  995.  
  996. This information is a reformatted version of that which was made
  997. available to the writer by the National Computer Security Association,
  998. Suite 309, 4401-A Connecticut Ave. NW, Washington, D.C., 20008.
  999.  
  1000. This list is not as complete as the list of names preceding. Since
  1001. viruses must be created and caught before they can be analyzed for the
  1002. type of information that follows, this list will never be as complete as
  1003. the list of names. In some instances, you may have been infected with a
  1004. variation of the name. You might wish to check this list for all
  1005. possible variations of a name you've found on the list of synonyms.
  1006.  
  1007. Explanation of codes used under "What it does", and analysis of frequency
  1008. of occurrence of each effect:
  1009.  
  1010. EFFECT # OCCURRENCES %
  1011. ------ - ----------- -
  1012. 1. Virus uses self-encryption 13 12
  1013. 2. Virus remains resident 83 74
  1014. 3. Infects COMMAND.COM 8 7
  1015. 4. Infects .COM files 62 55
  1016. 5. Infects .EXE files 41 37
  1017. 6. Infects .OVL files 15 13
  1018. 7. Infects floppy disk boot sector 36 32
  1019. 8. Infects hard disk boot sector 14 13
  1020. 9. Infects partition table 1 1
  1021. 10. Corrupts or overwrites boot sector 31 28
  1022. 11. Affects system run-time operation 53 47
  1023. 12. Corrupts program or overlay files 57 51
  1024. 13. Corrupts data files 4 4
  1025. 14. Formats or erases all/part of the disk 17 15
  1026. 15. Corrupts file linkage (FAT) 9 8
  1027. 16. Overwrites program 4 4
  1028. 17. Mac virus (as opposed to PC virus) 2 2
  1029.  
  1030.  
  1031. Increase in Disinfector
  1032. VIRUS NAME Prog'm size that works What it does
  1033. ---------- ----------- ----------- ------------
  1034.  
  1035. 1168/Datacrime B 1168 SCAN/D 1, 4, 12, 14
  1036. 1184/Datacrime 2 1184 1, 4, 5, 12, 14
  1037. 123nhalf 3907 2, 5, 11, 13
  1038. 1280/Datacrime 1280 SCAN/D 1, 4, 12, 14
  1039. 1514/Datacrime II 1514 SCAN/D 1, 4, 5, 12, 14
  1040. 1536/Zero Bug 1536 SCAN/D 2, 4, 11, 12
  1041. 1701/Cascade 1701 M-1704 1, 2, 4, 11, 12
  1042. 1704/Format 1704 M-1704 1, 2, 4, 11, 12, 14
  1043. 1704/Cascade 1704 M-1704 1, 2, 4, 11, 12
  1044. 1704/Cascade-B 1704 M-1704 1, 2, 4, 11, 12
  1045. 1704/Cascade-C 1704 1, 2, 4, 11, 12
  1046. 1704/Cascade-D 1704 1, 2, 4, 11, 12
  1047. 2930 2930 SCAN/D 2, 4, 5, 12
  1048.  
  1049.  
  1050.  
  1051.  
  1052.  
  1053.  
  1054.  
  1055.  
  1056.  
  1057.  
  1058. - 17 -
  1059.  
  1060. 3066/Traceback 3066 M-3066 2, 4, 5, 12
  1061. 3551/Syslock 3551 SCAN/D 1, 4, 5, 12, 13
  1062. 3555 3555 1, 3, 4
  1063. 405 SCAN/D 4, 16
  1064. AIDS SCAN/D 4, 16
  1065. AIDS Info Disk 0 AIDSOUT 11
  1066. Alabama 1560 SCAN/D 2, 5, 11, 12, 15
  1067. Alameda-B 2, 7, 10
  1068. Alameda-C 2, 7, 10
  1069. Alameda/Yale MDISK 2, 7, 10
  1070. Amstrad 847 SCAN/D 4, 12
  1071. April 1st 2, 4, 11
  1072. April 1st-B 2, 5, 11
  1073. Ashar MDISK 2, 7, 10
  1074. Black Hole 1808 2, 4, 5, 6, 11, 12, 15
  1075. Brain-B 2, 7, 8, 10
  1076. Brain-C 2, 7, 8, 10
  1077. Century 2, 4, 5, 6, 11, 12, 14, 15
  1078. Century-B 2, 4, 5, 6, 11, 12, 14, 15
  1079. Clone-B 2, 7, 10, 15
  1080. Clone virus 2, 7, 8, 10
  1081. dBASE 1864 SCAN/D 2, 4, 11, 12, 13
  1082. DOS-62-B 3, 4, 11
  1083. DOS-62-UNESCO 650 3, 4, 11
  1084. Dark Avenger 1800 M-DAV 2, 3, 4, 5, 6, 11, 12, 15
  1085. Datacrime II-B 1917 SCAN/D 1, 3, 4, 5, 12, 14
  1086. Disk Killer MDISK 2, 7, 8, 10, 11, 12, 13, 14
  1087. Do-Nothing 608 SCAN/D 4, 12
  1088. Fri 13th COM 512 SCAN/D 4, 12
  1089. Fri 13th COM-B 512 4, 12
  1090. Fri 13th COM-C 512 4, 12
  1091. Fu Manchu 2086 SCAN/D 2, 4, 5, 6, 11, 12
  1092. Ghost-Boot ver. MDISK 2, 7, 8, 10, 11
  1093. Ghost-COM ver. 2351 SCAN/D 4, 10, 12
  1094. Golden Gate 2, 7, 10, 14
  1095. Golden Gate-B 2, 7, 10, 14
  1096. Golden Gate-C 2, 7, 10, 14
  1097. Golden Gate-D 2, 7, 10, 14
  1098. IRQ v. 41 4, 5, 11
  1099. Icelandic I 642 SCAN/D 2, 5, 11, 12
  1100. Icelandic II 661 SCAN/D 2, 5, 11, 12
  1101. Italian/Ping Pong MDISK 2, 7, 10, 11
  1102. Italian-B MDISK 2, 7, 8, 10, 11
  1103. Jerusalem 1808 SCAN/D/A 2, 4, 5, 6, 11, 12
  1104. Jerusalem-B 1808 M-JERUSLM 2, 4, 5, 6, 11, 12
  1105. Jerusalem-C 1808 2, 4, 5, 6, 11, 12
  1106. Jerusalem-D 1808 2, 4, 5, 6, 11, 12
  1107. Jerusalem-E 1808 2, 4, 5, 6, 11, 12, 15
  1108. Jork 2, 7, 10
  1109. Lehigh SCAN/D 2, 3, 12, 14, 16
  1110. Lehigh-2 2, 3, 12, 14, 15, 16
  1111. Lisbon 648 SCAN/D 4, 12
  1112.  
  1113.  
  1114.  
  1115.  
  1116.  
  1117.  
  1118.  
  1119.  
  1120.  
  1121.  
  1122.  
  1123.  
  1124. - 18 -
  1125.  
  1126. MIX1 1618 SCAN/D 2, 5, 11, 12
  1127. New Jerusalem 1808 M-JERUSLM 2, 4, 5, 6, 11, 12
  1128. New Zealand MD 7
  1129. New Zealand-B 7, 8
  1130. New Zealand-C 7, 8
  1131. nVIR 11, 17
  1132. Ohio MDISK 2, 7, 10
  1133. Oropax 2, 4
  1134. Pakistani Brain MDISK 2, 7, 10
  1135. Palette/Zero Bug 1536 2, 3, 4,
  1136. Payday 1808 M-JERUSLM 2, 4, 5, 6, 12
  1137. Pentagon MDISK 7, 10
  1138. SF Virus 2, 7, 11, 14
  1139. SRI 1808 2, 4, 5, 6, 11, 12
  1140. SURIV01 897 SCAN/D 2, 4, 11, 12
  1141. SURIV02 1488 SCAN/D 2, 5, 11, 12
  1142. SURIV03 SCAN/D 2, 4, 5, 6, 11, 12
  1143. SYS 2, 7, 8, 11, 12
  1144. SYS-B 2, 7, 8, 11, 12
  1145. SYS-C 2, 7, 8, 11, 12
  1146. Saratoga 632 SCAN/D 2, 5, 11, 12
  1147. Saratoga-2 2, 5, 11, 12
  1148. Scores 11, 17
  1149. Search HD 2, 7, 8, 10, 11
  1150. Search-B 2, 7, 10, 11
  1151. Search/Den Zuk MDISK 2, 7, 10, 11
  1152. Shoe virus 2, 7, 8, 10
  1153. Shoe virus-B 2, 7, 10
  1154. Stoned/Marijuana MDISK/P 2, 7, 9, 10, 11, 15
  1155. SumDOS 1500 4, 5, 14
  1156. Sunday 1636 SCAN/D 2, 4, 5, 6, 11, 12
  1157. Swap/Israeli Boot MDISK 2, 7, 10
  1158. Sylvia/Holland 1332 SCAN/D 2, 4, 12
  1159. Terse Shoe virus 2, 7, 10
  1160. Typo (Boot) MDISK 2, 7, 8, 10, 11
  1161. Typo/Fumble (COM) 867 SCAN/D 2, 4, 11, 12
  1162. Vacsina/TP04VIR 2, 4, 5
  1163. Vienna-B 648 SCAN/D 2, 4, 5, 12
  1164. Vienna/648 648 M-VIENNA 4, 12
  1165. Yankee Doodle 2855 SCAN/D 2, 4, 5, 11, 12
  1166. Yankee Doodle/TP25VIR 2, 4, 5
  1167. Yankee Doodle/TP33VIR 2, 4, 5
  1168. Yankee Doodle/TP34VIR 2, 4, 5
  1169. Yankee Doodle/TP38VIR 2, 4, 5
  1170. Yankee Doodle/TP42VIR 2, 4, 5
  1171. Yankee Doodle/TP44VIR 2, 4, 5
  1172. Yankee Doodle/TP46VIR 2, 4, 5
  1173.  
  1174.  
  1175.  
  1176.  
  1177.  
  1178.  
  1179.  
  1180.  
  1181.  
  1182.  
  1183.  
  1184.  
  1185.  
  1186.  
  1187.  
  1188.  
  1189.  
  1190. - 19 -
  1191.  
  1192. 6.9 VIRUS DETECTOR AND ANTIDOTE SOFTWARE
  1193.  
  1194. *** None offer complete protection ***
  1195.  
  1196. Some do NOT test for boot sector viruses, modification of the command
  1197. interpreter, branching into the BIOS, etc., unconventional things that
  1198. nasty viruses are known to do. This is not a comprehensive list, but
  1199. you'll have an idea of what's available, either commercially or through
  1200. public domain. Look for a product that will detect as many of the
  1201. effects identified in the previous section as possible. Warning: some
  1202. highly publicized virus detectors only search for ONE (1) virus! Others
  1203. are more sophisticated, and may even act as a disinfector as well as a
  1204. detector.
  1205.  
  1206.  
  1207. Old virus symptoms vs file changes
  1208. Antidote
  1209. Antigen
  1210.  
  1211. Bombsqad
  1212. Canary
  1213. Cylene-4
  1214. C-4
  1215. Disk Defender * recommended (add-on board - write-protects hard disk)
  1216. Disk watcher
  1217. Dr. Panda Utilities
  1218. IBM - COMPare in DOS
  1219. Mace vaccine
  1220. Magic Bullets
  1221. Syringe
  1222. Sentry * recommended for systems booted regularly
  1223. Vaccine
  1224. Viraid
  1225. Virus-Pro * recommended for large corporate environments
  1226. Shareware: Novirus
  1227. Flushot4+
  1228. Virusck
  1229. Viruscan
  1230.  
  1231. Plus what's shown on preceding pages as a "Disinfector that works". I
  1232. also have a list of over 100 shareware products that do everything from
  1233. detect and/or disinfect to write-protecting the hard drive and requiring
  1234. password access .... but my fingers are getting tired from typing at this
  1235. point, and there are more important things to cover - after all, if
  1236. you're careful, you won't need a list of detectors/disinfectors.
  1237.  
  1238.  
  1239.  
  1240.  
  1241.  
  1242.  
  1243.  
  1244.  
  1245.  
  1246.  
  1247.  
  1248.  
  1249.  
  1250.  
  1251.  
  1252.  
  1253.  
  1254.  
  1255.  
  1256. - 20 -
  1257.  
  1258. 6.10 TROJAN HORSES
  1259.  
  1260. While a "virus" is something hidden within another program that is
  1261. waiting to make your system really sick, and a "worm" may be something
  1262. that lives on its own and usually transmits through networked computers,
  1263. a "Trojan Horse" is a little of both, so I've included it with this virus
  1264. section if only to warn you of its existence. It lives on its own as a
  1265. program, and will bring you down like Helen of Troy's soldiers. "I
  1266. wouldn't copy something like that," you say. Well, like Helen's horse,
  1267. it comes disguised. It will purport to do something really neat, like
  1268. compress files (so you have more disk space available), sort your
  1269. directories (so you can find things more easily), or play chess or
  1270. another game with you. In actuality, it's really just waiting to do the
  1271. things that viruses do - trash your files, scramble your boot sector, fry
  1272. your FAT, or erase your hard disk. It doesn't usually do anything it
  1273. promises to do.
  1274.  
  1275. The following are just a few examples of the known Trojan Horses, most
  1276. of which come from bulletin boards. Please don't misunderstand me, most
  1277. BB operators are honest people who are trying to help the computer
  1278. industry as a whole, but they can't be held responsible for the people
  1279. who might dial into their BB and leave a disaster waiting until the next
  1280. caller(s).
  1281.  
  1282.  
  1283. SCRNSAVE.COM: This is supposed to blank your screen after x seconds of
  1284. inactivity, thus preventing image burn-in or apparently
  1285. offering a sense of security; say goodbye to your files
  1286. while it erases your harddisk.
  1287.  
  1288. TSRMAP: For the 'sophisticated' user who uses Terminate and Stay
  1289. Resident programs, it's sometimes handy to have a map of
  1290. where these programs are loaded in memory, and be able to
  1291. delete some if you're short of memory; hopefully this
  1292. same 'sophisticated' user has a copy of track 0, because
  1293. his was just sent to heaven ..... or elsewhere.
  1294.  
  1295. DOS-HELP: Sounds great, doesn't it? This TSR program is supposed to
  1296. give on-line help on DOS commands. Your hard disk was
  1297. just formatted.
  1298.  
  1299. ULTIMATE.EXE: This is supposed to be a DOS shell (if you've used
  1300. Directory Scanner or some other software that allows you
  1301. to move around directories and load programs easily, or
  1302. even a menu system, then you know what a DOS shell is).
  1303. While the "Loading..." message shows on your screen, the
  1304. FAT (file allocation table) of your hard disk went to the
  1305. trash bin.
  1306.  
  1307. BARDTALE.ZIP This purports to be a commercial game from Electronic Arts
  1308. (BARDTALE I) Someone reverse engineered this program, and
  1309. wrote in a routine to format your hard disk upon
  1310. invocation.
  1311.  
  1312.  
  1313.  
  1314.  
  1315.  
  1316.  
  1317.  
  1318.  
  1319.  
  1320.  
  1321.  
  1322. - 21 -
  1323.  
  1324. COMPRESS.ARC This is dated April 1 1987, is executed from a file named
  1325. RUN-ME.BAT, and is advertised as "shareware from Borland"
  1326. (Borland is a highly reputable company). It will not
  1327. compress your files, but it will very competently destroy
  1328. your FAT table.
  1329.  
  1330.  
  1331. DANCERS.BAS You'll actually see some animated dancers in colour -
  1332. while your FAT is being tromped on.
  1333.  
  1334. DEFENDER.ARC Think you're going to get a copy of Atari's DEFENDER for
  1335. nothing, huh? There's still no such thing as a free
  1336. lunch, and this one will be particularly expensive: it
  1337. not only formats your hard disk, but it writes itself to
  1338. your ROM BIOS - the chip that holds the Basic Input Output
  1339. System for your machine. Get your wallet out.
  1340.  
  1341. SIDEWAYS.COM The good "SIDEWAYS.EXE" is about 30Kb, while this version
  1342. is about 3Kb. The really big difference, though, is what
  1343. happens to your hard drive - it's spun off into oblivion.
  1344.  
  1345.  
  1346. These are only a few of the 70 or so Trojans I have listed at work, but
  1347. I'm sure you've got the idea. These programs (a) stand alone, (b) often
  1348. claim to do something useful, (c) may be hacked versions of good
  1349. software, (d) may be named the same as good software, (e) may send you
  1350. back to using a quill pen.
  1351.  
  1352.  
  1353.  
  1354.  
  1355.  
  1356.  
  1357.  
  1358.  
  1359.  
  1360.  
  1361.  
  1362.  
  1363.  
  1364.  
  1365.  
  1366.  
  1367.  
  1368.  
  1369.  
  1370.  
  1371.  
  1372.  
  1373.  
  1374.  
  1375.  
  1376.  
  1377.  
  1378.  
  1379.  
  1380.  
  1381.  
  1382.  
  1383.  
  1384.  
  1385.  
  1386.  
  1387.  
  1388. - 22 -
  1389.  
  1390. 7. PC RULES OF THUMB (Additional to Basic Rules of Thumb)
  1391.  
  1392. Run virus check BEFORE backup
  1393.  
  1394. Boot floppy systems from known, protected disks only
  1395.  
  1396. Never work with masters - first make copies on a trusted machine
  1397.  
  1398. Store data on floppy:
  1399. set path in autoexec.bat, but load from A: to
  1400. ensure data goes to floppy
  1401.  
  1402. Save your data periodically while working
  1403.  
  1404. Use write protect tabs
  1405.  
  1406. Use write protect software on hard disk / backup track 0
  1407.  
  1408. Never boot HD systems from floppies (unless known and
  1409. protected)
  1410.  
  1411. New/repaired hard disk? - run a virus detector
  1412.  
  1413. Use protection package (practice safe hex)
  1414.  
  1415. Avoid shareware / BB demos
  1416. if you use a BB, set path to A: beforehand,
  1417. download only to A:, poweroff immediately after,
  1418. then powerup and do a virus scan on the floppy;
  1419. always scan shareware
  1420.  
  1421. Know the source of your software
  1422.  
  1423. Don't use illegal copies
  1424.  
  1425. If your data is truly confidential, don't depend on
  1426. DELETE - you must use, e.g., Wipefile
  1427.  
  1428. Autopark software
  1429.  
  1430. Hardcards
  1431.  
  1432.  
  1433.  
  1434.  
  1435.  
  1436.  
  1437.  
  1438.  
  1439.  
  1440.  
  1441.  
  1442.  
  1443.  
  1444.  
  1445.  
  1446.  
  1447.  
  1448.  
  1449.  
  1450.  
  1451.  
  1452.  
  1453.  
  1454. - 23 -
  1455.  
  1456. 6. A FEW EASY TRICKS FOR PC SECURITY
  1457.  
  1458.  
  1459. 1. Set Read only attributes on all files ending with .COM, .EXE, .SYS,
  1460. . OVL, .BIN, .BAT
  1461.  
  1462. e.g.: ATTRIB +R *.SYS
  1463.  
  1464.  
  1465.  
  1466. 2. Use an undocumented trick in DOS of naming your data files ending
  1467. with an ASCII blank or NUL character (ASCII 32 or 255): ***
  1468.  
  1469. e.g.: COPY A:OLDFILE.TXT NEWFILECHR$(255).TXT
  1470. or REN A:MYFILE.DAT MYFILECHR$(32).DAT
  1471.  
  1472. *** Newer versions of DOS will give the ASCII blank or null by
  1473. holding the [Alt] key and striking the numeric keypad numbers;
  1474. e.g. COPY A:OLDFILE.TXT NEWFILE[Alt]255
  1475.  
  1476.  
  1477.  
  1478. 3. Prevent inadvertent formatting of the hard disk:
  1479.  
  1480. Rename FORMAT.EXE to (e.g.) DANGER.EXE
  1481. Write a 1-line batch file called FORMAT.BAT:
  1482. DANGER A: %1 %2 %3 %4 %5 %6
  1483.  
  1484.  
  1485. 4. Have a batch program as a shutdown routine, to run:
  1486.  
  1487. 1. Virus Check
  1488. 2. Copy Track 0
  1489. 3. Back up your data files
  1490. 4. Park the heads
  1491.  
  1492.  
  1493.  
  1494.  
  1495.  
  1496.  
  1497.  
  1498.  
  1499.  
  1500.  
  1501.  
  1502.  
  1503.  
  1504.  
  1505.  
  1506.  
  1507.  
  1508.  
  1509.  
  1510.  
  1511.  
  1512.  
  1513.  
  1514.  
  1515.  
  1516.  
  1517.  
  1518.  
  1519.  
  1520. - 24 -
  1521.  
  1522. 9. SO YOU'RE INFECTED
  1523.  
  1524.  
  1525. Terminate all connections with other computers
  1526.  
  1527. Record your last activities
  1528.  
  1529. Determine the nature and extent of the damage
  1530.  
  1531. Notify other users
  1532.  
  1533. Contact the source of the carrier software
  1534.  
  1535. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  1536.  
  1537.  
  1538. Back up data files to new diskettes
  1539.  
  1540. Erase infected disk (using high or low level format -
  1541. low level is preferred to re-write track 0)
  1542.  
  1543. Check master disks with detection program(s)
  1544.  
  1545. Restore system files
  1546.  
  1547. Restore data files
  1548.  
  1549. Run detection program(s) again
  1550.  
  1551. Be careful in future - think like a thief!
  1552. ------------------
  1553.  
  1554.  
  1555.  
  1556.  
  1557.  
  1558.  
  1559.  
  1560.  
  1561.  
  1562.  
  1563.  
  1564.  
  1565.  
  1566.  
  1567.  
  1568.  
  1569.  
  1570.  
  1571.  
  1572.  
  1573.  
  1574.  
  1575.  
  1576.  
  1577.  
  1578.  
  1579.  
  1580.  
  1581.  
  1582.  
  1583.  
  1584.  
  1585.  
  1586. - 25 -
  1587.  
  1588. 10. SUMMARY: WHAT CAN YOU DO?
  1589.  
  1590. There are many aspects to computer security, none of which are totally
  1591. within your control, but all of which are reasonably within your control.
  1592. One of the major methods of getting control is to establish an
  1593. enforceable security policy AND a disaster recovery plan. However, it's
  1594. almost impossible to establish a plan unless you first know what the
  1595. risks are.
  1596.  
  1597. WHEN YOU GO BACK TO YOUR OFFICE
  1598.  
  1599. Try putting some staff into two teams: "hackers" and "police" (or call
  1600. them Blue Jays and Cardinals if you find that offensive). The role of
  1601. the hackers is to try to dream up all the things they could get from or
  1602. do to the company (or to a department) by breaking computer security.
  1603. The role of the police is to respond with defenses. Then switch roles.
  1604. List all the ideas, no matter how "far out" they seem, then use this for
  1605. the basis of risk analysis and disaster recovery planning. The only rule
  1606. to this game is that no idea is initially rejected.
  1607.  
  1608. Now that you have some idea of the value of your data and the risks it is
  1609. under, you can begin to work on a "Computer Security Policy" and a
  1610. "Disaster Recovery Plan." While many suggestions have been made on the
  1611. previous pages, recognize that not all risks/solutions apply to all
  1612. organizations: you have to make some judgement calls based on your
  1613. assessment of the risk. The judgement is based on how much loss you can
  1614. comfortably sustain, yet remain in business. The level of security
  1615. protection you require may not always be the same. It may vary with the
  1616. value of the hardware, software or data under consideration; the
  1617. security level, therefore, might be stated as "minimal," "discretionary,"
  1618. "mandatory," or "verified." The point is, as long as it's been
  1619. considered, you're closer to having a good security system than if you
  1620. have no policy or a policy that's based on guesswork.
  1621.  
  1622. You may find, after working on this for a while, that you may wish to
  1623. develop a separate policy for the selection or development, change,
  1624. testing and implementation of software. This might be stated as simply
  1625. as, "No system shall be acquired, developed, changed or implemented
  1626. without the prior approval of the Systems Steering Group." This might
  1627. also go on to cover documentation; e.g., "Documentation must be complete
  1628. for all systems prior to implementation, and must include sections on
  1629. files used, access controls, security considerations and controls
  1630. (etc.)."
  1631.  
  1632. Some further points for consideration are included in the next section.
  1633.  
  1634.  
  1635.  
  1636.  
  1637.  
  1638.  
  1639.  
  1640.  
  1641.  
  1642.  
  1643.  
  1644.  
  1645.  
  1646.  
  1647.  
  1648.  
  1649.  
  1650.  
  1651.  
  1652. - 26 -
  1653.  
  1654. 11. COMPUTER SECURITY POLICY: POINTS FOR CONSIDERATION
  1655.  
  1656. Any policy on computer security must be based on the premise that
  1657. information is a valuable asset of the company, just like its premises,
  1658. equipment, raw materials, inventory and so on. More than one company has
  1659. gone under because they lost their accounts receivable data in a fire,
  1660. flood, or from a simple hard disk failure. The value of your data should
  1661. be subjected to a risk analysis, and all identifiable risks assessed. It
  1662. is not until you identify the risks that you can plan for a disaster
  1663. recovery.
  1664.  
  1665. Your policy might include some of the many things addressed previously in
  1666. this paper: e.g., storing data only on removable media (diskettes or
  1667. tapes), limiting access to bulletin boards, establishing password
  1668. controls, rules on physical security, use of immunization software, etc.
  1669. There are, however, some other specific points not previously discussed:
  1670.  
  1671. RESPONSIBILITY
  1672. Recognize that security is a management issue, not a technological
  1673. issue, and that setting policy is the responsibility of senior
  1674. management. They must be 'on board' and understand why a security policy
  1675. is needed to make it sensible and effective, and they must give overt
  1676. support.
  1677.  
  1678. Someone should be in charge of computer and network security. Without
  1679. someone in charge, important security tasks may not get done. The duties
  1680. of the security manager would include responsibility for limiting access
  1681. to the network, securing the information that passes over it, overseeing
  1682. password systems, and installing security packages that protect computers
  1683. from illegal tampering once a user is on the network. Other duties might
  1684. include analyzing the network for security weaknesses and helping users
  1685. understand the security strengths and weaknesses of the network.
  1686.  
  1687. The amount of time required of the system security specialist may depend
  1688. on the size of the organization, and on the number and complexity of the
  1689. systems in use or planned.
  1690.  
  1691. Having one person in charge is probably the ideal security arrangement.
  1692. The security specialist can become aware of all of the issues affecting
  1693. computer/network security, can schedule and establish priority for
  1694. actions, and can ensure that the actions are taken.
  1695.  
  1696. This position in the organization requires some authority and autonomy.
  1697. For instance, security is compromised if the boss shares his/her
  1698. password. The security specialist needs to be able to change the boss's
  1699. password if this happens, and gently but firmly discuss the problems
  1700. which could result.
  1701.  
  1702.  
  1703. In many organizations, putting two or more people in charge of something
  1704. diffuses responsibility. Each can think that some security concern was
  1705. the responsibility of the other. If two individuals are charged with
  1706. network security, be certain that they work well together, communicate
  1707.  
  1708.  
  1709.  
  1710.  
  1711.  
  1712.  
  1713.  
  1714.  
  1715.  
  1716.  
  1717.  
  1718. - 27 -
  1719.  
  1720. well, and will each put in their fair share of the analysis and work that
  1721. is required for security.
  1722.  
  1723. In some organizations, a "communications manager" is responsible for
  1724. limiting access to the network (with dialback modems and encryption
  1725. devices), while the network manager maintains password systems and
  1726. installs security software.
  1727.  
  1728. If someone is in charge of network security and you don't know about it,
  1729. then they haven't been very obvious about it. They need not be. But if
  1730. it is evident to you that security is lacking, then perhaps the issue of
  1731. responsibility should be examined (or re-examined).
  1732.  
  1733.  
  1734. BACKUPS
  1735. Those who are most zealous about backups are those who've been affected
  1736. in the past by a loss of data. If backups are performed every day, your
  1737. computer or network is probably in good shape when the hard disk or file
  1738. server goes to heaven. You will want to verify that this is the case,
  1739. since most organizations (and individuals) put this off... and off...
  1740. until it's too late.
  1741.  
  1742. Backing a system up once a week is not enough, unless the system is
  1743. rarely used. If your last backup was a week ago, and your hard disk or
  1744. the hard disk in the file server crashes, all users of the network have
  1745. lost one week's work.
  1746.  
  1747. This cost is enormous. If you have 10 users who have lost 30 hours of
  1748. work each, if each user is paid $20/hour, and overhead is 100%, then you
  1749. have just lost 10 x 30 x 20 x 2 = $12,000. If you assume that backup
  1750. takes one $20 hour with a tape drive, you could back the system up 600
  1751. times for $12,000. That's nearly three years, if backups are done five
  1752. times a week. Many hard disks will not run continuously for three years.
  1753. Even if you're a 'stand alone' computer user, your time is valuable. You
  1754. might consider a policy that, if recovery covers a period of more than
  1755. 'x' days, it must be done on the employee's own time, and all deadlines
  1756. must be met - tough, but it get's the point across!
  1757.  
  1758. Irregular backups are a sign that backup is not taken as seriously as it
  1759. should be. It is probably wisest to do the arithmetic, comparing the
  1760. costs of backup with the costs of losing work for multiple users. The
  1761. cost comparison in the commentary on the second answer doesn't even
  1762. consider the possibility of losing irreplaceable files, such as those
  1763. containing new accounts receivable entries or new prospects.
  1764.  
  1765. Since file backup is a "private" activity, not knowing how often it
  1766. occurs does not mean that it does not occur. But if you have a security
  1767. concern, you should find out what the correct answer is. After all, if
  1768. you use the network, and it is not backed up frequently, it is your work
  1769. that is lost when the hard disk in the server crashes.
  1770.  
  1771.  
  1772.  
  1773.  
  1774.  
  1775.  
  1776.  
  1777.  
  1778.  
  1779.  
  1780.  
  1781.  
  1782.  
  1783.  
  1784. - 28 -
  1785.  
  1786. BEWARE: backing up is NOT enough! You MUST periodically run your
  1787. recovery procedure .... how else will you know it will work when you need
  1788. it most?
  1789.  
  1790.  
  1791. PURCHASING
  1792. The policy should state the controls in place for purchase of both
  1793. hardware and software, and it should be consistent and centralized.
  1794. Unless you've seen what some software can do to destroy security, or how
  1795. difficult it is to interconnect different equipment, this might seem to
  1796. destroy some autonomous activities in your organization. Autonomy be
  1797. darned, it's the company that's paying the bill.
  1798.  
  1799.  
  1800. MAINTENANCE AGREEMENTS
  1801. All warranty registrations must be mailed to the manufacturer, and
  1802. records kept of purchase dates, expiry dates and repairs made under the
  1803. warranty. Keeping accurate records has substantiated the complete
  1804. replacement of more than one machine.
  1805.  
  1806.  
  1807. SOFTWARE LOADING
  1808. The checking, copying and loading of software should be the
  1809. responsibility of one person or department. The 'penalty' for loading
  1810. illegal/unauthorized software can range from a note in the personnel file
  1811. to dismissal, depending on the organization. The opposite, copying the
  1812. organization's software for loading in another location, should also be
  1813. covered in the policy, because the company (as the registered owner)
  1814. could be party to a lawsuit without the ability to plead ignorance.
  1815.  
  1816.  
  1817.  
  1818.  
  1819.  
  1820. EMPLOYMENT TERMINATION
  1821. In several organizations, when a person submits their resignation, their
  1822. access to the computer system is immediately withdrawn. This, of course,
  1823. requires a close liaison with the personnel department in large
  1824. organizations. Many of these companies feel it's worth the salary cost
  1825. to have the person leave the premises immediately (escorted), and simply
  1826. pay out their notice period. If your company adopts such a policy, it
  1827. should be made very clear that it is not an indication of trust in the
  1828. person, but simply a means to reduce risk to the valuable resources of
  1829. hardware, software and data. It must be administered consistently and
  1830. equitably to avoid problems. There are problems with such a policy,
  1831. not the least of which could be someone who gives a very lengthy notice
  1832. period simply because they're aware of the policy - but you could
  1833. transfer them to a clerical job for the interim (like the mail room) or
  1834. to maintenance staff (washroom detail).
  1835.  
  1836. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1837.  
  1838.  
  1839.  
  1840.  
  1841.  
  1842.  
  1843.  
  1844.  
  1845.  
  1846.  
  1847.  
  1848.  
  1849.  
  1850. - 29 -
  1851.  
  1852. 12. TO RUN SCAN (Virus detection software included on this diskette)
  1853.  
  1854. SCAN looks for 42 viruses in software files, but not in data files. I
  1855. know it works on Jerusalem-B because I used SCAN to detect that virus on
  1856. a machine at work. This is NOT the latest version of SCAN, but then
  1857. again, you're not likely to have the latest viruses (I hope).
  1858.  
  1859. If you want to print the documentation, type: COPY A:SCAN.DOC PRN
  1860. If you want to run SCAN, just type: A:SCAN [drive identifier]
  1861. e.g., A:SCAN C:
  1862.  
  1863.  
  1864. An article from the Washington Post, January 14, 1990, on Computer
  1865. Viruses was added to the diskette after this paper was written.
  1866.  
  1867. To read this article, key TYPE A:ARTICLE|MORE
  1868. To print the article, key COPY A:ARTICLE PRN
  1869.  
  1870.  
  1871. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  1872.  
  1873.  
  1874. If you have found this presentation useful, either by attending or by
  1875. reading or using the information on this diskette, then I am rewarded.
  1876. If you found it useful, please feel free to copy this diskette or its
  1877. contents and share it with others - I would ask that you don't change
  1878. anything, though. (It was virus free at the time I made the original
  1879. diskette - but if you trust that statement, you might just have made your
  1880. first mistake.)
  1881.  
  1882. If you'd like to make suggestions that would improve the information on
  1883. this diskette, I would be very happy to hear from you. I'd also like to
  1884. hear from you if you wish to discuss security issues, get a virus
  1885. infection or hit by a Trojan Horse, or even just to comment on the
  1886. contents of this paper. My address and phone number are on the first
  1887. page of this document.
  1888.  
  1889. If you would like to join the National Computer Security Association, a
  1890. 'form' for application is on the next page. They provide benefits such
  1891. as a Virus Self-Defense Kit that's more sophisticated than the software
  1892. on this diskette, newsletters, a virus-free bulletin board with hundreds
  1893. of security-related programs, discounts on software, books and
  1894. conferences, and advice if you run into trouble.
  1895.  
  1896. Happy (and safe) computing!
  1897.  
  1898.  
  1899. E. A. (Liz) Bedwell
  1900.  
  1901.  
  1902.  
  1903.  
  1904.  
  1905.  
  1906.  
  1907.  
  1908.  
  1909.  
  1910.  
  1911.  
  1912.  
  1913.  
  1914.  
  1915.  
  1916.  
  1917.  
  1918.  
  1919. National Computer Association
  1920. Suite 309
  1921. 4401-A Connecticut Ave. NW
  1922. Washington, DC
  1923. USA 20008 Phone: (202) 364-8252
  1924.  
  1925.  
  1926.  
  1927.  
  1928. [ ] I wish to join NCSA. Cheque enclosed for $45.00 (US funds)
  1929.  
  1930. [ ] I wish to join NCSA. Please bill me for $45.00 (US funds)
  1931.  
  1932.  
  1933. Name: _____________________________________________________
  1934.  
  1935. Organization: _____________________________________________________
  1936.  
  1937. Address: _____________________________________________________
  1938.  
  1939. _____________________________________________________
  1940.  
  1941. City, Prov.: ____________________________ Postal Code ____________
  1942.  
  1943. Phone (with area code): ___________________________________________
  1944.  
  1945.  
  1946. Title or Position, or interest in computer security:
  1947.  
  1948. _____________________________________________________
  1949.  
  1950. _____________________________________________________
  1951.  
  1952. .
  1953. Downloaded From P-80 International Information Systems 304-744-2253
  1954. skype : yamod.gas
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!