From: seborg@csrc.ncsl.nist.gov (Brian Seborg)
Newsgroups: comp.virus
Subject: network security
Date: 29 Sep 92 15:42:29 GMT

Vesselin Bontchev writes:

>seborg@csrc.ncsl.nist.gov (Brian Seborg) writes:

>> Patricia Hoffman's VSUM lists the 1530 virus as CB-1530 
>> (according to her July 1992 version).  Your description seems to
>> more closely resemble the 1963 virus.  Both of these viruses are
>> related to the Dark Avenger Virus so this may account for 
>> McAfee's seeming mis-identification

>Two points: First, as Frisk mentioned, it was a completely new 
> virus (Alexander), not even belonging to the Dark_Avenger family.

So I see, however, my submission was in the mail before Frisk had
made this conclusion.  Not having a copy of this virus, I will
defer to his opinion. :-)

>Second, 1963 (Necropolis) and the Dark_Avenger viruses have
> nothing in common. They are completely different, belong to
> different families, infect in a different way, use different
> tricks, and are written by different people.

As you can see from my posting, I only offered a plausible guess
given the brief description of the original poster.  I am not
surprised that the virus was different.  As for 1963 having
"nothing in common" with the Dark_Avenger virus, I will leave you
to argue this out with Patricia since she seems to disagree with
you here.  Again, I was only offering a best guess, as was noted by
my posting!?!  I am not sure why you wasted the band width to
revisit this since it was obvious to any reader that no definitive
answer was being provided.
 
>> to see if in fact you have the same beast.  Patricia's VSUM
>> should be helpful in determining if you are at least talking
>> about a similar virus or not.

>I disagree. VSUM is full of errors and not helpful at all to
>provide correct, technical virus information. In fact, I challenge
>anyone to find an entry in VSUM, which has no errors and/or
>omissions...

While I must agree that VSUM does have its share of errors, and
provides little in the way of "down and dirty" technical
information, I still believe it is a good reference for ball-
parking whether you have a particular virus or not.  I have to
admit that I prefer the descriptions put out by Brunnestein's
students (including you) for accuracy, although the user-
friendliness of the lists containing these descriptions leaves
something to be desired.:-)

>Some comments about the "virus research algorithm" that you
>described (I'll save the bandwidth and will not quote it here).
>Have in mind that some viruses are very capricious and you have
>literally to feed them with a spoon, in order to make them
>replicate. The Rythem virus infects only files that are not in the
>root directory. Dr_Watson infects only AUTOEXEC.BAT. Some of the
>Astra viruses infect only device drivers. Some viruses (Tequila
>and StarShip, I think) will not

Wrong about Tequila, it infects just fine.  Remember, it is a
multi-partite virus and it does go TSR.

>infect, if you don't have a hard disk - because they don't go
>resident when you run an infected file, but only modify the MBR
>and wait until the user reboot... There are some other pitfalls.
> We have a huge amount of files here, about which we cannot easily
>decide whether they are viruses, trojans, buggy programs, or just
>innocent tools.  They all refuse to replicate on the systems we
>have tested them, but this does not imply that they will not
>replicate on some other 

But this does imply that they are unlikely to represent a threat
since there survival is unlikely.

>systems. The only way to solve the problem is to disassemble each
>one of them and see what it does. And this is a LOT of work...

No disagreement here.  Disassembly is obviously the best solution,
however, many users are not assembly programmers, and are unlikely
to be able to dis-assemble the virus.  Also, in cases where the
user notices changes in files (like the one we are speaking of) my
suggested technique works well.  I never said that it was "the only
way," or that it would be sufficient to completely describe any
virus, but it can provide important clues which could lead to a
sufficient understanding of the virus so that it can be dealt with,
or compared with other existing viruses to see if it is an existing
virus.  Also, continually bringing up viruses which have "new" and
"different" techniques that have often never been seen "in the
wild", or which are only the product of an active imagination may
be a useful academic exercise, but let's put some statistics next
to these viruses you have noted.  Have they infected any computers
at all other than in the lab?  Let's be reasonable!?!  I act as the
CERT for a network with over 350 servers, and 10,000 nodes.  In
addition, we have over 3000 lap-tops.  If I were "fishing" for
viruses this would represent a pretty large net.  Yet, we have seen
very few instances of other than the garden variety pests.  We have
anti-virus programs in place, and catch about 1 to 3 viruses a
month nation-wide, but have yet to see any of the viruses you
mention (other than Tequila which is fairly common in the USA). 
Our employees are not discouraged from reporting viruses by
reprimands, but are encouraged and even commended when they report
a virus.  I think it's time we started being realistic about the
actual threat from these viruses.

Sincerely,

Brian H. Seborg
VDS Advanced Research Group