From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Thu, 7 Jan 1993 15:23:39 GMT

In article <C0GIA7.4Fz@panix.com> rpowers@panix.com (Richard Powers) writes:
>>>In <1993Jan5.153018.18935@nastar.uucp> phardie@nastar.uucp (Pete Hardie) writes:
>
>>Consider a multi-user system where another user installed the virus, and I
>>want to transfer a file to my home system, and need to transfer the marker
>>file, but I do not know which file it is.
>
>A multi-user system can be treated exactly like several single-user
>systems.  If you want to transfer a file (or make available to other
>users) to another user on the same _or_ to a different system you can:
>
>(1) remove the virus first
>	or
>(2) also transfer (make available) the permission file.

If I do not know the virus is in place on the multi0user system (and if it
deserves the name 'virus', I shouldn't know unless I really poke around), I
cannot be aware of the necessity of transferring the marker file, and I also
do not know how to remove the virus before transferring the file.

>If you're talking about a multi-user system where a super-user has
>installed the virus (ie: the virus has permission to spread to _any_
>users files), then I would certainly hope that the super-user would
>have informed all other users that this is the case.  I don't think it
>would be ethical otherwise, since the person would be changing people's
>files without consent.

Not necessarily.  Some systems operate user accounts under suffrance - you
get only what the admins allow.  Others allow privacy, but do not guarantee
anything else.  The raw format of the data is not usually guaranteed, like
the position of files on a disk is not guaranteed.

An admin who installed a device driver that compressed all files would
be doing the same thing, in essence, and would not be likely to tell the
users, except as bragging about the regained disk space :-)

>This really was discussed already.  Upon failing to find the marker
>file (which may contain some of the code the virus uses to
>compress/spread), it could do several things:

I missed this in the discussion.  But it does bring up a point for later,
about the definition of virus.

>(1) Remove itself.  The BCV would decompress the file and then save it
>back to disk in its original state.  Uncompressed and w/out virus
>code.

This would be the only ethical option for a 'beneficial virus', IMHO.

>(2) Decompress as usual.  It would get the file running as usual, and
>then just quit.  Letting the host file continue.  *** I _don't_ think
>this is the way it should be implemented. ***

Ok, so noted.

>(3) Notify the user.  Tell the user it exists.  This could (should) be
>combined with other methods.

I would say *must* be combined with other methods.

>(4) Create a marker file.  Give itself permission to spread.  *** I do
>_not_ think this should be implemented by itself.  It defeats the
>pupose of the marker file.  ***

This would make the virus unremovable.  Major unethical for a beneficial
virus.

>(5) Ask the user.  Give the user a menu of choices for what it should
>do.  This is the only context I see (4) being appropriate.  (3) is, of
>course, not applicable.   ***  I prefer this method over all.  If (1)
>were implemented and the marker file was lost w/out my knowledge, I
>wouldn't want my files to mysteriously decompress. ***

This starts to make the program less of a virus, since it becomes more of
a system utility.  It also makes it possible for a user to infect a system
without the owner's knowledge.

>Now, I also mentioned having a list in the permission file of files
>the BCV was not allowed to infect.  You could just add the name of the
>file you wanted to transfer to this list and the BCV would use method
>(1) above.
>
>I would probably also have one or more BCV maintenance tools.  To
>check up on how it is performing, to create/update/change the
>permission file, and to remove the BCV from specific files.

This, along with the marker file having the compression code, makes this into
something other than a virus, IMHO.  It is not self-contained anymore.  It
becomes a disk compression utility that could be installed as a hook in the
drive access instead of a free-floating infectious program.



-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Xref: sparky comp.org.eff.talk:8312 alt.comp.acad-freedom.talk:3856 comp.security.misc:2443 alt.privacy:2843 alt.society.civil-liberty:7262