From: jsm@fc.hp.com
 (John Marvin)
Subject: Re: USR sportster conversion announcement.
Date: Fri, 2 Oct 1992 09:11:35 GMT
Organization: Hewlett-Packard Fort Collins Site
X-Newsreader: TIN [version 1.1.1 PL6]

Mark Buda (hermit@dastari.uucp) wrote:
: 
: I would be very interested to find out how modem firmware can inflict
: irreparable damage to anybody's hard drive.
: 
: 

   ...


: [Ob. disclaimer for the foolish: My first paragraph above is serious.
: The second one is not. I *would* be very interested to know how this
: alleged damage might happen. I do not believe it is possible. And no,
: Hayes has nothing to do with this, and modems can't have trojan horses
: or viruses. But I would not be the least bit displeased if this
: particular paragraph of USR's statement (if it is in fact USR's
: statement) caused such a rumor to spread.]

I agree that USR's statement is foolish and almost certainly untrue, but
why do people think that a modem ROM can't have a virus that could 
trash your hard disk? It is certainly possible, but not probable in this
case. It is not probable because:

	1) The "conversion" most people are referring to does not involve
	an illegally copied rom. It just entails using some special
	AT escape sequences.

	2) Even in the case where people are circulating illegal ROMS, the
	chance that they have been hacked to include a virus is very small,
	because of the difficulty in hacking binaries. People might be
	able to modify some of the text, etc, but to significantly change
	the firmware would take a significant investment in disassembly,
	including probably having to develop your own tools (We aren't
	talking about 80x86 assembly here!).

But in theory it is possible. It would even become a higher probability
if someone got their hands on an illegal copy of the original source for
the firmware (or if a disgruntled USR employee decided to risk his/her career).

Don't forget that the current generation of modems have a significant amount
of CPU/DSP power, with fairly large amounts of ROM space. I believe it would
be possible to do the following  (as one example of a possible virus):


	1) Analyze the characters being transferred (in both directions),
	looking for signs of standard uploading protocols like ZMODEM, etc.
	To minimize code space, only one particular protocol may be the
	target.

	2) Once the modem determines that an upload protocol is being used,
	look at the file names, looking for a .EXE or .COM extension.

	3) Modify the .EXE or .COM file to contain a virus which will
	trash the hard disk when executed. Modify associated protocol
        checksums/crcs, so that the protocol doesn't reject the 
	uploaded file as being corrupt.

For an even more farfetched, but still theoretically possible virus, consider
what could be done if the modem recognized that SLIP was currently being
used! Please note that the firmware controls the LED's, so the modem can 
hide (at least visually) any illicit traffic it is generating.

Anyway, I hope this doesn't start a long discussion on the probability of
this happening. I am only responding because more than one person has 
effectively stated that it is IMPOSSIBLE to have a virus in a modem.

	John Marvin
	jsm@fc.hp.com