From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: VIRUS TOOLKIT
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  6 Jan 93 14:43:32 GMT

johan@blade.stack.urc.tue.nl (Johan Wevers) writes:

> I've a few questions to the virus experts here:

Please note that comp.virus is a more appropriate newsgroup for such
questions. Besides, I have the impression that more virus experts are
reading comp.virus than alt.security... :-)

> Can these packages, in combination with the mutation engine, be a serious
> danger for the present virus scanners?

No more than without the mutating engine. Look, if a virus is buggy
(like most generated by VCL are), adding MtE-level of polymorphism to
it will not make it work better. On the other side, some of the
packages generate viruses in source, so it is -very- easy to modify
them and make them use the polymorphism of MtE. However, any scanner
that is capable to perform reliable detection of MtE-based viruses
will be able to detect the new virus too. (Well - almost; there are a
few insignificant exceptions, but they are not interesting.) Note that
if the MtE is -not- added to the new virus, chances are that it will
not be detected by the existing scanners... So, adding MtE
polymorphism actually reduces the chances of the newly generated virus
to remain unnoticed. On the other side, the scanners that are able to
perform reliable detection of the MtE-based viruses are relatively
few, so it is not so easy to answer correctly to your question...

> Further, I've heard of a virus
> toolkit which modifies the virus so that it isn't stuck after or before a
> program, but mixed through it, rebuilding the original program sequence of
> the program in memory, something like this:

> 0100:
>  jump to virus code
> [Piece of the original program]
>  virus code
>  jump to next virus code
> [Piece of the original program]
>  virus code
>  jump to the next virus code
>    :
>    :

> I've read in a magazine that a combination of this principle with the
> mutation engine could generate virusses which would be hard- or unpossible
> to detect, even with heuristic scanning methods. Is this true? And what

Your information is somewhat incorrect. There is no toolkit that can
modify an existing virus to infect a program in this way. Instead,
there is one existing virus (Commander Bomber), which infects programs
in this way. The virus is not encrypted, so it is trivial to scan for
it - the only problem is that you must scan the whole file - since the
main body of the virus can be anywhere in the file and control to it
is transfered via small pieces of code that contain some do-nothing
instructions and transfer control (not necessarily via a JMP) to the
next piece.

It is also true that if one combines this infection strategy with MtE
polymorphism of the main body of the virus, the resulting beast will
be -extremely- hard to scan for. I would not say "impossible", but -
extremely hard. Much more hard than scanning for MtE. The main
difficulty would be to avoid the false positive alerts. Fortunately,
not such virus exists yet. The Bulgarian virus writer who uses the
handle "Dark Avenger" is rumored to be working on such a virus (MtE
and Commander Bomber are his creations), but no such virus has been
created yet. It is definitively not trivial to do it. Unfortunately,
it is possible.

But even if such viruses begin to appear, you should always remember
that the scanners are not the strongest line of defense against
viruses... For instance, an integrity checker would have no problems
to detect the "beast" described above... (Well, the integrity checkers
have other problems, but this is a different subject.)

> about using an operating system that is not as open as DOS, e.g. linux or
> OS/2. Can this give any protection?

Yes, it can give some protection. As a beginning, most of the already
existing viruses will stop working. The important thing is that will
not give full protection - I mean, some people seem to think that just
by introducing memory protection and access controls you can make
viruses impossible... There were a few messages on comp.security.misc
on this subject recently; you should check there.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: alt.security,comp.mail.misc,news.answers,alt.security.ripem