From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Tue, 12 Jan 1993 15:09:40 GMT

In article <19530@mindlink.bc.ca> Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher) writes:
>How many people do you know who have a unix workstation at home that runs the
>same executables as the one at the office? Some versions of the same
>workstation won't even run each other's executables so for Joe to take an
>executables file home with him is VERY rare.

What about multi-user PCs?  The convergence of workstation power and PC power
is leading to more PC-type machines being used at home and at work, and
Intel binaries are generally compatible.

>>You are assuming that every user can (and should) have all his/her files
>>locked up tighter than a drum, on a multi-user system.  The first is
>possible,
>>but the second is debatable.
>
>Almost all multi-user systems I have been on have had write permission denied
>as a default.. Even on systems that don't (considering a different version
>would need to be done for each OS) the virus could be restricted so it looks
>in YOUR root directory (I can't see why it would do otherwise) for the marker
>file, and will not do anything unless the marker file AND the executable
>you're running belong to you. That's incredibly easy.

Write permission to where?  System directories, certainly, on UNIX systems.
But again, what about MS-DOS derived systems?

This is part of the problem - these things are being mentioned well after
the initial description of the BCV, and had Richard Powers gone ahead and
written the BCV, it might not have all this validity checking, and would
instead install in the system root directory, and infect any executable,
regardless of ownership.

>This way the sysadmin could install the virus for bin (who usually has root
>privs, or very near) and it would just pack the files in /bin.. Considering a
>user has absolutely no need to look at the executable then this would be a
>100% legit way for the sysadmin to pack the files without being obligated to
>tell you.

Yep.  But suppose the 'ownership check' was flawed, and merely checked if
you could write to a file - then this would infect all executables if it
was installed as root.

>>It is the assumption that you (or the virus writer) know better than I what
>>is beneficial to my system/files that is the problem.
>
>Where did you get this idea? If that was the thought of the virus writer then
>they wouldn't make it dependant on a marker file.

It is obvious from the context.  If all the writer wants is to compress his
own executables, without having to explicitly do it, he can write a batch
job, or device driver, that will do so on his machine, (or his account), and
none of this 'virus' discussion would be going on.  But once it is made into
a viral program, it can travel to other systems and infect them, and then
it begins to affect the programs of others, and at that point the definition
of 'beneficial' becomes relevant - I may considered it harmful to compress
my executables.



-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.org.eff.talk