From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Tue, 12 Jan 1993 14:57:49 GMT

In article <C0psLo.KLx@panix.com> rpowers@panix.com (Richard Powers) writes:
>The BCV would need to use _some_ method to search for files to infect.
>It would be trivial to restrict this to searching only what belongs to
>the user who placed it on the multi-user system.

Perhap it is trivial.

Another thought occurs - when does the virus infect an executable?  When
the executable is next run (virus is a TSR), or the first time an infected
program is run (virus is part of executable).  The latter case can introduce
long delays in execution of the 'real' program.

>I don't really see the BCV as being usefull to an individual user on a
>multi-user system.  Users usually don't own their own executables, for
>one thing.

Au contraire.  UNIX executables are owned by the user.  I believe that VMS
executables are owned by the user running the compile.

>>Again, if we are talking about use on one system, the BCV is not a problem
>>for the installer, and almost never a problem for anyone else.  
>
>Exactly!  These *are* the circumstances which I had in mind when
>proposing this.

OK, this is an agreement point.

>>Once we are
>>discussing 2+ machines, it *can become* a problem for the other users, since
>>they suddenly find a section of code *that they did not write* residing in
>>their executables, and asking them questions about a file *they may know
>>nothing about*.
>
>But I contend that all that is necessary is for the BCV to be used
>responsibly.  The design should make it easier for this to be so (the
>marker file, etc.), and minimize any problems that could occur.

And I keep saying that if it acts like a virus, it de facto cannot be 'used'
responsibly, since 'use' is not controlled by the user.

>>I'm not clear on this.  If the marker file is present, and I do not have
>>any executables from before, how do I know?  
>
>You are talking about a multi-user system in this case, yes?  "See
>above."  Refers to my discussion of the sysadmins responsibility to
>inform his/her users of the presence of the BCV.

But what about the case where the sysadmin is not the installer?

>But the BCV could (and should) be made to restrict itself to the
>owning users files.

How will the virus be able to tell that the user's files are his/hers on
another system?  User id's are different, and not all are equally certain
to be unique.

>No, I understand what you are saying.  I still don't think _you_ get
>my point.  Just because the program exhibits behavior that is right
>now exclusively(?) used by programs which exist only as a nuisance (at
>best), or are actually dangerous, does not mean that this should
>reflect on _every_ program which has _some_ similar characteristics.
>The particular methods any program uses can be debated for and
>against.  (Is it a bug or is it a feature?)  What I'm saying is that
>the characteristics which we say typify(sp?) as virus charecteristics
>do _not_ prohibit a program from being beneficial.

Let me try again.

The BCV _is_ a virus.  It compresses my files w/o my knowledge, just like
a device driver.  But it can arrive on my system and affect files that I
did not want affected.  Thus it no longer is _beneficial_.  And that is
the problem.  It does not affect ALL programs, which would be at least
noticeable, but only some, and only at a later date (execution).

If I am trying to make an executable that will exactly fill a single floppy
disk, your BCV is harmful to my goal, since it will allow a larger program
to be placed on the disk, and then at some later date it might be decompressed
and no longer fit.

>>It is the assumption that you (or the virus writer) know better than I what
>>is beneficial to my system/files that is the problem.
>
>I don't understand why you think anyone is assuming this.  This is no
>more the case with the virus writer (beneficial type) than with any
>other programmer whose programs are used on systems other than his
>own.

But other programs either a) run all the time, which means that the admin
can control their presence, or b) are run only by explicit invocation, which
means the user wants them to run.  The BCV runs in a 'hidden' manner, affecting
programs beyond the original one in an indeterminate manner (to the user)


-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.org.eff.talk