From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Protection from Boot Sector Viruses (PC)
Date: 9 Apr 92 20:45:56 GMT

pjs@mulga.cs.mu.oz.au (Peter Stuckey) writes:

> Peter Stuckey didn't write anything.  He merely acted as postman for

Sorry, the above statement is put automatically by my netnews reader.

[Moderator's (tongue-in-cheek) note: I think that we're going to have
a recursive situation (or at least a perpetually iterating one) here
in a moment - Vesselin's reply is to a note from Roger Riordan, not
Peter Stuckey.  Could this be a RISK of having someone forward e-mail
to a discussion group on your behalf?  :-\]

> I won't answer Vesselins comments in detail, except to re-iterate
> my statement;

>    "IF you replace any boot sector VET does not recognise on any
>     new disk, or any disk that has been in anyone elses PC, you
>     CANNOT get a pure boot sector virus."

My main complain was that it might "automatically" destroy something
that is not a virus.

> I did not explain that our documentation says that if you get any
> valuable software from anyone else the first thing you should do
> is to check if the disks are write protected, and if not write
> protect them. Then check them, & if VET does not like the boot
> sector (or finds a virus) copy the files to a clean disk & check
> (& disinfect) that.  This way you won't destroy anything valuable,
> & if a disk is infected you still have the evidence, & can't be
> accused of infecting it yourself.

Sure, if you have backups... Unfortunately, persuading the users to
make them seems to be just as difficult as to persuade them to boot
from the proverbial non-infected write-protected system diskette.

> Many of us are so busy thinking of obscure holes in each others

Yeah, those of us that try not to be as shortsighted as the people who
made the users rely entirely on known-virus scanning...

> products that we overlook the fact that 99% of viral incidents
> involve a few well known & readily detectable & removable
> viruses.  It is nice thinking of ways of preventing exotic
> attacks, but meanwhile our PCs are being overrun with Stoned, M,
> & similar trivia.

Yep, but if your claims were true, then these viruses should have been
already erradicated, since all self-respecting virus scanners are able
to detect them... Meanwhile I am trying to forsee and provide ways to
prevent the exotic attacks that would provide the current
sophisticated viruses to become just as widespread as Stoned after
four years or so...

> I fully agree that no system is foolproof, and we never claim so
> in our advertisements, but keeping viruses out is very largely

My main disagreement with your philosophy is that I claim that a known
virus scanner is unsecure. Since it is unsecure, it cannot prevent you
well enough from being infected - because it only detects the known
viruses. OK, then, since it is able to do only this, it must be able
to do it WELL, damn it, and detect ALL known viruses, not only a
subjectively selected subset of "the most common ones".

> majority of actual virus attacks. Furthermore a scanner is the
> only form of defence that will detect viruses before they have
> any chance do anything to your system.

Of course it isn't the only one... Even if you classify the hardware
write protection and the heurisitc analysers as "scanners", there are
the monitoring programs. True, they can be easily bypassed, but so can
the known virus scanners.

> Assuredly someone has to be hit by a new virus before the
> scanners can find it,

Yep. And if the "thing" is a highly polymorphic stealth multi-partite
fast infector, it might spread pretty far while you are busy updating
your scanner... So far, that you will be unable to erradicate it -
just like Stoned.

> but refusing to use a scanner because it is
> not 100% secure is like refusing to use a condom because they
> sometimes have holes in them, or may burst.

First, I didn't propose to refuse to use scanners. I am proposing to
stop RELYING entirely on them. Second, the analogy does not hold. It's
more like refusing to rely on certificates that your partner is not
AIDS-infected - which are good only for the next half an hour,
especially if s/he has had sex with the nurse who has administered the
test afterwards... :-) I have no objections against the condoms - yes,
do use those write-protect tabs on your diskettes... :-)

> Integrity checkers provide a valuable second line of defence, but

My oppinion is that they are a valuable MAIN line of defense. Of
course, the full defense must not exclude the scanners, the monitors,
the heuristic analysers, the integrity shells, the generic removers,
and of course, the backups... Did I forget something? Oh, yes, the
hardware-based protection devices...

> they are not entirely reliable unless the user can be persuaded
> to boot from a clean DOS disk, and experience has shown that they
> do not work well in the hands of unskilled users.

The same goes for the scanners...

> Relying entirely on an integrity checker is akin to relying on
> blood checks to protect yourself against AIDs.  Granted they will

Right, but I'm not suggesting that. I'm suggesting to build a
multi-level line of defense, with accent on the integrity checking.

> usually detect viruses before they do any damage, but are you
> prepared to stake your life on it?

Yep, if you can provide me with a good life backup system... :-)

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54