From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: "Viruses Get the Boot", Information Week 10 Aug. pg 15 (PC)
Date: 14 Aug 92 14:17:57 GMT

Once again the old "Hardware vs Software" question arises (as  an 
aside, I *suspect* that the patent referred to in the article  is 
the same one that I examined a couple of years ago. It *might* be 
effective against some viruses but the description was too  vague 
totell).

Just  to clear the air, IMHO the only hardware needed to  prevent 
viruses  is BIOS ability to select the primary boot disk  as  the 
hard  drive instead of a floppy. *Everything* else necessary  can 
be done as well by software. 

Further,  for  the  paranoid, MFM, RLL, and SCSI  drives  can  be 
hardware  write  protected  either at the controller  or  with  a 
physical device on the cable connecting drive and controller (IDE 
is more difficult) - but nowhere else.

While  hardware on the bus or attached to a port *could*  prevent 
or  at least detect the majority of the known viruses, they  will 
fail  a  directed  attack by a  professional  (or  professionally 
written viruses).

Why ? Because the PC architecture is a single-state machine. Even 
though  there  is  a  "protected" mode, what  can  be  done  with 
software  can be undone with software and the only  link  between 
ANY  hardware  device on the bus (or a port) that  does  not  use 
dedicated cabling is software.

So  far  I  have  only seen one  true  disk  hardware  device  as 
described above. It had a separate hardware control panel and  an 
internal  board.  While  it  was "on"  the  bus  (for  power  and 
reporting only, software commands would not be accepted), it also 
physically  separated the disk cable between the  controller  and 
the drive. This will work so long as a virus does not get  "help" 
from the user.

ANY other hardware device that relies on software for control  is 
subvertable  by  software. Period. Of course there  is  no  virus 
known  today  that  could do this, but to  me,  the  question  is 
*could* it be done. 

Consider a BIOS extension (the only major change made to the  IBM 
BIOS description since the PC was introduced). After POST  (power 
on  self test), the BIOS scans the region from segment  C000h  to 
EE00h  for a BIOS extension signature indicating that a  hardware 
device with on-board ROM is present. Early PC users will remember 
the  first  drive controllers loaded at segment C800h  and  using 
DEBUG  to  G C800:5 for a low level format using  the  controller 
ROM.

Such extensions work invisibly by redirecting one or more of  the 
BIOS interrupts (contained in the Interrupt table at location 0:0 
in RAM) from the BIOS to their own ROM code. A hardware antivirus
device  would have to work in the same way (for a  more  complete 
description,  refer to either the Phoenix BIOS book for  the  PC-
XT/AT or one of the early IBM PC Hardware Manuals).

A directed attack could simply patch the Interrupts back and  the 
hardware  device would be bypassed - the only hard part would  be 
finding the real interrupt vector but several mechanisms (such as 
tunneling) could be used for this. 

Consequently,  IMHO,  against  a  directed  attack,  a   hardware 
solution other than as outlined above (e.g. anything that  claims 
to work on "any PC" or "on any port" or "just by inserting in any 
available  slot")  would  need a lot of  explaining.  Again  IMHO 
software could be just as (in)secure without using a slot or port 
or dedicated upper memory (today, the address area from C000h  to 
FFFFh  is just as valuable as the "lower 640") and I have yet  to 
see hardware that could be sold as inexpensively as software.

The  bottom  line ? The IBM-PC, for all of its 486/66  power  and 
gigabyte hard disks, etc. etc. etc. Has had no real architectural 
changes since Oct. 27, 1982. It was not designed to be multi-user 
or  to have any integrity management. It will happily attempt  to 
execute  *anything*  it is told to. This is what makes a  PC  (or 
clone  or...) 100% compatible and the streets are  littered  with 
"PC"s that thought they could be different.

Anti-virus  software that succeeds does so by making the  minimum 
intrusion on the system (why Scanners are so popular -  integrity 
management  programs are *much* more difficult to write - my  MBR 
routines  were  hard  enough, replacement DBRs are  an  order  of 
magnitude  more  difficult  &  it is  incredible  just  how  many 
different  & conflicting OSs there are).  Hardware,  particularly 
pure hardware that claims to stop "any" virus, would be unlikely.

Warmly,

Padgett