Re: Viral encryption

As Mr. Ferguson pointed out, polymorphic viruses are making their way into the
DOS world.  This is a problem in the short term, but not in the long term
because people will be changing to memory-protected & file-permission based
operating systems like NT, OS/2 and Unix, where it is very difficult for
most kinds of virus to spread.

I myself am very familiar with the virus underground, so for those who are
not, let me explain the two newest and most deadly virus techniques which
are being seen in the DOS world.

The first is something called "Stealth" viruses.  Stealth viruses imbed
themselves into DOS and intercept disk read calls from applications. If
those read system calls are reading non .EXE or .COM files, then they are
processed normally.  However when an application such as virus scanning
program is reading in .COM and .EXE files (in order to scan them for virus
code), the stealth code in DOS intercepts this and returns to the application
what the .EXE or .COM file would look like if it wasn't infected by the
stealth virus.  Thus, all virus checking programs can be decieved in this
manner.  There are steps to get around this, like booting off of a
write-protected floppy disk (with a clean copy of DOS on it) and running
the virus checking program directly from that floppy.  But people seldom
do that, so the stealth technology is a worthwhile one for virus creators
to pursue.

The second is called "Polymorphic" viruses.  These are viruses which
contain a tiny encryption/decryption engine.  The great thing about
polymorphic viruses is that they encrypt themselves with a different key
each time they replicate (make a new copy of themselves).  The small 
amount of virus bootstrap code which is not encrypted is changed in each
replication by dispursing random NOP's throughout the virus boostrap code.
Thus each sample of polymorphic virus looks completely different to
virus checking programs.  The virus checking programs cannot use
"signature" byte strings to detect polymorphic viruses.

I have seen something called D.A.M.E., also known as Dark Avenger
Mutation Engine.  This is a freeware polymorphic library/kernel/toolkit
which allows anyone to take an ordinary virus and wrap it in a polymorphic
shell.  Thus each new copy of the virus will look completely different
as it replicates.  D.A.M.E. is a great toolkit for those who want to
release new viruses but don't have the skills to write a virus from
scratch.  DAME works very well with Turbo Assembler and MASM.
I believe that DAME II will be coming out sometime this spring. At
least that is what the author has promised.  Among the new features
will be more powerful encryption, stealth capabilities, and compatibility
with Stacker and DR DOS compressed file systems.  I have read that the
author of DAME and DAME II will be coming out with a Virus Construction
Set, which will allow point-n-click building of new viruses using
object oriented techniques.  It works sort of like a Mr. Potatohead,
you point and click on the parts/modules you want and it builds it for
you.  You select the replication method, stealth capability,
polymorphism, and payload module (there are several payloads, varying
from playing music and showing graphics, to printing a text message on
screan, to complete wipe out of the HD). The really wonderful thing
is that you will be able to build your own modules and link them into
the virus.  I am sure a flourishing of third-party modules will occur.

With the VCS, a 9 year old can build a competely new virus just by
pointing, clicking, and dragging, popping up windows and choosing options.

My oh my, aren't we in for fun times ahead...


Thug

> From: thug@phantom.com (Murdering Thug)
> I myself am very familiar with the virus underground, so for those who are
> not, let me explain the two newest and most deadly virus techniques which
> are being seen in the DOS world.

[ discusses stealth viruses, around for, oh, five years at least; and
  the MtE. ]

Reasonably accurate discussions, but let's leave the hype for _Time_
and McAfee.  "Stealth" viruses can be detected in memory, if you make
the mistake of getting infected in the first place.  MtE-derived
viruses enjoyed a window of about a month while they could not be
detected by scanners; they had no such reprieve from integrity
checkers.  Big deal.  (Well, from the point of view of a scanner
writer, it must be a pain, but that's not the user's problem.)
Cryptohash integrity checking is probably the way to go in the long
run, but scanners still work.

The "most deadly virus technique", in terms of number of infections
caused, is probably that of boot-sector infection.  Low-tech, but it
seems to work.

> Thug 

	 PGP 2 key by finger or e-mail
   Eli   ebrandt@jarthur.claremont.edu

> 
> > From: thug@phantom.com (Murdering Thug)
> > I myself am very familiar with the virus underground, so for those who are
> > not, let me explain the two newest and most deadly virus techniques which
> > are being seen in the DOS world.
> 
> [ discusses stealth viruses, around for, oh, five years at least; and
>   the MtE. ]
> 
> Reasonably accurate discussions, but let's leave the hype for _Time_
> and McAfee.  "Stealth" viruses can be detected in memory, if you make
> the mistake of getting infected in the first place.  MtE-derived
> viruses enjoyed a window of about a month while they could not be
> detected by scanners; they had no such reprieve from integrity
> checkers.  Big deal.  (Well, from the point of view of a scanner
> writer, it must be a pain, but that's not the user's problem.)
> Cryptohash integrity checking is probably the way to go in the long
> run, but scanners still work.
> 
> The "most deadly virus technique", in terms of number of infections
> caused, is probably that of boot-sector infection.  Low-tech, but it
> seems to work.
> 
> > Thug 
> 
> 	 PGP 2 key by finger or e-mail
>    Eli   ebrandt@jarthur.claremont.edu
> 

I'm sick and tired of all the virus hoo-hah myself.  The only "anti-virus
software" a hacker needs is DEBUG.  And maybe your favorite sector editor
utility, like DISKEDIT.  Anything more, and you're an embarassment.
Why don't you just send your life savings to McAfee while you're at it.
I could go and quote P. T. Barnum right now, but I think my point is made.

>I'm sick and tired of all the virus hoo-hah myself.  The only "anti-virus
>software" a hacker needs is DEBUG.  And maybe your favorite sector editor
>utility, like DISKEDIT.  Anything more, and you're an embarassment.
>Why don't you just send your life savings to McAfee while you're at it.
>I could go and quote P. T. Barnum right now, but I think my point is made.

Unfortunately most of humanity is not in the category of "hacker", and
we should be considerate of them.  While we tout cryptography for example
we have to remember that the only way that it will get into the mainstream 
is if it is integrated very nicely into foolproof user-friendly (sorry,
the term makes me cringe a bit too) software.

I don't see any constructive purpose served by viruses, and if anybody
in this group is advocating or even pursuing their development, I think
that has just brought the quality of the list down several notches, and 
really damaged the credibility of the speakers.  Definitely, they are
interesting to study, but the havoc they wreak is incalculable.  To the
extent that they encourage designers to create more straightjacket-type
security mechanisms, they are detrimental to the goal of simple and
straightforward access to computer technology, and significantly undermine
confidence in and use of that technology.