Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!cs.utexas.edu!wuarchive!udel!haven!mimsy!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: christer@cs.umu.se (Christer Ericson)
Newsgroups: comp.virus
Subject: Re: Where are the Sophisticated Viruses?
Message-ID: <0001.8911091541.AA08370@ge.sei.cmu.edu>
Date: 8 Nov 89 13:15:35 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 36
Approved: krvw@sei.cmu.edu

In article <0002.8911062045.AA11747@ge.sei.cmu.edu> ctycal!ingoldsb@cpsc.ucalga
ry.ca writes:
>There are probably two reasons why the viruses you suggest do not
>exist:
>  1) If the system code is bypassed, then it must be rewritten.
>     Most hackers are not at that level.  Those that are that
>     proficient are busy making money.
>  2) Code to do all the stuff needed would be quite large, and
>     therefore noticeable.  If you add 20 K to somebody's
>     programs they will likely notice.

I don't agree with you on any of these points, Terry. Say, on the
Macintosh all calls to ROM are done through trap vectors in RAM. These
trap vectors are patched by the system file (to fix bugs), by some
programs and by all anti-virus tools. However, it doesn't take a
genius to figure out that one could restore the trap vector to it's
original value and thereby bypassing the "safe" system.  (Alright, we
don't have the bug fixes installed, but it's easy to mimic what is
done by the system file. (For instance by simply calling the very same
routine.)). A patch like this wouldn't occupy much space and is quite
simple to write.

I'd guess I could write a virus using the above technique in a day or
two, which would be undetectable by all existing anti-virus tools, and
along with me so could lots of other people. However some of us are
busy making money, as you said, and we who are just working (:-))
probably have some sense of moral, stopping us from bringing total
chaos to the computer society.

>  Terry Ingoldsby

/Christer

| Christer Ericson                           Internet: christer@cs.umu.se  |
| Department of Computer Science, University of Umea, S-90187 UMEA, Sweden |
|     >>>>>    "I bully sheep. I claim God doesn't exist..."    <<<<<      |