Path: utzoo!utgpu!utstat!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!gem.mps.ohio-state.edu!uakari.primate.wisc.edu!unmvax!ncar!tank!eecae!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: WHMurray@DOCKMASTER.ARPA Newsgroups: comp.virus Subject: Sophisticated Viruses Message-ID: <0001.8911101233.AA16030@ge.sei.cmu.edu> Date: 9 Nov 89 14:59:00 GMT Sender: Virus Discussion List Lines: 39 Approved: krvw@sei.cmu.edu Thanks to Jim Frost for a very thought provoking posting. Here are some that I had while reading it. >Limiting Propagation Rates. Simple viruses, and often not-so-simple >ones, will proliferate without bounds. Rampant proliferation will >cause the virus to be noticed early in its lifetime and will probably >lead to its early demise. The internet worm did not do this. Most PC viruses do not do it either. When the vector is a diskette, it need not. Most of the network worms have not done it; they wanted to be noticed. Therefore, the requirement is a function of both the chosen vector and the motive. >Detecting and Avoiding "Virus-Protected" Hosts. I have yet to see a >virus which looked at the state of a system to detect virus detection >mechanisms to nullify them and/or avoid infecting them. Biological viruses simply ignore potential but immune hosts. If the potential population is sufficiently large, the presence of immune subjects is not important. However, again motive is important. We have not seen any viruses that were determined to conceal their existence, in part because writing a virus that no one notices is not any fun. If no one notices, then it is not possible to know about propagation or survival. What fun is that? >Count our blessings now because you >won't believe how bad tomorrow's nightmares will be unless we start >teaching ethics to tomorrow's programmers! I will settle for simple self interest. ALL computer users have a vested interest in an orderly environment in which programs can be relied upon to do only what they advertise. Virus writers are soiling their own nests. William Hugh Murray, Fellow, Information System Security, Ernst & Young 2000 National City Center Cleveland, Ohio 44114 21 Locust Avenue, Suite 2D, New Canaan, Connecticut 06840