Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!samsung!munnari.oz.au!cluster!metro!natmlab.dap.csiro.au!ditsyda!macuni!mqccsunc!ifarqhar
From: ifarqhar@mqccsunc.mqcc.mq.OZ (Ian Farquhar)
Newsgroups: comp.lang.postscript
Subject: Re: Postscript Viruses
Keywords: PostScript Viruses Trojan Horses
Message-ID: <159@macuni.mqcc.mq.oz>
Date: 24 Jan 90 11:33:48 GMT
References: <21772@uflorida.cis.ufl.EDU> <1990Jan14.180821.18711@trigraph.uucp> <1990Jan16.154513.10892@intercon.com> <17677@rpp386.cactus.org> <51011@bbn.COM> <137@macuni.mqcc.mq.oz> <139@macuni.mqcc.mq.oz> <1487@wrgate.WR.TEK.COM>
Sender: news@macuni.mqcc.mq.oz
Reply-To: ifarqhar@mqccsunc.mq.oz (Ian Farquhar)
Organization: Macquarie University, Sydney
Lines: 39

In article <1487@wrgate.WR.TEK.COM> herbw@midas.WR.TEK.COM (Herb Weiner) writes:
>In Article <21772@uflorida.cis.ufl.EDU> ifarqhar@mqccsunc.mqcc.mq.OZ
>(Ian Farquhar) writes:
> 
>> 2.  To really do damage, it would have to access the undocumented
>>     contents of the internal dictionary, or access the hardware
>>     directly.  Both are non-standard, would need a great amount
>>     of code and intimate knowledge of internal details to do this
>>     trick.  Woody mentioned scrambling the file system, which he
>>     said is not difficult.  This is about all that I can think a
>>     virus/trojan could do.
>
>I disagree!  My hard disk contains downloaded fonts plus the font
>cache.  I have backups for my fonts, and loss of the font cache
>would not be catastrophic.  The WORST thing that a virus or trojan
>horse could do would be to change the serverdict password!
>
Only if your password is set to zero, which mine isn't.  However, for
the vast majority of users this would be zero, and they might be up the
proverbial creek.

I have no idea where the serverdict password is stored - it possibly is
not accessible to any postscript codes (I would hope that this would be
the case).  The only quick fix is to have your EEPROM erased or replaced
with one containing the standard value.


All hail Saint Fubar, parton saint of computer programmers.

+-----------------------------------+-------------------------------+
|  Ian Farquhar                     | Phone : (02)  805-7420 (STD)  | 
|  Microcomputer Support            |         (612) 805-7420 (ISD)  |
|  Office of Computing Services     | Fax   : (02)  805-7433 (STD)  |
|  Macquarie University  NSW  2109  |         (612) 805-7433 (ISD)  |
|  Australia                        | Also  :       805-7205        |
+-----------------------------------+-------------------------------+
|  ACSNet      ifarqhar@macuni.mqcc.mq.oz			    |
|              ifarqhar@mqccsuna.mqcc.mq.oz         		    |
+-------------------------------------------------------------------+
D