Path: utzoo!utgpu!water!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!cornell!batcomputer!mha
From: mha@batcomputer.tn.cornell.edu (Mark H. Anbinder)
Newsgroups: comp.sys.mac
Subject: Re: SCORES ordeal + new(?) SCORES info
Message-ID: <6616@batcomputer.tn.cornell.edu>
Date: 17 Oct 88 01:50:41 GMT
References: <6685@ut-emx.UUCP> <10330059@eecs.nwu.edu> <1255@zippy.eecs.umich.edu>
Reply-To: mha@tcgould.tn.cornell.edu (Mark H. Anbinder)
Organization: Cornell Theory Center, Cornell University, Ithaca NY
Lines: 60

In article <1255@zippy.eecs.umich.edu> gld@zippy.eecs.umich.edu (Greg L. Dykema) writes:
<In article <10330059@eecs.nwu.edu>, jln@eecs.nwu.edu (John Norstad) writes:
<> NO, NO, NO!!!!  Please don't post disassemblies or sources for viruses!!!
<> 
<> John Norstad
<> Academic Computing and Network Services
<> Northwestern University
<
<This is one way of looking at the question of whether or not to publicize
<virus code and exact descriptions of virus operation. The other option
<is to release all the information anyone can find on viruses to everyone.
<The reasoning behind the former is that you hope to limit the number of
<people who have the desire and/or knowledge to write a virus...
<
<But we have lost something too. We have lost a free exchange of information,
<admittedly information that could help or hurt. But I believe that the 
<"additional" damage releasing virus source code might do is not worth
<the loss of information, information necessary if one is to understand the
<possible threat of viruses (and specific viruses in the case of publishing
<specific source code) and to defend against them. What gives anyone the
<right to decide in whose hands this "priviledged information" will lie?
<
<In any event, I believe that the question of whether not to publish virus
<source code does NOT have a clear answer!
<
<Greg Dykema

I have to agree with John here.  Releasing source code or exact descriptions
of what viruses do is tantamount to giving every half-competent programmer
in the world the ability to create a virus quickly and easily.

Something like the Scores virus does enough damage the way it is.  It doesn't
do anything actively except replicate itself, but its presense and its
reproductive activities cause enough problems.  Imagine if someone with the
least bit of programming skill got hold of a source copy and added a teensy
little routine to erase a desktop file or write over the boot blocks of a
hard disk?

Having the source code of a virus at hand would also help give someone the
knowledge necessary to circumvent all of the antivirus programs created to
date.  As Vaccine's author has said, the last thing we want is to fuel an
ongoing escalation whereby viruses get too smart for the antivirus programs,
which are then updated to take care of those viruses, which are then made
smarter, leading to...

In any case, no one need decide in whose hands this 'privileged information'
should lie.  Anyone with the ability to decompile a virus can look at it.
If you don't happen to have access to a virus to do this, DON'T COMPLAIN.
You've been lucky.  And no, I won't send you a copy of a virus, either.  This
isn't suppressing information, it's just refraining from publishing it.

I'm terrified that someone is going to get their hands on a virus' source
code and write the first virus that will REALLY be designed for damage.  It
won't be a pretty sight.

-- 
Mark H. Anbinder                                ** MHA@TCGould.tn.cornell.edu
NG33 MVR Hall, Media Services Dept.             ** THCY@CRNLVAX5.BITNET
Cornell University      H: (607) 257-7587 ********
Ithaca, NY 14853        W: (607) 255-1566 ******* Ego ipse custodies custudio