86-01-35 Counteracting Viruses in MS-DOS Previous screen Systems A. Padgett Peterson Payoff The trapdoors programmed into the first DOS-based personal computers still persist today, providing relatively easy access for viruses and worms. By learning how malicious software exploits these weaknesses, security managers can develop a coordinated defense to counteract virus attacks now and in the future. This article describes how MS-DOS start- up processes can become exposed to viruses, discusses various intrusion methods, and presents techniques for designing a safe computing environment. Problems Addressed Today's personal computers still bear striking similarities to the first units created during the 1970s. All of the trapdoors and loopholes developed by systems experts to permit BIOS-level programming in the early stages of development of these systems are still present today, providing easy access for viruses, worms, logic bombs, and Trojan horses. It is alarming that such low-level programs are no longer being fully documented by manufacturers; they are currently treating as proprietary the techniques that were widely disseminated just a few years ago. Administrators and systems managers who are responsible for the millions of dollars of corporate investment in trusted computing systems typically lack an in-depth understanding of these systems. Unfortunately, penetration techniques, though not readily available, are known to an underground of hackers. Although numerous antivirus products have become available, these products are as available to hackers as to legitimate users. Fortunately, defenses are available to the corporate systems manager that cannot be readily compromised by the individual computer user. A trusted computing environment can be developed that is low in cost and user impact, one that not only has a high degree of reliability but permits natural and easy growth. This article provides a basis for developing such an environment. Focusing on the MS- DOS-based computing environment, the article identifies potential security weaknesses introduced during the development of the IBM PC (and its clones) and the MS-DOS operating system. It reviews methods of intrusion, both current and expected in the near future, and concludes by presenting a set of automated and procedural methods for counteracting these threats. Development of MS-DOS-Based Systems The trapdoors introduced by systems experts in the early development of the personal computer still remain in the most recent versions of MS-DOS-based systems. To fully understand the vulnerability of today's systems to attack by computer viruses, the security specialist must become familiar with the way these systems were developed. The systems most widely used today are based on the design of the Intel 8086 microprocessor, the successor to the Intel 8080 family of microprocessors. When introduced in 1979, the Z-80 and the Intel 8080were the best-known microprocessors; Zylog had also recently announced its 16-bit Z-8000. The reception to the Intel 8086 was lackluster at best, despite Intel's promise to port CP/M to the 8086 (as soon as Digital Research could get around to it) and to provide MASM-86, its macro-assembler. The Air Force had just announced MIL-STD-1750 for 16-bit processors, and the 8086 didn't satisfy this standard. Enter IBM. A large market for microcomputers was forming, and Big Blue did not Previous screen want to miss out. IBM decided to leapfrog its competition, quietly opening a plan in Boca Raton FL to design a new personal computer targeted for introduction in 1981. This computer was originally planned as an 8-bit machine; IBM's EBCDIC coding protocol was abandoned in favor of ASCII. Intel offered IBM its 8088 microprocessor(an 8086 redesigned to accommodate an 8-bit data path) at a price IBM could not refuse, and a deal was made. Because IBM was a bit out of touch with single-tasking environments, it contracted with an outside vendor, Microsoft, for a disk operating system (DOS). Microsoft did not have a suitable operating system but arranged for a reciprocal agreement with Seattle Computer Products for use of Tim Paterson's 86-DOS, a CP/M clone. Microsoft later bought all rights to 86-DOS. Although present-day PC-DOS is much expanded—providing hooks for such functions as the rarely seen Macro-Assembler, Quick-BASIC, FORTRAN, and Pascal—in its underlying architecture, it deviates little from CP/M. In its first personal computers, IBM included a software bit that could be set to make a program executable but not readable or listable—the first copy protection. Hackers quickly learned how to use the BASIC POKE command to defeat this protection, leading to the first shareware (UN.P) and the attitude that it was open season on software: if you could obtain it, it was yours to run. The open season extended to cloning as well, and copies soon proliferated; some were so well executed that the IBM logo even appeared in their BIOS, leading to the first copyright infringement suits. To help market those first personal computers, IBM used an open architecture, supplying applications programmers with in-depth engineering specifications that documented exactly how the computer worked and encouraging them to develop such programs as spreadsheets and word processors. Unfortunately for IBM, the architecture was a bit too open: Microsoft made PC-DOS available to anyone as MS-DOS after changing only a few invisible names, which further heated up the clone wars. Nonetheless, by 1983 the standard created by IBM came to dominate the industry, as it does today. This evolutionary process has led to 486-based machines, with mainframe performance, multiuser networking, and multimegabyte memory. Despite such advances, however, that first IBM PC is still seen in every MS-DOS- based machine today (e.g., 64K-byte segments and a 640K-byte limitation on main memory). From a security perspective, this apparent strength of the IBM PC (and its clones) has become its most dangerous weakness: there have been no significant deletions from the operating system architecture since 1981. This is not to say that extensions have not been added. For example, with the introduction of MS-DOS 2.0 in 1983, the pervasive high-level interrupt INT 21h took over many of the low-level functions of the system. Previously, the BIOS communicated with external devices through the use of 32 basic interrupts, INT 00 through INT 1Fh. Only a few interrupts—for example, INT 10h (the display handler), INT 13h (the disk handler), and INT 16h (the keyboard handler)—had more than one function; all had less than 16. In MS-DOS 3.30, INT 21h has more than 100 functions, replacing nearly every low-level interrupt. The low-level interrupts are still supported, however, though not all are documented in the latest DOS technical manual. Most viruses infect systems through these low-level interrupts for one reason: although interrupts INT 20h through INT FFh are loaded by DOS, the BIOS loads INT 00 through INT 1Fh at boot time. In any IBM PC(or fully compatible microcomputer), these interrupts must be exactly as defined by PC/MS-DOS 1.0. This is why a 1982 Columbia BIOS can run easily with MS-DOS 3.3 and be upgraded to 5.0. This is also why a virus written in 1982 under DOS 1.25 is just as infectious in 1992. A Review of MS-DOS Start-Up Processes Previous screen Because the microcomputer is most vulnerable to infection during start-up, it is important to understand the process that all MS-DOS machines use to wake up, load files, and execute applications. When powered on, the 8086 CPU automatically sets its instruction pointer(IP) to location 0h of memory segment FFFFh, the last segment of memory addressable by the 20 bits available to an 8088/8086microprocessor. (Although the 186, 286, 386, and 486 microprocessors have more bits available, MS-DOS does not recognize them.) This memory area is devoted in every personal computer to the BIOS ROM. The CPU then runs some equipment checks on the system (i.e., the Power-on Self Test [POST] function), zeroing memory while discovering how much available memory is present; stores this amount in the BIOS data table at locations 413h and 414h; defines interrupts 00 through 1Fh in the interrupt table in segment 0, locations 00 to 3FFh; examines even segment addresses from A000 to F000 for ROM extensions; and finally performs an INT 19h to start the DOS boot-up process. This boot process, which is the same one triggered by pressing [CNTRL] [ALT] [DEL] , next attempts to read the first sector (1,024 bytes) of disk drive 0(i.e., drive A—the first diskette drive) into segment 0, locations 7C00h through 7FFFh. If this fails, the BIOS will attempt to read the first sector from drive 2 (i.e., drive C, the fixed disk). Failing this, a true IBM PC will branch to ROM BASIC by executing an INT 18h. Most clones, lacking ROM BASIC, will react to an INT 18h by sending a message requesting a bootable disk; the clone will retry an INT 19h after a keystroke has been entered. Execution is next transferred to the code that was just loaded into location 7C00h. With a hard drive, this information (which is contained in the partition table at physical sector 0) describes the logical disks, including the boot record. The sole purpose of the boot record is to find the first of two operating system files containing the rest of DOS (IBMBIO.COM and IBMDOS.COM for PC-DOS; in MS-DOS, these are IO.SYS and MSDOS.SYS), load them into low memory (just above the 400h table values), and transfer control to the operating system for the rest of the configuration.