A Short Course on Computer Viruses by Dr. Frederick B. Cohen Copyright c ASP Press, 1990 { All Rights Reserved ISBN# 1-878109-01-4 ASP Press PO Box 81270 Pittsburgh, PA 15217 USA Contents 0.1 Introduction 1 Computer Virus Basics 1.1 What is a Computer Virus? 1.2 How Do Viruses Spread Through Systems? 1.3 What Damage Could A Malicious Virus Do? 1.4 Some Other Things Malicious Viruses Might Do 1.4.1 A Data Diddling Virus 1.4.2 The Random Deletion Virus 1.4.3 A Production Destruction Virus 1.4.4 A Protection Code Changing Virus 1.4.5 A Network Deadlock Virus 1.4.6 An Ex- ecutive Error Virus 1.4.7 A Covert Channel Virus 1.4.8 Synergism in Attack 1.5 What Could a Benevolent Virus Do? 1.5.1 Maintenance Viruses 1.5.2 Distributed Databases with Viruses 1.5.3 Life for Its Own Sake 1.5.4 Practical Limits 1.6 Viruses in Specific Computing Environments 1.6.1 Viruses in MVS 1.6.2 PC, MacIntosh, and Amiga Viruses 1.6.3 Viruses in Unix and VMS 1.6.4 Viruses in LANs 1.7 The Three Differ- ences 1.7.1 Generality 1.7.2 Range of Effect 1.7.3 Persistence 1.8 High Risk Activities 1.9 Summary 2 Real World Viruses 2.1 Some Early Experiments 2.1.1 The First Scientific Experiment 2.1.2 A Compression Virus 2.1.3 A Bell-LaPadula Based System 2.1.4 Instrumentation 2.1.5 Psychological Effects of Experi- ments 2.2 The Computer Virus Record Book 2.2.1 The Smallest 2.2.2 The Fastest on a PC 2.2.3 Spreading in Networks 2.2.4 Other Time Dependent Indications of Interest 2.3 Real World Computer Viruses 2.3.1 The Xerox Worm 2.3.2 The First Maintenance Viruses 2.3.3 The Lehigh Virus 2.3.4 The Brain Virus 2.3.5 The Jerusalem Virus 2.3.6 The Swiss Amiga Virus 2.3.7 The Mainframe Christmas Card Virus 2.3.8 The MacMag Virus 2.3.9 The Scores Virus 2.3.10 The Internet Virus 2.3.11 The AIDS Disk 2.3.12 The Datacrime Virus 2.3.13 Early Evolutionary Viruses 2.3.14 Simulation (Stealth) Viruses 2.3.15 The Bulgar- ian Viruses 2.3.16 Some Trends 2.3.17 Virus ToolKits and Automated Evolution 2.3.18 Cruncher 2.3.19 What's in a Name? 3 Technical Protection From Viruses 3.1 Perfect Technical Defenses 3.1.1 Limited Sharing 3.1.2 Limited Transitivity 3.1.3 Limited Function 3.2 Technical Defenses With Major Flaws 3.2.1 Can We Detect All Viruses? 3.2.2 Can We Find Resulting Infections 3.2.3 The Tail Chasing Problem 3.2.4 Instrumentation 3.2.5 Vaccines 3.2.6 Virus Scanners 3.2.7 Software Self Defense 3.2.8 Boot Locks 3.2.9 Snapshots 3.2.10 System Call Interception 3.3 Technical Defenses That Work Well 3.3.1 Software Fault Tolerance 3.3.2 Sound Change Control 3.3.3 Integrity Shells 3.3.4 Integrity Shell Limitations and Features 3.4 Defense-in-depth Against Viruses 3.4.1 The Moated Wall 3.4.2 Synergistic Effects of Defense-in-depth 3.4.3 Limits of Synergism 3.4.4 Other Effects 4 Non-Technical Defenses 4.1 Limited Sharing 4.1.1 Isolation During Attack 4.1.2 Separation of Function 4.1.3 The AIDS Disk 4.1.4 No External Disks 4.1.5 Clearing Houses 4.1.6 Limiting Information Sources 4.2 Change Controls 4.3 Auditing 4.4 Peer Network Problems 4.5 Tracking Down Attackers 4.5.1 Tracking Down The Christmas Card Attacker 4.5.2 Tracking Down The Internet Attacker 4.5.3 When A Success Is Not A Success 4.5.4 Needed Improvements In EDP Audit 4.6 Backups as a Defense 4.6.1 They Don't Always Work 4.6.2 They Aren't Kept Long Enough 4.6.3 They Act As Safe Harbor For Viruses 4.7 Recovery From Viral Attack 4.7.1 See It 4.7.2 Kill It 4.7.3 Get Away Quickly 4.8 CERT Teams 4.9 Reactive And Proactive Defense 4.10 Management Tools 4.11 Laws Against Malicious Viruses 4.11.1 Intent 4.11.2 Malice 4.11.3 Unauthorized 4.11.4 Other Factors 4.11.5 Civil Re- course 5 Some Analysis 5.1 Risk Analysis 5.2 Product Comparison By Type 5.2.1 Defense-in-depth 5.2.2 Perfect Defenses 5.2.3 Integrity Shells 5.2.4 Cryptographic Checksums 5.2.5 System Call Detection and Prevention 5.2.6 Known Viruses Detectors 5.2.7 Special Purpose Defenses 5.2.8 Looking For Questionable i ii CONTENTS Instructions 5.2.9 Examining Printable Strings 5.3 Epidemiology of Computer Viruses 5.3.1 Virus Vectors 5.3.2 General Trends and Time Factors 5.3.3 Susceptibility of Modern Systems 5.3.4 How Defenses Impact Epidemiology 5.3.5 Another Vital Result 5.3.6 The Impact of Evolution on Epidemiology 5.3.7 How Good is Good Enough? 5.3.8 Epidemiology and Strategic Planning 5.4 Exposure Analysis 5.4.1 The Informa- tion Flow Model 5.4.2 The New Exposure Analysis 5.5 A Cost Analysis Of Viruses and Select Defenses 6 Strategy and Tactics in Virus Defense 6.1 General Principles 6.1.1 General Strategic Needs 6.1.2 General Tactical Needs 6.2 Some Widely Applicable Results 6.3 Some Examples 6.3.1 Typical Attacks 6.3.2 The Small Business Scenario 6.3.3 The University Scenario 6.3.4 The Financial Institution Scenario 6.3.5 The Computer Company Scenario 0.1. INTRODUCTION iii 0.1 Introduction This book was derived from recordings of my one-day short courses on computer viruses. The course runs about 8 hours, and at the time of this writing, had been taught about 50 times. In this course, I try to avoid the deep technical details and most of the mathematics behind the conclusions presented. At the same time, I think it is important to provide enough evidence to be convincing and understandable. As an aid to the technically inclined reader, I have provided a number of good references which contain more detailed technical information. This is not a technology book, it is a science book. By that I mean that the purpose of the book is to educate the reader, so that for the rest of their life, they will understand about computer viruses, and never be surprised by what happens. For that reason, I avoid discussing details of particular technologies except for the purpose of providing examples. The point is to give you knowledge of the subject that can be applied regardless of the system you are using, the programming languages in the environment, or the most popular operating system of the day. The intended audience is anyone who works intimately with computers on a day-to-day basis. It will be particularly helpful to computer programmers, information systems managers, systems administrators, EDP auditors, and computer security specialists, but it would also be a good book for an undergraduate student who has taken a course on computers, and has been used in graduate programs as a supplement to other material. You will find the coverage of this book quite broad. We begin with the basics of computer viruses, and discuss how they work, what they can do, and how they are different from other technologies. We then discuss scientific experiments with viruses, viruses that have appeared in the real world, and how organizations have historically responded to the threat of viruses. Next, we go into details about defenses, starting with theoretically sound defenses, then moving into a series of examples of defenses that don't work very well, describing the best current defenses in real systems, and discussing non-technical defenses and management issues. Next we analyze the impact of computer viruses and defenses, go through a series of scenarios that consider viruses in a variety of real-world situations, and sum up the course. Finally, in the appendices, we tell `the good joke' that I tell just after lunch to wake people up before starting the second half of the course, include the most commonly requested technical details, and provide a list of about 75 annotated references to related works. I hope that you enjoy this book, and I welcome your comments and suggestions. iv CONTENTS Chapter 1 Computer Virus Basics 1.1 What is a Computer Virus? I would like to start with a formal definition . 8M8V (M; V ) 2 VS , [V 2 TS]and[M 2 TM]and [8v 2 V [8HM [8t8j [1)PM (t) = jand 2)2M (t) = 2M (0)and 3)(2M (t; j); :::; 2M (t; j+ j v j −1)) = v] ) [ 9v0 2 V [9t0 > t[9j0 [1)[[(j0+ j v0 j) ≤ j]or[(j+ j v j) ≤ j0]]and 0 0 0 0 0 0 2)(2M (t ; j ); :::; 2M (t ; j + j v j −1)) = v and 3)[9t00s:t:[t < t00 < t0] and 00 0 0 0 [PM (t ) 2 j ; :::; j + j v j −1] ]]] ] ] ] ] ] Figure 1.1: Formal Definition So much for that! Now let me tell you what it means.