May 1993 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Richard Ford Technical Editor: Fridrik Skulason Consulting Editor: Edward Wilding, Network Security Management, UK Advisory Board: Jim Bates, Bates Associates, UK, Andrew Busey, Datawatch Corporation, USA, David M. Chess, IBM Research, USA, Phil Crewe, Ziff-Davis, UK, David Ferbrache, Defence Research Agency, UK, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Igor Grebert, McAfee Associates, USA,Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland, Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane, Barrister, UK, John Laws, Defence Research Agency, UK, Dr. Tony Pitt, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University of Jerusalem, Israel, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue University, USA, Dr. Peter Tippett, Certus Corporation, USA, Steve R. White, IBM Research, USA, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA. CONTENTS VIRUS ANALYSES 1. The Volga Virus Family 9 EDITORIAL 2. Pitch - A new Virus High Note 10 Better DOS than DOS? 2 3. Loren - Viral Nitroglycerine? 12 IN MEMORIAM FEATURE David Lindsay 3 The Other Virus War 14 VIRUS PREVALENCE TABLE 3 PRODUCT REVIEWS NEWS Popping Up 3 1. MS-DOS 6: Worth the Wait? 17 McAfee Makes a Deal? 4 2. VET - The Wizard of Oz 20 Dirty Macs 4 INDUSTRY WATCH IBM PC VIRUSES (UPDATE) 5 ICVC ’93 - Virus Hunting in Bulgaria 23 INSIGHT Bates: Blues and Roots 7 END NOTES & NEWS 24 VIRUS BULLETIN ©1993 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. Page 2 VIRUS BULLETIN May 1993 However, the question of whether there should be any anti- EDITORIAL virus utilities included in the operating system is much more thorny. Better DOS than DOS? The first point is that for the ordinary computer user with no anti-virus software, MS-DOS 6 is a very good buy indeed. It It has been a long wait. The tension has been built dramati- will stop the Form virus, it is going to prevent the spread of cally by the marketing men, hyping users into a state of Cascade - indeed, it is entirely possible that it will cause a breathless expectation... and now the moment is here. How gradual decrease in the numbers of common viruses which can you have a new computer for just £49 asksMicrosoft ? are in the wild. Easy - install MS-DOS 6 on your old machine! This operat- ing system, users are told, is the one foryou . Why be stuck It is all too easy for computer security practitioners to see no with anything else? further than the walls of their ivory tower, and forgetwhat is going on in the real world. The vast majority of users have MS-DOS has come a long way since its birth in August 1981 absolutely no knowledge of computer viruses andnever ever - as has its creator, Bill Gates (who was born even earlier). take a backup. All the arguments about good security The first version of the operating system consisted of 4000 practices and update frequency suddenly become redundant. lines of code and ran in 8 Kbytes of memory. Some protection is better than none. This was little over a decade ago, yet we now live with a 7 Of course there are problems with the anti-virus components Mbyte monster of an operating system... which will run most of MS-DOS - it would be foolish to say this was not the case: of the software designed for its great-great-great-grandfather. it will be targeted, and it is not particularly difficult to In essence, although MS-DOS has been tidied up somewhat subvert. Of course there are worries about the age and from its humble beginnings, it has not changed much. frequency of the updates, but for the single user, it still represents at least some protection against viruses. MS-DOS 6 represents the next salvo in the increasingly bitter operating system war now being waged betweenIBM Companies may have a completely different view of built-in and Microsoft. In this release, Microsoft has upped the virus counter-measures. One would be ill-advised to base the stakes by making the system much lessOS/2 -friendly. When security of any important system on the reliability ofMSAV . DOS 6 was installed on one of the VB test machines, which Indeed, the review in this month’sVirus Bulletin brings to has an OS/2 partition (or rather, had an OS/2 partition) the light one of MSAV’s biggest weaknesses: its age. The net result was to make OS/2 inaccessible. True, the product performed worse than the version ofCPAV exam- product warns the user to consult the manual before proceed- ined in the January 1993 edition ofVB - hardly a result to ing, but this ‘hiccup’ during installation could be seen as a inspire customer confidence. blatant attack at its nearest competitor. No doubt it occurred for purely technical reasons. Apart from worries about its rather antique virus recognition capability, users have to be aware thatany anti-virus features For a long time, third parties supplied the parts of the built in to the operating systemwill be specifically targeted. operating system which Microsoft in its infinite wisdom had Would you trust an integrity checker of which you knew decided users did not need or want. With each release of every virus writer owned a copy? MS-DOS, Microsoft examined which add-ons users were prepared to pay for and built them in to the operating system. It is impossible to upgrade theMS-DOS operating system After all, what easier means of market research than to let and suddenly be immune to all forms of computer virus. someone else do it for you. Even though it is possible to make reasonably good generic virus detection software, the very nature ofMS-DOS makes Between the release of DOS 5 and DOS 6,Microsoft has this approach inherently insecure. By effectively handing out clearly been examining which extra utilities are selling well. copies of the door locks to all would-be burglars, one is The three latest bolt-on goodies are disk compression, weakening the security of one’s house. backup facilities and anti-virus software (the current boomtime industry). The situation may improve with the arrival of the next generation operating systems. They are unlikely to be much It is not difficult to see why adding disk compression more secure, but it is probable that it will be significantly software and decent backup facilities is a good thing - and a harder to write viruses exploiting their weaknesses. Come to good selling point. After all, the operating system is the that, they will be much more difficult to writeanything for sensible place for both. them. Still, that is a very small price to pay. Isn’t it? VIRUS BULLETIN ©1993 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. May 1993 VIRUS BULLETIN Page 3 NEWS Virus Prevalence Table - March 1993 Popping Up Viruses reported to VB during March 1993. Dr Joseph Popp has been found guilty of ‘attempted Virus Incidents (%) Reports extorsion’ by a court in Rome. Dr Popp, who was accused of being the man behind the infamous Aids diskette case, has Form 22 33.3% been sentenced to a two and a half years imprisonment. New Zealand 2 8 12.1% Popp was tried in absentia, and therefore has sixty days in Spanish Telecom 6 9.1% which to lodge an appeal. If no such appeal is received Tequila 5 7.6% within this time, the sentence is fixed. Cascade 4 6.1% Popp was originally extradited to the UK to face charges Joshi 4 6.1% concerning this case, but was eventually ruled unfit to plead BFD-451 3 4.5% and was sent back to the USA. This is the first successful case brought against him in respect of the incident. Helloween 3 4.5% Yankee 3 4.5% Jim Bates, who was involved in the attempt by the British 1575 2 3.0% authorities to bring Dr Popp to a UK court, said ‘I am delighted that the hard work put in by both myself and the Michelangelo 2 3.0% police has finally resulted in a conviction’. Sources have Vacsina 2 3.0% informed Virus Bulletin that part of the evidence used DIR-II 1 1.5% against Popp in the trial was an Italian translation of Bates’ report on the Aids disk. NoInt 1 1.5% This sentence means that the authorities will immediately be Total 66 100.0% looking for Popp. For a long period after the original Aids Diskette incident, his whereabouts were not known. of his forthcoming œuvre until he is ready to have it pub- However, the Italian judiciary need not look far, because lished, but it is believed to be non-fiction, written for a according to a report in an American magazine, Dr Popp is general audience, along the lines of ‘I’m OK, You’re OK’.