Computer Virus Myths

                                 Computer Virus Myths

                                  by Rob Rosenberger
                                 with Ross Greenberg


               A number of myths have popped up recently  about  the threat
          of computer "viruses".  There are myths about how widespread they
          are, how dangerous they are, and even myths about what a computer
          virus really is.  We'd like the facts to be known.

               The first thing you have to understand is that a virus  is a
          programming technique that falls in the realm of "Trojan horses."
          All viruses are Trojan horses, but very few Trojan horses  can be
          called a virus.

               That having been said, it's  time to go over the terminology
          we use when we lecture:

          BBS            Bulletin Board System.    If you have a modem, you
                         can call a BBS and leave  messages,  transfer com-
                         puter files back &  forth,  and  learn a lot about
                         computers.  (What you're  reading  right  now most
                         likely came to you from a BBS, for example.)

          Bug            an accidental flaw  in  the  logic  of  a computer
                         program that  makes  it  do  things  it  shouldn't
                         really be doing.  Programmers  don't  mean  to put
                         bugs in their program, but they  always  creep in.
                         The  first  bug was discovered  by  pioneer  Grace
                         Hopper when she  found  a dead moth shorting out a
                         circuit in the  early  days  of  computers.   Pro-
                         grammers  tend to spend more time debugging  their
                         programs than they do writing  them  in  the first
                         place.

          Hacker         someone  who really loves computers and who  wants
                         to push  them to the limit.  Hackers don't release
                         Trojan horses onto the world, it's the wormers who
                         do that.  (See  the  definition  for  a "wormer".)
                         Hackers have a healthy  sense  of  curiosity: they
                         try doorknobs just to see if  they're  locked, and
                         they tinker with a piece of  equipment  until it's
                         "just right."

          Shareware      a distribution method for quality  software avail-
                         able on a "try before you buy" basis.  You pay for
                         the program only if you find it useful.  Shareware
                         programs can be downloaded from BBSs  and  you are
                         encouraged to give  an evaluation copy to friends.
                         There are few advertising & distribution costs, so
                         many shareware applications can rival the power of
                         off-the-shelf counterparts, at just a  fraction of
                         the price.



          Copyright (c) 1988 Rob Rosenberger & Ross Greenberg        Page 1
�





          Trojan horse   a  generic  term  describing  a  set  of  computer
                         instructions  purposely  hidden  inside a program.
                         Trojan horses tell  a  program  to  do  things you
                         don't  expect it to do.  The  term  comes  from  a
                         historic battle in which the ancient city  of Troy
                         was offered the "gift"  of  a  large  wooden horse
                         that secretly held soldiers  in  its  belly.   The
                         Trojans rolled it into their fortified city....

          Virus          a term for a very  specialized  Trojan  horse that
                         can   spread   to   other  computers  by  secretly
                         "infecting" programs with a  copy  of  itself.   A
                         virus is the only  type  of  Trojan horse which is
                         contagious, like the common cold.   If  it doesn't
                         meet this definition, then it isn't a virus.

          Worm           a term similar to a  Trojan horse, but there is no
                         "gift" involved.  If  the  Trojans  had  left that
                         wooden horse outside  the city, they wouldn't have
                         been  attacked  --   but  worms  can  bypass  your
                         defenses.   An example is an unauthorized  program
                         designed to spread itself by exploiting a bug in a
                         network  software  package.   (Such programs could
                         possibly also contain  a virus that activates when
                         it reaches  the  computer.)    Worms  are  usually
                         released by someone who has normal  access  to the
                         computer or network.

          Wormers        the  name  given  to   the   people   who  unleash
                         destructive  Trojan horses.  Let's face it,  these
                         people aren't angels.    What  they  do  hurts us.
                         They deserve our disrespect.

               Viruses, like all Trojan horses, are  purposely  designed to
          make a program do things you don't expect it to do.  Some viruses
          are just an annoyance, perhaps only displaying a "Peace on earth"
          message.  The viruses we're worried about are  the  ones designed
          to destroy your files and waste the valuable time you'll spend to
          repair the damage.

               Now you know the  difference  between  a  virus and a Trojan
          horse and a bug.  Let's get into some of the myths:

          All purposely destructive code comes as a virus.
               Wrong.  Remember, "Trojan horse"  is  the  general  term for
          purposely destructive  code.  Very few Trojan horses are actually
          viruses.

          All Trojan horses are bad.
               Believe it or not, there are a few useful Trojan horse tech-
          niques in the world.  A "side door" is any command not documented
          in the user manual, and it's a Trojan horse by definition.   Some
          programmers install side doors to  help them locate bugs in their




          Computer Virus Myths                                       Page 2
�





          programs.  Sometimes a command  may have such an obscure function
          that it makes sense not to document it.

          Viruses and Trojan horses are a recent phenomenon.
               Trojan horses have been around since the first  days  of the
          computer.  Hackers  toyed  with  viruses  in the early 1960s as a
          form of amusement.    Many different Trojan horse techniques were
          developed over the years  to  embezzle  money, destroy data, etc.
          The general public wasn't aware of this problem until the  IBM PC
          revolution brought it into the spotlight.  Just  five  years ago,
          banks  were still covering up computerized embezzlements  because
          they believed they'd lose too many customers.

          Computer viruses are reaching epidemic proportions.
               Wrong again.  Viruses may be spread all over the  planet but
          they aren't taking over the world.  There are only about fifty or
          so known virus "strains" at this time and a few of them have been
          completely eliminated.   Your  chances of being infected are slim
          if you take proper precautions.  (Yes, it's still safe to turn on
          your computer!)

          Viruses could destroy all the files on my disks.
               Yes, and a spilled cup of coffee will do the same thing.  If
          you have adequate backup copies of your data, you will be able to
          recover from  a virus/coffee attack.  Backups mean the difference
          between a nuisance and a disaster.

          Viruses have been documented on over 300,000 computers.
               This statistic comes from John McAfee,  a  self-styled virus
          fighter who seems to come up  with  all the quotes the media love
          to hear.  We  assume  it includes every floppy disk ever infected
          by a virus, as well as all of the computers participating  in the
          Christmas worm attack.  (That  worm was designed for a particular
          IBM network software package; it  never  infected  the computers.
          Therefore, it wasn't a virus.  The Christmas worm attack can't be
          included in virus infection statistics.)  Most of the media don't
          understand computer  crimes, so they tend to call almost anything
          a virus.

          Viruses can be hidden inside a data file.
               Data files can't wreak  havoc  on  your  computer -- only an
          executable program can do that.  If a virus were to infect a data
          file, it would be a wasted effort.

          Most BBSs are infected with viruses.
               Here's another scary myth drummed up in the big virus panic.
          Very few BBSs are  really  infected.  (If they are infected, they
          won't be around for long!)  It's possible a dangerous  file could
          be  available  on  a BBS, but that doesn't mean the BBS itself is
          infected.







          Computer Virus Myths                                       Page 3
�





          BBSs and shareware programs spread viruses.
               "The truth," says PC Magazine publisher  Bill  Machrone, "is
          that all major viruses to  date  were  transmitted  by commercial
          packages and private  mail  systems, often in universities."  The
          Peace virus, for example, made its way into a commercial software
          product sold to thousands of customers.  Machrone goes on  to say
          that "bulletin boards  and shareware authors work extraordinarily
          hard at policing themselves to keep viruses out."  Many reputable
          sysops check all new  files  for  Trojan horses; nationwide sysop
          networks help spread the word  about dangerous files.  You should
          be careful about software that  comes from friends & BBSs, that's
          definitely true -- but you must also be careful with the software
          you buy at computer stores.  The Peace virus proves it.

          My computer could be infected if I call an infected BBS.
               BBSs can't write information on your disks -- that's handled
          by the communications software you use.  You can only  transfer a
          dangerous file if you let your software do it.  (In rare cases, a
          computer hooked into a network could be sent a dangerous  file or
          directly infected, but it takes specialized software to connect a
          computer into a network.  BBSs are NOT networks.)

          My files are damaged, so it must have been a virus attack.
               It could also have been caused by a power  flux,  or  static
          electricity, or a fingerprint on a floppy disk, or a bug  in your
          software, or perhaps a simple error on your part.  Power failures
          and spilled cups of coffee have destroyed more data than  all the
          viruses combined.

          Donald Burleson was convicted of releasing a virus.
               A recent Texas computer crime  trial was hailed all over the
          country as a "virus" trial.  Donald Burleson was in a position to
          release a complex, destructive worm on  his  employer's mainframe
          computer.  This particular worm wasn't able to  spread  itself to
          other computers, so it wasn't a virus.  The prosecuting attorney,
          Davis McCown, claims he "never  brought up the word virus" during
          the trial.  So why did the media call it a virus?
             1.  David Kinney, an expert witness testifying for the defense
                 (oddly  enough), claimed he believed Burleson unleashed  a
                 virus.   This is despite the fact  that  the  programs  in
                 question had no  capability  to infect other systems.  The
                 prosecuting attorney didn't argue the point  and  we don't
                 blame him --  Kinney's  bizarre claim on the witness stand
                 probably helped  sway the jury to convict Burleson, and it
                 was the defense's fault for letting him testify.
             2.  McCown doesn't offer reporters a definition  for  the word
                 virus.  He gives the facts behind the case  and  lets  the
                 reporters deal with the definitions.  The Associated Press
                 and USA Today, among  others,  used  such vague terms that
                 any program could be called a virus.  If we  applied their
                 definitions in the medical world,  we  could  safely claim
                 penicillin is a biological virus (which is absurd).





          Computer Virus Myths                                       Page 4
�





             3.  McCown claims many of  the  quotes  attributed to him "are
                 misleading or fabricated" and identified one in particular
                 which "is total fiction."  Reporters occasionally  print a
                 quote out of context, and McCown apparently fell victim to
                 it.  (It's possible a few bizarre quotes from David Kinney
                 or John McAfee were accidentally attributed to McCown.)

          Robert Morris Jr. released a benign virus on a defense network.
               It may have been benign, but it wasn't a virus in the strict
          technical sense.  Morris, the son of a chief  scientist  for  the
          National Security Agency, allegedly became bored  and  decided to
          take advantage of a tiny  bug in the Defense Department's network
          software.  (We  say  "alleged" because Morris hadn't been charged
          with a crime  when we went to press.)  That tiny bug let him send
          a worm through the network and have it execute  when  it  reached
          certain computers.  Among other things, Morris's  "Internet" worm
          was able to tell some computers to send copies of itself to other
          computers in the network.  The network became clogged in a matter
          of hours.  The media called the Internet worm a "virus"  (like it
          called the Christmas worm a virus) because it was able  to spread
          itself to other computers.  But it didn't infect those computers,
          so  it can't be called a virus.  (We can't really fault the press
          for calling it one, though.  It escapes the definition of a virus
          because of a technicality.)  A few notes:
             1.  This worm worked only on Sun-3 & Vax computers with a UNIX
                 operating system that was linked to the Internet network;
             2.  The 6,200  affected computers should not be counted in any
                 virus infection statistics (they weren't infected);
             3.  Yes, Morris could easily have added some infection code to
                 make it a worm/virus if he'd had the urge; and,
             4.  The network bug Morris exploited has since been fixed.

          Viruses can spread to all sorts of computers.
               All Trojan horses are limited  to a family of computers, and
          this is especially true for viruses.  A virus designed  to spread
          on IBM PCs cannot infect an IBM 4300-series mainframe, nor can it
          infect a Commodore C64, nor can it infect an Apple MacIntosh.

          My backup disks will be destroyed if I back up a virus.
               No, they won't.  Let's suppose a virus does  get  backed  up
          with your other files.  Backups are just a form of data, and data
          can't harm your system.  You can recover the important files from
          your backups without triggering the virus.

          Anti-virus software will protect me from viruses.
               Anti-virus  packages offer some good front-line  protection,
          but they can be tricky to use at times.  You could make a crucial
          mistake in deciding whether to  let a "flagged" event take place.
          Also, Trojan horses can be designed to take advantage of holes in
          your defense.







          Computer Virus Myths                                       Page 5
�





          Copy-protected software is safe from an attack.
               This is  totally wrong.  Copy-protected software is the most
          vulnerable software in a  Trojan  horse attack.  You may have big
          problems trying to use or re-install such software, especially if
          the master disk was attacked.  It should also be noted that copy-
          protection schemes rely on extremely tricky techniques which have
          occasionally "blown up" on users.  Some people mistakenly believe
          they were attacked by a clever virus.

          Viruses are written by hackers.
               Yes,  hackers  have  written viruses -- just to see how they
          operate.  But they DON'T  unleash them to an unsuspecting public.
          Wormers are the  ones who do that.  (You can think of a wormer as
          a hacker who was seduced by the Dark Side of The Force.)  Hackers
          got a bum rap when the press corrupted the name.


               We hope  this dispels the myths surrounding the virus scare.
          Viruses DO exist, many of them will cause damage, and all of them
          can spread to other computers.  But you can defend  yourself from
          an attack if you keep a cool head and a set of backups.

               The following guidelines can shield you  from  Trojan horses
          and viruses.  They will lower your chances of being  attacked and
          raise your chances of recovering from one.

             1.  Download files only from reputable BBSs where sysops check
                 every program  for Trojan horses.  If you're still afraid,
                 consider getting your programs from a BBS or "disk vendor"
                 company which gets its programs directly from the author;

             2.  Let a newly uploaded file "mature" on a BBS for one or two
                 weeks before you  download  it (others will put it through
                 its paces).

             3.  Set  up  a  procedure to regularly back up your files, and
                 follow  it  religiously.    Consider  purchasing  a  user-
                 friendly backup program that  takes  the  drudgery  out of
                 backing up your files.

             4.  Rotate between two sets  of  backups  for  better security
                 (use set #1, then set #2, then set #1...).

             5.  Consider  using  a  program  which  will  create  a unique
                 "signature" of all the programs on your computer.  Once in
                 a while, you can  run  this program to determine if any of
                 your applications  have been modified -- either by a virus
                 or by a stray gamma ray.

             6.  If your computer starts acting weird, DON'T PANIC.  It may
                 be a virus, but then again it may not.  Immediately reboot
                 from a legitimate  copy  of  your  master DOS disk.  Put a
                 write-protect tab on that disk just to be safe.    Do  NOT
                 run any programs on your regular disks (you might activate



          Computer Virus Myths                                       Page 6
�





                 a Trojan horse).  If  you don't have adequate backups, try
                 to  bring them up to date.  Yes, you might be backing up a
                 virus as well, but it can't hurt you as long as  you don't
                 run any of your normal programs.  Set your backups  off to
                 the side.  Only then can you safely hunt for the problem.

             7.  If you can't  figure  out what's wrong with your computer,
                 and you aren't sure of yourself, just turn it off and call
                 for help.   Consider calling a local computer group before
                 you hire an expert to fix your problem.    If  you  need a
                 professional,  consider hiring a regular computer  consul-
                 tant before you call on a "virus expert."

             8.  If you can't  figure  out what's wrong with your computer,
                 and you are  sure  of yourself, execute a low-level format
                 on all of your regular disks  (you  can learn how to do it
                 from almost any BBS), then  do a high-level format on each
                 one of them.   Next,  carefully  re-install  your software
                 from legitimate copies  of  the master disks, not from the
                 backups.  Then, carefully restore only the data files (not
                 the executable program files!) from your backup disks.

               If you DO find a Trojan horse or a virus, we'd appreciate it
          if you'd mail a copy to us.  (But please, don't handle one unless
          you know what you're doing.)  Include as much information  as you
          can, and put a label on the disk that says  it  contains a Trojan
          horse or virus.  Send it to Ross Greenberg, 594 Third Avenue, New
          York, NY 10016.  Thank you.

               -------------------------------------------------------
               Ross Greenberg is the author of a  popular Trojan/virus
               detection program.   Rob Rosenberger is the author of a
               modem analysis program.   These  men  have never met in
               person; they worked on this story completely by modem.
               -------------------------------------------------------

                 Copyright (c) 1988 Rob Rosenberger & Ross Greenberg


          You may give copies of this to anyone if you pass it along in its
          entirety.  Publications must obtain written permission to reprint
          this article.  Write to Rob Rosenberger, P.O. Box #643, O'Fallon,
          IL 62269.