cube writes:  For many computer users, the computer viruses are mysterious and ask for the attention because every time a new virus hits, it spreads quickly and quickly. This way, viruses show us how vulnerable we are, but also they show how unknowingly interconnected human beings are nowadays. For example "Melissa" virus in March / 1999 -- was that powerful that it forced Microsoft and number of other large companies to completely turn off their e-mail servers, and it took a while, until they could handle it.. "ILOVEYOU" virus had a similarly devastating effect in 2000, not mentioning Sircam, which heavily flooded whole world this year, causing massive overload of e-mail servers and terrible traffic. That's quite impressive when you realize how simply coded this viruses are.
This brings up a several related subjects to dicuss :
- What reasons or motivation are behind creating them.
- Something really interesting about their history, and how dangerous they are
- More detailed information on those ones, which are most dangerous nowadays - viruses, which spreads themselves via e-mail.
- An interview with advanced original viruses writer, in which you could learn some interesting tips and tricks about coding of virii
Computer Viruses
:: What's a virus ::
This pieces of software code, which are able to spread themselves through computers and networks, are called viruses, simply because they share some of the traits of biological viruses. A computer virus passes from computer to computer like a biological virus passes from person to person. Looking deeper, a biological virus is a DNA fragment, which has unlike a cell in fact nothing to do, except to reproduce itself. Computer virus does the same, it must sit back on top of other code, or document in order to get executed and reproduce itself.
First viruses were first seen in late 80's and the first factor was the spread of personal computers (PCs).
The second factor was the user of bulletin boards systems (BBS), where people could connect to BBS with modem and download software of any kind (games, office apps). BBSs led to creation and use of so called Trojan Horses - the programs which resides in your computer, and based on any input like your action, computer time, disk capacity etc. do usually something really bad, like wiping your drive.
The third factor was creation of floppy disks, which were widely used that time, as the harddrives was still expensive, and software usually fitted on a small capacity of floppy. Viruses often used a part of floppy data which was preloaded and executed (boot sectors) to spread.
The spreading part of virus code is the infection phase. Then, most of the viruses have a destructive phase where they do some sort of damage. Some of the viruses though only printed out some funny message on screen.
:: What's a motivation behind creating viruses ::
There are known a few reasons, why people write viruses.
1. the psychology of vandal - the thrill of watching things blow up - why would someone want bust the window of your car, or spray your house. Also many people are fascinated about power of explosions.
2. thrill of really well written code - many viruses, which mostly didn't do or didn't mean to do the damage were written simply, because coders had to write extremely efficient and small code, to fit into boot sectors or computer memory
3. - hard to say. I'd say it has got a lot with human psychology and society. If you'd like to comment, I'd be glad to bring here more sophisticated reasons to discuss, please contact cube@box.sk right away :)
And what the other people think:
agent sigmund freud (andrew@baselbiet.ch) wrote us: it's to me - clearly some kind of the well known JESUS complex that is caused by the persons believing that society is not aware of them, low self-assurance of this person and probably something in their childhood that causes them to want to show the world how cool and POWERFUL they are. They love to see on tv talking about their virus destroying whole networks for the stronger kids laughed at them and annoyed them in kindergarten and they want to pay-back this time. just my humble 2cents..
Jim (jswagner@cs.svsu.edu) says: While I haven't written any that I let go (only on a stand-alone machine at my house), it demonstrates another motivation. I think you touched on it when you said that it's the thrill of well-written code, but it's really a separate reason. (I can really relate to the well-written code point also; I was made fun of at my last job because I refused to let a software package I was responsible for writing go until it was as close to perfect as possible.).... The reason I've written the few I have is simply to see if I could do it. I hear about security holes in various software packages and think to myself "I wonder if that could be exploited to do blah blah blah..." and I think about it until I discard the idea, get it to work, or give up because I couldn't do it.
Jager (shadow_child@start.com.au) presents other factor: Another possible motivation you dont appear to have mentioned is revenge. Someone writes a virus to trash a network that has offered some kind of insult (real or imagined) and due to uncareful thinking (TM) (I sound like a school councillor) it gets out of the area it was written to thrash, infecting 'innocent' bystanders.
:: Abbreviated history of the computer virus ::
The following is an abbreviated history of the computer virus. It is not comprehensive, nor is it intended to be. I'm sure that many aficionados will find that I have skipped some major events, while detailing some others.
As we live now in a time where every brain-dead 15 year old is downloading the latest plugin for remote access trojans like subseven and the media makes amazing spectacles out of virii like Code Red, it is hard to imagine a world in which the computer virus did not exist. However, it was not all that long ago, that there was no worry or even thought of such a thing.
As fact and fiction have become intertwined over the years, it is difficult to pinpoint exactly when the first actual computer virus was written. The first known virus released into the wild infected the Apple II operating system. The program was not created with malicious intent and 'escaped' into the wild by accident. This occurred sometime in 1981. In 1982, a 7th grader named Richard Skrenta created the famous "Elk Cloner" for the apple OS. The term "virus" had not been applied yet.
In 1984, a university professor named Fred Cohen first publicly introduced the idea of a computer virus to a class of graduate students. His associate, Len Adelman, is actually the one who is credited with naming the self-replicating program a "virus". It is Dr. Cohen who first proved the theory that a program could infect other programs with a clone of itself in any computer environment.
To read more about Fred Cohen Click Here
THE BOOT SECTOR VIRUS
A boot sector virus is a virus that resides in a portion of a computer drive that is only read when the computer is booted up, at which time the virus is loaded into memory. Boot sector viruses often spread through floppy disks, which also have a boot sector which can become infected. If an infected floppy is left in the disk drive when a computer is booted up, the virus will be loaded into memory and can spread to other disks and computers. A well-known boot sector virus is the Michelangelo virus. (1)
In 1986, two brothers, Basit and Amjad Alvi who owned a computer store in Pakistan got a little tired of seeing people copying their software. (Even though there are many reports that the two brothers were heavily involved in pirating the software of others.) Around the same time, they realized that the boot sector of a floppy diskette contained executable code, and this code is run whenever you start up the computer with a diskette in drive A. They realized that they could replace this code with their own program, that this could be a memory resident program, and that it could install a copy of itself on each floppy diskette that is accessed in any drive.(2) So Amjad wrote the Brain virus, which was completly non destructive. The payload of the virus was simple -- it changed the volume label of the floppy to "(c) Brain 00-00-1980 12:00".
HITTING THE BIGTIME
Nobody knew it yet, but the face of computer security was about to change forever. In 1987, a student in Wellington, New Zealand created, as a joke, a slopily coded little virus called the 'STONED' virus. The virus was spread by infected floppy disks, which would in turn infect the Master Boot Record of the hard disk. Stoned monitored Interrupt 13, and any DOS use of that to read/write (even the DIR command) triggered the virus to infect disks in the A drive, if they are not already infected, or write-protected. It moves the floppy disk's original Boot record code to the area used by the Directory, and if the disk has files listed in the overwritten sector, this caused the loss of entries of files, deleted files, and sub-directories in the root. (3) Infected computers read "your computer is now STONED".
The Stoned virus and its many varients spread like wildfire throughout the world. To this day, it still pops up from time to time and is one of, if not the most widespread viruses in history.
Throughout the early 1990's variants of the stoned virus were prevalent. The most ballyhoo was created over the Michelangelo variant in 1991. The Michelangelo virus had a vicious payload of wiping out the hard disk of the infected machine on March 6, (Michelangelo's birthday). The first media uproar occurred over the anticipation of the doom that this little bit of malicious code would create. The words "computer virus" were introduced to Joe and Jane Aoluser and antiviral products began to really sell.
Of course, all of the hoopla resulted in an anticlimax. The infection rate was very low for Michelangelo. Much lower than expected. This prompted many of the more jaded members of the computer community to theorize that the whole thing had been created by AV companies, to instill fear in the minds of its customers. While that may be a bit off the mark, it was quite a popular theory of the time. There were many other boot sector viruses, as well as others that infected command.com and exe files. Examples included Jerusalem and Lehigh, two of the more infamous viruses.
To read more about the Stoned virus and its variants Click Here
To read more about the boot sector virus in general Click Here
THE POLYMORPHIC VIRUS
Polymorphic viruses are viruses which change slightly each time they are executed. These are meant to defeat anti-virus scanners which search for certain strings of code to identify viruses. Some virus writers have written toolkits so that novice users can write their own viruses. (1)
What we now call the polymorphic virus was first created by Mark Washburn, who modified the source for a virus called "Vienna" to change itself. These were not very infectious, however, and did not make much of an impact. The first widely reported polymorph was called Tequila. Tequila erupted out of Switzerland, spread through a shareware company. Tequila used full stealth when it installed itself on the partition sector, and in files it used partial stealth, and was fully polymorphic. A full polymorphic virus is one for which no search string can be written down, even if you allow the use of wild cards.(4) This was, of course a huge problem for anti-virus vendors to deal with. It took several months and more than one company closing its doors to get the best of Tequila.
To read more about polymorphic virii Click here
THE MACRO VIRUS
Macro viruses are relatively new but experts now estimate that they are the most common type of virus. A macro is a set of instructions within an application that can be used to automate tasks. While this sounds relatively harmless, macros can often perform system operations such as creating or deleting files, or writing into already existing files, and thus have the potential to cause a great deal of damage. Most macros are written for Microsoft Word and Excel. These often work by infecting the template for a new document. Therefore, each time a new document in created, the virus replicates and executes. Macros are especially dangerous because they can often be cross platform, unlike most viruses, which are written for the PC only.(1)
The first macro virus was discovered in August of 1995, when several large companies began having to deal with the rather annoying nuisance of a MS WORD macro that copied and reproduced itself. It was called "Concept". Once again, it was believed to be created without malicious intent. Part of the payload was displaying a message from the author reading "That's enough to prove my point"
Since most Macro viruses are also worms, we will discuss two of the most famous macro viruses in the following section on worms.
 WORMS
Worms are spread over computer networks, and are distinct from viruses in that they do not have a host file. However, worms today are commonly spread through e-mail. Oftentimes, there is an attachment to the e-mail, and when the user opens the attachment, the worm is executed.
Worms commonly attempt to send copies of themselves to everyone in the user's address books. (1) Worms generally use security holes in operating systems to gain access. Since Windows is the most used operating system in the world, most modern worms are written in Visual Basic Script and fall under the definition of the MACRO VIRUS.
The term 'WORM' is derived from a science fiction novel called The Shockwave Rider, which spoke of a "tapeworm" that brought down a network of government supercomputers. This and the worms of today, certainly do not inspire kind feelings, but actually the first worms, created in the 1970's were meant to benefit networks.
The first notable program that can be reasonably referred to as a worm is "creeper" written by Bob Thomas in 1975. The program was intended to help air traffic controllers keep track of airplanes. The idea did not catch on.
In the 80's Xerox started to play around with worms. John Shock and Jon Hepps are the ones that actually began calling such programs 'worms'. They began implementing worms to help out with tasks around the network. Some worms were very simple and did things like traveling around the network delivering messages. Others were more complex, like "vampire", which laid dormant during the day and at night would use idle computers for processor power. (5) One night, Vampire malfunctioned, causing all the computers on the network to crash. Powering up the computers caused nothing but another crash. A "vaccine" had to be created to rid the systems of the worm and render the network useful again. Needless to say, this was the end of Xerox's experimentation with worms...
In 1988, the first malicious worm was created. It was written by a student at Cornell University named Robert Tappan Morris. The "Internet Worm" single-handedly crashed most of the internet (which of course was a lot smaller back then). The program merely copied itself and overloaded computers with invisible tasks, rendering them useless to users.
Quite a few worms followed, but nothing really took hold until the macro virus was discovered.
Macro viruses are relatively new but experts now estimate that they are the most common type of virus. A macro is a set of instructions within an application that can be used to automate tasks. While this sounds relatively harmless, macros can often perform system operations such as creating or deleting files, or writing into already existing files, and thus have the potential to cause a great deal of damage. Most macros are written for Microsoft Word and Excel. These often work by infecting the template for a new document. Therefore, each time a new document in created, the virus replicates and executes. Macros are especially dangerous because they can often be cross platform, unlike most viruses, which are written for the PC only.(1)
The first macro virus was discovered in August of 1995, when several large companies began having to deal with the rather annoying nuisance of a MS WORD macro that copied and reproduced itself. It was called "Concept". Once again, it was believed to be created without malicious intent. Part of the payload was displaying a message from the author reading "That's enough to prove my point"
MELISSA
All was relatively quiet on the Macro Virus front until 1999, when the Melissa virus began spreading at an incredible rate. Written in Visual Basic Script, it executed a macro in a document attached to an email, which forwarded the document to 50 people in the user's Outlook address book. The virus also infected other Word documents and subsequently mailed them out as attachments. At the time, Melissa was the fastest spreading virus in history. Hundreds of thousands of computers were infected. Melissa was written by a programmer from New Jersey, named David Smith. It was believed to be named after a stripper he once knew. The only stripping David now sees is the tease performed by his cellmate...
I LOVE YOU
(No, not like that. I mean the virus)
In 2000, the world was hit yet again with another macro virus. This one, called I love you or "the love bug" infected millions of machines and caused an estimated $8.5 billion damage worldwide. This nasty little bug was also written in VBS, deleted mp3 and JPG files and emailed usernames and passwords to the virus author. A suspect in The Philippines was arrested in the case, but he was released.
The history of the Computer Virus, while a long one, is a very interesting one. Unfortunately, detailing every virus and it's payload, as well as it's impact on the viral world is not feasible here in this article. If you are interested in delving deeper into virus history, I recommend these links:
http://www.securityfocus.com/frames/?focus=virus&content=/focus/virus/articles/virhist.html
http://all.net/books/virus/
http://www.cknow.com/vtutor/vthistory.htm
FOOTNOTES
(1) http://www-cse.stanford.edu
(2)http://www.ladysharrow.ndirect.co.uk/Virus%20Information/a_rough_history_of_the_computer_.htm
(3)http://www.datafellows.com/v-descs/stoned.shtml
(4)http://www.ladysharrow.ndirect.co.uk/Virus%20Information/polymorphism.htm
(5)http://www.software.com.pl/newarchive/misc/Worm/darbyt/pages/worm.html
:: Email Viruses ::
Email attachments were, are, and will be the most common way of spreading computer viruses, trojans, and worms nowadays. Some of their actions are limited to just annoying the user, while others contain data destructive procedures.
COMING TO LIFE
Generally, viruses sent by email are brought to life by the user who deliberately double clicks the attachment file itself. To increase the possibility of a successful attack by the virus, their writers often prepare a message that lures the user into executing the attachment itself. The themes of these message range from explaining that the attached file is a slide show fo summer vacation photos, through business reports, to love letters.
However, this is not the only way of bringing the malicious file to life - recently, many vulnerabilities have been found in email client software, especially MicroSoft's product - MS Outlook. By exploiting these vulnerabilities, viruses may spread with almost no user intervention, for example viewing the message body. Most of these vulnerabilities exploit MicroSoft's improper implementation of JavaScript and its own language - ActiveX.
The most dangerous, at the moment (Sept. 2001), is the vulnerability in MicroSoft's Windows Explorer, Internet Explorer, and Outlook, recently found by the security expert, Georgi Guninski (http://www.guninski.com/clsidext.html). Named the CLSID bug, it exploits the Windows CLSID values, which tell windows what kind of file it is and what program to run it from. It is possible to set the CLSID value to another extension than the real file shows. Exploiting this bug, it is possible to trick the user into thinking that he will view for example a text file, while windows runs it as an application file.
HALL OF FAME
- Melissa (http://www.cert.org/advisories/CA-1999-04.html)
The first virus to use the MS Outlook address book to spread itself to other users.
- Worm.Explore.Zip (http://www.virusbtn.com/VirusInformation/expzip.html)
Highly destructive email virus that again uses the MS Outlook address book to spread itself. Destroys .ASM .C .CPP .DOC .H .XLS .PPT files. It can also spread without the use of email, through the LAN.
- Bubble Boy (http://www.virusbtn.com/VirusInformation/bboy.html)
The first virus (inspired by Melissa) that was able to propagate itself via email without having the need of an attachment file to be executed by the recipient.
- Love Bug (http://hackingtruths.box.sk/ilu.txt)
The infamous virus based on a master thesis of an university student, which used social engineering to spread itelf. Disguised under the name of a love letter, the attachment file was a visual basic script which included destructive procedures. It propagated itself by selecting male users from the MS Outlook address book and sending the email to them.
EMAIL VIRUS PREVENTION
(http://admin.soe.purdue.edu/support/emailstuff/email_virus/)
- Have up-to-date antivirus software installed on your computer
- Turn off html message viewing in your email client software
- Do not open any attachment file unless you know exactly what it is, whom is it from, and were you expecting it. (REMEMBER: The sender could also be infected and might have sent you the attachment file unwillingly)
:: An interview with original virus writer ::
The interview was done via e-mail, with a quite well known virus coder around. He asked me to stay in anonymity, so there wen't be published any contact to him. (cube)
Q: how do the viruses spread, what kind of OS feature (or vulnerability) do they misuse to spread
A: a lot of answers really. win9x viruses often use ring-0 code to spread. a normal program is not supposed to enter ring-0 mode, but windows 9x has very little protection and viruses can enter ring-0 in 10 lines of code. once in ring-0, they hook API calls such as the once responsible for opening files for example. other types of viruses, such as true win32 compadible once simply search for files using the windows API. once found they can use a number of ways to infect the file. usually the last section is either extended or a new section is created at the end of the file.
Q: can you tell a few tricks for a virii coding from 'your virii building kitchen'
A: some little known tricks that i have used recently might be for example:
- EPO, or Entry Point Obsifucation - Usually when a file gets infected, the entry EIP gets modified to point to the viral code, or a jump get's placed at the start of the file to jump to the virus. EPO is way to mask
- EPO, or Entry Point Obsifucation - Usually when a file gets infected, the entry EIP gets modified to point to the viral code, or a jump get's placed at the start of the file to jump to the virus. EPO is way to mask that. my last virus would scan the soon to be infected file for a CALL statement, and maybe or maybe not skip it. keep doing that until it finds a random call in the program that than get's patched to point to the viral code. the virus would restore the original call. end result is, the virus get's executed during program execution instead of always at the start. sometimes it might not even execute at all, which can be good because it avoids detection.
- ring-0 - I'm not sure how known it is, but it's quite easy to switch a win9x system to ring-0 mode. in this mode you have complete access to everything. no more memory protection, port protection, etc. this can be done via a number of ways, including for example VxDCall backdoor and CallGates. threads - i'm currently working on a multi-thread/multi-fiber virus. i hope this will somehow evade heuristic/emulator scanners. Crypto - and of course there are a number of ways to mutate your code. simple XOR encrytion, polymorphism, and metamorphism to name the most common. currently i'm trying to create a virus that makes use of some the things i know about AI. maybe a genetic algorithm based one?
Q: how would you compare the major operating systems (NT, Win 9x, Unixes) in terms of being vulnerable to the kind of viruses you're coding on a scale from 1-5, 1 being a 5 year old kid draging a sack of gold, 5 being fort knox:
A: - NT - 5, simply put, its easy to infect. no ring-0 virus will work, but runtime infection can be just as successful. need i mention Code Red?
- 9x - 6, there's too many ways to list the possible ways to infect a win9x box. from outlook express exploits to Excel exploits. ring-0, ring-3, everything works. in addition, millions of windows users pirate or download some other software of the net that has a potential virus in it
- *Nix - 1, it's easy to infect it provided that root runs the virus. userlevel security does not allow a virus to roam around the system like in nt and 9x. in addition, almost noone downloads software from a uknown source. sure there are viruses out for *nix, but you wont get em unless you download them specifically, and they wont infect you unless you're stupid enough to run them as root.
Q: what's your opinion on fairness of building and spreading virii
A: from the view of virus creator I don't have a problem with it (as you would expect). to me its more of a game. i try to stay one step ahead of the user, or more specificaly, the AV software the user is using. sooner or later my virus will get busted anyway, so i just gotta keep comming up with new techniques. also, in my opinion destructive payloads are absolutly fucking lame. they annoy people, give the real virus coders a bad reputation, and ruin a otherwise potentially well done virus. they alert the user and possibly destroy the virus while they're at it.
Q: oh also a question about where to start (tutorial tips, websites links) to get a basic knowledge about virii coding
A: the net is full of excellent tutorials. i would suggest you check out coderz.net and go from there. they host a ton of great sites, which link you to even more. in addition you might want to check out these:
http://vx.netlux.org/lib.shtml
http://lordjulus.cjb.net/
http://surf.to/mandragore/
http://z0mbie.host.sk/index.html
written and compiled by cube - cube@boxnetwork.net, Drew - drew@boxnetwork.net, zerostealth - zerostealth@cdlni.com
|