Wikipedia

Computer virus

This is an old revision of this page, as edited by Sietse Snel (talk | contribs) at 10:25, 22 September 2004 (Integrated information about payload). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

In computer security terminology, a virus is a self-replicating program that spreads by inserting copies of itself into other executable code or documents (for a complete definition: see below). Thus, a computer virus behaves in a way similar to a biological virus, which spreads by inserting itself into living cells. Extending the analogy, the insertion of the virus into a program is termed infection, and the infected file (or executable code that is not part of a file) is called a host. Viruses are one of the several types of malware or malicious software. In common parlance, the term virus is often extended to refer to computer worms and other sorts of malware.

While viruses can be intentionally destructive (for example, by destroying data), many other viruses are fairly benign or merely annoying. Some viruses have a delayed payload, which is sometimes called a bomb. For example, a virus might display a message on a specific day or wait until it has infected a certain number of hosts. However, the predominant negative effect of viruses is their uncontrolled self-reproduction, which wastes or overwhelms computer resources.

Today (2004), viruses are somewhat less common than network-borne worms, due to the popularity of the Internet. Anti-virus software, originally designed to protect computers from viruses, has in turn expanded to cover worms and other threats such as spyware.

Definition

A virus is a type of program that can replicate itself by making (possibly modified) copies of itself. The main criterium for classifying a piece of executable code as a virus is that it spreads itself by means of 'hosts'. A virus can only spread from one computer to another when its host is taken to the uninfected computer, for instance by a user sending it over a network or carrying it on a removable disk. Viruses are sometimes confused with worms. A worm, however, can spread itself to other computers without needing to be transferred as part of a host.

Viruses can infect different types of hosts. The most common target are executable files that contain application software or parts of the operating system. Viruses have also infected the executable boot sectors of floppy disks, script files of application programs, and documents that can contain macro scripts. Additionally, viruses can infect files in other ways than simply inserting a copy of their code into the code of the host program. For example, a virus can overwrite its host with the virus code, or it can use a trick to ensure that the virus program is executed when the user wants to execute the (unmodified) host program. Viruses have existed for many different operating systems, including MS-DOS, AmigaDOS, and Mac OS; today, the majority of viruses run on Microsoft Windows.

A legitimate application program that can copy itself as a side-effect of its normal function (e.g. backup software) is not considered a virus. Some programs that were apparently intended as viruses cannot reliably self-replicate, because the infection routine contain bugs. For example, a buggy virus can insert copies of itself into host programs, but these copies never get executed and are thus unable to spread the virus. Self-replicating programs that have very limited spreading capabilities because of bugs are sometimes not considered as being viruses.

Use of the word "virus"

The term "virus" was first used in an academic publication by Fred Cohen in his 1984 paper Experiments with Computer Viruses, where he credits Len Adleman with coining it. However, a mid-1970s science fiction novel by David Gerrold, When H.A.R.L.I.E. was One, includes a description of a fictional computer program called "VIRUS" that worked just like a virus (and was countered by a program called "ANTIBODY"); and John Brunner's 1975 novel The Shockwave Rider describes programs known as "tapeworms" which spread through a network for the purpose of deleting data. The term "computer virus" with current usage also appears in the comic book "Uncanny X-Men" No. 158, published in 1982. And even earlier, in 1973, the phrase "computer virus" was used in the movie Westworld to describe a malcicious program that emerged in the computer system of the theme park. Therefore, we may conclude that although Cohen's use of "virus" may, perhaps, have been the first "academic" use, the term has been used earlier.

The term 'virus' is often used in common parlance to describe all kinds of malware (malicious software), including those that are more properly classified as worms or trojans. Most popular anti-viral software packages defend against all of these types of attack.

The plural of virus is viruses, not virii, which is sometimes used incorrectly, both knowingly and otherwise. See plural of virus.

History

A program called "Elk Cloner" is credited with being the first computer virus to appear "in the wild" -- that is, outside the single computer or lab where it was created. Written in 1982 by Rich Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread by floppy disk.

Since the mid-1990s, viruses which infect operating systems or applications directly have been eclipsed by macro viruses. Written in the scripting languages for Microsoft programs such as Word and Outlook, these viruses spread in the Windows monoculture by infecting documents and sending infected e-mail.

Reasons for creating viruses

Unlike biological viruses, computer viruses do not simply evolve by themselves. They cannot come into existence spontaneously, nor can they be created by bugs in regular programs. They are deliberately created by programmers, or by people who use virus creation software.

Virus writers can have various reasons for creating and spreading malware. Viruses have been written as research projects, pranks, vandalism, to attack the products of specific companies, and to distribute political messages. Some people think that the majority of viruses are created with malicious intent. On the other hand, some virus writers consider their creations to be a work of art, and see virus writing as a creative hobby. Additionally, many virus writers oppose deliberately destructive payload routines. Some viruses were intended as "good viruses". They spread improvements to the programs they infect, or delete other viruses. These viruses are, however, quite rare, still consume system resources, and may accidentally damage systems they infect. Moreover, they normally operate without asking for permission of the owner of the computer. Since self-replicating code causes many complications, it is questionable if a well-intentioned virus can ever solve a problem in a way which is superior to a regular program that does not replicate itself.

Releasing computer viruses (as well as worms) is a crime in most jurisdictions.

Anatomy of viruses

Most viruses just consist of a finder and a replicator. The finder is responsible for finding new files to infect. For each new executable file the finder finds, it calls for the replicator to infect that file. The replicators task is to 1) open the new file 2) append the virus code to the executable file 3) save the executables starting point 4) change the executables starting point so that it points to the location where the newly copied virus code starts 5) save the old start of execution point to the virus in a way so that the virus branches to that location right after its execution. 6) save the changes to the executable file and 7) return to the finder so that it can find new files for the replicator to infect.

However, this only applies to quite simple viruses.

In addition, some viruses also encrypt their code before injecting it to new executables to avoid detection from antivirus-software. Such viruses must, obviously, decrypt their code before running it. In order to do that, such viruses have a decryption engine at the very beginning of their body and an already encrypted encryption-engine somewhere in their replicator.

Mostly, the decryption for viruses is fairly simple and mostly done by just xoring each byte with a randomized key that was saved by the parent virus. Most often, the encryption- and decryption-engines are the same, because xor works in both ways. (a xor b = c, c xor b = a.)

However, while not being able to detect the actual virus code (because it is encrypted), antivirus-software can still detect the decryption-engine located in the front of the body of such viruses by comparing the byte pattern of the decryption-enginge. To avoid being detected in this way, some viruses mutate their decryption engines for each new copy of themselves. Such viruses are said to be polymorphic, and are much harder to detect. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body.

However, while not being able to detect the virus at all when it starts its execution, the anti virus-software can still detect it with pattern analysis while it is executing. To avoid being detected in this way, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that uses this technique is said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. W32/Smile consisted of over 14000 lines of assembly code, for example. 90% of it is part of the metamorphic engine.

Replication Strategies

A virus requires several features from its host software to successfully duplicate itself. It must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to useful programs, in the hope that users will run those programs (and therefore the virus).

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of personal computers, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk.

As bulletin board systems and online software exchange became popular in the late 1980s and early 1990s, more viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBSes. Within the "pirate scene" of hobbyists trading illicit copies of commercial software, traders in a hurry to obtain the latest applications and games were easy targets for viruses.

Many personal computers are now connected to the Internet and to local-area networks. Today's viruses take advantage of standard network protocols such as the World Wide Web, e-mail, and file sharing systems to spread, blurring the line between viruses and worms.

Hiding Strategies

In order to stay alive, some well written viruses employ different kinds of obfuscation. Some old viruses (especially in MS-DOS) alter the information attached to the files they infect, such as the "last modified" date and the recorded filesize. Antivirus software that just searches for recently edited files or files that have changed in size will not notice the virus's presence in this case. Note that changing the information stored about the size of the file is not the same thing as actually changing the size of the file under MS-DOS. This approach does not fool modern antivirus software.

Another hiding technique, a method DOS-era viruses commonly used to spread, is to infect the hard disk drive instead of the files saved on it. At bootstrap the computer runs the code located in the boot sector, which has been replaced by virus-code. The virus loads itself from the hard disk into memory and makes itself memory resident, then loads the original bootsector into memory and transfers control to the code in it. This way, not even the operating system notices the presence of the virus.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. The stealth methods of modern viruses often try to exploit the failings of modern antivirus software in trying to detect viral presence. Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them. If they find a byte-pattern that corresponds to any specific virus-pattern, the antivirus software tries to remove, contain, or delete the virus/file.

The CIH virus, or Chernobyl Virus, infected Portable Executable files. Because those files had many empty gaps, the virus, which was 1 kilobyte in length, did not add to the size of the file.

Modern state-of-the-art viruses try to encrypt themselves in order to avoid being detected by an antivirus search. This is often done with a combination of encryption and self-modifying code. A virus that uses this technique is said to be polymorphic.

There are usually two different parts of the virus when we speak of polymorphic viruses: The encryption/decryption engine and the infector. The crypto engine encrypts/decrypts the infector. Each time the virus runs it uses a different cryptokey. The crypto engine cannot encrypt itself, because if it did, there would be no code to decrypt the engine next time the virus ran. Therefore, the crypto-engine has to use a form of self modifying code to modify itself differently each time it runs, without any part of the original algorithm getting lost. This is possible to do with a good knowledge of assembly language and the use of polymorphic code.

Viruses and legitimate software

The vulnerability of operating systems to viruses

Another analogy to biological viruses: just as genetic diversity in a population decreases the chance of a single disease wiping out a population, the diversity of software systems on a network similarly limits the destructive potential of viruses.

This became a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office software. Users of Microsoft software (especially networking software such as Microsoft Outlook and Microsoft Internet Explorer) are particularly vulnerable to the spread of viruses, especially since such complicated software inevitably includes many errors. Integrated applications, applications with scripting languages with access to the file system (eg: Visual Basic Script, or VBS, and applications with networking features) are also particularly vulnerable.

Although Windows is the most popular operating system for virus writers, some viruses also exist on other platforms. It is important to note that any operating system that allows third-party programs to run can theoretically run viruses. However, some operating systems are less secure than others. Unix-based OSes (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their protected space in their own directories.

A well-patched and well-maintained Unix system is very well-secured against viruses. Windows has the same type of scripting ability as Unix-based systems, but doesn't natively block normal users from executing such scripts written by a third-party as Unix does for users who are not running as root. More recently, Microsoft's Outlook (but not Outlook Express) e-mail client has developed similar features when dealing with executable file types that Outlook may download as attachments. Ordinary users would do well to patch their operating systems and e-mail clients to prevent viruses and worms from reproducing through security "holes" which prudence (and most virus scanners) are unable to prevent.

The role of software development

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses must exploit software bugs in a system or application to spread. Software development strategies which produce large numbers of bugs will generally also produce potential exploits.

Closed-source software development as practiced by Microsoft and other proprietary software companies is also seen by some as a security weakness. Open source software such as GNU/Linux kernel, for example, allows all users to look for and fix security problems without relying on a single vendor. Some advocate that proprietary software makers practice vulnerability disclosure to ameliorate this weakness.

Anti-virus software and other countermeasures

Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or mounts the executable. Some virus scanners can also warn a user if a file is likely to contain a virus based on the file type; some antivirus vendors also claim the effective use of other types of heuristic analysis. Some industry groups do not like this practice because it often increases the number of false positives the anti-virus software detects. They work by examining the contents of the computers memory (its RAM, and boot sector) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus signatures. Some anti-virus programs are able to scan opened files in addition to sent and received emails 'on the fly' in a similar manner. This practice is known as "on-access scanning." Anti-virus software does not change the underlying capability of host software to transmit viruses. Users must therefore update their software regularly to patch security holes. Anti-virus software also needs to be updated in order to gain knowledge about the latest threats and hoaxes.

See also:

References

Retrieved from "https://en.wikipedia.org/w/index.php?title=Computer_virus&oldid=6065963"