Old-skool virus writers still exist.
pastebin.com
pastebin.com
Today, as most users don't care about what processes are running on their system, and since the most common vector of infection is through the internet, what we call "viruses" are actually worms: they don't infect other programs, they are just self-replicating, malicious, executables.
1) They infect boot sectors of floppy and hard disk, or 2) They infect partition tables of hard disk or, 3) They infect .COM (most commonly Command.com) and .EXE
Old school virus infects the executable files such that when the executable files are run, the virus stays resident in memory and infects all other executable files and floppy disks, hence the reason Command.com is the most popular target.
The file size of the executable might increase when the virus infects it. To minimise this and avoid detection based on file size, the virus need to small enough to hide in the slack space, hence the reason most of them are written in assembly.
To overcome boot sector virus on a floppt is easy. I made a clean copy of newly formatted MS-DOS disk and then kept a copy of Boot Sector 0 in a file which I then use to override the Boot Sector 0 in the infected floppy using Norton Diskedit. Same applies to partition tables.
Executables that are infected are a pain to clean, but knowing that Command.com is most often targetted, I alway keep a clean copy of Command.com renamed as abc.def (to avoid detection by the virus) on my system. Create an entry in autoexec.bat to do a file compare between command.com and abc.def and alert me of changes.
These are the problems I had cleaning old school virus.
New school virus are easy to handle, they don't infect executables. They create entries in Windows startup to run themselves. Find the right entries and remove them and the virus won't be problem when you next boot up.
The biggest threat I see is when some of the old school virus writers return and start infecting/corrupting executable files such as Command.com via drive-by download.
Actually I working on a side project to combat new school virus. If anyone is interested, just drop me a mail via my account.
Old school isn't snazzy and exciting and has a higher entry point. You won't find many old school fart apps.
"- Microsoft
hh86: love it"The average Unix user runs without superuser privileges most of the time. Typically, the less experienced a user is, the less privileges he has in a Unix environment [1].
At least as recently as Windows XP [2], the average Windows user ran his computer with an administrator account on a daily basis, which opens the user to much greater damages from malware. When I used Windows on my own computers, I always setup a non-administrator account for daily use, but I'm experienced enough to know (1) how to do that and (2) that it's a good idea. This suggests that Windows has an inversion of privileges compared to Unix. That is, the most experienced users grant their daily account the fewest privileges, whereas the least experienced users operate with administrator privileges.
[1] http://librenix.com/?inode=21
[2] Windows XP is the latest version of Windows that I've had enough experience with to say what the average user's setup is like. I hear that the situation has improved a bit with Windows 7, but when I was an intern at Microsoft, every one seemed to run as an administrator on their Windows 7 machines, so I'm not convinced that it's any better.
I'm not a Windows user. Since age 13, I have spent a total of one (1) year in Windows, in 2000, when I ran a Solaris to WinAPI ACE_wrappers port for my startup. I cut my teeth on 386bsd, installed from approximately 900,000 3.5 inch floppy disks.
What I am is a security person, and these arguments about Windows being a petri dish for viruses strike this security person as BS. Computers are a petri dish for viruses, and the smug Unix weenie attitude of "we solved that with su" drives me nuts even before we get to analyzing how long any Unix operating system has ever gone without a well-known privilege escalation flaw.
In regards to your first post about popularity, do you think that all of those Unix web servers out there are not a juicy target? How valuable do you think it would be to a virus writer to be able to infect Google's datacenter?
The rest of your comment is name-calling and self-congratulatory back-patting, which does nothing to present a cogent argument.
[1] Executables aren't the only files that can be infected. You could infect a user's PDF, JPEG, or other files that are then interpreted by a vulnerable executable.
(b) How valuable do you think it would be to a virus writer to infect Mastercard's data center? It isn't riddled with viruses.
(c) If you have a population that accounts for 80% of the market which is only 20% saturated and another that accounts for 5% of the market, why would you ever, ever, ever write for the 5% market? We haven't hit "peak oil" for malware yet.
(d) Your footnote makes my point. Thanks.
(ps) the congratulatory back-patting is to head off the inevitable Linux advocacy "you're a shill for Microsoft" BS that comes bundled with these discussions.
> WinAPI is no more hospitable to viruses than Linux is.
I think that implies that all operating systems are created equal (at least as far as security is concerned for this discussion), or that Linux is more hospitable to viruses than Windows. I think the idea that all operating systems are created equal is laughably false. The second idea---that Linux is more hospitable to viruses than Windows---is a much more complex issue. Proving that there is at least one way to infect Linux with a virus does not prove that point. All that proves is that Linux's security is less than 100%, which I agree with (hence the footnote in my previous comment).
In other words, your argument:
S(Linux) < 100%
S(Linux) > S(Win32)
S(Win32) < S(Linux) < 100%
> What it is is popular enough to be worth targeting.
Your economic argument proves that claim. I agree. However, being less popular doesn't preclude Linux from being less hospitable to viruses.
> (ps) the congratulatory back-patting is to head off the inevitable Linux advocacy "you're a shill for Microsoft" BS that comes bundled with these discussions.
Fair enough. Those "you're a shill for Microsoft" type comments do have a tendency to show up in discussions like this. I like a high signal-to-noise ratio in conversations, which is why I called you out on that, but now I see you were trying to keep the content-less comments out as well.
We're talking about the security of single-user machines --- of which most servers are a special case thereof. The perceived significant difference between the two platforms simply isn't there.
Yep, low privileges only isolate viruses. A virus running as superuser can infect the entire system. A virus running as a low-privilege user can only infect what the user has access to. And all this applies equally to Windows as to Linux.
>(b) How valuable do you think it would be to a virus writer to infect Mastercard's data center? It isn't riddled with viruses.
Have you heard of Stuxnet and how it infected nuclear reactors?
> Unix was designed from the start to run multi-user environments, whereas Windows grew out of DOS, which was initially built for single-user, non-networked environments. The difference in their initial goals led to wildly different security models.
No. [1, Section 2.2]
> The average Unix user runs without superuser privileges most of the time. Typically, the less experienced a user is, the less privileges he has in a Unix environment.
No. The most popular Linux distribution lets you run any command as any user by default. [2, Default Sudoers File]
> Windows has an inversion of privileges compared to Unix. That is, the most experienced users grant their daily account the fewest privileges, whereas the least experienced users operate with administrator privileges.
No. This isn't the case with the Windows that is shipping today.
--
One final thing to consider. Who cares about separation of privileges if your OS is full of privilege escalation exploits? Hint: one of these operating systems spent billions of dollars hardening their OS and the other is full of holes.
[1] http://www.cs.purdue.edu/research/technical_reports/1991/TR%...
NT was designed from ground up to be multi-user too.
The idea that Windows is harder to update than Linux will come as a surprise to enterprises who have been getting autoupdated fixes for almost a decade now.
Edit: Ah, and I forgot: Windows ACE's are pretty much as good as NFSv4 ACLs but Linux still doesn't support anything other than basic POSIX.1e ACLs out of the box.
There is a misunderstanding about updates. I was not saying that Windows is less updated, I was saying its security holes remain exploitable for a longer time, if they get fixed at all. Compare Windows XP (read section "Most Critical Unpatched"):
http://secunia.com/advisories/product/22/?task=statistics_20...
with Ubuntu Linux (again, read section "Most Critical Unpatched"):
http://secunia.com/advisories/product/18611/?task=statistics...
This was particularly true back when executable file viruses were at their most prolific - back in those days, if you copied a game from your friend at high school, that binary was quite likely to be several tens of generations removed from the original source. Each generation was an opportunity for a virus to climb aboard. With internet distribution of illicit wares, you're much closer to the original source.
virii
http://stason.org/TULARC/security/computer-virus/14-Is-it-vi...
That's not immediately clear. Depending on whether you think it's second or fourth declension, and masculine or neuter, the various possibilities are virua, vira, virūs, and viri. My best guess is that the "correct" usage was one of the more exotic varients (virua or vira), but the word was so rare that many people didn't learn the nuances, and instead adopted it to the more common patterns. Similar to how "begs the question" is often used incorrectly, and that ends up becoming an accepted usage.
However, the plural could not have been "virii."
More than either of you two probably want to know about the subject.
Nowadays, software is either obtained directly from authors (or packagers), or from more centralized P2P sources, and, in my personal perception, most of time flash drives are used is to transfer documents, not executables.
See, destruction is also creation. She creates viruses. These things then go on to destroy other stuff.
Destruction is not at all a boring art. It's as legitimate an art as creation.
Somewhere around 10th grade I finally gave in to my urge to put a lot of energy behind a simple question: why do parasites exist? Why are there lice, ticks, bacteria and viruses?
Turns out they do, just because they do. They're legitimate 'creations,' living beings. And in non-parasitic beings, they inspire toughness and survival strategies — if it can't adapt to the parasite (in one way or another) it'll die out.
Really, I don't get why people are biased against 'evil' black hats. If they target you and your app failed, you better get some security going. It's better some 'artist' who just feels the need to destroy intricate systems in an ingenuous fashion makes me aware of my security holes than someone with a malicious intent.
From the interview, I can't see anything sociopathic or even malevolent in her (granted, I haven't read the whole thing.)
But when I was a teenager, it was quite different. I admired black hats, and people who wrote viruses, because they were playing a game: there were people whose sole existence was based on working against these 'bad guys.' They got paid to fix security holes, to design programs in an 'un-hackable' manner. And yet, the intruders often prevailed. It's a game of outsmarting. There's someone, incredibly smart, trying to prevent you from achieving goal x. He's getting paid, probably has a whole team of experts around him. And yet, you find your way into the system; break it. That sounded almost heroic to me.
Of course, the whole metaphor works even better when you're discontent, or even at odds with society at large. Read: when you're pretty much every teenager on this planet :-D
Have not heard that name in a while! Admired his code