This chapter is from the book
This chapter is from the book
This chapter is from the book
Viruses
A virus is a program or code that replicates itself onto other files with which it comes in contact; that is, a virus can infect another program, a boot sector, a partition sector, or a document that supports macros by inserting itself or attaching itself to that medium. Most viruses only replicate, although many can do damage to a computer or to the user’s data as well. Unlike worms, which are discussed later in this chapter, viruses generally require human action to propagate.
Risks from Viruses
Symantec has identified more than 10,000 variations of viruses, with multiple new viruses added to this list every day. Some of these simply seek to spread copies; others can be used to weaken a computer’s defenses against later attacks in a process referred to as softening the target. Other viruses have deleted files of a particular type on local and network-shared file stores, while some are programmed to lie in wait until a particular date or time and then enact a preprogrammed process, such as attacking antivirus Web sites in an effort to create a distributed denial-of-service of a Web site.
Viral Propagation
Just as a biological virus can find its way to a new host by air, contact, or water, digital viruses can be transmitted between hosts via a number of different avenues, including removable storage, downloads, network file shares, wireless connectivity, and email.
Removable Storage
Early virus propagation occurred when a medium, such as a floppy disk, was loaded into an infected computer. The virus copied itself to this medium so that when the floppy was inserted into another host, the viral code executed and spread to this new computer. Common removable media exploited by viral code included floppy disks, Bernoulli cartridges, removable drive platters, and any other form of medium that could carry the infection between computers. Today removable optical media and the ubiquitous USB flash drives provide a convenient transport mechanism between unprotected computers.
Downloaded Information
With the advent of networked operating systems and the development of the global Internet, users can transfer data without requiring a physical medium of transport. Data downloaded from Web sites, electronic mail, and peer to peer file-sharing services such as BitTorrent or Kazaa all provide a conduit for potential viral transmission. Users who download cracked applications or illegally downloaded audio and video files commonly encounter viral programs masquerading as the desired file. Legitimate users might find themselves attacked by a newly released virus if they visit an infected Web site or otherwise download virus-laden data.
Network File Shares
In modern network scenarios, multiple users often share common file storage on a centralized file server. This allows mobile users to access their data from the central repository without requiring that they always log on from a particular client computer, while also allowing centralized management of backup/ recovery and file-storage policies. Some viruses can replicate themselves to an available file, potentially corrupting key data or providing a vector for transmission to other users who might access infected files from a shared directory that has been compromised in this manner.
Wireless Connectivity
Viral programs are evolving into forms capable of being transmitted via wireless connectivity, including Bluetooth and WiFi wireless data connections. As mobile devices employ greater data-sharing capabilities and expanding computer resources, many devices and embedded control computers might become capable of being infected by viruses.
Windows and the World
Because of the dominance of the Microsoft Windows® operating systems, on computers around the world, virus writers have focused on this platform and its common applications. However, other operating systems are not without risk; for example, viruses are now being seen infecting mobile devices such as cell phones, personal digital assistants (PDAs), and other mobile devices. Like their server and desktop-computing counterparts, these devices can also be vulnerable to viruses and other forms of threats.
PCs Are Not Alone
In July 2004, proof-of-concept threats were identified that were targeted at the Symbian operating system used by many mobile devices, including personal digital assistants (PDAs), cell phones, vending machines, environmental controls, and many other forms of wirelessly connected electronics. Some of these threats were capable of taking advantage of the Bluetooth connectivity built into mobile devices to spread to nearby devices configured for Bluetooth access. Symantec lists 31 variations of SymbOS-based threats at the time of this text’s writing.
As with biological viral infections, a digitally infected mobile device can potentially spread to other susceptible devices that passed close by—much like having a co-worker with the flu come to the office and share his or her biological virus with those who come too close. This is not limited to cell phones, laptops, and PDAs alone. SC Magazine recently detailed the potential for viral infection of the onboard computers on some late-model automobiles.
With the capability to infect other devices without direct contact, the potential for rapid viral propagation between automobiles and other devices becomes a very complex issue. Users passing through a crowd, walking past parked cars, or walking near other wireless devices in their office or home could find their personal devices infected simply by their proximity.
Executable Files
By attaching itself to an executable file, viral code can be executed by the operating system when the executable file is run. Some viruses are capable of renaming common executable files and duplicating themselves in place of the replaced application so that when a user attempts to open a common application such as notepad.exe, the virus executes in its place. A few of these viruses can attempt to hide their existence by also executing the renamed program the user sought after they have completed their own operation.
File Attachments
With the growing use of email for personal and professional uses, file attachments have become a common means of viral transmission. Many viruses arrive in a user’s inbox pretending to be from a known source, offering some type of information of interest to the target. Little does the user know, when he or she launches the attached file, a virus and is activated.
Macro Viruses
Within some applications, such as the Microsoft Office Suite of products, users can record macros, allowing a set of common tasks to be executed. Macro viruses append themselves to common file types, such as document (.doc) or spreadsheet (.xls) files, and execute their payload when an infected document is opened by the application or some other program capable of executing embedded macro code.
Direct Infection
Some viruses directly damage files by replacing the original file with a copy of the virus named the same as the deleted file, or by embedding their code within an existing file by discarding the original file contents beyond the file’s header segment. Other viruses can attach their code to the beginning or end of existing files, to conceal the infection more effectively. Many viruses hide copies of their code within the System Restore on Windows XP computers, requiring that a user disable this feature to be able to remove the infection. Others write keys into the Registry that must be removed to clean out the viral code.
Boot-Sector Viruses
Boot-sector viruses directly infect the first sector of a computer’s hard drive. When a computer is first powered on, its built-in programming is capable of performing only simple Power-On Self-Test (POST) operations and then accessing the first sector on the configured boot device (typically a hard drive). Code loaded from this boot sector directs the computer through additional steps necessary to load software drivers and the operating system itself.