<epigraph>
  <attribution>Dr. David Butler, British psephologist</attribution>
  <simpara>
    The function of the expert is not to be more right than
    other people, but to be wrong for more sophisticated reasons.
  </simpara>
</epigraph>

<simpara>
  Intended audience for this document are developers and script savvy
  administrators. But from the very beginning it also attracted people
  who sincerely care about security and view example code with suspicion.
  I'll try to explain what the source code is showing -
  or at least is supposed to show, once it's bug free and complete.
</simpara>

<sect2 id="what.exactly.is.a.virus">
  <title>What exactly is a virus?</title>

  <simpara>
    The plural of virus is neither <foreignphrase>viri</foreignphrase>
    nor <foreignphrase>virii</foreignphrase>, nor even
    <foreignphrase>vira</foreignphrase> nor
    <foreignphrase>virora</foreignphrase>.
    It is quite simply viruses, irrespective of context.
    &note.virus.plural;
  </simpara>
  <simpara>
    The jargon files contain a good definition.
    For my purposes it is not technical enough, though.
    I want to make clear what this all is about,
    and even more important, what it is not.
  </simpara>

  <itemizedlist>
    <listitem>
      <simpara>
	A virus &note.jargon.virus; is a program that
	infects other programs stored in inactive form. This document
	concentrates on copying the executable code of the virus into
	another file. Other possible targets are boot sectors and
	programmable ROMs.
      </simpara>
    </listitem>
    <listitem>
      <simpara>
	A worm &note.jargon.worm; is a program that penetrates other
	running programs. Penetration means to copy the executable
	code of the worm into the active process image of the host.
      </simpara>
    </listitem>
    <listitem>
      <simpara>
	A trojan program &note.jargon.trojan; is deliberately started
	by a user because of advertised features, but performs covert
	malicious actions.
      </simpara>
    </listitem>
  </itemizedlist>

  <simpara>
    The jargon files include programs infected by a virus into their
    definition of trojan. I don't consider this helpful. The survival
    strategy of viruses is to stay below the level of perception of
    humans, operating systems or scanners.
    But trojans don't hide. They obfuscate their real intend by delivering
    a good show. Good advertising can persuade the user to install
    necessary system components, deactivate security checks,
    and throw overboard all common sense.
  </simpara>
  <simpara>
    The jargon files also claim that
    <quote>a virus cannot infect other computers without assistance</quote>.
    Widespread use of write-enabled network shares has made this a bold
    statement. It is correct that patching an executable file over
    the net is meaningless if that program is not executed somewhere.
    But I want to stress that it's not the media containing the target
    that distinguishes worms from viruses.
    A virus polluting a RAM-disk is still a virus. A worm saved to disk by
    the hibernation feature of a laptop is still a worm.
  </simpara>

</sect2>
<sect2 id="worm.vs.virus" xreflabel="Worm vs. virus">
  <title>Worm vs. virus</title>

  <simpara>
    The main difference between worms and viruses is persistence and
    speed.  Modifications to files are usually permanent and remain after
    reboot. On the other hand a virus attached to a host can get active
    only when that host program is started. A worm takes immediate control
    of a running process and thus can propagate very fast.
  </simpara>
  <simpara>
    Usually these techniques are combined to effectively cause mischief.
    Viruses can get resident, i.e. attach themselves to a part of the 
    system that runs independent of the infected executable.
    Worms can modify system files to leave permanent back doors
    &note.jargon.backdoor;.
    And tricking the user into executing the very first infector
    is a lot easier than finding and exploiting &note.jargon.exploit;
    buffer overflows &note.jargon.buffer.overflow;.
  </simpara>
  <simpara>
    But Unixes have traditional concepts to limit the possible damage of
    a malicious process. Network services can be run under the access
    permissions of a non-privileged account. File systems can be mounted
    read-only (e.g. <filename>/usr</filename>) or as
    <literal>noexec</literal> (e.g. <filename>/home</filename>).
    Some file systems have extended attributes that can prohibit
    access even when <command>ls <option>-l</option></command>
    tells otherwise
    (on <literal>ext2</literal> this is
    <citerefentry>
      <refentrytitle>chattr</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>).
    Probably the strongest defense is 
    <citerefentry>
      <refentrytitle>chroot</refentrytitle>
      <manvolnum>1</manvolnum>
    </citerefentry>.
  </simpara>
  <simpara>
    Every single one of these techniques can stop a vandalizing human,
    virus or worm to take over the entire machine. But while it is easy
    to control viruses, it is very hard to stop worms.
    To exploit a vulnerable network service a worm needs permissions
    for an incoming connection. To compromise the next machine on the
    network it needs an outgoing network connection. Nothing else.
  </simpara>

</sect2>
<sect2 id="freedom.is.security" xreflabel="Freedom is security">
  <title>Freedom is security</title>

  <simpara>
    I will now put on a black hat and an evil grin.
    Using material already published on the net, contributions sent to me,
    and all documentation available, I will try to build a virus to do in
    &config.UNAME; for good.
    All concepts, ideas and experiments - along with enough working code
    to prove my conclusions - will be released to public ridicule
    through this document.
  </simpara>

  <simpara>
    Should the quest fail this may have a few reasons:
  </simpara>
  <orderedlist>
    <listitem>
      <simpara>I am incompetent.</simpara>
    </listitem>
    <listitem>
      <simpara>Nobody cared to sent in evidence for #1.</simpara>
    </listitem>
    <listitem>
      <simpara>
        It already has been done,
	but They will prevent #2 to maintain #1. 
      </simpara>
    </listitem>
    <listitem>
      <simpara>
	Optimistic readers could think that the inevitable big mistake of
	developers and distributors will be released soon, but just isn't
	available right now.
      </simpara>
    </listitem>
    <listitem>
      <simpara>
	Even more adventurous spectators might say that design,
	development model, or distribution concept make &config.UNAME;
	immune against a direct attack.
      </simpara>
    </listitem>
    <listitem>
      <simpara>
        This is just one of the more boring episodes in the matrix.
      </simpara>
    </listitem>
  </orderedlist>

  <simpara>
    Anyway, it is not a problem if we, or someone using this document,
    succeeds. The correct name for that situation is opportunity.
    Should you happen to take this document - and especially above
    agenda - too seriously, the story of <quote>Osama bin virus</quote>
    &note.vmyths.osama; can help.
  </simpara>
  <simpara>This text written under influence of an evil grin.</simpara>

</sect2>
