Path: softp!relay1!csoft!kiae!relcom!fuug!news.funet.fi!sunic!seunet!pipex!bnr.co.uk!bnrgate!nott!torn!cs.utexas.edu!sdd.hp.com!saimiri.primate.wisc.edu!caen!msuinfo!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: seborg@first.org (Brian Seborg)
Newsgroups: comp.virus
Subject: Viruses, Greeks, and Trojan Horses
Message-ID: <0001.9302241456.AA04775@first.org>
Date: 22 Feb 93 20:26:57 GMT
Sender: virus-l@lehigh.edu
Lines: 106
Approved: news@netnews.cc.lehigh.edu

I have been watching the attempts to define a virus here with some
degree of nausea and boredom and thought it only appropriate to punish
those responsible by forcing them to read my own thoughts on the
subject.

Let's go back to the beginning.  It all started with the Trojan Horse.
You see, the Greeks were fighting the Trojans, and the Trojans were
basically pouring hot oil on the Greeks, shooting them with arrows,
and generally making the battle a bit of a downer for the Greeks.  The
Greeks came up with an idea to take advantage of the Trojan's love of
horses, and to turn the tide of the battle to their advantage.  To do
this they built a large horse made out of wood, and loaded the entire
Greek army inside.  The Trojans woke up the next day and saw that the
Greek army had disappeared and in their place stood this large wooden
horse.  Thinking that the Greeks had given up and had left the horse
as a token of their admiration of the Trojan's war prowess, the
Trojans pulled the horse inside and had a big party.  That night as
the Trojans slept the Greeks crawled out and wiped them out.  This
story has different flavors, but it will suffice for the rest of my
discussion.

Now, we leap forward to the time of computers, and some joker figures
that he can mess up your system by fooling you into running some
program which promises great speed increases, or a neat game, and this
type of program with hidden functionality becomes christened a "Trojan
Horse."  Your computer is the Trojan Fort, you are the Trojan, the
program is the Trojan Horse, and the code inside it becomes the
Greeks.  Seems appropriate.

Next we progress to program code which not only houses malicious code,
but code which can spread to other programs turning them into Trojan
Horses.  We called these viruses since we assume the original program
is similar to a cell, and the virus code is similar to a biological
virus which attaches to the cell making it function like the virus.
We also saw the development of worms which much like a biological tape
worm are self-contained and can consist of one or several segments,
and essentially exist to tap or sap the resources of systems attached
to networks.

But, we have seen viruses which attach to programs in different ways
other than direct attachment.  Companion viruses come to mind, where
the viruses actually create a seperate and distinct file which has the
same name as a legitimate program, but which is lower in the hierarchy
of execution (i.e.  creating program.com to ensure that it runs before
program.exe).  We have also seen viruses which change the pointers in
the directory to point to the virus first (such as DIR II) and the
virus maintains its own pointers to the original programs.  There is
also the "fragmentation attack" (I believe this was coined by Vesselin
Bontchev) in which a virus takes advantage of the fact that certain
system files are assumed to be located in fixed positions on the disk
relative to the beginning of the DOS boot partition, and the virus
simply places itself in these locations after moving the original code
elseware (similar in concept to MBR and Boot infectors).  So, we
have to try to come up with a definition which embraces all of these
developments, and still excludes programs such as Xcopy, and Diskcopy
as well other legitimate programs which are not viruses.

The old definition attributed to Fred Cohen's 1987 paper "Computer
Viruses: Theory and Experiments," Computers & Security, Vol. 6, No. 1,
February 1987, pp. 22-25 is:

"We define a computer 'virus' as a program that can 'infect' other
programs by modifying them to include a possibly evolved copy of
itself."

Fred further points out in his article the following:
"The key property of a virus is its ability to infect other
programs..."

He also states:
"It should be pointed out that a virus need not be used for evil
purposes or be a Trojan Horse."

The definitions put forth in this paper were groundbreaking, but Fred
never anticipated some of the new ways viruses currently use to
"infect" program code.  However, I believe we can modify Fred's basic
definition and arrive at a new working definition which will include
the different types of viruses such as companion viruses and still
exclude other non-virus programs.

Modified definition:

We define a computer 'virus' as a program that can 'infect' other
programs by modifying them or their environment such that execution of
the infected program implies a call to a possibly evolved copy of the
'virus.'

Granted, the definition is recursive, and may need some work, but it
seems to cover the current state of the art, while still
distinguishing viruses from worms, or Xcopy.

As for Fred's comment about viruses not necessarily being Trojan
Horses, this is true since if one knows that a program contains a
virus, then there is no unknown functionality implied.  Also, perhaps
when we find that our programs have a virus inside we should be
historically correct and state, " My program was attacked by a damn
Greek" (my apologies to any one of Greek decent :-)) since the Trojan
Horse would have been nothing but a nice statue of a horse if it were
not for the fact that it concealed the Greek Army inside.

Also, an 'infected' program only becomes a Trojan Horse if we don't
know that it is infected.

Brian Seborg
VDS Advanced Research Group 
:-)

