Open Source Security

During my lab admin days as an undergrad, people used to come into the computer lab with virus infected 5 1/4″ diskettes and (inadvertently) try to infect the lab machines. (It doesn’t feel like it was THAT long ago!) Next, viruses were commonly spread attached to email. More recently, viruses have been propagated through music sharing. All of these infection vectors have one thing in common – a proper virus requires a host to carry the malicious code. Colloquially many people have become used to calling all malware viruses, but this is not correct terminology and I do believe that it is important to be pedantic on this point.

So here is a definition of virus in my own words: A virus is a piece of code which attaches to a host file and when executed performs an action that the user does not desire (including replicating itself to other hosts).

Wikipedia says: “A computer virus is a computer program that can copy itself and infect a computer without the permission or knowledge of the owner. The term ‘virus’ is also commonly but erroneously used to refer to other types of malware, adware and spyware programs that do not have the reproductive ability. A true virus can only spread from one computer to another (in some form of executable code) when its host is taken to the target computer; for instance because a user sent it over a network or the Internet, or carried it on a removable medium such as a floppy disk, CD, DVD, or USB drive. Viruses can increase their chances of spreading to other computers by infecting files on a network file system or a file system that is accessed by another computer.”

Anti-virus software was created to detect signatures for existing known viruses. Before any file was opened, anti-virus software scanned it for these known signatures. So viruses morphed, they changed their signatures by compressing the executable code (compression viruses), by rewriting their codebase each time they were attached to a new host (polymorphic viruses), even encrypting their code (encrypted polymorphic viruses). Anti-virus software has morphed too, and that will be a topic for another post.

Wikipedia has a more in depth discussion of the definition of computer virus and a list know viruses (few hundred in the wild to tens of thousands known) and a separate list of know Linux viruses (22).

This entry was posted on Tuesday, March 31st, 2009 at 1:27 pm and is filed under security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.
Digg it | Bookmark at del.icio.us