Subject: VIRUSes (was Re: Unix based FITS table browsers?)

From: sla at fast.ucsc.edu (Steve Allen)
Date: 17 Mar 92 14:54:50 GMT

In article <1992Mar16.184014.21997 at draco.macsch.com> bds at woim.id.macsch.com writes:
>Hello all,
>Enclosed is a utility that I wrote for my brother.  ...
>This is an executable and runs on his sun4 and my sparc2....
>I request that you give me feedback on this program as to future
>-Barry
>   [followed by what appears to be a UUencoded binary for Sparc]

No offense intended, but you don't honestly expect me to put this
binary on some machine with data that I value and run it, do you?
I might do it immediately after a complete dump of all my disks, and after
unplugging that particular Sparc from the net to contain possible damage.
Be very careful about this.
_______________________________________________________________________________
Steve Allen          | That was the equation!         |   sla at helios.ucsc.edu
UCO/Lick Observatory | Existence!...Survival must     | If the UC were opining,
Santa Cruz, CA 95064 | cancel out programming! -- Ruk | it wouldn't tell me.

---

From: cflatter at nrao.edu (Chris Flatters,109,238)
Date: Tue, 17 Mar 1992 16:54:39 GMT

>Be very careful about this.

I hope that we are not going to see the free interchange of astronomical
software inhibited by virus hysteria spreading from the DOS world.  DOS
is particularly vulnerable to malicious actions since all DOS users and
DOS programs effectively have system administrator privileges.  This is
not true of a UNIX system unless the sysadmin has done some remarkably
stupid things to it.

While it is technically possible for a program to exploit bugs in the
system to get itself root privileges (as the Morris worm did) the Trojan
horse approach would not be the preferred method to do this.  If nasties
are going to get onto your machine they are much more likely to come
over the net.

==============================================================================
Chris Flatters				|  cflatter at nrao.edu
National Radio Astronomy Observatory	|
==============================================================================
Desperation is the raw material of drastic change --- W. S. Burroughs
==============================================================================

---

From: warnock at nssdca.gsfc.nasa.gov (Archie Warnock)
Date: Tue, 17 Mar 1992 17:45:00 GMT

In article <1992Mar17.165439.5812 at nrao.edu>, cflatter at nrao.edu writes...
>DOS programs effectively have system administrator privileges.  This is

In addition, it should be pointed out that the virus threat to DOS and 
Macintosh machines is blown way, way out of proportion with reality, and 
that most virus infestations on those platforms have come from 
commercial software, rather than PD or shareware files from reputable 
BBSs.  Viruses are real, and rare.

----------------------------------------------------------------------------
-- Archie Warnock                     Internet:  warnock at nssdc.gsfc.nasa.gov
-- Hughes STX                         SPAN:      NSSDC::WARNOCK
-- NASA/GSFC                          "Hail To The Redskins!"

---

From: bds at woim.id.macsch.com ()
Date: Tue, 17 Mar 92 19:05:02 GMT

I apologize for not putting the code on an ftp site.  To post it was a spur of the
moment decision.  The display is slow because to merge 3 images and display on 8bit
machines requires some fancy coding.

 Is this the type of program that you all out there would be interested in?
I mean, should I continue to work on it?

 By the way, the second window that has the colormap allows you to select a color
and see where in your image that color is used and what values it is.

Barry

---

From: pmurphy at baboon.cv.nrao.edu (Pat Murphy)
Date: Wed, 18 Mar 1992 21:18:52 GMT

In article <17MAR199212453081 at nssdca.gsfc.nasa.gov>
    warnock at nssdca.gsfc.nasa.gov (Archie Warnock) writes:

One simple way of spotting suspicious binaries in a case like this is
to run the unix "strings" command on the file.  In this case there is
nothing harmful visible offhand (plus it shows nicely exactly which
FITS keywords are checked :-).  On large binaries, you want to pipe
the output through more (or less).  And yes, I know someone determined
can defeat this check, but it is another firewall -- and a useful one
IMHO.
				- Pat
--
==========================================================================
| Patrick P. Murphy, Ph.D.                Scientific Programming Analyst |
| National Radio Astronomy Observatory    Net:   pmurphy at nrao.edu        |
| 520 Edgemont Road                       or:    uunet!nrao.edu!pmurphy  |
| Charlottesville, VA 22903-2475          Phone: (804) 296-0372          |
|      "I don't believe in the no-win scenario"  --- James T. Kirk       |
==========================================================================

---

From: anthony at csd4.csd.uwm.edu (Anthony J Stieber)
Date: Thu, 19 Mar 1992 02:18:15 GMT

I really suggest that anyone interested in finding viruses get
one of the several virus scanning programs.  F-prot, McAffee Scan,
and Virex are all good programs and are freely distributable.

Viruses do tend to be rather rare, until I started working in
a computer lab I had never seen one before.  Before we started
to actively prevent viruses from getting on the lab machines
I'd see a dozen infections a week, now it's down to about one
infection a month.  Whether you see viruses depends on who
you interact with and how careful they are.

Incidently, strings will only work on file viruses, it can't
be used on boot sector viruses like stoned or michaelangelo.
Although some viruses do have interesting strings within them
plenty of others do not, or the strings are encrypted to prevent
casual searches.

In any case, viruses are only one of many possible ways to
loose valuble information.  The best preparation is to back
up the information.

See comp.virus and archive sites like wuarchive.wustl.edu.
--
<-:(= Anthony Stieber	anthony at csd4.csd.uwm.edu   uwm!uwmcsd4!anthony

---

From: carl at SOL1.GPS.CALTECH.EDU (Carl J Lydick)
Date: Tue, 17 Mar 1992 18:12:11 GMT

>are going to get onto your machine they are much more likely to come

On UNIX systems, it is quite easy for a program to, e.g., mail a copy of
/etc/passwd to the person who wrote the program, who can then try to find
passwords that encrypt to the values for the root password and a non-privileged
user's password.  It's also quite easy for a program to delete (or worse,
corrupt) all files owned by the person who runs it.  If you value your data,
DON'T accept binary executables except from trusted sources.
--------------------------------------------------------------------------------
Carl J Lydick | INTERnet: CARL at SOL1.GPS.CALTECH.EDU | NSI/HEPnet: SOL1::CARL

Disclaimer:  Hey, I understand VAXes and VMS.  That's what I get paid for.  My
understanding of astronomy is purely at the amateur level (or below).  So
unless what I'm saying is directly related to VAX/VMS, don't hold me or my
organization responsible for it.  If it IS related to VAX/VMS, you can try to
hold me responsible for it, but my organization had nothing to do with it.

---

From: sysmark at helios.physics.utoronto.ca (Mark Bartelt)
Date: Tue, 17 Mar 1992 18:27:48 GMT

[ Chris Flatters ]

| I hope that we are not going to see the free interchange of astronomical
| software inhibited by virus hysteria spreading from the DOS world.  DOS
| is particularly vulnerable to malicious actions since all DOS users and
| DOS programs effectively have system administrator privileges.  This is
| not true of a UNIX system unless the sysadmin has done some remarkably
| stupid things to it.
|
| While it is technically possible for a program to exploit bugs in the
| system to get itself root privileges (as the Morris worm did) the Trojan
| horse approach would not be the preferred method to do this.  If nasties
| are going to get onto your machine they are much more likely to come
| over the net.

Well, I prefer to err on the side of excessive caution, and therefore never
install an executable that I haven't built from source myself.  Of course,
even this is no guarantee of safety; not by a long shot.  For example, let
me toss out a couple questions:

(1)  How many of you have pulled something off the net which included a
     README file that said something like

		Type "make" to build executables, then
		su to root, then
		type "make install".

(2)  Those of you who raised your hands to #1:  How many of you always look
     at the makefile to see what "make install" will actually *do*?  I do,
     but I've certainly encountered far too many people who don't bother.

Mark Bartelt                                                   416/978-5619
Canadian Institute for                                mark at cita.toronto.edu
Theoretical Astrophysics                              mark at cita.utoronto.ca

---

From: stefan at helios.physics.utoronto.ca (Stefan Mochnacki)
Date: Tue, 17 Mar 1992 19:57:18 GMT

I cannot recall EVER seeing an EXECUTABLE for a Unix machine
distributed over Usenet. It is completely unnecessary, since in general
the potential users will have an appropriate compiler and the
standard libraries. That is not the case in the MS-DOS or
Mac world, where (a) there is a large proliferation of non-standard
compilers, (b) there is (was???) no standard graphical interface, and
(c) most users would not have a compiler anyway.

Thus, I would like to remind the well-meaning poster of "fits-bds"
that only SOURCE CODE should be posted to Usenet if it is for Unix
use. Anyway, many of us have non-SPARC machines, such as Sun 3's and
386i's. Usually, decent code will compile on run on many different
architectures, sometimes with a little hacking needed. 

				Stefan Mochnacki

-- 
Stefan W. Mochnacki          INTERNET - stefan at centaur.astro.utoronto.ca
Astronomy, U. of Toronto     UUCP - {uunet,pyramid}!utai!helios.physics!stefan
Ph. (416) 884-9562           BITNET - mochnacki at utorphys.bitnet 
FAX (416) 884-2672	     LOCATION - David Dunlap Observatory

---

From: hybl at umbc4.umbc.edu (Dr. Albert Hybl (UMAB-BIOPHYS))
Date: 18 Mar 92 00:42:53 GMT

In article <1992Mar17.195718.28883 at helios.physics.utoronto.ca> stefan at helios.physics.utoronto.ca (Stefan Mochnacki) writes:
>standard libraries.
The IRAF software is distributed with binaries tuned to each
machine type.  One can also get the source and recreate the
whole system.  I'd hate to have to look for a virus in that
system--source or binaries.  As Farragut said: "Damn the
virus--full installation ahead!"

Albert Hybl (hybl at umbc3.umbc.edu)