TweetFollow Us on Twitter

Jul 90 Letters
Volume Number:6
Issue Number:7
Column Tag:Letters

Virus Defense

By Kirk Chase, Editor, MacTutor

Viruses, Worms, And Trojan Horses

Steve Seaquist

3126 Brinkley Road, #204

Temple Hills, MD 20748-6308

For those who don’t know who I am, I wrote SecurityPatrol, which was published in the February 1989 issue. I’m writing in response to the April 1990 issue’s Mousehole report of the first two destructive Mac programs, which were of the trojan horse and time bomb types.

In discussing the general topic of defense, typical success stories have involved many simple defenses that overlap and reinforce one another, so that if one subsystem temporarily breaks down, another can take up the slack until total defenses can be shored up. That’s where we’re heading now, with many tools, of different types, from different sources. There will soon be so many tools that no new virus, worm, trojan horse or whatever can be programmed to evade them all. Ours is becoming an environment both sensitive and hostile to destructive software. We can now, if we so choose, swarm like bees (or Maryland police cars, an awesome sight to behold) around new releases of harmful software, isolate their spread and track them back to their source.

What we need now are our own success stories. We need to catch people with unbroken threads of evidence that lead to convictions in court. We need to make our environment even more sensitive and even more hostile to destructive software. We need to force anyone who contemplates releasing destruction into our world to think long and hard on the question: “Just how certain am I that I won’t get caught?”

To start working toward our own success stories, we need to start doing three things we haven’t been doing, namely: audit-trails, cooperation among anti-virus software developers and glorifying the hero:

Audit-Trails

By audit-trails, I mean the unbroken threads of evidence that lead to convictions in court. Keeping an audit-trail takes the most work, by far, from everyone. It means keeping track of where everything came from: every disk, every document, every application, every system file. (Yes, yes, every disk and document too.) It means keeping track of people: who they say they are, what they look like (height, weight, pitch of voice, color of eyes, race, identifying marks and scars, etc), where and when you met them, what information they used to convince you they were who they said they were, whether or not they could have overheard that information, etc. They don’t have to be extensive notes, but take notes. And if you run a BBS, multiply everything I just said times the number of users on your system.

This may sound like too much work, but consider your own liability: If someone gave you an application program, and you gave it to someone else, and it turned out to contain the worse virus ever released, and they traced it back to you, how much could you tell them about the person who gave it to you? Will they believe you? It’s for your own protection too. In situations of mutual defense, it often makes little sense to distinguish between self-defense and defense of others.

So if a guy you don’t know very well offers you a disk, the very least you should do is ask to see some photo-id and take down the numbers. If this provokes a fearful reply “What do you want to see that for?”, just tell the truth “I like to keep a record of where I get everything, just in case it turns out to contain a virus or something.” If he balks, it’s probably because he hasn’t been keeping records himself and has just realized with force his own precarious legal position. (Don’t be surprised to see his face go pale.) Be compassionate, calm his fears that people are going to be out to get him and explain the need for group solidarity in fighting this war. You’ve just encouraged another citizen to keep records of everyone and everything, and you’re probably better off not accepting anything from him till he does anyway.

Cooperation Among Anti-Virus Developers

While I was finishing up SecurityPatrol for publication, some new viruses were discovered that I had not “contracted”. Since I needed to have an actual copy of a virus in order to fingerprint it (see the MacTutor article), I talked to various companies that were working on anti-virus software. I explained a secure arrangement that would allow them to send the viruses safely through MacTutor or the Washington Apple Pi users group. If I listened with my ears, I heard them say “Our lawyers have advised us we would be in a dangerous legal position if we sent anyone a virus.”. But if I listened with my heart and to the tones of their voices, I got the very strong feeling that they didn’t want to help out a magazine article that might undercut their own future profits.

The real reasons behind their non-cooperation are irrelevant. The key points are that non-cooperation exists and that it slows the progress of every one of the commercial product developers. Even if Apple were to work out a virus distribution system to get out copies of newer viruses to developers, there’s still the problem of analysis. What one of them knows about a new virus, they all should know, so that no one’s product is caught by surprise. In other words, we should be fighting the enemy, not one another.

Please understand, I’m not a mawkish ivory-tower-dwelling sophomore who thinks profit is a dirty word. Far from it. Profit is an excellent motive to dedicate people to a task, and security is a task to which I’d like to see many more people dedicate themselves. But I also believe security is a special case that threatens everyone’s profit, and as such, deserves special treatment. The survival of an anti-virus product should be based on approach, cost, ease-of-use, interface, performance, stability, support, upgrades to deal with new viruses, etc, but not on secrecy. Vermin hide in the dark, not in the sunlight.

I might add that Mainstay was the only group that gave me any help to speak of. If you’re undecided among anti-virus products, I think they should be rewarded for their attitude. But no one provided copies of the newer viruses.

As a result, I was unable to finish SecurityPatrol with defenses against the newer viruses in time for publication. My hope was then, as it is now, that MacTutor readers would, when they encountered a new virus, analyze whether its fingerprints vary according to variable data stored in the virus, fingerprint it over its invariant parts and mail the code and fingerprint numbers to MacTutor so that everyone would benefit from their analysis. That would extend cooperation throughout the developer community.

Glorifying the Hero

You can’t blame the press for needing to find something to write about. That’s the situation they’re in. Many virus writers are unconsciously eager to become infamous for the number of people they’ve hurt or angered, and when caught, freely provide interviews citing grandiose motivations, intended to show that they were actually doing the community a service (to get Apple to clean up its act on security, for example). The press should see through such claims which endanger the foundations of their own freedoms:

The 1st Amendment protects the idea by protecting its author. It does not confer unlimited mode of expression. If you express anger in words, in print or in paint on a canvas you bought, you are protected by the 1st Amendment. But if you express anger with fists or bullets, or in paint on the side of someone else’s building, even a government building, you are not. (If virus writers want Apple to clean up their act on security, they should say so, and how to do so, in print, or they should publish application programs that shore up the defenses. Those modes of expression are protected by the 1st Amendment. And in the free exchange of ideas, the stronger ones, possibly their own, will win out.)

We are partly to blame for the press having nothing to write about except bad news. When someone does something good, we don’t issue a press release about it. In effect, we don’t give them anything to write about except bad news. The only time anyone ever issues a good news press release, it’s a vendor touting a new product. (The press is loathe to provide free publicity; vendors are normally expected to pay for publicity.)

But make no mistake. The press is just as eager to print good news if they think it’ll sell, and news about viruses sells big. If you figure out exactly how a virus works or can be detected, produce a detailed description and send it in to a Mac magazine. (MacWEEK is a timely place for such info, and they helped me find people who knew about viruses, so they deserve to be rewarded.) That, friend, is a press release, and it’ll be your name that’ll be printed along with the description, not the name of the person who wrote the virus. You’re the hero, and you deserve recognition for your efforts. If you figure out how to modify SecurityPatrol to detect it, send in the code and fingerprints to MacTutor, and it’ll be your name again.

The popular press also has trouble distinguishing gifted programmers. Their only measures are how many people were affected and how severely. They don’t know that most viruses are written by junior and mid-level programmers who wish to be regarded as senior simply because they’ve figured out how to read Inside Macintosh and Tech Notes. But true seniority in programming reveals itself in the thoughtfulness with which flexible human needs are matched to inflexible machine realities. It’s a kind of maturity that comes from working on many projects, making many people happy and being happy that you made them happy. In other words, senior programmers have a joy of relating to people that virus writers know nothing about. And the popular press doesn’t know it either.

So at the same time as you provide your analysis of the new virus, be sure to point out what a simpleton its programmer was for understanding only the computer, and not even very well. If the virus does something particularly mindless, such as an INIT that installs itself into every file, not just INIT files, say so. If it skips a CODE resource-id number because it lost track of its own counter, say so. If it’s exactly the same as another virus except for a minor variation, say so. And always, always, always point out that its author isn’t fit to lick the dog poop off the boots of the programmers whose programs it infects. Maybe by the time its author is revealed, the press will be less inclined to talk about him as if he’s a genius or to analyze his ideas and motivations in depth as if there’s something there profound to be found.

I sincerely believe that, by shining bright light on all areas of Mac security, opening our eyes wide and paying very close attention to detail, we will create a place where vermin will have no place to hide. Please help.

More on Modula-2

Allen Stenger

Gardena, CA

This letter summarizes my experience with Modula-2 compilers on the Macintosh; it responds to the letter from Thorsten Kramp in the April 1990 MacTutor.

I have used both the SemperSoft compiler and the Metrowerks standalone (PSE) system. The SemperSoft compiler is well-integrated into the MPW environment. It produces good code and runs fairly quickly. (Is SemperSoft still in business? They don’t advertise in MacTutor anymore, and APDA no longer carries the compiler.)

The Metrowerks standalone system is also fairly fast, but produces very peculiar-looking code. Apparently each procedure is called through some sort of jump table. Also the linked applications are very large (100K for a 20-line program); most of this seems to be library routines. There are no MacsBug symbols. The Metrowerks system comes with a very nice symbolic debugger, which allows breakpoints to be set and shows formatted dumps of Macintosh structures. It also allows faster turnaround than the SemperSoft system (the Metrowerks compiler itself is about half as fast, but the link takes almost no time, compared to SemperSoft where you have to go through the slow MPW linker). The SemperSoft system has a few obscure bugs; the Metrowerks system has a few less-obscure bugs. The most annoying Metrowerks bug was that the very nice symbolic debugger refused to work on the program where I really needed it (it turned out that the debugger doesn’t like anchored variables).

For learning and miscellaneous fooling around (which seems to be Mr. Kramp’s need) the Metrowerks system seems to be the better choice. Its bulky object code makes it less attractive than the SemperSoft system for application development.

Metrowerks also makes an MPW version. In addition TML Systems is reported to sell a Modula-2 system. But I have not had experience with any of these, nor have I heard any reports on them.

World Wide Developers Note

Kirk Chase

MacTutor

Just a short note about the World Wide Developer's Conference in San Jose last May. Practically every session the speaker was asking for input from us developers. Apple is making some far reaching changes in the future. Now is a good time to send some feedback through AppleLink.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Live Home 3D Pro 3.2.2 - $69.99
Live Home 3D Pro, a successor of Live Interior 3D, is the powerful yet intuitive home design software that lets you build the house of your dreams right on your Mac. It has every feature of Live Home... Read more
FileZilla 3.27.0.1 - Fast and reliable F...
FileZilla (ported from Windows) is a fast and reliable FTP client and server with lots of useful features and an intuitive interface. Version 3.27.0.1: MSW: Add misssing file to .zip binary package... Read more
Spotify 1.0.59.395. - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
Sierra Cache Cleaner 11.0.6 - Clear cach...
Sierra Cache Cleaner is an award-winning general purpose tool for macOS X. SCC makes system maintenance simple with an easy point-and-click interface to many macOS X functions. Novice and expert... Read more
DiskCatalogMaker 7.1.2 - Catalog your di...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast Finder-like intuitive look and feel Super-fast search algorithm Can compress catalog data for... Read more
Live Home 3D Pro 3.1.2 - $69.99
Live Home 3D Pro, a successor of Live Interior 3D, is the powerful yet intuitive home design software that lets you build the house of your dreams right on your Mac. It has every feature of Live Home... Read more
Deeper 2.2.1 - Enable hidden features in...
Deeper is a personalization utility for macOS which allows you to enable and disable the hidden functions of the Finder, Dock, QuickTime, Safari, iTunes, login window, Spotlight, and many of Apple's... Read more
Pinegrow 3.04 - Mockup and design webpag...
Pinegrow (was Pinegrow Web Designer) is desktop app that lets you mockup and design webpages faster with multi-page editing, CSS and LESS styling, and smart components for Bootstrap, Foundation,... Read more
Deeper 2.2.1 - Enable hidden features in...
Deeper is a personalization utility for macOS which allows you to enable and disable the hidden functions of the Finder, Dock, QuickTime, Safari, iTunes, login window, Spotlight, and many of Apple's... Read more
Spotify 1.0.59.395. - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more

Latest Forum Discussions

See All

The best deals on the App Store this wee...
There are quite a few truly superb games on sale on the App Store this week. If you haven't played some of these, many of which are true classics, now's the time to jump on the bandwagon. Here are the deals you need to know about. [Read more] | Read more »
Realpolitiks Mobile (Games)
Realpolitiks Mobile 1.0 Device: iOS Universal Category: Games Price: $5.99, Version: 1.0 (iTunes) Description: PLEASE NOTE: The game might not work properly on discontinued 1GB of RAM devices (iPhone 5s, iPhone 6, iPhone 6 Plus, iPad... | Read more »
Layton’s Mystery Journey (Games)
Layton’s Mystery Journey 1.0.0 Device: iOS Universal Category: Games Price: $15.99, Version: 1.0.0 (iTunes) Description: THE MUCH-LOVED LAYTON SERIES IS BACK WITH A 10TH ANNIVERSARY INSTALLMENT! Developed by LEVEL-5, LAYTON’S... | Read more »
Full Throttle Remastered (Games)
Full Throttle Remastered 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Originally released by LucasArts in 1995, Full Throttle is a classic graphic adventure game from industry legend Tim... | Read more »
Stunning shooter Morphite gets a new tra...
Morphite is officially landing on iOS in September. The game looks like the space shooter we've been needing on mobile, and we're going to see if it fits the bill quite shortly. The game's a collaborative effort between Blowfish Studios, We're Five... | Read more »
Layton's Mystery Journey arrives to...
As you might recall, Layton's Mystery Journey is headed to iOS and Android -- tomorrow! To celebrate the impending launch, Level-5's released a new trailer, complete with an adorable hamster. [Read more] | Read more »
Sidewords (Games)
Sidewords 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Grab a cup of coffee and relax with Sidewords. Sidewords is part logic puzzle, part word game, all original. No timers. No... | Read more »
Noodlecake Games' 'Leap On!...
Noodlecake Games is always good for some light-hearted arcade fun, and its latest project, Leap On! could carry on that tradition. It's a bit like high stakes tetherball in a way. Your job is to guide a cute little blob around a series of floating... | Read more »
RuneScape goes mobile later this year
Yes, RuneScape still exists. In fact, it's coming to iOS and Android in just a few short months. Jagex, creators of the hit fantasy MMORPG of yesteryear, is releasing RuneScape Mobile and Old School RuneScape for mobile devices, complete with... | Read more »
Crash of Cars wants you to capture the c...
Crash of Cars is going full on medieval in its latest update, introducing castles and all manner of new cars and skins fresh from the Dark Ages. The update introduces a new castle-themed map (complete with catapults) and a gladiator-style battle... | Read more »

Price Scanner via MacPrices.net

Save or Share
FotoJet Designer, is a simple but powerful new graphic design apps available on both Mac and Windows. With FotoJet Designer’s 900+ templates, thousands of resources, and powerful editing tools you... Read more
Logo Maker Shop iOS App Lets Businesses Get C...
A newly released app is designed to help business owners to get creative with their branding by designing their own logos. With more than 1,000 editable templates, Logo Maker Shop 1.0 provides the... Read more
Sale! New 15-inch MacBook Pros for up to $150...
Amazon has the new 2017 15″ MacBook Pros on sale for up to $150 off MSRP including free shipping: – 15″ 2.8GHz MacBook Pro Space Gray: $2249 $150 off MSRP – 15″ 2.89Hz MacBook Pro Space Gray: $2779 $... Read more
DEVONthink To Go 2.1.7 For iOS Brings Usabili...
DEVONtechnologies has updated DEVONthink To Go, the iOS companion to DEVONthink for Mac, with enhancements and bug fixes. Version 2.1.7 adds an option to clear the Global Inbox and makes the grid... Read more
15-inch 2.2GHz Retina MacBook Pro, Apple refu...
Apple has Certified Refurbished 2015 15″ 2.2GHz Retina MacBook Pros available for $1699. That’s $300 off MSRP, and it’s the lowest price available for a 15″ MacBook Pro. An Apple one-year warranty is... Read more
13-inch 2.3GHz Silver MacBook Pro on sale for...
B&H Photo has the new 2017 13″ 2.3GHz/256GB Silver MacBook Pro (MPXU2LL/A) on sale for $1399 including free shipping plus NY & NJ sales tax only. Their price is $100 off MSRP. Read more
Apple Tackles Distracted Driving With iOS 11...
One of the most important new features coming in iOS 11 is Do Not Disturb while driving, intended to help drivers stay more focused on the road. With Do Not Disturb while driving, your iPhone can... Read more
iMazing Mini for Mac: Free Automatic and Priv...
Geneva, Switzerland-based indie developer DigiDNA has released iMazing Mini, their free macOS utility designed to automatically back up iOS devices over any local Wi-Fi network. The app offers users... Read more
Clearance 2016 13-inch MacBook Airs, Apple re...
Apple dropped prices recently on Certified Refurbished 2016 13″ MacBook Airs, with models now available starting at $809. An Apple one-year warranty is included with each MacBook, and shipping is... Read more
9.7-inch 2017 iPads available for $299, save...
B&H Photo has 2017 9.7″ 32GB WiFi iPads on sale for $30 off MSRP for a limited time. Shipping is free, and pay sales tax in NY & NJ only: – 32GB iPad WiFi: $299, $30 off Read more

Jobs Board

*Apple* Retail - Multiple Positions - Apple...
SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
*Apple* Retail - Multiple Positions - Apple...
SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
Senior Payments Architect - *Apple* Pay - A...
Changing the world is all in a day's work at Apple . If you love innovation, here's your chance to make a career of it. You'll work hard. But the job comes with more Read more
Frameworks Engineering Manager, *Apple* Wat...
Frameworks Engineering Manager, Apple Watch Job Number: 41632321 Santa Clara Valley, California, United States Posted: Jun. 15, 2017 Weekly Hours: 40.00 Job Summary Read more
Manager, *Apple* Media Products - Apple Inc...
Job Summary The Apple Media Products Discovery, Fraud and Abuse team is responsible for protecting the integrity of Apple services. As a manager of the team, you Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.