By 1990, it was no longer a matter of running a couple of dozen search strings down each file. Mark Washburn had taken the Vienna virus, and created the first polymorphic virus from it. We didn’t use that word at first, but the idea of his viruses (1260, V2P1, V2P2 and V2P6) was that the whole virus would be variably encrypted, and there would be a decryptor at the start of the virus. But the decryptor could take a very wide number of forms, and in the first few viruses, the longest possible search string was just two bytes long (V2P6 got this down to one byte). To detect this virus, it was necessary to write an algorithm that would apply logical tests to the file, and decide whether the bytes it was looking at were one of the possible decryptors.
One consequence of this, was that some vendors couldn’t do this. It isn’t easy to write such an algorithm, and many vendors were, by this time, relying on search strings extracted by someone else. The three main sources of search strings were a newsletter called Virus Bulletin, the IBM scanner, and reverse engineering a competitor’s product. But you can’t detect a polymorphic virus this way (indeed, two years after these viruses were published, many products are [were] still incapable of detecting these viruses). Washburn also published his source code, which is now widely available. At the time, we thought that this would bring out a number of imitators; in practice, no-one seems to be using Washburn’s code. However, plenty of virus authors are using his idea.
Another consequence of polymorphic viruses, was an increase in the false alarm rate. If you write code to detect something that has as many possibilities as V2P6, then there is a chance that you will flag an innocent file, and that chance is much greater than with the sort of virus that you can find with a 24-byte scan string. A false alarm can be as much hassle to the user as a real virus, as he will put all his anti-virus procedures into action.
Also, in 1990, we saw a number of virus coming out of Bulgaria, especially from someone who called himself “Dark Avenger.” The Dark Avenger viruses introduced two new ideas. The first idea was the “Fast infector”; with these viruses, if the virus is in memory, then simply opening a file for reading, triggers the virus infection. The entire hard disk is very soon infected. The second idea in this virus, was that of subtle damage. Dark Avenger-1800 occasionally overwrites a sector on the hard disk. If this isn’t noticed for a period of time, the corrupted files are backed up, and when the backup is restored, the data is still no good. Dark Avenger targets backups, not just data. Other viruses came from the same source, such as the Number-of-the-Beast (stealth in a file virus) and Nomenklatura (with an even nastier payload than Dark Avenger).
Also, Dark Avenger was more creative about distributing his viruses. He would upload them to BBSes, infecting shareware anti-virus programs, together with a documentation file that gave reassurance to anyone who checked the file size and checksums. He uploaded his source code also, so that people could learn how to write viruses.
In 1990, another event happened in Bulgaria – the first virus exchange BBS. The idea was that if you uploaded a virus, you could download a virus, and if you uploaded a new virus, you were given full access. This, of course, encourages the creation of new viruses, and gets viruses into wider circulation. Also, the VX BBS offered source code, which makes the technology of writing a virus more widely available.
In the second half of 1990, the Whale appeared. Whale was a very large, and very complex virus. It didn’t do very much; mostly, it crashed the computer when you tried to run it. But it was an exercise in complexity and obfuscation, and it arrived in virus author’s hands like a crossword puzzle to be solved. Some virus researchers wasted weeks unraveling Whale, although in practice you could detect it with a couple of dozen search strings, and you didn’t really need to do any more, as the thing was too clumsy to work anyway. But because it was so large and complex, it achieved fame.
At the end of 1990, the anti-virus people saw that they had to get more organised; they had to be at least as organised as the virus authors. So EICAR (European Institute for Computer Antivirus Research) was born in Hamburg, in December 1990. This gave a very useful forum for the anti-virus researchers and vendors to meet and exchange ideas (and specimens), and to encourage the authorities to try to prosecute virus authors more vigorously. At the time that EICAR was founded, there were about 150 viruses, and the Bulgarian “Virus factory” was in full swing.
The information in this section was provided by and used with permission of Dr. Solomon Software. Please do not further use the material without obtaining your own permission to use it.
 Dr Solomon History |
|
 |
 |
| 1989 Datacrime | 1991 Product Launches and Polymorphism |