Re: Bliss virius

Seth M. Landsman (seth@cs.brandeis.edu)
Mon, 10 Feb 1997 11:05:32 -0500 (EST)


On Sat, 8 Feb 1997, Timothy Peters wrote:

> I have one or two idears on this
>
> a) add a patch to the a.out of elf loader that can detect if the virus
> is present and prevent it from running

That stinks of kernel bloat ... What if, under Windows or DOS,
everytime you ran an executable, McAfee's automagically came up and ran a
scan. Perhaps having such a thing specifically for BLISS wouldn't be bad,
but what happens when there are a thousand virii for Linux? Remember that
BLISS is only a proof of concept, it shows that Linux virii *CAN* exist.
Now that this is out, there will be a hundred by April, a thousand by next
year. This is a bad precedent to set ...

> b) develope a free virus scanner for linux that can detect viri like
> bliss and allert the operator
>
> c)stress the need for good security

Much better alternatives. McAfee has one, but it chokes when you
run it from / recursively, b/c it doesn't play well with symlinks ...

\begin{SOAPBOX}
What it comes down to is the lack of security. A unix operating
system is very, very secure if it is maintained correctly to be secure.
Too many people believe they are secure b/c they are running a unix
operating system, even though they are always logged in as root and don't
know what 'sudo' does ...
\end{SOAPBOX}

-Seth

-----------------------------------------------------------------------
|"We pray for one last landing, | Seth M. Landsman |
| On the globe that gave us birth. | Dept. of Computer Science |
| Let us rest our eyes on fleecy skies,| Brandeis University |
| And the cool, Green Hills of Earth" | |
| -Green Hills of Earth | "I'm in ninteenth grade!" |
| RAH | |
-----------------------------------------------------------------------
| "Artificial Intelligence usually beats real stupidity" |
-----------------------------------------------------------------------
| "Someday I want an office with walls" |
-----------------------------------------------------------------------