From: joe_n_turner@amoco.com
Date: Thu, 1 Feb 1996 09:34:26 +0800
To: PADGETT@hobbes.orl.mmc.com
Subject: re: More FUD
In-Reply-To: <960131174331.202083b0@hobbes.orl.mmc.com>
Message-ID: <199602010014.AA04925@interlock.amoco.com>
MIME-Version: 1.0
Content-Type: text/plain


Author:  owner-cypherpunks at unix,sh/dd.RFC-822=owner-cypherpunks\@toad\.com
Date:    1/31/96  4:43 PM

Your comments intrigued me, but unfortunately I have to disagree with you on 
several points.
    
>>The degree to which the attack you describe is a threat to online 
>>commerce depends critically on the degree to which viruses and Trojan 
>>horse programs can propagate through their potential base of platforms. 
     
>Have to interject a comment: even real professionals (which virus writers 
>are not) have trouble getting software to work on on machine, let alone 
>all of the different platforms out there. Windows is worse (ever try to 
>write a .VXD - not easy). Take Michelangelo (please) is a member of a 
>class of viruses the is very difficult to detect: you have to read one 
>word at 0:414 from DOS to know something is wrong.

"real professionals?"  You mean the kind that take meetings to avoid work and 
leave the office by 5:00?  As far as "virus writers" there are relatively few 
that I would lump into that category, but the ones who do get there are worthy 
of at least a little respect.  Most are of the 
VCL-cut-and-paste-upload-it-and-see-who-complains variety.

I have never written a virtual device driver for windows, but I have written 
kernel device drivers for Windows NT, and some nifty driver and TSR code for 
MS-DOS.  I have (and still do) collect viruses.  Its been fun, and it also makes
me a teeny-tiny bit more employable.  
     
>True, in early '92 when [Mich] came out things were more difficult - not 
>everyone had 640k in their machine so the user acurally had to have a clue 
>how much memory was supposed to be there. Today is there anyone with 512k ?

If my memory serves me correctly, by '92 386's were rolling off the assembly 
lines.  Getting extended memory cards was still easy but they were getting more 
and more scarce as expanded memory became the rage.  A lot people did have 640k.

>Detection has *always* been easy, it is removal that is difficult and 
>*automated* removal that is even more so - know what it takes to determine 
>that there is a macro that might be a virus in a WORD document ? One bit. 
>(Of course things are made a bit more difficult by the fact that MicroSoft 
>considers that bit's location or even its *existance* to be "proprietary" 
>and requires an NDA before they will discuss it - I refuse to sign it).

Maybe you should use WordPerfect instead.  

>In recent months I have had all sorts of software blow up in Windows. 
>On this machine alone (a 486DX-100 w 8 Mb of RAM & Win 3.1, 1 Mb SVGA
>and nothing special), Reachout 5.0, FTP Onnet 2.0, QEMM 8.0 (Windows Manager), 
>and several name brand programs  have required massage to get to play 
>together - and these are the programs from people I consider expert at what 
>they do, in fact each is IMNSHO the best in their class.

Solution: Get rid of Windows.  Upgrade to '95, NT, or go to Linux, even OS/2. 

>And you tell me that someone is going to spread a virus on the net that will 
>capture keystrokes on any machine it hits without anyone noticing ? It is 
>to laugh (and if they can, they are wasting their time with credit card 
>numbers).

        This sounds like a challange.  Is it worth a T-Shirt?

[...snip...]

>Not going to say you could not make one machine act that way - that is easy, 
>not even going to say you won't make a number of machines act that way, but 
>spread with a virus enough will self-destruct on enough machines that 
>intelligent people will get suspicious and some will react creatively.
     
Not if it is written properly.  A lot of viruses become known only when they 
drop their payload.  Others are just poorly written, no different from a bad 
software product.

>Fact is that the greatest protection the net has is that no two machines are 
>alike, may even start that way but after six months, no way.

Ahhhhh.. but your wrong.  Granted, the underlying strata may be radically 
different, but I can run an MS-DOS program on an 300 Mhz DEC Alpha (under NT) 
without any problems (except I couldn't get DOOM to run).  There is already a 
read-only Filesystem driver for Linux that will read NT.  Like TCP/IP, the 
operating systems are going towards interoperability.

The big computer companies recognize that they have to compete to survive.  No 
longer can IBM design a machine and lock in their customers to IBM parts, IBM 
service, and an IBM operating system.
     
>                                                Warmly,
>                                                        Padgett