Subject: Re: BCP suggestion, port 25 control RE: [Asrg] BCP suggestion: port-b locking by ISPs

From: Fridrik Skulason <[email-masked]>
Date: Tue, 14 Dec 2004 13:23:15 +0000

>   I've sometime wondered about that - would it be possible to use 
> viruses to fight viruses? 

It is possible.  It has been done.  It hasn't worked.

My favourite example is the Denzuko virus - an old boot sector virus
written in Bandung, Indonesia back in...uhm 1989 or so.  It was designed
to locate and remove the Stoned virus, replacing it with a copy of
itself.  This virus only infected 5.25" floppies with 40 tracks,
numbered 0..39, and it would format track 40 and place the original boot
sector and the rest of itself there.

Eveything worked fine....until the apperance of 3.5" floppies, which had
80 tracks.  Then the virus would reformat a track in the middle of the 
disk, changing from a mostly harmless anti-virus virus into a destructive
one.

Another reason why this is a bad idea is the legal one - the law does
not distinguish between harmless and "not-so-harmless" viruses when it
comes to the issue of legality of virus writing.

There is also the slight problem that anti-virus software would have to
find the anti-virus virus as well as any regular one.

Finally there is the ethical side - and the bottome line there is simply
that this is unacceptable behaviour.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email-masked]       fax:   +354-540-7401

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Gadi Evron <[email-masked]>
Date: Tue, 14 Dec 2004 22:19:27 +0200

> that this is unacceptable behaviour.

And a couple of things you did not mention..

Putting aside the ethical issues (just for a short moment) there is also 
the issue of a virus still being malicious software. Why? Not getting 
into term and definition arguments - it does something that the user did 
not ask for, on the user's machine.

Say we don't care... controlling replication of malicious code is 
extremely difficult. When attempted before, it caused the falling of 
entire networks, just last year.

Also.. who said viruses are bug free or well written? A programming 
error of some sort.. say.. even a buffer overflow could be disastrous.

And how the heck is someone REALLY supposed to control how, when and 
where a single sample spreads. It never worked. It has been attempted 
more than just a few times.

Add to that the fact that it doesn't actually solve the problem, and you 
still haven't covered everything of why it is a bad thing.

Back to ethical - writing viruses is simply a no-no.

	Gadi.