Alex Rivera | Logout

How to recognize malicious source code?

Asked 2009-09-06T17:57:14.740
11

BE AWARE! Creating spyware, computer viruses and similar nasties can be illegal where you live and is considered extremely unethical by almost everyone. Still, I need to ask this to raise awareness about how easy it is to create one. I am asking this after the W32/Induc-A was introduced to this world by someone who came up with a nasty way to spread one. So I want to know how a virus can be created so I will be able to recognise them in the future!

Recently a new virus was discovered which spreads itself by replacing the developers' copies of library code. Actually, through the source code of Delphi 4 through 7. What happened is that there's a virus in the wild which searches the computer for a file called SYSCONST.PAS, to which it will add itself as source code. This file happens to be a source file for the runtime libraries of Delphi. (This runtime source code is available for Delphi developers.) As a result, after being infected a programmer would create lots of new versions of this virus without even knowing it. Since virus scanners sometimes generate false positives many developers might thus decide to ignore the warnings of the scanner and maybe they'll even disable their scanner while building their project. To make it worse, their project might even trigger the scanners of their customers so it's likely that those programmers won't check their source code but will just try to fool the scanner somehow. That is, if a virus scanner is even able to recognise the virus, which isn't very likely. Thus, we software developers might be creating viruses without realizing what we're doing!

So, how to create a virus? Simple: get your source code infected by a virus and you're done!

Okay, so the source code of Delphi 4 through 7 might be infected. All Delphi developers, please check your source files! The case is j

delphi open-source virus
Edit
Report

2 Answers

8

While this does not really answer your question, I think a really interesting paper to read is Reflections on Trusting Trust by Ken Thompson. It raises a fascinating point that even if your source code is free of defects (viruses, trojans, etc.), you might still be producing defective executables if your compiler is defective. And even if you rebuild the compiler from clean source code, you can still have the same problem.

Unless you're building your computer from the ground up with your own microchips, hand-assembling your own BIOS, writing your own operating system, compiler, and software, you have to draw the line somewhere and trust that the hardware and software upon which you're building your systems are correct.

answered 2009-09-06T18:46:19.057
4

If you want to recognize malware, you must know how it works. This means researching malware and aquirering the skill to produce malware.

  • search for 29A - they wrote papers on virus
  • read about rootkits (there are even books on it)
  • read about reverse engineering
  • read source code of malware - there's plenty of it in the web.
  • learn assembler
  • learn about your OS
  • reverse the os-kernel
  • get clam-av, check the source

I won't provide links here. They are easily found though.

answered 2009-09-07T08:33:58.713

Your Answer