122
2 Computer Viruses, Malicious Logic, and Spyware
data exchange is created in this system, which usually remains unnoticed by system
administrators for a long time. Nearly, all known implants used by various intruders
at different times were found either due to errors made during the programming
phase or by accident solely.
If an implant is properly written, it is extremely difficult to discover it by standard
administration features after its penetration into the system; therefore, it can function
for an unlimited time, and the intruder will have nearly unlimited access to system
resources during this time.
Implants can damage both separate users and companies and entire states—for
example, by jeopardizing defensive capacity of a country.
Let us consider a simple example—the military conflict in the Persian Gulf. During
execution of the Desert Storm Operation by multinational forces, Iraqi air defence
system turned out to be blocked due to an unknown reason. As a result, the Iraqi side
was forced to leave bombing attacks on its territory unanswered. Experts believe that
the computers included in the complex of technical means of the air defense system
purchased by Iraq from France contained specially controlled implants that blocked
the operation of the computing system.
There are three main groups of destructive actions that can be performed by
software implants:
• Copying information of a computer system user (passwords, cryptographic keys,
access codes, confidential electronic documents) stored in the random access
or external memory of this system or in memory of another computer system
connected via local or global computer network;
• Changing functioning algorithms of system, applied, and service software (for
example, introducing changes in the access control program can result in this
program allowing all users regardless of correctness of the password to enter the
system);
• Imposing certain modes of operation (for example, blocking writing to disk when
deleting information; the “deleted” information in this case is not destroyed and
can subsequently be copied by the hacker).
2.2.3 Classifications of Software Implants
There are different classifications of software implants (Trojan programs). Let us
consider the most popular ones.
Software implants can be classified based on the method of their introduction to
the computer system:
• Firmware implants associated with hardware means of the computer (they are
usually found in BIOS—the set of programs written in the ROM as machine
code);
• Loading implants associated with bootstrap loading programs, which are found in
the loading sectors (during bootstrap loading, the computer reads a program from
2 Computer Viruses, Malicious Logic, and Spyware
data exchange is created in this system, which usually remains unnoticed by system
administrators for a long time. Nearly, all known implants used by various intruders
at different times were found either due to errors made during the programming
phase or by accident solely.
If an implant is properly written, it is extremely difficult to discover it by standard
administration features after its penetration into the system; therefore, it can function
for an unlimited time, and the intruder will have nearly unlimited access to system
resources during this time.
Implants can damage both separate users and companies and entire states—for
example, by jeopardizing defensive capacity of a country.
Let us consider a simple example—the military conflict in the Persian Gulf. During
execution of the Desert Storm Operation by multinational forces, Iraqi air defence
system turned out to be blocked due to an unknown reason. As a result, the Iraqi side
was forced to leave bombing attacks on its territory unanswered. Experts believe that
the computers included in the complex of technical means of the air defense system
purchased by Iraq from France contained specially controlled implants that blocked
the operation of the computing system.
There are three main groups of destructive actions that can be performed by
software implants:
• Copying information of a computer system user (passwords, cryptographic keys,
access codes, confidential electronic documents) stored in the random access
or external memory of this system or in memory of another computer system
connected via local or global computer network;
• Changing functioning algorithms of system, applied, and service software (for
example, introducing changes in the access control program can result in this
program allowing all users regardless of correctness of the password to enter the
system);
• Imposing certain modes of operation (for example, blocking writing to disk when
deleting information; the “deleted” information in this case is not destroyed and
can subsequently be copied by the hacker).
2.2.3 Classifications of Software Implants
There are different classifications of software implants (Trojan programs). Let us
consider the most popular ones.
Software implants can be classified based on the method of their introduction to
the computer system:
• Firmware implants associated with hardware means of the computer (they are
usually found in BIOS—the set of programs written in the ROM as machine
code);
• Loading implants associated with bootstrap loading programs, which are found in
the loading sectors (during bootstrap loading, the computer reads a program from