144
2 Computer Viruses, Malicious Logic, and Spyware
2.3 Models of Influence of Software Implants
on Computers, Introduction Methods, and Interaction
with Intruders
2.3.1 Models of Impact of Software Implants on Computers
Let us consider six most popular models of impact of software implants on computers
[1]:
• Interception;
• Trojan;
• Watchdog;
• Compromising;
• Distortion or error initiation;
• Scavenging.
1. Interception model
Program implant is installed (implemented) in the ROM, operating system, or application software and saves all or selected fragments of the input or output data in a
hidden area of local or remote direct access external memory. The data saved can
include keyboard input, printed documents, or destroyed files. This model is characterized by presence of the space for information storage in the external memory,
the organization of which needs to ensure its preservation during the given period of
time, and the possibility of its subsequent removal. It is also important for the saved
information to be somehow hidden from legal users.
2. Trojan Horse model
Such implant is embedded in constantly used software and after a certain activating
event models a failure on information storage media or in the computer (network)
equipment. Thus, two goals can be achieved: first, normal operation of the computer
system will be paralyzed; second, the intruder (e.g., disguised as maintenance or
repair specialist) can familiarize himself with information stored in the system or
accumulated using the interception model. An event that activates an implant may
be a moment in time, a signal from a modem communication channel (explicit
or disguised), or the state of some counters (for example, the number of program
launches).
3. Watchdog model
These implants are built into network or telecommunication software. Using the
fact that this software is normally active at all times, the implant controls the data
processing on this computer, installation and deletion of implants, and extraction
of the accumulated information. The implant can initiate events for previously
introduced implants employing the Trojan model.
2 Computer Viruses, Malicious Logic, and Spyware
2.3 Models of Influence of Software Implants
on Computers, Introduction Methods, and Interaction
with Intruders
2.3.1 Models of Impact of Software Implants on Computers
Let us consider six most popular models of impact of software implants on computers
[1]:
• Interception;
• Trojan;
• Watchdog;
• Compromising;
• Distortion or error initiation;
• Scavenging.
1. Interception model
Program implant is installed (implemented) in the ROM, operating system, or application software and saves all or selected fragments of the input or output data in a
hidden area of local or remote direct access external memory. The data saved can
include keyboard input, printed documents, or destroyed files. This model is characterized by presence of the space for information storage in the external memory,
the organization of which needs to ensure its preservation during the given period of
time, and the possibility of its subsequent removal. It is also important for the saved
information to be somehow hidden from legal users.
2. Trojan Horse model
Such implant is embedded in constantly used software and after a certain activating
event models a failure on information storage media or in the computer (network)
equipment. Thus, two goals can be achieved: first, normal operation of the computer
system will be paralyzed; second, the intruder (e.g., disguised as maintenance or
repair specialist) can familiarize himself with information stored in the system or
accumulated using the interception model. An event that activates an implant may
be a moment in time, a signal from a modem communication channel (explicit
or disguised), or the state of some counters (for example, the number of program
launches).
3. Watchdog model
These implants are built into network or telecommunication software. Using the
fact that this software is normally active at all times, the implant controls the data
processing on this computer, installation and deletion of implants, and extraction
of the accumulated information. The implant can initiate events for previously
introduced implants employing the Trojan model.