1.6 Typical Examples of Viruses and Trojans
71
password again. The user assumes that an error has occurred and re-enters login
and password. After that, the user successfully logs in and proceeds with the
work as usual. Some malicious logic operating according to this scheme, before
finishing their work display a plausible error message on the screen, for example:
“Your password was entered incorrectly. Try again.”
2. Password crackers of the second-type intercept all data entered by the user from
the keyboard. The simplest malicious logic of this type saves all this data on the
computer hard drive or drops it in any other place accessible to the attacker. More
advanced malicious logic analyzes the obtained data and filters out information
unrelated to passwords. This malicious logic is resident programs intercepting
one or more interrupts used while working with the keyboard. Information about
the key pressed and the character entered, returned by these interrupts, is used
by malicious logic for its own purposes.
3. Password crackers of the third type include malicious logic completely or
partially replacing the authentication subsystem of the protected system. Since
the task of creating malicious logic is much more complicated than the task of
creating password crackers of the first two types, this class of malicious logic has
appeared quite recently. Hence, we shall consider the possibility of maliciously
affecting the subsystems of identification and authentication of users logging in
the system merely hypothetical.
Joke Programs
Programs of this group do not cause any direct harm to the computer; however, they
report that such harm has already been caused or will be caused under some conditions or warn the user about a nonexistent danger. Bad jokes include, among others,
programs that frighten the user with disk formatting warnings (although no formatting
actually occurs), detect viruses in clean files (the notorious ANTITIME program),
display strange virus-like messages (CMD640X disk driver from a commercial
package), etc.—depending on the author’s sense of humor. Apparently, the string
“CHOLEEPA” existing on sector 2 of Seagate hard drives is also a “bad joke.”
Deliberately false reports of new superviruses can be attributed to the same category. Every now and then, such messages appear in electronic conferences and cause
panic among users.
1.6.4 Neutralizers of Tests and Code Analysis Software
One of the ways to counteract the threats posed by malicious logic is to check the
programs used in information systems for critical infrastructure management during
certification tests and case studies on security requirements [33, 34].
71
password again. The user assumes that an error has occurred and re-enters login
and password. After that, the user successfully logs in and proceeds with the
work as usual. Some malicious logic operating according to this scheme, before
finishing their work display a plausible error message on the screen, for example:
“Your password was entered incorrectly. Try again.”
2. Password crackers of the second-type intercept all data entered by the user from
the keyboard. The simplest malicious logic of this type saves all this data on the
computer hard drive or drops it in any other place accessible to the attacker. More
advanced malicious logic analyzes the obtained data and filters out information
unrelated to passwords. This malicious logic is resident programs intercepting
one or more interrupts used while working with the keyboard. Information about
the key pressed and the character entered, returned by these interrupts, is used
by malicious logic for its own purposes.
3. Password crackers of the third type include malicious logic completely or
partially replacing the authentication subsystem of the protected system. Since
the task of creating malicious logic is much more complicated than the task of
creating password crackers of the first two types, this class of malicious logic has
appeared quite recently. Hence, we shall consider the possibility of maliciously
affecting the subsystems of identification and authentication of users logging in
the system merely hypothetical.
Joke Programs
Programs of this group do not cause any direct harm to the computer; however, they
report that such harm has already been caused or will be caused under some conditions or warn the user about a nonexistent danger. Bad jokes include, among others,
programs that frighten the user with disk formatting warnings (although no formatting
actually occurs), detect viruses in clean files (the notorious ANTITIME program),
display strange virus-like messages (CMD640X disk driver from a commercial
package), etc.—depending on the author’s sense of humor. Apparently, the string
“CHOLEEPA” existing on sector 2 of Seagate hard drives is also a “bad joke.”
Deliberately false reports of new superviruses can be attributed to the same category. Every now and then, such messages appear in electronic conferences and cause
panic among users.
1.6.4 Neutralizers of Tests and Code Analysis Software
One of the ways to counteract the threats posed by malicious logic is to check the
programs used in information systems for critical infrastructure management during
certification tests and case studies on security requirements [33, 34].