Re: Virus or Worm ??

On Monday, September 8, 2003 at 2:27:19 AM UTC-7, cquirke wrote:
> >On Tue, 2 Sep 2003 18:04:28 +0000 (UTC), John Carroll
> >>Apologies to all you learned folk out there for this very simplistic
> >>question - what is the differnce between a virus and a worm [besides
> >>you can't fish with a virus :-)].
> The first point to make is that these terms are no longer useful as
> generic hand-basket nouns, though still relevant as adjectives. The
> reason is that modern malware written in higher-level languages
> typically combine multiple penetrative behaviours.
> See http://users.iafrica.com/c/cq/cquirke/malware.htm and
> http://users.iafrica.com/c/cq/cquirke/safe2000.htm for coverage of
> these.
> All code is interpreted, whether it be raw code, scripts, or "safe"
> data that happens to break through an "unchecked buffer". Raw code
> that is interpreted in hardware is generally referred to as being
> executed. In each case, the interpreter is the (initial) environment
> that the code runs in, and places limits on what the code can do -
> limits that can often be escaped either through flaws in the
> interpreter, or as a series of escalation strategies that fall within
> the intended design (if not intention) of the interpreter.
> Viral behavior involves infecting an existing structure with the
> malware code, so that the structure becomes a stealth vehicle for the
> propagation of the malware. File viruses infect files, be they raw
> code, macro-capable "documents" (Office, HTML), or email messages
> enjoying similar exploitability thanks to running of scripts. Boot
> viruses infect pre-file-system boot code and spread via disks.
> Infoshphere viruses infect components of the infosphere such as
> individual PCs (e.g. Kazaa shared directories).
> Worms don't just sit inside objects and wait to be carried when the
> object is transported - they initiate their transmission directly.
> The purest worms may never exist as files at all, merely flitting
> across the infosphere as a series on in-RAM tasks that spread through
> broken network code to other systems in the network.
> Trojans appear to be useful or desirable and are either downloaded on
> that basis. Various Kazaa bait, the famous old PKZIP300.EXE and
> others, and incoming emaul attackments purporting to be MS security
> patches or kewl screensavers are using the trojan concept as Social
> Engineering (SE) to encourage spread, while most malware that exist as
> pure malware files (as opposed to in-memory worm processes or viral
> code embedded in "real" files) try to masquerade as files that should
> be there, with names like WinSys32.exe and so on.
> Many modern malware do all of these things. Melissa could be called a
> virus because if infects Word documents and thus spreads with "real"
> files that cannot be spotted through out-guessing attempts at SE.
> Melissa could be called a worm because it initiates spread by
> automating Outbreak to send itself out. 
> Most modern malware aren't really viruses in the sense that they
> infect existing files; rather, they worm themselves out as pure
> malware files, relying on trojan SE to gain acceptance (or breaking
> through software defects without the need for user to be SE'd). But
> they may use multiple propagation strategies; p2p networks, chat,
> email, etc. so that it's better to use "malware" as a generic term.
> 
> >--------------- ----- ---- --- -- - - -
> Error Messages Are Your Friends
> >--------------- ----- ---- --- -- - - -
nice