Slashdot Mirror

← Back to Stories (view on slashdot.org)

First (proof-of-concept) .NET virus

Posted by ryuzaki0 on from the guess-that-isn't-surprising dept.

Juergen Kreileder writes "Symantec says they've received W32.Donut, the first .NET virus: 'This virus targets EXE files that were created for the Microsoft .NET framework. W32.Donut is a concept virus. It does not have any significant chance to become wide spread. However it shows that virus writers are paying close attention to the new .NET architecture and attempting to learn how to exploit it before the Framework will be available on most systems.'"

5 of 384 comments (clear)

  1. The virus. by miguel · · Score: 5, Insightful

    Well, this virus really does not do anything interesting. .NET as any other complete programming environment will allow you to create replicating code (oh big surprise).

    These kind of virus programs will probably not succeed in the NT world with user permissions or in any system with per-user permissions (Linux). Although theoretically possible (root runs the virus) in practice this kind of virus programs never succeed on the wild due to this kind of security mechanisms.

    For .NET "applets" or any other .NET code that is downloaded from the network and executed, the virus would throw an exception because it would not have permission to touch your file system.

  2. Virus Check every SWF, etc? by gmhowell · · Score: 5, Insightful

    Do virus checkers currently check SWF, java, etc files that are downloaded through web browsers?

    It seems that while everyone says we have 'more than enough processing power' it is going to be sucked up by virus scanners and "do you want to run this" pop-up boxes.

    Except of course (for now) on Linux.

    A side point: everyone says "don't run as root, only run as a regular user". Sure. No problem. But suppose I run as a regular user, and get some virus/trojan/whatever. I've got a lot of stuff in my home directory. In fact, I'll even say that it's easier to replace / than /home/*. Are people doing development work under one account, reading email in another, browsing the web in a third, and ripping CD's in a fourth account? Didn't think so. And for that reason, sooner or later, we need more helpful Linux virus solutions than "don't run as root".

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
    1. Re:Virus Check every SWF, etc? by zulux · · Score: 5, Insightful

      In fact, I'll even say that it's easier to replace / than /home/*.

      This is the crux of the mater! /home/* has all of my carfully handmade files. The rest of the tree is all GPL/BSD stuff that I can get off the net and have reinstalled in under an hour. Trash my /usr/local/bin directory and I really won't cry. Trash my /home/posgres directory and I'll loose my billable hours for today.

      If anything Unix needs to push it over the top as far as a secure server operating systems is the ability to tell the OS that "This File can never be deleted and can only be appended to by Postmaster. Forever. No matter what. Even if I want to get rid of it later." If I could give my clints that, they would jump to UNIX no matter what hurdels thay had to jump - they have lost too many Outlook folders and too many database tables due to the insecurity of Windows. They would RUN to Unix.

      Just me and my rambelings. And yes I know about backups and rsyncing from a locked down OpenBSD box.

      --

      Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.

    2. Re:Virus Check every SWF, etc? by Jason+Earl · · Score: 5, Insightful

      Imagine you are a virus. Now tell me how exactly are you going to spread using the stuff found in your home directory. Viruses spread by attaching themselves to executables, but I don't have any executables in my home directory, and if I did there is almost no chance that some other user is going to run them. If by some amazing obscure fluke I did have some binaries in my home directory, and I just so happened to mail one of those infected binaries to a friend, even if my friend did run this binary the virus is stuck with the same low chances for infection. It can only infect files that my friend has read access to, and it can only carry out tasks that my friend has permission to do.

      In other words such a beast has almost no chance of actually spreading.

      Now, someone could send you a malicious email attachment. Something along the lines of:

      #!/bin/sh
      rm -rf ~/

      Of course, this sort of binary has very little chance of getting run. After all, there isn't an email client for Linux that I am aware of that would make this sort of attachment easy to run. You would have to save it to your home directory, set the executable bit, and then run it.

      And even if you did run it, how would it spread. It might try and email itself to everyone in your address book, but Linux doesn't have a default address book, nor is it likely to ever have one. Some folks use mutt, others use Pine, Evolution has it's own format, as does Aethera, and for folks like me that use Emacs to read our mail there are several possible places to put our address book.

      Windows has a ton of viruses for four basic reasons:

      1) There are no sensible file permissions. Users can write to system files.

      2) Microsoft has made it easy to do some incredibly stupid things. For example, getting the contents of your address book is dead simple.

      3) Microsoft has blended the line between executable content and data. Double clicking on an icon can either launch a program or open a document. Some documents (like MS Word files) can even contain executable content with full access to your system.

      4) Microsoft is a ubiquitous mono-culture. A Microsoft exploit has plenty of susceptible victims, making it easier for viruses to spread. Even if someone did write a Linux mail virus, the chance of it working on both my Emacs/Gnus set up and someone else's Evolution setup is highly unlikely. Without enough susceptible victims viruses can't spread.

      Even if all of the Joe Sixpacks in the world were running Linux it still would be a good deal less dangerous than what Windows users currently face.

  3. .NET virus not such a big deal by Tom7 · · Score: 5, Insightful


    Don't get all worked up, guys. Executable files that can modify other executable files to self-replicate are nothing new, and .NET is not "insecure" because viruses can be written for it. (Though it may be insecure for many other reasons! ;)) Linux has viruses too. The real question is how much damage such code can do once it's run -- on multi-user systems with permissions like linux and NT, presumably this is not much.

    (Regardless, kudos to the creator for the cool hack and for not unleashing it on the world!)

    Personally, I think the idea of high-level languages and portable binaries is a good one, so I am actually excited about the Common Language Runtime (etc.) aspect of .NET. I hate hate hate the web services and passport bit, though...