Messages in this thread | | | From | "Matthew D. Pitts" <> | Subject | [OFF TOPIC] Java virus | Date | Sun, 23 Aug 1998 21:59:40 -0400 |
| |
Fellow kernel hackers, Please pardon me for posting this here, but I think it should be mentioned because of the recent JVM thread. This was taken straight from Symantec's website. Matthew D. Pitts mpitts@suite224.net
News Release
Symantec AntiVirus Research Center Finds First Cross-Platform Java Virus
- Symantec's revolutionary "Seeker" web spider finds new type of virus -
Cupertino, Calif --August 19, 1998-- Symantec Corporation (Nasdaq: SYMC), the world leader in utility software for business and personal computing, today announced that the Symantec AntiVirus Research Center (SARC) has found a computer virus reported to infect Java applets and applications. The virus, named Strange Brew, was found on the World Wide Web by Symantec's automated virus engine, known as Seeker. Seeker is a web spider that has been continuously scouring the Internet since 1996 and gathering files for analysis in the SARC lab.
The Strange Brew virus is considered the first truly cross-platform virus because it is capable of running on any computing platform where Java is supported, making virus infection viable on literally dozens of different computing architectures. SARC researchers have determined that while the virus does not pose a serious threat to the average consumer, it can affect Java application developers. Users of Norton AntiVirus can protect their systems against this new class of virus by downloading the latest set of virus definitions, which are scheduled to be posted on Aug. 20, 1998.
"The Strange Brew virus is just one of thousands that have been automatically tracked and quarantined by Symantec's Seeker technology," said Enrique Salem, vice president of Symantec's Security and Assistance Business Unit. "With Seeker and the Norton AntiVirus EXtensible engine (NAVEX) technology, SARC engineers can provide protection against new viruses-and even whole new classes of viruses-long before users ever run the risk of being exposed."
The Virus As a parasitic virus, Strange Brew attaches itself onto a host program while still enabling the host program to function after infection. The virus attaches itself to Java ".class" files, which are the executable files that comprise Java applets and application programs. Java .class files can be used on any computer system that supports Java technology. As a result, whereas the replication capabilities of traditional viruses are limited to one or a small number of computing environments, Strange Brew is capable of successfully replicating on any platform that runs a Java virtual machine, from Windows 95 PCs to Unix servers and Cray supercomputers.
The virus can infect both Java application and Java applet files, but is only capable of spreading when infected Java applications are launched. The virus cannot spread from infected applets due to security features in most Java-enabled web browsers. As a result, the virus can infect applets, but once they are infected, the virus cannot spread further.
Strange Brew contains no intentional payload and will not cause any additional damage beyond infecting or possibly damaging Java executable files. This virus is not "in the wild," and it is not known to have infected end users or corporations. The virus cannot spread by web surfing. However, Java applet/application developers are at risk of having their Java .class files infected or corrupted.
Users who are infected by Strange Brew may notice that their Java applications take longer to load during start-up or that they may fail to operate. If an infected Java applet is inadvertently downloaded and run inside an Internet browser, an error message may display containing the name of the virus. A detailed technical analysis of the Strange Brew virus can be found on the SARC web site at http://www.symantec.com/avcenter.
SARC engineers were able to add protection against this new class of virus by using Symantec's award-winning NAVEX technology. NAVEX is a modular engine that allows Symantec to ship fundamental changes and updates to the Norton AntiVirus engine as part of Symantec's standard virus definition updates. This enables SARC to provide both detection and repair capabilities for complex viruses or whole new virus classes. As a result, Norton AntiVirus users can eliminate the threat in a matter of hours by upgrading their virus definitions over the Internet rather than waiting weeks or months for a product inline on diskette or CD distribution.
In addition to this new protection against Java viruses, Norton AntiVirus 5.0 includes state-of-the-art technology that automatically blocks malicious Active X code and Java applets from entering a user's computer. And because approximately 90 percent of Trojan Horses found in circulation today are from online services, Symantec has added its new Trojan Horse detection engine to the AutoProtect feature in Norton AntiVirus 5.0 to guard users against online programs that may steal passwords or destroy data.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |