Messages in this thread |  | | From | Jesse Pollard <> | Subject | Re: Glad we did not add NTFS stream support | Date | Wed, 6 Sep 2000 21:36:12 -0500 |
| |
On Wed, 06 Sep 2000, Trevor Harrison wrote: >Don't be a dim-wit. The only reason its a problem on NT is that MS decided to >not allow users to browse the other data streams (or forks, or whatever you >want to call them) in Explorer. > >Actually, this type of virus is probably easier to find and clean because its >isolated itself in a nice little package that you can nuke at via the file >system.
Ummm maybe. A SANS newsletter indicated that none of the current virus scanners even look at the other data streams (yet). Determining if the default stream is actually infected could be problematical too - consider that the signature of the virus might be a VERY short piece of code that looks just like other pieces that do ligitimate functions (like start another process...). This could give many false positives, making a scan nearly useless.
This also gives rise to the posibility of hiding a virus via a chain of block reads, where each block is read over the previous block, but offset by a few 10s of bytes. After 20 blocks are read the complete virus exists. The virus signature is scattered across many blocks and is not contigueous for a virus scanner. If the data is loaded from several different streams (interleaved, of course) it would be even harder to locate. Yet the virus signature is still missing since reading blocks of data is a fairly normal thing to do.
Nasty little bugger.
The current NT utilities also have a problem in that a stream could consume the entire disk, but not be visible to the standard utilities - they don't list file size of any but the default stream.
Of an interesting note: one of the suggested fixes involved copying the infected file to a "non windows system such as Linux..." (paraphrased.. not real quote) and then copying it back without the alternate stream(s).
-- ------------------------------------------------------------------------- Jesse I Pollard, II Email: pollard@cats-chateau.net
Any opinions expressed are solely my own. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/
|  |