عنوان

A pathology of computer viruses

شابک

0387196102

شابک

3540196102

شابک

9780387196107

شابک

9783540196105

شماره

b565337

عنوان اصلي

A pathology of computer viruses

نام عام مواد

[Book]

نام نخستين پديدآور

David Ferbrache.

محل نشرو پخش و غیره

London ; New York

نام ناشر، پخش کننده و غيره

Springer-Verlag

تاریخ نشرو بخش و غیره

©1992.

نام خاص و کميت اثر

xiii, 299 pages : illustrations ; 24 cm

متن يادداشت

1 Introduction.- 1.1 Preamble.- 1.2 What is a Computer Virus?.- 1.3 Worms: Networked Viruses.- 1.4 Terminology.- 2 Historical Perspectives.- 2.1 Introduction.- 2.2 1960s: Early Rabbits.- 2.3 1970s: Fiction and the Worm.- 2.4 1980-1983: Genesis.- 2.5 1984-1986: Exodus.- 2.6 1987: Mac, Atari and Amiga Next.- 2.7 1988: Proliferation and Disbelief.- 2.7.1 January-March.- 2.7.2 April-September.- 2.7.3 October-December.- 2.8 1989: Reaction by the Community.- 2.8.1 January-March.- 2.8.2 April-June.- 2.8.3 July-September.- 2.8.4 October-December.- 2.9 1990: Organisation and Litigation.- 2.9.1 January-April.- 2.9.2 May-September.- 2.9.3 October-December.- 2.10 Summary.- 3 Theory of Viruses.- 3.1 Introduction.- 3.2 Addition of Viral Code.- 3.3 Detection of Viruses.- 3.4 Classes of Viruses.- 3.5 Thompson: and Trusting Trust.- 3.6 Biological Analogies.- 3.6.1 Biological Viruses.- 3.6.2 Parallels Between Low Level Operation.- 3.6.3 High Level Parallels.- 3.7 Quest for Life.- 3.8 Evolution: Genetic Algorithms.- 3.8.1 Random Mutation.- 3.8.2 Programmed Mutation.- 3.8.3 Genetic Algorithms.- 3.8.4 Growth and Death.- 4 Operation of PC Viruses.- 4.1 Introduction.- 4.2 PC Boot Sequence: Initialisation.- 4.3 BIOS and DOS.- 4.4 Master Boot Record.- 4.5 DOS Boot Sector.- 4.6 System Initialisation.- 4.7 Batch Processing Viruses.- 4.8 COM and EXE Viruses.- 4.8.1 Non-overwriting Prepending COM Infectors.- 4.8.2 Overwriting COM Infectors.- 4.8.3 Non-overwriting Appending COM Infectors.- 4.8.4 EXE Viruses.- 4.9 Resident and Transient Viruses.- 4.10 Manipulation by Viral Code.- 4.11 Activation Criteria.- 4.12 Camouflage.- 4.12.1 Concealment in Infected Files.- 4.12.2 Encryption of Viral Code.- 4.12.3 Hiding of Viral Code.- 4.12.4 Checksum Calculation.- 4.12.5 Prevention of Alteration Detection.- 4.12.6 Concealment of Viral Code in Memory.- 4.12.7 Concealment of Viral Activity.- 4.12.8 Concealing Disk Activity.- 4.12.9 Concealing System Slowdown.- 4.13 Replication.- 4.13.1 Locating a Host.- 4.13.2 Signatures.- 4.13.3 Miscellaneous Topics.- 4.13.3.1 Corresponding File Virus.- 4.13.3.2 SYS Virus.- 4.13.3.3 Multi-vector Viruses.- 4.13.3.4 Multi-architecture Viruses.- 4.13.3.5 Architecture Dependent Viruses.- 5 Management of PC Viruses.- 5.1 Perspective on Security.- 5.2 Components of a Virus Control Scheme.- 5.3 Prevention of Virus Attack.- 5.3.1 Physical Access Constraints.- 5.3.2 Electronic Measures.- 5.3.2.1 Physical Feature Verification.- 5.3.2.2 Knowledge Verification.- 5.3.2.2.1 Passwords.- 5.3.2.2.2 Background Verification.- 5.3.2.2.3 Other Techniques.- 5.3.2.3 Possession Verification.- 5.3.3 Media Access Controls.- 5.3.4 Network Access Controls.- 5.3.4.1 Identification of Access Controls.- 5.3.4.1.1 Centralised Network File Servers.- 5.3.4.1.2 Distributed Trust.- 5.3.4.1.3 Network Transport by Public Carrier or Accessible Media.- 5.3.5 Ideological Controls.- 5.3.5.1 User Education.- 5.3.6 Management Policies.- 5.3.6.1 Training of Employees.- 5.3.6.2 Use of Anti-viral Measures.- 5.3.6.3 Compartmentalisation.- 5.3.6.4 Centralisation.- 5.3.6.5 Personnel Policies.- 5.3.7 Vaccination and Inoculation.- 5.4 Detection of Viral Code.- 5.4.1 Monitoring and Logging.- 5.4.2 Signature Recognition.- 5.4.3 Generic Code Recognition.- 5.4.4 Sacrificial Lamb.- 5.4.5 Auditing.- 5.4.6 Use of Expert Systems to Analyse Viral Behaviour.- 5.4.7 Fighting Fire with Fire.- 5.5 Containment of Viral Code.- 5.5.1 Hardware Compartmentalisation.- 5.5.1.1 Virtual Machine.- 5.5.1.1.1 80386 Task Switching Support.- 5.5.1.1.2 80386 Paged Segmented Memory.- 5.5.1.1.3 Accessing OS Code.- 5.5.1.1.4 Segment Permissions.- 5.5.1.1.5 Paged Memory Operation.- 5.5.1.1.6 Input/Output Operations.- 5.5.1.1.7 Virtual Machine in Software.- 5.5.1.2 Automatic Flow Verification.- 5.5.1.3 Software Distribution: Ensuring Trust.- 5.5.2 Software Compartmentalisation.- 5.5.2.1 Interrupt Trapping Code.- 5.5.2.1.1 Configurable Monitors.- 5.5.2.1.2 Operation of a Monitor.- 5.5.2.1.3 Extensions to Real Time Monitoring.- 5.5.2.2 OS Support.- 5.5.3 Network Compartmentalisation.- 5.5.4 Investigation and Response.- 5.5.4.1 What is the Infection?.- 5.5.4.1.1 Acquisition.- 5.5.4.1.2 Logging of Relevant Information.- 5.5.4.1.3 Disassembly.- 5.5.4.2 Dissemination of Information.- 5.5.4.3 General Containment.- 5.5.4.4 Tracing of Infection Source.- 5.5.5 Disinfection of Viral Code.- 5.5.5.1 Re-installation.- 5.5.5.2 Recompilation from Source.- 5.5.6 Checking for Re-infection.- 5.5.7 Disinfection Utilities.- 5.6 Recovery from Viral Infection.- 5.6.1 Backup Procedures.- 5.7 Contingency Planning.- 5.7.1 Redundancy.- 5.7.2 Insurance.- 5.7.3 Public Relations.- 5.8 Remedial Action.- 6 Apple Macintosh Viruses.- 6.1 Introduction.- 6.2 Macintosh: The Abstract Operating System.- 6.2.1 Initialisation.- 6.2.2 Resources.- 6.2.3 Trap Dispatch Table Structure.- 6.2.4 Non-link Viruses.- 6.2.5 Link Viruses.- 6.2.6 Notes on Keyboard Sequences.- 6.2.7 Summary of Mac Protection.- 7 Mainframe Systems: The Growing Threat.- 7.1 Introduction.- 7.2 Hardware Architectures.- 7.3 Software Architecture.- 7.3.1 Discretionary Access Controls.- 7.3.2 Integrity versus Confidentiality.- 7.3.3 Mandatory Access Controls.- 7.3.4 Commentary on Security Standardisation.- 7.4 UNIX: A Viral Risk Assessment.- 7.4.1 System Startup.- 7.4.2 Login and User Commands.- 7.4.3 Bugs and Loopholes.- 7.4.4 Mechanics of UNIX Viruses.- 7.4.4.1 Batch Viruses.- 7.4.4.2 Link Viruses.- 7.4.4.3 Dynamic Loading.- 7.4.4.4 Other Considerations.- 7.4.4.5 Protecting Against UNIX Viruses.- 7.4.4.6 Cohen: Early UNIX Viruses.- 8 Network Viruses: The Worms.- 8.1 Introduction.- 8.2 Standardisation.- 8.3 History of Network Pests.- 8.3.1 Early Work: Pre-1980.- 8.3.2 Recent Benign and Malicious Worms.- 8.3.3 CHRISTMA EXEC Chain Letter.- 8.3.4 Chain Letters on UNIX.- 8.4 Internet Protocols.- 8.4.1 Architecture.- 8.4.2 Peer Authentication.- 8.4.3 Access Controls.- 8.4.4 Data Stream Integrity.- 8.4.5 Daemons and Servers.- 8.4.6 Distributed Trust.- 8.4.7 Trusted Ports.- 8.4.8 Problems and Solutions.- 8.4.9 Internet Worm: Black Thursday - 3 November 1988.- 8.4.9.1 Internals.- 8.4.9.2 Action and Reaction.- 8.4.9.3 The Aftermath.- 8.4.10 DISNET: A Child of the Internet.- 8.5 OSI: Security in the Making.- 8.6 DECNET: Insecurity Through Default.- 8.6.1 HI.COM: The Christmas Worm.- 8.6.1.1 Reaction of the DECNET Community.- 8.6.1.2 Worms Against Nuclear Killers.- 9 Reactions of the IT Community.- 9.1 Discussion and Advice.- 9.1.1 Bulletin Board and Casual Users.- 9.1.2 Academic Establishments.- 9.1.2.1 CREN/CSNET.- 9.1.2.2 NSFNET.- 9.1.2.3 HEPNET/SPAN.- 9.1.2.4 General Community Responses.- 9.1.3 Government Research Organisations.- 9.1.4 Military Organisations.- 9.1.5 Commercial Organisations.- 9.1.6 Criminal Investigation Organisations.- 9.1.7 Professional Organisations.- 9.2 Legislative Issues.- 9.2.1 Scottish Law Commission.- 9.2.2 English Law Commission.- 9.2.3 Computer Misuse Act.- 9.2.4 Summary of Legislation.- 9.3 Professionalism and Software Development.- 10 Conclusions: The Future Ahead.- Appendices.- 1 DOS Filestore Structure.- 1.1 Introduction.- 1.2 Master Boot Record.- 1.3 DOS Boot Sector.- 1.4 File Allocation Table.- 1.5 Root Directory.- 2 Low Level Disk Layout.- 3 EXE File Format.- 4 Mac Filestore Structure.- 5 PC Virus Relationship Chart.- 6 Macintosh Virus Relationship Chart.- 7 PC Boot Sequence.- 8 AIDS Trojan: Accompanying Licence.- 9 Software Infected at Source.- 10 Nomenclature.- 10.1 Types of Virus.- 10.1.1 Master Boot Sector Viruses.- 10.1.2 DOS Boot Sector Viruses.- 10.1.3 Executable COM/EXE Viruses.- 10.1.4 Memory Resident Viruses.- 10.1.5 Overwriting Viruses.- 10.1.6 Prepending Viruses.- 10.1.7 Appending Viruses.- 10.2 Generations of Virus.- 10.3 Classes of Anti-virus Product.- 11 UNIX Boot Sequence.- 12 CERT Press Release.- 13 CERT/CIAC Advisories.- 14 Contact Points.- 15 Abbreviations.- 16 Further Reading.- 17 Virus-1 Archive Sites.- 18 Relative Frequencies of IBM Viruses.

موضوع مستند نشده

Computer viruses.

موضوع مستند نشده

Computervirus

موضوع مستند نشده

Computervirussen.

شماره رده

نشانه اثر

مستند نام اشخاص تاييد نشده

David Ferbrache.

مستند نام اشخاص تاييد نشده

David Ferbrache

نام الکترونيکي

نوع ماده

[Book]

تكميل شده

Y