main

Antivirus Concerns in XP and .NET Environments

Tom Warren   on 08 July 2003 - 23:05 · 9 comments & 472 views

Advertisement (Why?)
After Windows NT was released, it took virus writers five years to learn how to infect it. Windows NT 3.1 and the Win32 API were released in late 1993, but it wasn't until August 1998 that W32.Cabanas became the first NT virus by capturing coveted kernel mode access. .NET and some of Microsoft's other initiatives have not been as lucky. The purpose of this article is to discuss antivirus (AV) concerns with .NET and Microsoft Windows XP.

.NET was officially announced by Microsoft in July 2000 at a Microsoft Professional Development Conference. Since then, what .NET has meant and the products involved have changed (and been renamed). .NET is an idea and a programming platform. The basic concept is an evolving extension of Microsoft's Object Linking Embedding (OLE) introduced back in the early days of Windows 3.0. OLE allows you to copy objects and data created in one application, like a spreadsheet graph, to other applications. OLE evolved into ActiveX objects, which are executables you can download and run within an Internet browser.

NET takes it two steps further by allowing the entire application to be hosted elsewhere (potentially allowing your environment to follow you, no matter where you go) and allowing different distributed software parts to make up one application. For example, your Windows desktop settings, your applications, and your data may be available to you where ever you compute. Running by an Internet kiosk in an airport? Just login and access your desktop and your data. Different applications will co-exist together, over the web, to bring you that integrated environment. One vendor will handle the login and authentication, another will store your data, and each of your applications will be made up of specifically customized components. I'll take two thesauruses, a math equation editor, and a French translation dictionary please. Hold the autocorrect.

News source: securityfocus.com


He should turn it in to his professor, get his grade -- and then they both should burn it," said Richard Clarke, who until recently was the White House cyberterrorism chief. "The fiber-optic network is our country's nervous system." Every fiber, thin as a hair, carries the impulses responsible for Internet traffic, telephones, cell phones, military communications, bank transfers, air traffic control, signals to the power grids and water systems, among other things.

"You don't want to give terrorists a road map to blow that up," he said.

Gorman compiled his mega-map using publicly available material he found on the Internet. None of it was classified.

His interest in maps evolved from his childhood, he said, because he "grew up all over the place." Hunched in the back seat of the family car, he would puzzle over maps, trying to figure out where they should turn. Five years ago, he began work on a master's degree in geography. His original intention was to map the physical infrastructure of the Internet, to see who was connected, who was not, and to measure its economic impact.

Post a comment · Send to friend Comments · There are 9 additional comments
(4 replies) #1 Goalie_CA on 09 Jul 2003 - 01:47
No one's posted, i guess no one's surprised. I wonder how easy the .NET code can be decompiled, because java classes can be quite easily using "javap -c". If .NET code can be decompiled it would be a free-for all for hackers. I seriously doubt ms would ever do something so stupid.
#1.1 chris_kabuki on 09 Jul 2003 - 02:08
QUOTE
I wonder how easy the .NET code can be decompiled

Very easily, as easily as Java classes can be. As a result, you need some form of obfuscation to make it harder for the person trying to decompile your source. Whilst this will not stop them it will hopefully make the resulting code unreadable enough to not make the decompilation worth it. Here's an open source decompiler for instance:

http://www.devhood.com/tools/tool_details.aspx?tool_id=354

QUOTE
I seriously doubt ms would ever do something so stupid.

Riiiiiiiiiight... yeah, as if they would be so stupid! This isn't a stupidity thing it's a side effect of writing code in an intermediary byte form.
#1.2 JaggedFlame on 09 Jul 2003 - 02:29
Yeah, .NET code is very easy to decompile. At RemoteSoft, you can find a decompiler, or (ironically enough) an obfuscator.

Looks like Microsoft has recognized this, because they've released a community edition of an obfuscator with Visual Studio .NET 2003. Hopefully, they'll bring it to the next level next time.
#1.3 Goalie_CA on 09 Jul 2003 - 02:54
Perhaps i need a crash course in byte-code but isn't byte-code just asm instructions for a "virtual machine". Usually high-level languages like c++ produce asm code that is all but impossible to decompile esp once optimizers et their hands on it. Function names and other labels get converted to addresses and jump tables once the linker does its job.
#1.4 chris_kabuki on 09 Jul 2003 - 13:58
No crash course required, you're right, however the important difference is that the byte code was designed with compactness in mind, ease of analysis by JIT compilers as well as several other things. Therefore the 'assembler' is of a much higher level and therefore easier to decompile, especially as a lot of additional information (like variable names) is stored in the byte code.

Note that you can decompile code that was originally written in C/C++ but you won't get anything too useful out of it - the only reason for this is that you don't know what compiler was used, what version of the compiler, what flags were used, what linker was used, it's version and flags etc etc and all of those items affect the final executable. If you did know all of that information you could do quite a decent job of decompiling the program (minus variable names etc).

And why in the world would you want to pay for a decompiler from RemoteSoft when you can get plenty of them for free!
(1 reply) #2 Gary_Player on 09 Jul 2003 - 02:17
...I still dont get .NET...
EVERYBODY has the framework but it does next to nothing...
That and that whole anyone can acess your crap anywhere is more than a little sketchy
#2.1 JaggedFlame on 09 Jul 2003 - 02:30
Well, you have a Java 2 Runtime Environment installed, don't you? What does that do?

.NET, right now, is more than just Windows applications that require the framework. When you browse the Internet these days, chances are you're going to encounter more than a few ASP .NET web applications.

As for "anyone can access your crap anywhere," that's .NET Passport, which is Microsoft's implementation of .NET. It has nothing to do with how other companies implement .NET, and as a result has not much significance as anything more than a Microsoft product.
#3 puredeath on 09 Jul 2003 - 02:38
I don't think Microsoft itself knows how NT works.
#4 Mr. Black on 09 Jul 2003 - 16:35
I remember this -- yeah, noone could write viruses for NT. But that's old news and now their is a sh1tload of them...all it takes is time for virii and hax0rz to catch up.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)