EGNILGES@PUCC.BITNET (Ed Nilges) (07/04/89)
>>in Communications Monitoring System (CMS) version 4 for IBM's MVS >>operating system where a dangerous virus could be introduced by simply >>programming 16 lines of code. That's Conversational Monitor System (formerly Cambridge Monitor System), and it is independent of, not "for", MVS. To my knowledge, ALL viruses on this system require some human action (to pull files in from the "virtual reader" user input queue). Although certain idiotic viruses (the CHRISTMA virus being the most notable) have affected CMS, it is not as subject to damage as is unix, where files are transmitted directly to the user's file space, rather than an independent queue.
kelly@uts.amdahl.com (Kelly Goen) (07/20/89)
> >>in Communications Monitoring System (CMS) version 4 for IBM's MVS > >>operating system where a dangerous virus could be introduced by simply > >>programming 16 lines of code. > > That's Conversational Monitor System (formerly Cambridge Monitor System), > and it is independent of, not "for", MVS. To my knowledge, ALL viruses > on this system require some human action (to pull files in from the > "virtual reader" user input queue). Although certain idiotic viruses > (the CHRISTMA virus being the most notable) have affected CMS, it is > not as subject to damage as is unix, where files are transmitted > directly to the user's file space, rather than an independent queue. sorry guys I hate to dispel your fantasies on both of you but rumuour are getting rife as of late and its time to quench some of them: 1. CMS is also known as VM/CMS its the equivalant of a complete OS in its own virtual machine... 2. neither MVS nor VM could be infected by 16 bytes of code in an none obtrusive manner... an overwriting virus possibly...!! however these are both large expensive mainframe SCP(system control programs) note I didnt include cms in this he is a user interface!! but they most defintely can be infected!!!!!! 3. given the richness of the 2 above environments and both of them predate any other System control programs currently used now... no human intervention is necessary for an infection mechanism to accomplish its designed task!!!! 4. to acheive point 3 above... one must be what is knwown in IBM Parlance as a SYSPROG not just a technical support specialist... in other words it most likely is not going to be the local 14 year old sunnyvale hacker!!!(that would implement this code) cheers kelly
VALDIS@vtvm1.cc.vt.edu (Valdis Kletnieks) (07/20/89)
>2. neither MVS nor VM could be infected by 16 bytes of code in an none >obtrusive manner... an overwriting virus possibly...!! however these >are both large expensive mainframe SCP(system control programs) note I >didnt include cms in this he is a user interface!! but they most >defintely can be infected!!!!!! First of all, I beleive it was 16 *lines* not 16 *bytes*. Even in assembler, 16 lines will give you 64 bytes of code (assuming average 4/bytes instruction), and more if you allow macro use. I'm unclear what you're saying - are you saying that VM and MVS are systems that "can't be infected non-obtrusively" or that they "can be infected"? I have seen 5-line programs that broke VM. Once you do that, all the rest is just pretty-printing. And the 5-line program was SO unobtrusive that the author literally didn't KNOW for a while that he had done it. It turned out to be a bug in HIS program accidentally exploiting a bug in the SYSTEM. IBM very recently (as an SPE apar to SP/4) fixed a BIG hole in the reader file support, where a sequence of 5 user commands would break a userid. The bottom line is that (a) you can break it (b) if you're good, nobody will notice and (c) sometimes you don't even have to be very good... >3. given the richness of the 2 above environments and both of them >predate any other System control programs currently used now... no >human intervention is necessary for an infection mechanism to >accomplish its designed task!!!! Well, MVS/ESA can trace itself back to 1963 and the OS/360 project. However, CP/67 (the ancestor of VM/SP and VM/XA) dates to almost literally the same month in 1967 as the first attempts to bring Unix up. And both Unix and VM are newer than the venerable Multics (which is still used at a fairly large number of sites). And admittedly MVS and VM *can* both be broken. Otherwise IBM would not have needed to issue 'Statements of Integrity' for them. However, if anything, you got the point here backwards. It is mostly the *newer*, *less mature* systems that are easily attacked and penetrated without human intervention. Remember that MVS has literally 25 years of people breaking into it, while the Macintosh OS has a lot less experience in defending itself. Yes, the older operating systems ARE generally more full-featured. But the features are generally a LOT more robust. >4. to acheive point 3 above... one must be what is knwown in IBM >Parlance as a SYSPROG not just a technical support specialist... in >other words it most likely is not going to be the local 14 year old >sunnyvale hacker!!!(that would implement this code) Ah yes - to break into VM without human intervention DOES require a fair amount of true wizardry. However, you can trust that enough users will run anything that shows up that a trojan horse like the Christmas Card exec is effectively a virus. Yes, technically the Christmas Exec was a trojan horse. However, that didn't stop it from taking out the BitNet academic network and the VNET IBM internal net just as effectively as the Morris worm did to the Internet. Valdis Kletnieks Computer Systems Engineer Virginia Tech