Viruses: three parts, four phases, and the concealment ladder

Three parts

A virus is a fragment of code embedded in a host program. Take it apart and there are exactly three components, and keeping them separate makes almost every exam question on this chapter easier:

• Infection mechanism — the vector. The code that finds a new host and writes a copy of the virus into it. This is the part that answers how it spreads.
• Trigger — also called the logic bomb. The event or condition that decides when the payload runs: a date, the presence or absence of a named file, a particular software version, or a count of how many times this copy has already replicated.
• Payload — what it does besides spreading. It may be destructive, or merely noticeable.

A very common error is to treat "logic bomb" as a kind of malware sitting beside "virus" in a list. It is not a sibling; it is a part.

Four phases

Every copy of a virus runs the same life cycle, and worms run it too:

1. Dormant — idle, waiting for an activating event. Not every virus has this phase, but the count of phases is still stated as four.
2. Propagation — the virus copies itself into other programs or into system disk areas. Critically, the copy need not be identical: morphing during propagation is exactly how concealment works.
3. Triggering — the condition is met and the virus activates to perform its function.
4. Execution — the function is performed. It might be a message on screen; it might be the destruction of programs and data.

Worked example — one virus through all four

A virus is written into an accounting utility that a firm runs on the last working day of every month.

• Dormant. The infected utility is copied onto a new workstation in March. The virus does nothing at all for eleven days: nobody runs month-end until the 31st.
• Propagation. On the 31st the utility runs. Before the utility does its own work, the infection mechanism scans the local program directory, finds three other executables it has write access to, and writes a copy of itself into each. Each copy is written through a mutation step, so no two of the three are byte-identical.
• Triggering. Each copy carries the same trigger: fire when the system date is the 13th and the day is a Friday. On this run the condition is false, so nothing happens — the virus has now spread four times without a single visible symptom, and this is why detection lags infection.
• Execution. Months later the condition is true on one machine. The payload deletes the firm’s ledger backups. Note where the damage sits: in phase four, on one machine, long after the spreading was done. Cleaning that machine does nothing about the other three.

Classification by target

• Boot sector infector — infects a master boot record or boot record and spreads when the system boots from the disk.
• File infector — infects executables.
• Macro virus — infects files containing macros or scripting code interpreted by an application.
• Multipartite — infects in multiple ways or multiple file types. The reason this one is examinable is that it is a cleanup problem: eradication must address every infection site, so cleaning the executables and leaving the boot record reinfects the machine on the next reboot.

### Why macro viruses were a step change

Five reasons, and the fourth is the deep one:

1. Platform independent — any system running the application can be infected, whatever the hardware or operating system.
2. They infect documents, not executable code — and most of the information entering an organisation is documents, not programs.
3. They spread easily, because documents are shared by design, usually by e-mail, and may be opened automatically without prompting.
4. Traditional file-system access controls are of limited use, because users are expected to be able to modify documents. You cannot mark the thing read-only; editing it is the job.
5. They are far easier to write than executable viruses.

Read reasons 2 and 4 together and you have the history of the entire shift: as operating systems tightened controls on executables, attackers moved into the one file class that had to stay writable.

The concealment ladder

Each rung exists because it answers the detection technique that beat the rung below it:

• Encrypted. The virus body is stored encrypted, with a small plaintext stub that holds a key and decrypts the body at run time. A new random key is generated per replication, so there is no constant bit pattern in the body across copies. What is left constant is the stub, and that is what a scanner writes a signature for.
• Stealth. Designed to hide the whole virus from antivirus software, not merely to vary its bytes — by compression, or by rootkit-style interception of the calls a scanner makes to read files.
• Polymorphic. Every copy is functionally equivalent but has a distinct bit pattern, produced by a mutation engine. Crucially, the mutation engine itself changes with each use, so the decryptor is not constant either. But once a copy has decrypted itself in memory, the body it reveals is the same body every time.
• Metamorphic. The virus rewrites itself completely at each iteration, and may change its behaviour as well as its appearance. There is no invariant decrypted body to find.

That last pair is the standard exam confusion, so state it as one sentence: polymorphic changes its appearance and keeps its code; metamorphic changes its code. And it explains why sandbox analysis works on the polymorphic case — force it to run, wait until it has decrypted, and scan what is now in memory.