CHAPTER 4: The Engine that Kills! A Mutating Menance!
Dark Avenger Mutation Engine No Threat to Protected PCs
FACT: Each day of the year a new virus is introduced into the computer industry.
Santa Clara, CA -- May 11,1992 -- McAfee Associates confirmed today that users of its suite of VIRUSCAN anti-virus products have nothing to fear from the new generation of mutating or polymorphic viruses.
McAfee Associates, the nation's leading anti-virus software company, has been swamped with calls from concerned corporate PC users worried about the threat of the so-called Dark Avenger Mutation Engine.
"Actually, we cracked this engine some months ago and have been shipping product capable of detecting the Mutation Engine since March," said William S. McKiernan, vice president, McAfee Associates.
The Dark Avenger Mutation Engine, which first appeared on European bulletin boards a few months ago, is a new kind of virus threat. In the past, viruses such as the Jerusalem or the recent Michelangelo strain had distinct, single identities that made them relatively easy to detect and control.
"The Mutation Engine, however, can be used by virtually anyone to create a mutating virus which is very difficult to detect," said McKiernan. "The fact that it is widely available on bulletin boards makes it that much more frightening."
The Mutation Engine uses encryption techniques to avoid detection. Before a virus can become active it needs to decrypt itself. Ordinarily the code used for this decryption remains constant, allowing the use of standard byte matching techniques for detection.
The Mutation Engine, however, uses a special algorithm to generate a completely variable decryption routine each time. "The result is that no three bytes remain constant from one sample to the next," said Igor Grebert, senior programmer at McAfee Associates. "This makes detection using conventional string matching techniques impossible."
VIRUSCAN, however, has no such problem. According to McKiernan, the downloadable shareware contains a new generation of virus detection algorithm capable of statistical and numerical analysis.
It detects the Mutation Engine by "sensing" its presence rather than by attempting to actually spot it in a byte-for-byte string comparison. VIRUSCAN consistently detected all iterations of the Mutation Engine in tests done at McAfee, McKiernan said.
Santa Clara-based McAfee Associates first received reports of the Mutation Engine early this year. It is believed that the Engine is a product of the Bulgarian virus creator responsible for the original conventional Dark Avenger virus.
Though some viruses using the Mutation Engine have already appeared in the U.S., the engine is not expected to present a widespread problem for some time, McKiernan said. Typically the McAfee "early warning" network identifies new viruses months before they are a threat to the U.S. market.
Nevertheless, the PC world has reacted emotionally to the presence of the Mutation Engine. "It is clear that the game is forever changed," said columnist Steve Gibson in a recent issue of the computer journal InfoWorld. "The sophistication of the Mutation Engine is amazing and staggering."
The presence of the Mutation Engine on bulletin boards may be more of a threat than the virus itself. "You no longer have to be particularly clever or experienced to use it," said McKiernan. "Now if you have a modem you can be in the virus business overnight and the potential for proliferation is a sobering thought."
McKiernan said that conventional viruses are turning up at a rate of 10 to 20 per week. "We expect that the Mutation Engine will increase this problem exponentially for those with unprotected systems," he said.
- end -
