How To Hide Viruses On UNIX?
There are several candidates on UNIX for being a virus runtime environment.
Similarly, there are several places for a virus to hide on UNIX:
1. The UNIX shells
Shell scripts are a powerful way to program. Unix shells are ubiquitous, accessible,
and provide homogeneity across otherwise heterogeneous systems(for example, with
differing application binary interfaces). Shell scripts are simple text files, and lend
themselves easily to be modified.
2. Binary executables
A virus writer may want his virus to hide in a binary executable, for obvious
reasons(such files provide more obscure hiding places, and are often more" active").
However, given the diverse nature of different UNIX platforms(including different
executable formats), modifying an executable might be rather painful to implement.
IJCES International Journal of Computer Engineering Science , Volume1 Issue 3, December 2011
ISSN : 2250:3439
https://sites.google.com/site/ijcesjournal
http://www.ijces.com/
75
For example, the feasibility and difficulty of injecting a stream of instructions into an
executable to modify program execution would depend on the file format. The
executable and linking format(ELF) is meant to provide developers with a set of
binary interface definitions that extend across multiple platforms. ELF is indeed used
on several platforms, and is flexible enough to be manipulated creatively. A virus
could attach viral code to an ELF file, and re-route control-flow so as to include the
viral code during execution.
3. Jingle bell: a simple virus in C
Jingle bell is an extremely simple minded virus written in c that attaches itself to an
executable by appending the latter to itself and recording the offset. This process
repeats itself. The virus infects the first executable found, if any, on its command line.
Other infection policies could be programmed too. The virus would some how need to
be introduced in the system, through a downloaded binary, for examp