On that special day, Technophobe, (Technophobe.24prhb@no-
mx.forums.yourdomain.com.au) said...

> and susceptible
> to computer viruses

How can something that only *stores* data, become *viral*?

I hate people who can't use the *proper* wors, when they are talking
about anything. Hey, I've got a pain in my neck, it's probably a flu...


Gabriele Neukam

(E-Mail Removed)


--
Ah, Information. A property, too valuable these days, to give it away,
just so, at no cost.

On Wed, 15 Mar 2006 18:56:57 +0100 Gabriele Neukam wrote:

> On that special day, Technophobe, (Technophobe.24prhb@no-
> mx.forums.yourdomain.com.au) said...
>
> > and susceptible
> > to computer viruses
>
> How can something that only *stores* data, become *viral*?
>
If the data loaded into the chip is corrupt?
--
Ernie B.

Communication: The art of moving an idea from one mind to another,
hopefully without distortion.

"Gabriele Neukam" <(E-Mail Removed)> wrote in message news:dv9kh7$lt1$02$(E-Mail Removed)...
> On that special day, Technophobe, (Technophobe.24prhb@no-
> mx.forums.yourdomain.com.au) said...
>
> > and susceptible
> > to computer viruses
>
> How can something that only *stores* data, become *viral*?

How can files, which are stored data, be viral?

Data representation is in the eye of the interpreter. If the data is
corrupted in such a way as to cause the interpreting software to
fail, and this fialure can be leveraged into running code that puts
that corrupted data into the next device, you have a virus.

When you redefine virus as the AV community has, this would
probably be a worm and not simply a virus.

Jake Dodd wrote:
> "Gabriele Neukam" <(E-Mail Removed)> wrote in message news:dv9kh7$lt1$02$(E-Mail Removed)...
>> On that special day, Technophobe, (Technophobe.24prhb@no-
>> mx.forums.yourdomain.com.au) said...
>>
>>> and susceptible
>>> to computer viruses
>> How can something that only *stores* data, become *viral*?
>
> How can files, which are stored data, be viral?
>
> Data representation is in the eye of the interpreter. If the data is
> corrupted in such a way as to cause the interpreting software to
> fail, and this fialure can be leveraged into running code that puts
> that corrupted data into the next device, you have a virus.
>
> When you redefine virus as the AV community has, this would
> probably be a worm and not simply a virus.

having (mostly) read the source material i can probably answer some of
these questions...

regular rfid tags can hold up to 128 bytes (1024 bits) of data and that
data is read by hardware, interpreted by software and generally stored
in a database... in the example given an sql injection exploit was used
as the rfid data which when inserted into the database caused the
self-replicating query to execute...

under the formal definition of virus the first example given was a
virus, however under the definition the av community uses it was not a
virus as it doesn't infect any other programs... that's not to say that
one couldn't write an infector, however - something that infects stored
procedures for example...

and for the record, the requirement for infection comes from fred cohen
himself, it's not part of any redefinition by the av industry (though
they have tweaked things here and there from his original informal
definition)...

it's unfortunate, however, that the researchers seem to have chosen to
publish their code, otherwise i would have put a link to it on my site...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

Jake Dodd wrote:

> When you redefine virus as the AV community has, this would
> probably be a worm and not simply a virus.

Uh, yeah. Point.

It will not be a virus until the RFID devices become two way.

On Thu, 16 Mar 2006 09:13:03 -0600, Offbreed wrote
(in article <Cq-dnfidrv2aE4TZRVn-(E-Mail Removed)>):

> Jake Dodd wrote:
>
>> When you redefine virus as the AV community has, this would
>> probably be a worm and not simply a virus.
>
> Uh, yeah. Point.
>
> It will not be a virus until the RFID devices become two way.

I am not sure about that. No it doesn't broadcast but my understanding is
that any RFID reader automatically attempts to read any RFID tag in range.
And I don't know enough about the code to know if the same tag would affect
both say wal-mart and the speed passes at the pumps. If that were true I
would call it a virus.

Anyway a couple of other issues.
1) The thought used to be ( according to the articles I have seen) that
there was not enough room in 128 bytes to put anything malicious on there.
What about the magnetic stripes on credit cards and drivers licenses? I don't
know their size but I would have to think it is larger than 128 bytes.


2) 128 bytes is just this generation of RFID tags. Does anyone know what the
next generation is supposed to have?

Hud

"kurt wismer" <(E-Mail Removed)> wrote in message news:nT2Sf.9021$(E-Mail Removed)...

> and for the record, the requirement for infection comes from fred cohen
> himself, it's not part of any redefinition by the av industry (though
> they have tweaked things here and there from his original informal
> definition)...

If one modified reader's software program's instance is capable of transmitting
the same modification to another instance, doesn't that still fit in with both of
Cohen's definitions for virus? I seem to recall no restrictions on just exactly
'how' such modification was accomplished even in the plain language version.

the shadow wrote:
> I am not sure about that. No it doesn't broadcast but my understanding is
> that any RFID reader automatically attempts to read any RFID tag in range.
> And I don't know enough about the code to know if the same tag would affect
> both say wal-mart and the speed passes at the pumps. If that were true I
> would call it a virus.

I would not call it a virus until it can replicate. I don't think going
cross platform or cross program is really relevant. Not for this part.
Massive PITA, for sure.

> 2) 128 bytes is just this generation of RFID tags. Does anyone know what the
> next generation is supposed to have?

Bigger. <G>

I bet someone could make a transceiver that would mimic an RFID device,
and spit out something larger than 128 bytes. The RFID reader would just
be the entry device.

IIRC, several science fiction stories used devices somewhat like this to
defeat electronic security.

Jake Dodd wrote:
> "kurt wismer" <(E-Mail Removed)> wrote in message news:nT2Sf.9021$(E-Mail Removed)...
>
>> and for the record, the requirement for infection comes from fred cohen
>> himself, it's not part of any redefinition by the av industry (though
>> they have tweaked things here and there from his original informal
>> definition)...
>
> If one modified reader's software program's instance is capable of transmitting
> the same modification to another instance, doesn't that still fit in with both of
> Cohen's definitions for virus?

the example given in the paper doesn't modify the reader software at all...

that said, what you describe does seem like it fits with what is
described here (http://all.net/books/virus/part2.html)

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

Offbreed wrote:
> Jake Dodd wrote:
>
>> When you redefine virus as the AV community has, this would
>> probably be a worm and not simply a virus.
>
> Uh, yeah. Point.
>
> It will not be a virus until the RFID devices become two way.

not true... that functionality is not required for it to be a virus...
what is required is that the program infects other host programs... that
doesn't have to be on the rfid devices themselves...

rfid tags can *carry* viruses (as they're just a wirelessly accessible
storage medium), they just can't be infected by them (contrary to the
terminology used by the researchers themselves)...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"