
=========================
Ideas For Your Next Virus
=========================
by alcopaul/brigada ocho
october 18, 2011


Viruses are basic. If we adhere to the basic definition of it, a virus should be "a piece of code that inserts itself to another code." And there have been a lot of proof of concept codes that demonstrate that. They are even written in different languages, from assembly to BASIC. Infection methods may vary a little but in general they all follow the definition. 

But as time goes by, viruses have acquired functionalities that made them break free from that simplistic definition. We have now network aware viruses aka worms. We have viruses that take advantage of the operating system and hide themselves deep into the operating system. We have now viruses that attack nuclear power plants and military drones. And possibilities are endless.

And this article attempts to give you few of those possibilities.

Let's Go
--------

So the key for a successful virus is the chance of it spreading in the wild. Before, the methods of spreading is by sharing disks so virus writers took advantage of that to spread their creations. They made their viruses infect the boot sector and the files in the disk. With this, this ensured the execution of it in another pc. And when the internet came, virus writers took advantage of email, network exploits and social engineering for their viruses to spread. Of course the old school file infection still existed but the majority was worming routines. And now, there's even a new trick that takes advantage of the internet. Virus writers host their viruses in websites and uses exploits for it to be remotely executed in a victim's pc.

But no, that's not all of the techniques that can be done. There is still few tricks that we can do.

1.) You can make your virus insert itself to picture file and upload the picture file to picture servers that gives you a direct link to the picture. And in the picture, there is an instruction for the user to do for him to execute the virus embedded in the picture (see Perrun.NET in b8#3). The virus then include the direct link to public galleries.
2.) You can make your virus convert itself to plaintext and upload the plaintext to a free text hosts, including in it an additional instruction for the text to be converted back to executable. You can make him download an executable that converts plaintext to executable bytes and execute it in memory.
3.) You can make the virus host itself to a free file server that gives you direct link and then make the virus message the link to your friends in Facebook, Twitter, Yahoo and other instant messaging services, telling them to execute the link (a .com extension is suggested for this). Or better, you can poison searches by showing the direct link in search engines.
4.) You can make your virus copy itself to removable drives to filenames that should be enticing for the innocent user to execute. Remember that the autorun feature was already given a fix so a little social engineering is necessary. Removable drives/USB sticks are used especially in university/school settings.
5.) You can make your virus embed itself to old school documents since documents are still the most exchanged form of data. Say your virus can put a link of itself in a document. This is very possible in Office documents, and possible too in the new XML Office format.
6.) You can predeploy the virus in crypted/data form and lie dormant in computers. Then deploy a program which only function is to decode/decrypt/make executable the predeployed files. Antivirus software won't raise a flag on the decoder since their only function is to decode.
7.) You can theoretically modify a video by placing a watermark on it, which can be an instruction to execute your virus, hosted on a remote server or embedded in the video.
8.) You can theoretically modify a sound file by appending another sound instructing the listener things to do for your virus, hosted on a remote server or embedded in the sound, to be executed.

I'm sure you'll notice that all the techniques lacks an important feature that the virus should have - autoexecution. But it is supplanted by social engineering. Your virus should be effective in convincing the user to do an additional step to actually executing your virus. This is like the old email worm wherein the attached worm must still be executed by double clicking the attachment.

Finally
-------

So that's all that I can suggest for your next virus. That is if you're running out of ideas and you want to do something new.


