Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a user was infected with a file altering virus is it possible that checked in code (files containing text) to the source control could contain dangerous properties.

I ask this after this got me thinking:

Installing a new version of the operating system over the compromised operating is not a good solution as files may have been altered that could affect the new system. Even copying business critical information from a compromised system is a risk as that data may have been altered in some manner by use of the backdoor.

If so how would one clean up the code base?

share|improve this question

2 Answers 2

Yes. As early as 1990, Peter DaSilva had circulated a cautionary tale about a source code virus. It reads a lot like a design document for such a virus. I don't believe that one was ever implemented, or at least nobody I know of has confessed to trying it.

In 1989, the Usenix Association published Computing Systems Volume 2, Number 2. This had an article, Virology 101, by Doug McIlroy. That article walks you through writing a shell-script virus, which infects source code. I think that shell-script virus would work today, probably requiring minor syntax fix ups.

I'm not at all sure how you'd go about cleaning up a code base that had been messed with by some kind of source code virus. If you had it in version control, you could revert to a pre-virus version, and then carefully construct patches to bring the code base up to date, but without the self-reproducing code of the virus in it. Seems like a lot of work.

share|improve this answer

Yes, there is known malware out there which infects ftp programs to inject <iframe>-tags into html and php files. Those iframe tags point to drive-by exploits hosted on other servers.

The only reliable way to ensure a clean source code base is to review all checkins done by the comprimised user in the affected timeframe. That is assuming that the compromise did not happen on the source control server itself.

share|improve this answer
    
Thanks, I once had to clean up an attack you mentioned, I was wondering if the injected code would not be in a text format but rather .exe code that could somehow be run when parsed by the server? –  FutuToad Mar 2 '13 at 22:48
    
Yes, it is possible as well that they infect .exe files. This used to be quite common in MS-DOS era, while nowadays it's much easier to make another program that runs in the background than mess with existing files (but it is nevertheless possible). If the program has a valid digital signature from the company authoring it (eg. Microsoft for a program part of Microsoft Windows), then it is likely it wasn't tampered with (see Flame case for an instance where malware authors were able to pass signature validation). –  Ángel Jun 30 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.