5

If a user was infected with a file altering virus is it possible that checked in code (files containing text) to the source control could contain dangerous properties.

I ask this after this got me thinking:

Installing a new version of the operating system over the compromised operating is not a good solution as files may have been altered that could affect the new system. Even copying business critical information from a compromised system is a risk as that data may have been altered in some manner by use of the backdoor.

If so how would one clean up the code base?

Improve this question

2 Answers 2

Reset to default
4

Yes. As early as 1990, Peter DaSilva had circulated a cautionary tale about a source code virus. It reads a lot like a design document for such a virus. I don't believe that one was ever implemented, or at least nobody I know of has confessed to trying it.

In 1989, the Usenix Association published Computing Systems Volume 2, Number 2. This had an article, Virology 101, by Doug McIlroy. That article walks you through writing a shell-script virus, which infects source code. I think that shell-script virus would work today, probably requiring minor syntax fix ups.

I'm not at all sure how you'd go about cleaning up a code base that had been messed with by some kind of source code virus. If you had it in version control, you could revert to a pre-virus version, and then carefully construct patches to bring the code base up to date, but without the self-reproducing code of the virus in it. Seems like a lot of work.

Improve this answer
1
  • Modifying source code on disk is child's play compared to doing just-in-time infection, discussed in 1984, the famous "Reflections on Trusting Trust" paper. dl.acm.org/doi/10.1145/358198.358210
    – Ben Voigt
    Commented Feb 15, 2023 at 17:13
2

Yes, there is known malware out there which infects ftp programs to inject <iframe>-tags into html and php files. Those iframe tags point to drive-by exploits hosted on other servers.

The only reliable way to ensure a clean source code base is to review all checkins done by the comprimised user in the affected timeframe. That is assuming that the compromise did not happen on the source control server itself.

Improve this answer
2
  • Thanks, I once had to clean up an attack you mentioned, I was wondering if the injected code would not be in a text format but rather .exe code that could somehow be run when parsed by the server?
    – FutuToad
    Commented Mar 2, 2013 at 22:48
  • Yes, it is possible as well that they infect .exe files. This used to be quite common in MS-DOS era, while nowadays it's much easier to make another program that runs in the background than mess with existing files (but it is nevertheless possible). If the program has a valid digital signature from the company authoring it (eg. Microsoft for a program part of Microsoft Windows), then it is likely it wasn't tampered with (see Flame case for an instance where malware authors were able to pass signature validation).
    – Ángel
    Commented Jun 30, 2014 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .