{"id":1717,"date":"2009-08-20T06:56:17","date_gmt":"2009-08-20T05:56:17","guid":{"rendered":"http:\/\/www.itwriting.com\/blog\/1717-delphi-developer-virus-exposes-weakness-in-anti-virus-defences.html"},"modified":"2009-08-20T06:56:17","modified_gmt":"2009-08-20T05:56:17","slug":"delphi-developer-virus-exposes-weakness-in-anti-virus-defences","status":"publish","type":"post","link":"https:\/\/www.itwriting.com\/blog\/1717-delphi-developer-virus-exposes-weakness-in-anti-virus-defences.html","title":{"rendered":"Delphi developer virus exposes weakness in anti-virus defences"},"content":{"rendered":"

I found a real live instance of the Delphi-attacking virus W32\/Induc-A yesterday. It was in the executable for FinalBurner Free<\/a> from ProtectedSoft (ironic name in the circumstances), a decent freeware CD burning application. The file is burner.exe and I suspect the company has been shipping it for some time. I do not know if it affects the paid-for versions. <\/p>\n

<\/p>\n

This malware was highlighted by Sophos<\/a> though one thing Sophos does not make clear (as it is in the scaremongering business) is that the virus has only a mild affect. It only affects machines with ancient versions of Delphi installed \u2013 versions 5, 6 and 7 according to Marco Cantu<\/a> \u2013 and its activity appears to be limited to replication. In other words, a successfully infected machine modifies Delphi\u2019s runtime library so that it compiles infected executables, but does nothing else that I know of.<\/p>\n

The implication is that the anti-virus companies, far from doing a great job at protecting us, have only just spotted a problem that has been around for months or possibly years. The burner.exe I found was dated 16 June 2009. If anyone has an older example, I would be interested to know; I\u2019ve seen one report of an August 2008 infection.<\/p>\n

Thus, when Delphi Product Manager Mike Rozlog comments to the Register\u2019s report<\/a>:<\/p>\n

\n

The best ways to combat these types of issues are to establish a deployment protocol that checks for viruses and trojans before shipping any applications<\/p>\n<\/blockquote>\n

you have to ask: how? Clearly scanning with an anti-virus product would not have helped ProtectedSoft. Note that Sophos admits in its database<\/a> that protection has been available only since 18 August 2009. <\/p>\n

Despite the mild impact of W32\/Induc-A (as far as we know so far) it is not something to take lightly. The attack looks like a proof-of-concept, to be followed by similar code with more serious impact, or possibly just an experiment that escaped into the wild. Maybe there are other more serious variants that the vigilant anti-virus folk will find in a month or two\u2019s time.<\/p>\n

How then can developers protect their machines? Another Reg reader says:<\/p>\n

\n

Instead, people should try to ensure the integrity of their development systems. Don’t connect them to the ‘net and don’t play games on them (duh!). Don’t have any foreign executables on them besides the OS and the compiler, transfer the sources there and compile them there. Run some kind of integrity checker to make sure that your compiler distribution hasn’t been tampered with. That sort of stuff.<\/p>\n<\/blockquote>\n

Good advice, though not trivial to implement. A suggestion for Embarcardero<\/a>: how about giving some thought to the problem and coming up with an easy means for developers to check the integrity of their runtime library files? <\/p>\n

The disturbing aspect of this story is how malware can end up in shipping software from reputable companies; it could even be signed code. How long before something like this ends up in an executable shipped with an operating system itself, maybe with a timed payload so it lies dormant until well distributed?<\/p>\n

Technorati Tags: delphi<\/a>,embarcadero<\/a>,anti-virus<\/a>,sophos<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

I found a real live instance of the Delphi-attacking virus W32\/Induc-A yesterday. It was in the executable for FinalBurner Free from ProtectedSoft (ironic name in the circumstances), a decent freeware CD burning application. The file is burner.exe and I suspect the company has been shipping it for some time. I do not know if it … Continue reading Delphi developer virus exposes weakness in anti-virus defences<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,31,80],"tags":[],"class_list":["post-1717","post","type-post","status-publish","format-standard","hentry","category-delphi","category-embarcadero","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/1717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/comments?post=1717"}],"version-history":[{"count":0,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/posts\/1717\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/media?parent=1717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/categories?post=1717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.itwriting.com\/blog\/wp-json\/wp\/v2\/tags?post=1717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}