PCWDIMMN.RVW 921109
Comparison Review
Company and product:
Western Digital Corporation
8105 Irvine Center Drive
Irvine, CA 92716
714-932-5000
714-932-6250 Letty Ledbetter
Robert McCarroll, Product Manager, Systems Logic Group
714-932-7013 Terry Walker (and Robert Lee, developer) fax: 714-932-7097
Mark Levitt fax: 714-932-7098
Benjamin Group (marketing)
Suite 480, 100 Pacifica Ave.
Irvine, CA 92718
714-753-0755 (Erin Jones, Sari Barnhard and Carolyn Fromm) fax: 714-753-0844
Immunizer (new technology to be announced 921109)
Summary: concept proposal for hardware component for data security
Cost: N/A
Rating (1-4, 1 = poor, 4 = very good)
"Friendliness"
Installation 1
Ease of use 1
Help systems 1
Compatibility 2
Company
Stability 2
Support 1
Documentation 1
Hardware required 2
Performance 2
Availability 1
Local Support 1
General Description:
The "Immunizer" concept involves a cooperative effort between BIOS makers,
board manufacturers and antiviral software producers. The central component,
as far as Western Digital is concerned, is the 7855 system controller chip.
With proper implementation, the concept should allow protection of hard disk
and memory areas, while at the same time allowing the user the option to "lift"
the protection via software in order to allow for normal system maintenance
functions.
Comparison of features and specifications
User Friendliness
Installation
The test unit arrived with the Immunizer protection in place. The notes with
the system do not specify how the protection program (ANTIDOTE) was to be
invoked or removed, other than at boot time.
Physical examination of the unit found an AMD NG80386SXLVIO-25 CPU and a Caviar
280 85Meg drive. Bus slots were labelled "do not use bus" and "5V". The
system boot messages referred to a "7855 3.3V Notebook system".
Initial assessment of the system found that the two FAT tables did not agree,
and that there were numerous "duplicate filenames" in the root and directories
created before the system was shipped. Examination of the root directory
showed multiple filenames of ANTIDOTES_R. (Addition and protection of new
program files increases the number of these entries.)
To begin with, I could not understand the purpose of these files, supposing
that they might point to table information regarding which files were to be
protected. However, the number of protected files did not exactly correspond
with the number of ANTIDOTES_R entries. Eventually I found that groups of
these entries always end at sector boundaries. This would indicate that
protection is on the basis of disk sectors and that the entries are used as
"spacers" to keep data files out of the protected sectors.
Note that removal of these file entries requires sector editing, and that
directories that have such entries cannot be removed even if "all files" have
been deleted from the directory. I had hoped that disabling protection,
deleting all files, and then running the "organize and protect" function again
would solve the problem, but it did not. It did, however, remove the
protection from the directories so that a tool like NDD was able to remove
duplicate entries. One ANTIDOTES_R entry remained, and could not be deleted
from the command line, but another utility program was then able to remove the
single remaining entry. This, however, seems to be excessive trouble for such
a common procedure.
Analysis of the FAT with one tool initially showed that a file at cluster 5276
had no directory entry. On a second run, that had changed to 5398. Further
runs after addition of more files indicated that this particular cluster is a
fixture of the system. Examination showed the contents to be very similar, and
similar to the FAT data structure.
Ease of use
As noted, the notes shipped with the test system did not indicate how to invoke
the ANTIDOTE program, other than by rebooting the computer.
An attempt to write to the root directory entries (overwriting the duplicated
ANTIDOTES_R filenames, in fact) with PCTools invoked an alert screen. This
screen stated that a suspicious write had been detected. The options presented
were to reboot the computer, or to disable protection. There was no option to
disallow the operation, but continue with the session. The screen noted that
if the operation was allowed to proceed, ANTIDOTE would not be active until
again invoked (by rebooting?). Choosing to reboot presents a second screen to
confirm the choice. The system appears to be able to discriminate between
program and non-program directory entries.
(Subsequent testing demonstrated that the alert system, at least, would remain
in place even if the option to disable protection was selected.)
There are only six menu selectable items on the main ANTIDOTE screen, and using
the menu should not present any problem to a user with even moderate computer
experience. The only item that presents any further complexity of use is the
option to select files to be protected. It should be comprehensible to any
user of "dual window" file managers.
Help systems
None provided aside from brief (one sentence) explanations of the six menu
items on the ANTIDOTE program.
Compatibility
Utility programs show numerous potential problems with inconsistent entries
between the two FAT tables, and with numerous "duplicate" filenames, as well as
lost chains whenever the "Protect" functions are used. Use of programs to
attempt to correct these problems is almost inevitably fatal. The ANTIDOTES_R
"files" are, of course, part of the protection system, and rightly attempt to
defend themselves, but it would help if the implementation was not such a
problem to other utilities. Attempts to reconcile the two FAT tables appear to
be allowed, but will need to be done again after each use of the ANTIDOTE
program to protect new or modified files.
An attempt to test compatibility with other antiviral programs raised an
interesting point. The protection system does *not* appear to really start
from the BIOS level. Installation of the DISKSECURE system seemed to eliminate
the ANTIDOTE system entirely. However, attempts to infect the system with boot
sector infectors from floppies did not work: the system was able to prevent
infection.
There is considerable interference from the system in terms of false alarms.
In fact, there were numerous times when the "alert" screen popped up when no
disk activity should have been taking place. In the limited time available it
is difficult to say for sure how much was unwarranted interference with normal
operations, particularly as the only option is to reboot or shut down the
protection.
Initially, I was not aware of too many false alarms; after all, I had little
idea of how the system should work and was obviously making mistakes. As I
started to load software into it, I began to suspect that large scale copying
operations "confused" the system as to what was supposed to be protected. The
problem seems to get much worse as the disk is "loaded": at 80% full the system
"alarms" on almost every operation that copies data, or even reads the disk.
At 95% full, invocation of programs larger than one cluster will consistently
generate a warning.
I was, however, able to determine that numerous alerts (at least six when I
tested the system conditions both before and after the alert) were fully in
error. Some of the cases were inconsistent in generating the warnings. In any
case, false alarms seem to occur at a rate of one out of ten disk operations
when the disk is half full.
At 95% full or higher, there are also numerous false alarms when the system
boots. Interestingly, removal of programs to reduce the "load" to 60% and
reprotecting the system did not rectify the errors. ("Cold" booting does
improve the success rate.)
There are occasions, however, when the "false" alarms aren't really false, but
are misleading just the same. This occurs when a protected program or file has
been deleted. As noted, the system allows you the option of allowing an
operation. The alert screen states that the protection system will be shut
down after a restricted operation is allowed, but, in fact, doesn't.
Therefore, while the area formerly occupied by the deleted file looks (to DOS)
to be available, to the protection system this area of the disk is still to be
protected. This is more than just a bug in the current implementation; it is a
significant obstacle to the utility of the concept as a whole, and needs to be
seriously addressed.
Another bug in the current program concerns the computer system it is installed
in, and the diagnostics. Roughly half of the attempts to reboot the system
resulted in some failure of the diagnostic tests, although there was no
apparent problem with the items that had failed.
It should be noted that, aside from the rather random interference with normal
computer operations that go on from time to time, nothing in the system
mitigates against "companion" (also known as "spawning" or "precedence") viral
programs. Duplicate filenames with different extensions may exist, and are not
noted in any way.
The system, as currently configured, prevents booting from a floppy disk except
when the protection is disabled. While this seems generally reasonable, note
that it means that checking of the system is problematic. (During testing, I
attempted a "clean boot" to ensure that a stealth virus had not, in fact,
affected the system. I then, inadvertently, wiped out the disk with a trojan.)
If the system is infected by a boot sector infector, it will not prevent
subsequent infection of floppy diskettes.
A version of the Traceback virus was able to consistently lock up the system.
This should be explored as indicating a possible weakness in the protection
system.
Company Stability
Western Digital is well known for their drive controller and network cards.
This is their first effort in the antiviral arena.
Company Support
I was first contacted by "The Benjamin Group", which appears to be a marketing
company hired by Western Digital for the promotion of this concept. An
evaluation unit was promised to be shipped. I was very careful to spell out
the conditions under which I would accept the unit for review: these were
agreed to by Benjamin, but were apparently not communicated to Western Digital.
Significant problems were encountered in shipping. The unit was to have been
shipped over the weekend: because of problems with declarations at Customs the
shipment was received a week late. Equal, or worse, problems were encountered
in attempting to get information from Western Digital in order to return the
unit.
Because of the miscommunication over review conditions, and because of the
delay in shipping, this review has been conducted under less than ideal
conditions and time frame. A series of questions was put to Western Digital in
order to better structure the review. Unfortunately, the answers were somewhat
misleading.
Western Digital stated that although full documentation is not available with
the system, some description of the concepts and theory were enclosed with the
package. User notes were said to be enclosed regarding the anti-viral
management software. In fact, there was no material relating to the theory and
concept, and the user notes simply reproduced the explanations listed with each
menu item on the ANTIDOTE screen.
The software and system was said to be complete and debugged so far as the
"proof of concept" is concerned, although it was not to be judged as a
commercial and saleable product. This is fair as far as it goes, but it would
be hard to defend the mistakes that the system makes in terms of losing files
and clusters in terms of a fully debugged program.
Some software, particularly Windows 3.1, was said to be installed and available
on the system. In fact, only MS-DOS (and not all of that), F-PROT and a virus
"storyboard" presentation were on the system.
There were additional problems with contacts. Phone calls and faxes were not
returned. Several times Western Digital requested action on my part on a rush
basis, but when further information was requested in order to pursue this
action, calls by me were left unreturned by Western Digital for days at a time.
To date I am still waiting for some materials promised by Western Digital and
The Benjamin Group.
Documentation
Basically, none is yet available beyond the press releases and a "white paper".
Hardware Requirements
At present, the system is limited to those systems with SMI equipped 386/486
level processors. The system will need the proper BIOS and the WD 7855 system
controller. The protection is limited to ISA IDE hard drives, and only to the
first physical and logical drive.
In terms of exactly how the technology works to protect the disk, it would seem
to be possible in a number of ways. However, the current implementation seems
to require all programs (or other files to be protected) to be contiguous on
the disk. This suggests that the protection is applied on a "cluster" or
"sector" basis, rather than at the higher, logical, level of file protection.
In terms of the files to be protected, this is not a major problem. However,
the FAT clusters must also be protected. (Directory "files" listing the files
within the directory also appear to be protected in some way. Renaming of
files in some ways is allowed: methods that involve direct disk access appear
to be restricted. This may present a security loophole.)
The implications here are more serious since data files, which are not to be
protected, must not occupy any of the clusters in the FAT which are protected.
Observation of the test system indicates that data files are therefore
restricted from certain areas of the disk. The exact restriction will depend
upon the amount of space required for program files, the FAT type (12 or 16
byte), the cluster size and the size of the hard disk. (Given the number of
variables, I have not attempted to calculate specific examples. The precise
extent of this restriction as an obstacle to computing is difficult to
determine.) My initial observations indicated that this might require a
restriction of disk usage limiting disk utilization to 50 percent or possibly
even less. Subsequent observations did not confirm this, since I was able to
fill the disk to 99% capacity. However, it should be noted that when the disk
allocation reached 50% of capacity there was a significant increase in the
number of false alarms.
In relation to this, "FAT" or "system" viral programs were tried against the
Immunizer system. While they did not infect the system, neither did they
prompt any alarms. Although two copies of DIR II were tried, my suspicion is
that somehow the system prevented their operation, rather than preventing the
infection. This will require further testing.
Performance
Invocation of the "Protect" or "Organize and Protect" functions of the ANTIDOTE
program results in a major disk reorganization. Each addition or modification
to a program, therefore, requires significant time for re-establishment of
protection.
In addition, the disk reorganization appears to have some bugs currently, and
each run resulted in some truncated files and lost clusters. The files lost or
truncated tend to be data files, although at least one overlay file was
truncated during testing. Each run also results in inconsistencies between the
two FATs.
After the addition of some files required an "Organize and Protect" run of more
than 35 minutes duration, I attempted to build a metric for this activity.
Therefore, having protected, organized and cleaned up the disk errors on the
system, I installed Windows 3.0 as being fairly representative of the mix of
programs and data in today's commercial software. 52 megabytes of the 83
megabytes available on disk were occupied, and Windows added approximately 5
megabytes to that. The organize and protect run took 21 minutes to complete.
An initial run with CHKDSK did not find any lost clusters. Correcting the FAT
inconsistencies with NDD took a further 9 minutes. It found four truncated
files and 97 chains of 1218 lost clusters, the correction of which took a
further 3 minutes. The cost of the addition and protection of one commercial
package, therefore, is generally more than half an hour for protection, and a
random loss of data files.
However, observation suggests that this is neither consistent nor predictable.
Most runs took 30 to 40 minutes, regardless of the space available on disk or
the number and size of program files added. On the other hand, after one
addition of a large number of program files the organize and protect run took
only five minutes to complete.
A "worst case" test was done with the disk 99% full. This took 4.5 hours to
complete. After this was done, the system "alarmed" on every bootup.
Interestingly, on this run only one file and 24 cluster chains were lost.
Note that removal of files requires a similar time investment. Deleting 35
megabytes of (mostly program) files required an "organize and protect" run of
24 minutes.
Recovery of files was generally unsuccessful. On two notable occasions very
large data files were recovered with reasonable success after extended efforts.
Lost clusters tended to be mixtures of files; in many cases mixtures of files
and directories.
The processing overhead added by the protection system is not perceptible to
the user in normal operation. Numerical tests of disk speed, however, reveal a
very different story.
Coretest Transfer ratePerf. index/ SI Disk Index
with protection349.65.7564.3
without protection942.09.2917.0
While processing does not appear to be adversely affected, disk access
certainly is. Where disk performance is a factor, this must be a
consideration.
Although memory protection was mentioned (in a teleconference promoting the
release) system areas of memory do not appear to be protected. However, upon
further information from the company, an area of memory was found which is
protected.
Additional "bugs" were found in the system. The ANTIDOTE alert screen did not
recognize both "Enter" keys on the keyboard: in certain situations it requires
one, in others the other. At times the system would not "free" memory after a
program had completed a run. At times the system seemed to interfere with
parameters being passed to programs.
Support Requirements
Even without the bugs, the current concept would need to be installed and
managed by those who thoroughly understood both virus protection and the level
and type of activity on the computer to be protected. Certain files not
covered by the default protection would need to be added and certain programs
would need to be "writable" in certain situations. It is, of course, possible
for the user or operator to override the protection, but they would need to be
informed of the times when they safely could, and times when they shouldn't.
The fact that the alert screen is so vague does not help this decision, but
this could be changed, hopefully without adding too much overhead. The
addition of more "intelligence" to the alert screen, in order to inform the
user of what part of the disk was being written to, and what the implications
were, would help here.
General Notes
The concept appears to have substantial potential. However, the current
implementation has a sufficient number of bugs as to make judgement of the
value of the concept, separate from this implementation, problematic.
As currently implemented, the system does appear to provide substantial
protection against infection of program and specific protected files on the
target machine by most types of viral and trojan programs. The cost of this
protection, in terms of the reduced utility of the system, would be
unacceptable in all but the highest risk environments. A combination of
software defenses and user training would provide almost the same level of
protection at greatly reduced cost.
There are indications of loopholes in the current implementation. Specific
identification of such requires further testing.
This concept should be pursued, but in conjunction with established antiviral
researchers and antiviral software developers. Numerous existing programs
could contribute to patching the gaps in this implementation.
copyright Robert M. Slade, 1992 PCWDIMMN.RVW 921109
======================
roberts@decus.ca Rob.Slade@f733.n153.z1.fidonet.org rslade@vanisl.decus.ca
Crossbows don't kill people, quarrels kill people
Author "Robert Slade's Guide to Computer Viruses" 0-387-94663-2 (800-SPRINGER)