Intellectual Property Law

Malware Turns Software Compilers into Virus Breeders

By Kevin Poulsen

Security experts seem more intrigued than alarmed over a newly-discovered virus that inserts itself into a Delphi compiler, and replicates itself in every program compiled.

Sophos says its seen 3,000 instances of the Induc virus in the wild, where it’s popped up in some production software. “This makes us believe that the malware has been active for some time, and that a number of software houses specializing in developing applications with Delphi must have been infected,” writes Sophos’ Graham Cluley on his blog.

The virus also reportedly hitched a ride on the free CD ROM that shipped with the latest issue of ComputerBild, one of Germany’s largest computer magazines.

Fortunately, Induc has no malicious payload — it just spreads. The could mean it was intended as a harmless prank, perhaps pulled off by a Computer Science undergrad assigned to read Ken Thompson’s seminal “Reflections on Trusting Trust” (.pdf), which posited a similar attack 25 years ago.

“Right now it’s rather hard to say who was the author and what were his motives, because in the current stage virus is not harmful,” writes Kaspersky Lab’s Alexander Ivanyuk, in an e-mail to Threat Level. “At the same time we all understand that such proof of concepts can later be used (because of its interesting model of distribution) for something harmful.”

Ironically, Induc is showing up in Trojan horse programs designed to steal online banking credentials, according to Cluley. That suggests the compter underground — which favors Delphi for rapid Trojan production — has itself been infected.

Full post as published by Threat Level on August 21, 2009 (boomark / email).