avertissement concernant ie cdrom - link.springer.com978-2-287-98240-8/1.pdf · ce cdrom ne...
TRANSCRIPT
Avertissement concernant IeCDROM
Le CDROM accompagnant le present ouvrage est destine a un usage exclusivement academique (enseignement et recherche). Tout autre usage estformellement condamne par l'auteur. Avant utilisation, il est vivement recommando de lire la partie du chapitre 6 consacree aux aspects legaux dela virologie informatique, pour s'assurer que l'utilisation des donnees se faitdans le strict respect de la legislation en vigueur.
Ce CDROM ne contient AUCUN code executable d'aucune sorte (virus,programmes... ). Le lecteur ne court donc aucun risque d'infection en l'utilisanto Deux formats de fichiers ont ete exclusivement utilises:
- format HTML simple, sans aucun langage de script, d'aucune sorte. IIs'agit des pages de presentation destinees a une utilisation ergonomiquedu support et des donnees qu'il contient ;
- format PDF, pour toutes les autres donnees proprement dites : articles etcodes de virus essentiellement. II a ete genere a partir de fichiers POST
SCRIPT produits par Ib-1EX et convertis via la commande ps2pdf13.
En particulier, l'utilisation des codes sources fournis sur le CDROM nepeut etre fortuite. Elle reclame une demarche active et volontaire de la partdu lecteur (saisie du code et compilation), qui de ce fait engage sa propreresnonsabilite,
References
1. Adleman L. M. (1988) An Abstract Theory of Computer Viruses. In Advances inCryptology- CRYPTO'88, pp 354-374, Springer.
2. Adobe Systems Inc. (2004) PDF Reference Version 1.6. Fifth Edition. http://WTifW .adobe. com/support/
3. Agence France Presse (2005) Worms do China's spying, 25 juillet 2005, Bureau deWashington.
4. Aho A., Hopcroft J. E. et Ullman J D (1975) The Design and Analysis of ComputerAlgorithms. Addison Wesley.
5. Aleph One (2000) Smashing the stack for fun and profit, Phrack Journal, Vol. 7, no.49, www.phrack.org.
6. J. Anders, Net filter spies on kid's surfing, 25 janvier 2001, http://zdnet . com/2100-11-527592.html
7. Anderson J. P. (1972) Computer Security Technology Planning Study, TechnicalReport ESD-TR-73-51, US Air Force Electronic Systems Division, October.
8. Anderson R. (2001) Security Engineering, Wiley.
9. Anderson R. (2002) Trusted Computing Frequently Asked Questions,TCPA/Palladium/NGSCB/TCG, disponible sur www.cl.cam.ac . uk/"'rja14/tcpa-faq.html
10. Arbib M. A. (1966) A simple self-reproducing universal automaton, Infor. and Cont.,9, pp. 177-189.
11. Areas G. et Mell X. (2006) Botnets : la menace fantome ... ou pas. MISC, Le journalde la securite informatique, Numero 27, pp. 4-11.
12. Areas G. et Mell X. (2007) Botnets : le pire contre attaque. MISC, Le journal de lasecurite informatique, Numero 30, pp. 4 - 9.
13. Areas G. (2008) Take a Walk on the Wild Side, Actes de la conference SSTIC 2008,pp. 350 - 361, www. sstic. org.
14. Antivirus AVP - www.avp.ch.
15. Azatasou D., Tanakwang A. (2003) Etude de faisabilite d'un virus de Bios, Mcmoirede stave inzenieur. Ecole Sunerieure et d' Annlication des Transmissions. Rennes.
552 References
16. Bailleux C. (2002) Petits debordements de tampon dans la pile, MISC, Le journalde la securite informatique, Numero 2.
17. Balepin 1. (2003) Superworms and Cryptovirology : a Deadly Combination, http://wwwcsif.cs.ucdavis.edu/~balepin/new_pubs/worms-cryptovirology.pdf
18. Barel M. (2004) Nouvel article 323-3-1 du Code Penal: le cheval de Troie du legislateur?, MISC, Le journal de la securite informatique, Numero 14.
19. Barwise J. (1983) Handbook of Mathematical Logic, North-Holland.
20. Beaucamps P., Filiol E. (2006) On the possibility of practically obfuscating programs- Towards a unified perspective of code protection, Journal in Computer Virology,(2)-4, WTCV'06 Special Issue, G. Bonfante & J.-Y. Marion eds.
21. Bell D. E., LaPadula L. J. (1973) Secure Computer Systems: Mathematical Foundations and Model, The Mitre Corporation.
22. Biba K. J. (1977) Integrity Considerations for Secure Computer Systems, USAFElectronic Systems Division.
23. Bidault M. (2002) Creation de macros VBA pour Office 97, 2000 et XP, CampusPress.
24. Bidou, R. (2007) Bots, bots et autres bots : une petite taxonomie. MISC, Le journalde la securite informatique, Numero 30, pp. 10 - 13.
25. Bishop, M. (2003) Computer Security: art and science, Addison Wesley.
26. Blaess C. (2000) Programmation systeme en C sous Linux, Eyrolles.
27. Blaess C. (2002) Langages de scripts sous Linux, Eyrolles.
28. Blaess C. (2002) Virologie : NIMDA, MISC, Le journal de la securite informatique,Numero 1.
29. Blonce A., Filiol E. et Frayssignes L. (2008) Portable Document Format (PDF) Security Analysis and Malware Threats. Black Hat Europe 2008 Conference, Amsterdam,mars 2008, www.blackhat.com/archives
30. Bonfante G., Kaczmarek M. et Marion J.-Y. (2006) On Abstract Computer Virologyfrom a Recursion Theoretic Perspective, Journal in Computer Virology, 1(3-4), pp.45 - 54. II s'agit de la version etendue de l'article Toward an Abstract ComputerVirology, publie dans le volume 3722 des Lecture Notes in Computer Science, pp.579 - 593, en 2005.
31. Bonfante G., Kaczmarek M. et Marion J.-Y. (2007) A Classification of VirusesThrough Recursion Theorems, CiE Proceedings, Lecture Notes in Computer Science4497, 73 - 82, Springer Verlag.
32. Bontchev V. (1995) Are "good" computer virusses still a bad idea, www. virusbtn.com/old/OtherPapers/GoodVir
33. Boyer R. S. et Moore J. S. (1977) A fast string searching algorithm algorithm. Communications of the ACM, Vol. 20, Nr 10, pp. 262-272.
34. Brassier M. (2003) Mise en place d'une cellule de veille technologique, MISC Lejournal de la securite informatique, numero 5, pp 6-11.
35. Bridis T. (2001) FBI Develops Eavesdropping Tools. Washington Post, November22nd.
36. Brulez N. (2003) Analyse d'un ver par desassemblage, MISC, Le journal de la securiteinformatiaue. Numero 5.
References 553
37. Brulez N. (2003) Techniques de reverse engineering - Analyse d'un code verrouille,MISC, Le journal de la securite informatique, Numero 7.
38. Brulez N. (2003) Faiblesses des protections d'executable PE. Etude de cas: Asprotect, Actes de la conference SSTIC 2003, pp. 102-121, www. sstic. org
39. Brulez N., Filiol E. (2003) Analyse d'un ver ultra-rapide : Sapphire/Slammer, MISC,Le journal de la securite informatique, Numero 8.
40. Burks A. W. (1970) Essays on Cellular Automata, University of Illinois Press, Urbanaand London.
41. Byl J. (1989) Self-reproduction in cellular automata, Physica D, 34, pp. 295-299.
42. Calmette-Vallee V., de Royer Dupre S., Filiol E. et Le Bouter G. (2008) Passiveand Active Leakage of Secret Data from Non Networked Computers. Black Hat LasVegas, Las Vegas, aout 2008. Disponible sur www.blackhat.com/archives
43. Cantero A .(2003) Droit penal et cybercriminalite : la repression des infractions lieesaux TIC, Actes de la conference SSTIC 2003, www. sstic. org
44. Caprioli E. A. (2002) Les moyens juridiques de lutte contre la cybercriminalite, RevueRisques, Les Cahiers de l'assurance, juillet-septembre, numcro 51.
45. CERT (2000) http://www . cert. org/advisories/CA-2000-02 .html
46. Chambet P., Detoisien E. et Filiol E. (2003) La fuite d'information dans les documents proprietaires, MISC, Le journal de la securite informatique, Numero 7.
47. Chambet P. (2005) FakeNetBIOS, French Honeynet Projet Homepage, http: / /honeynet.rstack.org/tools.php
48. Chess D. M., White S. R. (2000) An undetectable computer virus, Virus BulletinConference, September.
49. Church A. (1941) The calculi of lambda-conversion, Annals of Mathematical Studies,6, Princeton University Press.
50. Codd, E. F. (1968) Cellular Automata, Academic Press.
51. Cohen F. (1986) Computer viruses, Ph. D Thesis, University of Southern California,Janvier 1986.
52. Cohen F. (1994) A Short Course on Computer viruses, Wiley.
53. Cohen F. (1994) It's alive, Wiley.
54. Cohen F. (1987) Computer Viruses - Theory and Experiments, IFIP-TC11 Computers and Security, vol. 6, pp 22-35.
55. Cohen F. (1985) A Secure Computer Network Design, IFIP-TC11 Computers andSecurity, vol. 6, vol. 4, no. 3, pp 189-205.
56. Cohen F. (1985) Protection and Administration on Information Networks under Partial Orderings, IFIP-TC11 Computers and Security, vol. 6, pp 118-128.
57. Cohen F. (1987) Design and Administration of Distributed and Hierarchical Information Networks under Partial Orderings, IFIP-TC11 Computer and Security, vol.6.
58. Cohen F. (1987) Design and Administration of an Information Network under aPartial Ordering: a Case Study, IFIP-TC11 Computer and Security, vol. 6, pp 332338.
59. Cohen F. (1987) A Cryptographic Checksum for Integrity Protection in UntrustedComnuter Svstems. IFIP-TC11 Comnuter and Securitv.
554 References
60. Cohen F. (1988) Models of Practical Defenses against Computer Viruses, IFIP-TC11Computer and Security, vol. 7, no. 6.
61. Cohen F. (1990) ASP 3.0 - The Integrity Shell, Information Protection, vol. 1, no. 1.
62. Cormen T., Leiserson C. and Rivest R. (1990) Introduction to Algorithms, MITPress.
63. Coursen S. (2001) 'Good' viruses have a future, www.surferbeware.com/articles/computer-viruses-article-text-2.htm
64. de Drezigue D. et Hansma N. (2006) Indepth Analysis of The Viral Threats withOpenOffice.org Documents. Journal in Computer Virology, 2 (3), pp. 187£210, Springer.
65. Detoisien E. (2003) Execution de code malveillant sous Internet Explorer 5 et 6,MISC, Le journal de la securite informatique, Numero 5.
66. Devergranne T. (2002) La loi "Godfrain" a l'epreuve du temps, MISC, Le journal dela securite informatique, Numero 2.
67. Devergranne T. (2003) Virus informatiques : aspects juridiques, MISC, Le journalde la securite informatique, Numero 5.
68. Devergranne T. (2003) Le reverse engineering coule-t-il de source 7, MISC, Le journalde la securite informatique, Numero 9.
69. Dewdney A. K. (1984) Metamagical Themas, Scientific American, mars 1984.Concernant le jeu Core Wars consulter egalement www.koth.org/info/sciarn oukuoi.asui.uidaho.edu/~karnikaze/documents/corewar-faq.htm1
70. D'Haeseleer P., Forrest S. et Helman P. (1996) An immunological approach to changedetection: algorithms, analysis ans implications, In Proceedings of the 1996 IEEESymposium of Computer Security and Privacy, IEEE Press, pp. 110-119.
71. Dharwadker A. (2006) The Vertex Cover Algorithm, http://www.geocities.com/dharwadker/vertex_cover
72. Documentation sur le format PE, http://spiff. tripnet. se/~iczelion/files/pel.zip
73. Dobbertin H. (1996) rump session, Eurocrypt'96. Disponible sur www. iacr. org/
conferences/ec96/rump/
74. Dobbertin H. (1996) Cryptanalysis of MD4. In : Gollman D. ed., Third Fast SoftwareEncryption Conference, Lecture Notes in Computer Science 1039, pp 71-82, SpringerVerlag.
75. Dodge Y. (1999) Premiers pas en statistique, Springer-Verlag.
76. Dougherty D., Robbins A. (1990) Sed & Awk, O'Reilly & Associates.
77. Dralet S., Raynal F. (2003) Virus sous Unix ou quand la fiction devient realite, MISC,Le journal de la securite informatique, Numero 5.
78. Dubois M. (2007) Virus benefiques, Linux Magazine HS 32, aout 2007.
79. DufLot F. (2004) Les infections informatiques benefiques : chroniques d'un anatheme. Juriscom editions. Disponible sur http://www.juriscom.net/documents/virus2005l227.pdf
80. Eichin M. W., Rochlis J. A. (1988) With microscope and tweezers: an analysis ofthe Internet virus of november 1988, IEEE Symposium on Research in Security andPrivacv.
References 555
81. Espiner T. (2006) Hackers attacked parliament using WMF exploit, ZdNetUK, 23 janvier 2006, http://news . zdnet . co . uk/ internet/security/0, 39020375,39248387,OO.htm
82. eEye Digital Security (1999) Retina vs lIS 4, Round 2, www.eeye.com/html/Research/Advisories/AD19990608.html
83. Evrard P. et Filiol E. (2007) Guerre, guerilla et terrorisme informatique : fiction ourealite. MISC, Le journal de la securite informatique, numcro 33, pp. 09-17.
84. Evrard P. et Filiol E. (2008) Guerre, guerilla et terrorisme informatique : du traffic d'armes numeriques a la protection des infrastructures. Journal de la securiteinformatique MISC 35, pp. 4-13, janvier 2008.
85. Evrard P. et Filiol E. (2008) Lutte informatique offensive: les « bons » la « brute» etles « mechants ». MISC 36, pp. 22-31, mars 2008.
86. Filiol E. (2002) Applied Cryptanalysis of Cryptosystems and Computer Attacks Through Hidden Ciphertexts Computer Viruses, Rapport de recherche INRIA numero 4359. Disponible sur http://www-rocq.inria.fr/codes/Eric . Filiol/papers/rr4359vf.ps.gz
87. Filiol E. (2002) Le ver Code-Red, MISC, Le journal de la securite informatique,Numero 2.
88. Filiol E. (2002) Le virus CIH dit « Chernobyl », MISC, Le journal de la securiteinformatique, Numero 3.
89. Filiol E. (2002) Autopsie du macro-virus Concept, MISC, Le journal de la securiteinformatique, Numero 4.
90. Filiol E. (2003) Les infections informatiques, MISC, Le journal de la securite informatique, Numero 5.
91. Filiol E. (2003) La lutte antivirale : techniques et enjeux, MISC, Le journal de lasecurite informatique, Numero 5.
92. Filiol E. (2003) Le virus de boot furtif Stealth, MISC, Le journal de la securiteinformatique, Numero 6.
93. Filiol E. (2002) L'ingenierie sociale, Linux Magazine 42, Septembre 2002.
94. Filiol E. (2003) Les virus informatiques. Revue des Techniques de I'ingenieur, volumeH 5 440, octobre 2003.
95. Filiol E. (2004) Le ver Blaster/Lovsan, MISC, Le journal de la securite informatique,Numero 11.
96. Filiol E. (2004) Le ver MyDoom, MISC, Le journal de la securite informatique,Numero 13.
97. Filiol E. (2004) Strong Cryptography Armoured Computer Viruses Forbidding CodeAnalysis: the BRADLEY virus, Rapport de recherche INRIA 5250. Disponible sur lesite de l'auteur et de l'INRIA.
98. Filiol E. (2004) Analyses de codes malveillants pour mobiles: le ver CABIR et le virusDUTS. MISC, Le journal de la securite informatique, Numero 16.
99. Filiol E. (2005) SCOB/PADODOR : quand les codes malveillants collaborent. MISC,Le journal de la securite informatique, Numero 17.
100. Filiol E. (2005) Le virus Perrun : mefiez vous des rumeurs ... et des images. MISC,Le iournal de la securite informatiaue. Numero 18. mars 2005.
556 References
101. Filiol E. (2005) Le virus WHALE: le virus se rebiffe. Journal de la securite informatiqueMISC, numero 19, Mai 2005
102. Filiol E., Helenius M. et Zanero S. (2005) Open problems in computer virology,Journal in Computer Virology, Vol. 1, Nr. 3-4.
103. Filiol E. et Jean-Yves Marion (2009) Open problems in computer virology - Part II. A paraitre, Journal in Computer Virology, Springer Verlag.
104. Filiol E. (2006) Techniques virales avancecs, Collection Iris, Springer Verlag France.
105. Filiol E. et Fizaine J.-P. (2006) Le Risque Viral sous OpenOffice.org 2.0.x, MISC, Lejournal de la securite informatique, numero 27.
106. Filiol E., Jacob G, et Le Liard M. (2006) Evaluation Methodology and TheoreticalModel for Antiviral Behavioural Detection Strategies. WTCV'06 Special Issue, G.Bonfante & J.-Y. Marion eds, Journal in Computer Virology, 2 (4), 2006.
107. Filiol E. (2007) Formalisation and Implementation Aspects of k-ary (malicious)codes, Journal in Computer Virology, EICAR 2007 Best Academic Papers, V. Broucek Editor, 3 (2), 2007.
108. Filiol E., Franc E., Moquet B. and Roblot G. (2007) SUWAST : a large-scale simulation environment for worm network attacks. Technical Report ESAT 2007 11.
109. Filiol E., Franc E., Moquet B. et Roblot G. (2007) Combinatorial Optimisation ofWorm Propagation on an Unknown Network. International Journal in ComputerScience, 2 (2), pp. 124-130.
110. Filiol E, et Fizaine J.P. (2007) Les virus applicatifs multi plates-formes. MISC, Lejournal de la securite informatique, numero 34, pp. 52-58, novembre/decembre 2007.
111. Filiol E. et Fizaine J. P. (2007) OpenOffice security and viral risk, Part I (septembre2007) and Part II (octobre 2007), Virus Bulletin, pp. 11-17, http://www.virusbtn.
com
112. Filiol E. et Fizaine J.-P. (2007) Max OS X n'est pas invulnerable aux virus: commentun virus se fait compagnon. Linux Magazine HS 32, pp. 20-31, aout 2007.
113. Filiol E. (2007) Analyse du macro-ver OpenOffice/BadBunny. MISC, Le journal dela securite informatique numero 34, pp. 18-20, novernbre /decembre 2007.
114. Filiol E., Geffard G., Jacob G., Josse S., Quenez D. (2008) Analyse de l'antivirus DrWeb : l'antivirus qui venait du froid. MISC, Le journal de la securite informatique,numero 38, pp. 04-17, juillet.
115. Filiol E. (2009) Operational aspects of cyberwarfare or cyber-terrorist attacks: whata truly devastating attack could do. In : European Conference in Information Warfare2009, Lisbonne, Portugal. A paraitre, 2009.
116. FIPS 180-1 (1995) Secure Hash Standard, Federal Information Processing StandardsPublication 180-1, US Dept of Commerce/NIST.
117. Fix B., A Strange Story, http://www.aspector.com/ ...brf/devstuff/rahab/rahab.
html
118. Fogie S., Grossman J., Hansen R., Rager A. et Petkov P. D. (2007) XSS Exploits:Cross Site Scripting Attacks and Defense, Syngress, ISBN-13 978-1597491549.
119. Foll C. (2008) Emulation d'architectures reseau, MISC, Le journal de la securiteinformatiaue. numero 40. DD. 53 - 59.
References 557
120. Forrest S., Hofmeyr S. A. et Somayaji A. (1997) Computer Immunology, In Communications of the ACM, Vol. 40, No 10, Octobre, pp. 88-96.
121. Foucal A. et Martineau T. (2003) Application concrete d'une politique antivirus,MISC Le journal de la securite informatique, numcro 5, pp 36-40.
122. Antivirus F-Secure - www.fsecure.com
123. News F-Secure (2003) A potentially massive Internet attack starts today, disponiblesur www.f-secure.com/news/items/news_2003082200.shtml
124. Garcia R., La protection contre les virus est-elle encore possible?, SecuriteInformatique-CNRS No 38, fevrier 2002.
125. Gardner M. (1970) Mathematical Games : The fantastic Combinations of JohnConway's New Solitaire Game 'Life', Scientific American, 223, 4, pp. 120-123
126. Gardner M. (1983) The Game of Life Part I-III, in Wheels, Life and other Mathematical Amusements, p 219-222, W. H. Freeman.
127. Girard M., Hirth L. (1980) Virologie generale et moleculaire, editions Doin.
128. Gleissner W. (1989) A Mathematical Theory for the Spread of Computer Viruses,Computers €3 Security, 8, pp. 35 - 41. Une version electronique de cet article estdisponible via lc lien http://vx . netlux. org/lib/mwg02 . html
129. Codcl K. (1931) Uber formal unenscheidbare Satze des Principia Mathematica uneverwandter Systeme, Monatsh. Math. Phys., 38, 173-198.
130. GOST 28147-89 (1989) Cryptographic Protection for Data Processing Systems. Government Committee of the USSR for Standards.
131. Gubiolli A. (2007) Un simulatore della diffusione di worm in un sistema informatico,Master's Thesis, Politecnico di Milano. Mcmoire prepare au sein du laboratoire devirologie et de cryptologie de l'Ecole Superieure et d' Application des Transmissions.
132. Gratzer G. (1971) Lattice Theory: First Concepts and Distributive Lattices, W. H.Freeman.
133. Harley D., Slade R., Gattiker U. E. (2002) Virus: Definitions, mecanismcs et antidotes, Campus Press.
134. Herman G. T. (1973) On universal computer-constructors, Information ProcessingLetters, 2, pp. 61-64.
135. Hopcroft J. E., Ullman J. D. (1979) Introduction to Automata Theory, Languagesand Computation, Addison Wesley.
136. Huang Y. J. et Cohen F. (1989) Some Weak Points of one Fast Cryptographic Checksum Algorithm and Its Improvements, IFIP-TC11 Computers and Security, vol. 8,no. 1.
137. Hruska J. (2002) Computer virus prevention: a primer, http://www.sophos.com/virusinfo/whitepapers/prevention.html
138. Hypponen M. (2008) F-Secure Weblog : Monthly Archives - June of 2008. Creatingmalicious PDF files (2 juin 2008).
139. Ilachinski A. (2001) Cellular Automata: A Discrete Universe, World Scientific.
140. Inside the Windows 95 registration wizard, http://www . enemy. org/essays/2000/reQ"wiz.shtml
558 References
141. Jacob G., Filiol E., Debar H. (2008) Behavioral Detection of Malware : From aSurvey Towards an Established Taxonomy, WTCV'07 Special Issue, G. Bonfante &J.-Y. Marion eds, Journal in Computer Virology, 4 (3), pp. 251-266.
142. Jacob G., Filiol E., Debar H. (2008) Malware as Interaction Machines : A NewFramework for Behavior Modelling. WTCV'07 Special Issue, G. Bonfante & J.-Y.Marion eds, Journal in Computer Virology, 4 (3), pp. 235 - 250.
143. Jacob G., Filiol E., Debar H. (2008) Functional Polymorphic Engines: Formalisation,Implementation and Use cases, Proceedings of the 17th EICAR Conference, Laval,France, may 2008.
144. Jones N. D., Gomard C. K. et Sestoft P. (1985) Partial Evaluation and AutomaticProgram Generation, Prentice Hall, 1993.
145. Jones N. D. (1997) Computability and complexity: from a programming perspective,MIT Press, Cambridge, MA, USA, ISBN 0-262-10064-9.
146. Kleene S. C. (1936) General recursive functions of natural numbers, MathematischeAnnalen, 112, pp. 727-742.
147. Kaczmarek, M. (2008) Des fondements de la virologie informatique vers une une im-munologie formelle. These de doctorat, Institut National Polytechnique de Lorraine.
148. Kleene S. C. (1938) On Notation for ordinal numbers, J. Symbolic Logic, 3, 150-155.
149. Kleene S. C. (1952) Introduction to Metamathematics, Van Nostrand.
150. Korf R. E. (1999) Artificial Intelligence Search Algorithms, dans Atallah M. J. editeur, Algorithms and Theory of Computation Handbook, CRC Press.
151. Kraus J. (1980) Selsbtreproduktion bei Programmen (Auto-reproduction des programmes). These de doctorat. Universite de Dortmund. Une traduction en anglaispar D. Bilar & E. Filiol a ete publiee dans [152].
152. Kraus J. (1980) Self-reproduction of Computer Programs. Journal in Computer Virology, 5 (2), 2009.
153. Lagadec P. (2003) Formats de fichiers et codes malveillants, Actes de la conferenceSSTIC 2003, pp. 198-214, www. sstic. org Une version actualisee est disponible surhttp://www.ossir.org/windows/supports/liste-windows-2003.shtml
154. Lagadec P. (2007) Securite des formats OpenDocument et OpenXML. Actes de laconference SSTIC 2007, pp. 259 - 278, http://www . sstic. org
155. Lagadec P. (2006) Diode reseau et ExeFilter : deux projets pour des interconnexionssecurisees, Actes de la conference SSTIC 2006, pp. 130 - 143. http://www . sstic. org/
156. Lai X., Massey J. L. (1991) A Proposal for a New Block Encryption Standard.In : Damgard 1. B. (ed) Advances in Cryptology - Eurocrypt'90, Lecture Notes inComputer Science 473, Springer, Berlin Heidelberg New York, pp 389-404.
157. Lamos R. (2006) Researchers :rootkits headed for BIOS, Security Focus, 6 janvier2006, http://www.securityfocus.com/news/11372?ref=rss ..
158. Langton C. G. (1984) Self-reproduction in Cellular Automata, Physica D, 10, pp.135-144.
159. Laurio J.- M. (2007) Universal XSS with PDF Files: highly dangerous. http: / /lists.virus.org/full-disclosure-0701/msg00095.html
160. Leitold F. (1996) Mathematical model of computer virus. In : Virus Bulletin Conference, Brighton, UK, pp. 133 - 148. Une version etendue a ete publiee lors de laconference EICAR, 2000. Bruxelles. Belaioue.
References 559
161. Leitold F. (2001) Reduction of General Virus Detection Problem, In Proceedings ofthe 10th EICAR Conference, Munich, pp. 24 - 30.
162. Lewis H. R., Papadimitriou C. H. (1981) Elements of the Theory of Computation,Prentice Hall.
163. Leyden J. (2001) AV vendors split over FBI Trojan Snoops, http://WTifW.theregister.co.uk/content/55/23057.html
164. Li J., Leong B. and Sollins K. (2005) Implementing Aggregation/Broadcast overDistributed Hash Tables, ACM Computer Communication Review, 35 (1), http://krs.lcs.mit.edu/regions/docs/broadcast.pdf
165. Linde R. R. (1975) Operating System Penetration, In National Computer ConferenceAIFIPS, pp. 361-368.
166. Ludwig M. A. (1991) The Little Black Book of Computer Viruses, American EaglePress.
167. Ludwig M. A. (2000) The Giant Black Book of Computer Viruses, Second edition,American Eagle Press. La traduction francaise de la premiere edition a ete assureepar Pascal Lointier aux editions Dunod, sous le titre : Du virus it l' antivirus.
168. Ludwig M. A. (1993) Computer Viruses and Artificial Life and Evolution, AmericanEagle Press.
169. Manach J.-M. (2004) Quand un officier superieur de I'armee tire a boulets rougessur la LCEN, ZdNet France du 10 juin 2004, http://www.zdnet.fr/actualites/technologie/O,39020809,39156449,OO.htm
170. Markov A. (1954) Theory of Algorithms, Trudy Math. Inst. V. A. Steklova, 42,Traduction anglaise : Israel Program for Scientific Translations, Jerusalem, 1961.
171. Martin M. (1990) Au coeur du Bios, Editions Sybex.
172. Maymounkov and Mazieres (2002) Kademlia : A Peer-to-Peer Information SystemBased on the XOR Metrics. Proceedings of IPTPS02, http://www . cs. rice. edu/Conferences/IPTPS02/109.pdf
173. Menezes A. J., Van Oorschot P. C., Vanstone S. A. (1997) Handbook of AppliedCryptography. CRC Press, Boca Raton, New York, London, Tokyo, 1997.
174. Moore D. (2001) The spread of the Code-Red worm (CRv2) http://www.caida.org/analysis/security/code-red/coderedv2_analysis.xml
175. Moore D., Paxon V., Savage S., Shannon C., Staniford S., Weawer N. (2003)The spread of the Sapphire/Slammer Worm, http://www.caida . org/analysis/security/code-red/coderedv2_analysis.xml
176. Moore E. F. (1962) Machine Models of self-reproduction, Math. Prob. BioI. Sci.,Proc. Symp. Appl. Math. 14, pp. 17-33.
177. Morales J. (2008) A Behaviour-based Approach to Virus Detection. These de doctorat, Florida International University.
178. Newham C., Rosenblatt B. (1998) Learning the Bash Shell, Second Edition, O'Reilly& Associates.
179. Ohno H. et Shimizu A. (1995) Improved Network Management Using NMW (Network Management Worm) System, Proceedings of INET'95.
180. Ondi A. et Ford R. (2007) How Good is Good Enough? Metrics for Worm/AntiWorm Evaluation. EICAR 2007 Special Issue, V. Broucek & P. Turner eds, Journalin Comnuter Virolozv. 3 (2). 2007. Snrinzer Verla~.
560 References
181. http://www.packetstormsecurity.org
182. Papadimitriou C. H. (1994) Complexity Theory, Addison Wesley.
183. Pavie O. (2002) Bios, Editions Campus Press.
184. Post E. (1936) Finite combinatory processes: Formulation I, J. Symbolic Logic, 1,pp. 103-105.
185. Poulsen K. (2003) Slammer worm crashed Ohio nuke plant network, SecurityFocus,August 19th. Disponible sur www.securityfocus.com/printable/news/6767
186. Pozzo M. et Gray T. (1986) Computer Viruses Containment in Untrusted ComputingEnvironments, IFIP-TC11 Computers and Security, vol. 5.
187. Pozzo M. et Gray T. (1987) An Approach to Containing Computer Viruses, IFIPTC11 Computers and Security, vol. 6.
188. Provos, N. (2003), A Virtual Honeypot Framework, http://niels . xtdnet. nLz'papers/honeyd.pdf.
189. Rado T. (1962) On non-computable functions, Bell System Tech. J., 41, 877-884.
190. Recommendation 600/DISSI/SCSSI, Protection des informations sensibles ne relevant pas du secret de Defense, Recommendation pour les postes de travail informatiques. Delegation Interministerielle pour la Securite des Systemes d'Information.Mars 1993.
191. RFC 1945 : Hypertext Transfert Protocol - HTTP/1.0 (Specification). Disponiblesur www.10t3k.org/biblio/rfc/french/rfc1945.html
192. RifHet J.-M. (1998) La programmation sous Unix, 3eme edition, Ediscience.
193. Riordan J., Schneier B. (1998) Environmental key generation towards clueless agents,Mobile Agents and Security Conference'98, Lecture Notes in Computer Science,Springer-Verlag.
194. Rivest R. L. (1992) The MD5 Message Digest Algorithm, Internet Request for Comment 1321, April 1992.
195. Rogers H. Jr (1967) Theory of Recursive Functions and Effective Computability,McGraw-Hill.
196. Ruff N., Le spyware dans Windows XP, Conference SSTIC 2003, pp 215-227, www.sstic.org
197. Schneier B. (1996) Applied Cryptography, Wilew et Sons, 2nd ed.
198. Schneier B. (1994) Description of New Variable-Length Key, 64-Bit Block Cipher(Blowfish). In : Anderson R. (ed) Fast Software Encryption Cambridge SecurityWorkshop Proceedings, Lecture Notes in Computer Science 809, Springer, BerlinHeidelberg New York, pp 191-204.
199. Serazzi G. et Zanero S. (2003) Computer Virus Propagation Models. In : PerformanceTools and Applications to Networked Systems (Calzarossa M. et Gelenbe E. editeurs),revised Tutorial Lectures MASCOTS 2003, Lecture Notes in Computer Science 2965,pp 26-50, Springer 2004.
200. Shannon C. E. (1948) A mathematical theory of communication. Bell System Journal, Vol. 27 pp. 379-423 (Part I) et pp. 623-656 (Part II).
201. Shannon C. E. (1949) Communication Theory of Secrecy Systems.Bell System Journal. Vol. 28. Nr.4. nn 656-715.
References 561
202. Shezaf O. (2003) The Universal XSS PDF Vulnerability. http://WTifW. owasp. org/images/4/4b/OWASP_IL_The_Universal_XSS_PDF_Vulnerability.pdf
203. University to run virus writing course, Mai 2003, www.silicon.com/news/500013/14/4372.html
204. Virus writing at University : Could we, would we, should we?, Mai 2003, www.silicon.com/leader/500013/14/4377.html
205. Shoch J. F., Hupp J. A. (1982) The Worm programs - Early Experience with aDistributed Computation, In Communications of the ACM, March, pp. 172-180.
206. Smith G. C. (1994) The Virus Creation Labs, American Eagle Press.
207. Smith G. C. (2003) One printer, one virus, one disabled Iraqi air defense, www.theregister.co.uk/content/55/29665.html
208. Antivirus Sophos - www.sophos.com
209. Spafford E. H. (1989) The Internet worm incident, European Software EngineeringConference (ESEC) 1989, Lecture Notes in Computer Sciences 387.
210. Spinellis D. (2003) Reliable Identification of Bounded-length Viruses is NP-complete,IEEE Transactions in Information Theory, Vol. 49, No.1, pp. 280-284, janvier.
211. Staniford S., Paxson V. et Weaver N. (2002) How to Own the Internet in your SpareTime. In 11th Usenix Security Symposium, San Francisco, August 2002.
212. Sturgeon W. (2003) Security Firms slam Uni decision to write viruses, Mai 2003,www.silicon.com/news/500013/14/4403.html
213. Sturgeon W. (2003) University virus writing sparks end user outrage, Mai 2003,www.silicon.com/news/500013/14/4404.html
214. Sturgeon W. (2003) Support grows for controversial virus writing course, Mai 2003,www.silicon.com/news/500013/14/4420.html
215. Tischer M. (1996) La bible PC - Programmation systeme, Geme edition, Micro Applications.
216. Thatcher J. (1962) Universality in the von Neumann cellular model, pp 132-186in [40].
217. Thompson K. (1984) Reflections on Trusting Trust, Communications of the ACM,vol. 27-8, pp. 761-763.
218. Turing A. M. (1936) On computable numbers with an application to the Entscheidungsproblem, Proc. London Math. Society, 2, 42, pp. 230-265.
219. Vandevenne P. (2000) Re : virus de bios? et precisions, fr. comp. securite, 2000-1203, 07 :43 :28 PST.
220. von Neumann J. (1951) The general and logical theory of automata, in CerebralMechanisms in Behavior: The Hixon Symposium, L.A. Jeffress ed., pp 1-32, Wiley.
221. von Neumann J. (1966) Theory of Self-reproducing Automata, edited and completedby Burks, A. W., University of Illinois Press, Urbana and London.
222. Wall L., Christiansen T., Schwartz R. (1996) Programming Perl, O'Reilly & Associates.
223. Wang X., Feng D., Lai X. et Yu H. (2004) Collisions for Hash Functions MD4, MD5,HAVAL-128 and RIPEMD, disponible sur http://eprint . iacr. org/2004/199
224. Weaver N. (2002) Potential Strategies for High Speed Active Worms: A Worst CaseAnalvsis. htt o : / /www.cQ"isecuritv.com/lib/worms .ndf
562 References
225. Webster M. (2008) Formal Models of Reproduction : from Computer Viruses toArtificial Life. These de doctorat. Universite de Liverpool, juillet 2008.
226. Wiley B. (2002) Curious Yellow : The first Coordinated Worm Design, http: / /blanu.net/curious_yellow.html
227. http://msdn.microsoft.com/livrary/en-us/winprog/windows_api_reference.asp
228. http://burks.brighton.ac.uk/burks/progdocs/winsock/winsock.htm
229. Zou C. C., Gong W. et Towsley D. (2002) Code Red Worm Propagation Modelingand Analysis. In : CCS'02 Proceedings, November 2002, ACM Press.
230. Zuo Z. et Zhou M. (2004) Some further theoretical results about computer viruses,The Computer Journal, Vol. 47, No.6.
231. Zuo Z. et Zhou M. (2005) On the Time Complexity of Computer Viruses, IEEETransactions on Information Theorv. Vol. 51. No.8.
Index
T-obfuscation, 99emulation de code
voir lutte antivirale, antivirus, 190eradication virale, 61Halting problem, 44Malware, 43, 66OpenOjJice
virus, 439Quine, 141UNIX_ Companion. a, 275dropper
voir virus, 112hoaxes, 166honeyd, 378phishing, 470buffer overflow, 113YMUN20
vo~ v~us, 527, 529, 533YMUN
voir virus, 529
absolue isolabilite, 76Adleman, Leonard, 4algorithme
Kademlia, 366analyse heuristique
voir lutte antivirale, antivirus, 188analyse spectrale
voir lutte antivirale, 186antivirus
lutte contre les, 144antivirus
emulation de code. 190
analyse heuristique, 188, 243analyse spectrale, 186controle d'integrite, 4, 189mode dynamique, 183mode statique, 183recherche de signatures, 184scanning, 4surveillance comportementale, 190
approx-vertex-cover, 376Arpanet, 41automate
autoreproducteur, 18autoreproducteur de Byl, 32, 37autoreproducteur de Langton, 30, 36,
188autoreproducteur de Ludwig, 35calculabilite universelle, 26cellulaire, 8, 18configuration, 21constructeur universel, 25fonction de propagation, 21fonction de transition, 21sous-configuration, 21
automate cellulaire, 20automate fini, 19autoreproduction, 8, 23, 33, 34
voir Kraus, J iirgen, 33
BadTransvoir vers, 529
Bash, 212bios, 200
fonctionnement. 512
564
POST, 517structure, 512voir virus de bios, 509
bombe logique, 199, 459definition, 127detection, 182gachette, 127
botherder, 363botnet, 127, 343
Agobot3, 346, 350, 393Agobot4, 348, 359Agobot, 344, 348, 350, 354, 355, 389Gtbot, 346, 353Phatbot, 353Sdbot, 353Storm Worm, 353botherder, 345canal C&C, 351combinatoire, 344, 365console C&C, 345, 351, 367definition, 344gestion combinatoire, 372phase d'attaque, 357phase de coordination et de gestion, 351phase de deploiement, 345roseau bas-niveau, 367reseau superieur, 367reseau viral P2P, 367structure centralisee, 353structure decentralisee, 353techniques d'anonymisation, 353type P2P, 353
boucle de Langton, 31Boyer-Moore
algorithme de, 88Burks, Arthur, 8, 19Byl, John, 32
calculabilite universelle, 26calculabilite virale, 55Caligula
voir virus, 528, 532cardinalite virale, 56charge finale virale, 34, 222charte informatique, 193Chess, David, 86cheval de Troie, 70, 71, 102, 199, 486
Back Orifice 2000, 127Back Orifice. 129
Index
Netbus, 129P adodor, 130Phage, 114Scob, 130SubSeven, 129keyloggers, 129definition, 128detection, 182module client, 128module serveur, 128
Church, Alonzo, 7, 34cout d'une attaque
voir virus, vers, 191Codd, Edgar, 30code de G6del, 13, 34Cohen, Fred, 4, 43compilation
evaluation partielle, 101constructeur universel
voir automate, 25controle d'integrite
voir lutte antivirale, antivirus, 4, 189Core Wars, 41couverture d'un graphe, 375cryptanalyse appliquee
voir virus, 528
debordement de tampon, 113, 282, 286,290
detectioncomplexite, 73vers, 182
detection des virus, 60souple, 86
documentsvoir virus, 395
dropper, 70
ecto-symbiote, 102Enigma, 41ensemble d'infection, 75ensemble viral, 46ensemble viral singleton, 50Evolution virale, 48Evolutivite virale, 54
FBI, 482fonction d'infection, 34fonction decidable. 15
Index
fonction recursive, 8, 11index, 14
Forrest, S.modele de, 121
furtivite, 96, 214, 349, 525definition, 145rootkit, 525
Godel, Kurt, 12generateur
VBSWG, 106VCL, 106
gachet.tevoir bombe logique, 127
Gleissner, Winfried, 82
Holling, Fritz, 512hygiene informatique, 179, 181
regles, 192
IBM, 193icones
chainees, 139et virus compagnons, 139transparentes, 139
infections informatiques, 3, 43, 66epeiennes, 71absolument isolables, 76aspects juridiques, 198benignes, 70, 71cheval de Troie, 70, 71, 128conception, 124conduite a tenir en cas d', 194contagieuses, 70degre de detectabilite, 124disseminatrices, 71leurres, 129malicieuses, 71pathogenes, 70simples, 71, 126virulentes, 70
infections simplesbombe logique, 127
ingenierie sociale, 112, 116, 166, 172, 316
kits de contruction viraux, 166VBSWG, 166VCL, 166
Kleene. Stenhen. 17. 100
Kraus, Jurgen, 33, 100langage PL, 33
langageAwk, 216Bash, 212Pdf, 153Perl, 216Postscript, 153VBScript, 212Visual Basic for Applications (VBA),
155, 212, 399langage interprete
voir virus, 211langage PDF, 456
attaque par phishing, 470attaques virales, 467attaques XSS, 469fonctionnalites, 447modele, 446politique de securitc, 467primitives, 457
classe Action, 458classe OpenAction, 457
risque viral, 444securitc, 457, 464structure des fichiers, 452
Langton, Christopher, 30boucle de, 31, 188
largueur, 70Leitold, Ferenc, 84leurres, 129, 199
detection, 182Ludwig, Mark, 143lutte anti-antivirale, 144
furtivite, 145, 214polymorphisme, 145, 216
lutte antivirale, 4, 179emulation de code, 190analyse heuristique, 188analyse spectrale, 186confiance, 180controle d'integrite, 189cfficacite, 181fiabilite, 180hygiene informatique, 179, 181, 192indecidabilite, 53par controle d'integrite, 4recherche de sicnatures. 184
565
566
scanning, 4, 184surveillance comportementale, 190techniques dynamiques, 190techniques statiques, 184
Metamorphismeformalisation, 96
machine de Turing, 7, 8bande de calcul, 9fonction de controle, 9probleme d'arret, 15, 44tete de lecturejecriture, 9universelle, 13
machine virale universelle, 56macro-virus
voir virus, 153, 212, 395Magic Lantern
voir vers, 528malware
voir infections informatiques, 110Manhattan, projet, 41marqueur d'infection, 115MD5, 189modele
RAM, 84RASPM,84RASPMjABS, 84RASPMjSABS, 85
modele isolationniste, 57, 75Morris Jr, Robert T., 284
numeration de Godel, 13
obfuscation, 99ordinateur universel, 26ordinateurs de poche
virus pour, voir virus, 114
Perrunvoir virus, 529
Plus grand ensemble viral, 49Plus petit ensemble viral, 49PocketPC
virus pour, voir virus, 114polymorphisme, 4, 42, 45, 87, 88, 214, 216,
425, 430complexite, 90definition, 145
nrobleme
Index
SAT, 88probleme de decidabilite, 53probleme du vertex cover, 375programme
k-autoreproducteur, 34autoreproducteur, 33cycliquement autoreproducteur, 34
avec changement de langage deprogrammation, 34
infiniment autoreproducteur, 34
recursivitc enumerable, 15retrovirus
voir virus, 163recherche de signatures
voir antivirus, lutte antivirale, 184relation decidable, 13rootkit, 346rootkits, 525
securite, 145surcte, 145scanning
voir lutte antivirale, antivirus, 4scripts
voir virus, 211SHA-1, 189signature
algorithme de recherche de, 88marqueur d'infection, 115
signature virale, 214, 430discriminante, 184, 214non incriminante, 185non-incriminante, 214proprietes, 184
singleton viral, 45Spinellis, D., 88Spinellis, Diomidis, 88spywares, 486SUN Microsystems, 193surinfection, 214, 350surveillance comportementale
voir lutte antivirale, antivirus, 190SuWAST, 365, 382symbian, 114
telephones portablesvers pour, voir vers, 114
TCPA/Palladium. 512
Index
techniquesKademlia, 366d'anonymisation, 353d'ingenierie sociale, 463de T-obfuscation, 408de chiffrement, 425de persistance, 113, 127, 348de polymorphisme, 425, 430de repression, 436de repression de programmes, 349de residence, 126, 348de scanning, 364
techniques de furtivite, 406theorems
de recursion de Kleene, 17, 34, 100de recursion explicite, 104de de Herman, 37
Thompson, Ken, 102, 144Turing
machine dite de, 7, 8Turing, Alan, 4
Ultra, projet, 41
vers, 281Apache, 341A utodoubler, 490BadTrans, 114, 529Bagle, 281Blaster/Lovsan, 197CRClean, 490Cabir, 114Code Green, 490Codered 1, 200, 364Codered 2, 168, 282, 364Codered, 114, 123, 197, 290, 490Creeper, 283, 492Currious_ yellow, 364Flash, 364Fortnight.F, 198lIS_Worm, 282, 289ILove You, 102, 110, 172, 281Internet Worm, 282, 283Kelaino, 147Melissa, 172, 281MyDoom, 110, 123, 281Netsky, 281Nimda, 114, 149, 364Noved.499
567
Pedoworm, 118, 499Polypedoworm, 507Ramen, 342Reaper, 492Sapphire/Slammer, 110, 121, 123, 126,
170, 172, 175, 198, 282, 348, 499Sobig-F, 197Symbos_ Cardtrp.a, 114, 166UNIX. LoveLetter, 330W32. Nyxem. E, 149W32/Bagle, 175, 348W32/Blaster, 348W32/Bugbear-A, 149, 173, 182W32/Klez.H, 149W32/Klez, 182W32/Lovsan, 110, 172, 282, 369, 491W32/AJydoom, 175,348W32/Nachi, 491W32/Netsky, 175W32/Sasser, 172W32/Sircam, 281W32/Sober, 113W32/Sobig-F, 173W32/Sobig.F, 110, 147W32/Welchi, 491W32/Zafi-B, 175Warhol, 364Win32.AJyfip, 499Xanax, 309worms, 171cout d'une attaque, 191combinatoires, 365cycle de vie, 116d'emails, 172detection, 182de Morris, 282, 283diagramme fonctionnel, 115macro-vers, 172
BadBunny, 172Magic Lantern, 182, 482, 487, 497, 528mass-mailing worms, 172modeles de propagation, 171Netsky, 123nomenclature, 167OpenOffice, 172phase d'infection, 116phase de diffusion, 116phase de maladie, 117nrimo-infection. 117
568
scanning, 364simples, 171, 282super-vers, 364ultra-rapides, 364versus botnet, 363Xerox, 42, 488, 492
vertex cover approche, 376virulence
compromis avec la furtivite, 410Virus
metarnorphenoyau, 96
polymorphenoyau, 96
polymorphe a nombre infini de formes,96
virus, 3k-aires, 420, 437, 444, 445, 449, 459, 472,
529eradication, 61evolution virale, 48evolutivite virale, 54Whale, 1471099, 116AdobeR, 112Brain, 42, 159, 161Caligula, 528, 532Century, 118Coffee Shop, 118Colors, 118, 200Concept, 151CrazyEddie, 166Dark Avenger, 165Dark Vader, 165Datacrime, 185Duts, 114Ebola, 121Elk Cloner, 42Hole Cavity Infection, 133Ithaqua, 165Joshi, 160Kilroy, 158, 518Linux.RST, 163Mange_ tout, 116March6, 160Mawanella, 118Melissa, 149Nuclear/Pacific, 166Outlook. PDFWorm. 468
Index
Peachy, 152, 468Perrun, 152, 162, 529Smiths, 105Stealth, 159, 161, 496, 521Telefonica, 163Tremor, 114Unix. satyr, 177, 267Unix_ Coco, 225Unix_ bash, 225Unix_head, 224Unix_ owr, 223Vacsina, 165W32. Yourde, 468W32/Magistr, 509, 517W32/Nimda, 182W97/Title, 474Warrier, 116Whale, 163Winux/Lindose, 166Wogob, 166X21, 236X23, 262Yankee, 165blueprint, 104dropper, 112pre-bios, 510vbashp, 216vbash, 212, 216vcomp ex_ v1, 247vcomp ex_ v2, 255vcomp ex_ v3, 264vcomp ex, 236vendredi 13, 118virux, 229KOH, 488, 493, 507CIH, 110, 116, 118, 127, 137, 157, 200,
509, 517SURIV, 133VBIOS, 519YMUN20, 113, 527, 529, 540YMUN, 162, 255, 527de Bios, 157de fichiers PE, 133modes d'action, 130Apple II, 42AppleDOS 3.3, 42applications, 482, 487
chiffrement automatise, 493comnression automatisee. 489
Index
contournement d'un controle dintegrite, 279
contournement du controle de signaturede RPM, 279
cryptanalyse appliquee, 528generation environnementale de clefs
cryptographiques, 501lutte contre le crime, 499militaires, 497recuperation de mot de passe, 280
aspects juridiques, 198avec rendez-vous, 162binaires, 162blindes, 163calculabilite virale, 55cardinalite virale, 56charge finale, 116, 222cout d'une attaque, 191combines, 162combinatoire, 97compagnons, 137, 233
UNIX_ Companion. a, 275X21, 236X23, 262vcomp ex vl, 247vcomp ex_ v2, 177, 255vcomp ex_ v3, 264vcomp ex, 236
comportementaux, 160composite, 97contradictoire de Cohen, 60cycle de vie, 116d'cxccutables, 150definition, 42definition formelle, 3detection, 60detection par evolutivite virale, 60de boot, 158de code source, 141de demarrage, 157, 158de documents, 69, 151, 395
Outlook. PDFWorm, 468Peachy, 468W32. Yourde, 468definition, 152langage PDF, 444
de FAT, 140de scripts, 211de tvne BAT. 211
569
de BIOS, 509degre de detcctabilitc, 124diagramme fonctionnel, 115en langage Bash, 212en langage interprete, 211ensemble d'infection, 75ensemble viral, 46ensemble viral singleton, 50et fonctions recursives, 16experiences de Cohen, 61famille YMUN20, 533famille YMUN, 529furtif, 96, 214generateurs de, 166in dice d'infection, 123in dice infectieux, 122infecteur ELF, 267largueur de, 112lents, 164metamorphe, 96machine virale universelle, 56macro-virus, 69, 153, 212, 395
Concept, 397OpenOffice/BadBunny, 440, 443Open Office, 439W97/Title, 397, 474acces au code viral, 419charge finale, 405chiffrement, 425furtivite, 406gestion des macros preexist.antes, 416gestion des sauvegardes, 409polymorphisme, 430repression, 436routine d'infection, 402routine de recherche, 399signature virale, 430
macro-virus Office, 397multi-formats, 166multi-partites, 165multi-plateformes, 165nombre de, 121nomenclature, 149non resident, 93OpenOffice, 172par ecrasement de code, 131par ecrasement non resident, 94par accompagnement de code, 137Dar a iout de code. 132
570
par entrelacement de code, 133par recouvrement de code, 102phase d'incubation, 117phase d'infection, 116phase de diffusion, 116phase de maladie, 117plus grand ensemble viral, 49plus petit ensemble viral, 49polymorphe, 87, 121, 214polymorphe a deux formes, 95prevention, 57
modele de fLot, 58par cloisonnement, 58
primo-ifection, 397primo-infection, 117psychologiques, 166
definition, 166resident, 94residents. 160
retrovirus, 163rapides, 164routine d'anti-detection, 115routine de copie, 115routine de recherche, 115simple, 50singleton viral, 45statique, 61virulence, 122, 123virus binaires, 529
von Neumann, John, 4, 8,19modele de, 22
WAST, 365, 377White, S., 86
Xerox, incident, 42
Zhou, M., 93Zou. Z.. 93
Index
Collection IRIS
Dirigée par Nicolas Puech
Ouvrages parus :
– Méthodes numériques pour le calcul scientifique. Programmes en Matlab
A. Quarteroni, R. Sacco, F. Saleri, Springer-Verlag France, 2000
– Calcul formel avec MuPAD
F. Maltey, Springer-Verlag France, 2002
– Architecture et micro-architecture des processeurs
B. Goossens, Springer-Verlag France, 2002
– Introduction aux mathématiques discrètes
J. Matousek, J. Nesetril, Springer-Verlag France, 2004
– Les virus informatiques : théorie, pratique et applications
É. Filiol, Springer-Verlag France, 2004
– Introduction pratique aux bases de données relationnelles. Deuxième édition
A. Meier, Springer-Verlag France, 2006
– Bio-informatique moléculaire. Une approche algorithmique
P.A. Pevzner, Springer-Verlag France, 2006
– Algorithmes d’approximation
V. Vazirani, Springer-Verlag France, 2006
– Techniques virales avancées
É. Filiol, Springer-Verlag France, 2007
– Codes et turbocodes
C. Berrou, Springer-Verlag France, 2007
– Introduction à Scilab. Deuxième édition
J.P. Chancelier, F. Delebecque, C. Gomez, M. Goursat, R. Nikouhah, S. Steer,
Springer-Verlag France, 2007
– Maple : règles et fonctions essentielles
N. Puech, Springer-Verlag France, 2009