******************************************************************************
                                                                          PT-6
							         December 1989
******************************************************************************


1.  Product Description:  VIRUS-CHECK (VCHECK) is a shareware program to create
a database of all executable files and to calculate checksums for those files.
The author, Axel Dunkel, proposes to use the program as an anti-viral tool on
the assumption a computer virus infection must change the size and/or checksum
of the file.

2.  Product Acquisition:  VCHECK is available on several public bulletin
boards.  It resides in the following path on the Directorate of Information
Management host simtel20 at White Sands Missile Range:  pd1:<msdos.trojan-pro>
vcheck11.arc.1.  The author provides the following address for the $25.00
registration fee:  Systemberatung Axel Dunkel, Robert-Schuman-Ring 37, D 6239
Kriftel, West Germany.

3.  Product Tester:  Chris Mc Donald, Computer Systems Analyst, Directorate of
Information Management, White Sands Missile Range, NM  88002-5030, DSN 258-7548
or DDN:  cmcdonal@wsmr-emh03.army.mil.

4.  Product Test:

    a.  I obtained a copy of VCHECK in December 1989 from the MS-DOS repository
on the Internet host simtel20.  The repository manager obtained the copy from
a reliable source.

    b.  I ran the current version of VIRUSCAN against the VCHECK.EXE with
negative results for the detection of any known viral signature.

    c.  I examined the VCHECK.EXE program with "nu" from NORTON Utilities and
saw nothing unusual or suspicious.

    d.  The VCHECK.DOC file describes many options available to users.  There
are, however, occasions in which the "Syntax" instructions frustrated me.  The
option to have all "recogniced (sic) changes" written into a documentation
file appears as: "VCHECK <Path> /DL <path+file>".  The first <Path> establishes
the directory in which the database file of file sizes and checksums will 
reside.  The /DL option creates the documentation file and asks that all
"changes" be written to a user-specified directory and file.  If the user
understands these instructions, he or she might enter:  "VCHECK C:\ /DL C:\doc.
txt".

    e.  I will confess that it took me a few attempts to get the correct
"syntax"
because I was reading along with the actual syntax instruction without any
"sample" command line.  I discovered too late that had I gone to the end of the
VCHECK.DOC file I would have seen a correct rendering of this command
illustrated in a batch file.  I then searched unsuccessfully on how to actually
"read" or "access" my doc.txt file.  Since an example of what should be in the
doc.txt file appeared following the syntax instructions, I assumed that I would
automatically have the record of "changes" file printed to my screen upon
successive "vcheck" commands.  I discovered after trail-and-error that I had to
specifically ask to "read" the doc.txt file.   An instruction to "more
<doc.txt" would have been appreciated.

    f.  Trial-and-error also resulted in the discovery of an interesting
contradiction in the VCHECK.DOC instructions and the actual operation of
VCHECK.EXE.  VCHECK.DOC states:  "On every invokation (sic) of VCHECK, the
program will compare the data stored in the database with the current state of
the files.  If any differences occur, VCHECK will give a warning."  I tested
this feature by running "VCHECK" and then initiating changes to files in the
database.  On subsequent invocations I was notified of a change in file size
and/or checksum for any file I had modified.  HOWEVER, IF I DELETED A FILE
PREVIOUSLY "STORED IN THE DATABASE", AND THEN RAN "VCHECK", I WAS NOT NOTIFIED
OF ANY CHANGE.  Apparently, if one has deleted a file, the "VCHECK"
command automatically updates the "VCHECK.DTA" database file when one
subsequently invokes the command.  

    g.  The VCHECK.DTA database file is unprotected with all data stored in
unencrypted form.  Similarly the documentation file, which a user may create
as an option to record "all" changes, is unprotected and unencrypted.

5.  Product Advantages:

    Checksum protection has gained increased attention as a method to 
detect unauthorized modifications to files.  The product automates this tool
and might be used as a "demonstration" of the concept.

6.  Product Disadvantages:

    a.  The failure to protect and to encrypt database information in the
VCHECK.DTA file presents a significant vulnerability.  

    b.  The action of VCHECK to update the VCHECK.DTA database file upon the
deletion of a file previously checksummed results in another vulnerability.

    c.  I attempted to contact the author via his last known electronic mail
address (unido!cosmo!ADSOFT@uunet.uu.net).  Unfortunately I was not able to
reach him through our gateways to discuss my concerns.

7.  Comments:

    There has been substantial INTERNET discussion on the strength and
weaknesses associated with checksum protection.  While the author of VCHECK
states that his program calculates a 32-bit checksum, the security of the
database file, or rather the lack of security, inclines me to recommend the
program only as a "demonstration" or "educational" tool.  The ability to
attack and/or modify the database file clearly reduces VCHECK's overall
effectiveness.  The author discusses that the next version of VCHECK will have
an additional cycle-redundancy-check (CRC) feature.  But it is not at all clear
what his intentions are in the area of improving protection for the database
file and for the optional documentation file to record "changes."

    There is simply no comparison between VCHECK and a previously tested
commercial anti-viral software package, DATA PHYSICIAN (see PT-4, December
1989).  DATA PHYSICIAN is the better product for checksum protection.  

[The opinions expressed in this evaluation are those of the author, and should
not be taken as representing official Department of Army positions or a
commercial endorsement.]

				       2


======================================================================