CIH, also known as the Chernobyl virus, is a computer virus that targets computers running the Windows 9x family of operating systems. There are several variants, with different trigger dates that cause the virus to activate on different days, ranging from once a month to once a year. The most widespread variant first activated on April 26, 1999, causing widespread damage to hundreds of thousands of computers worldwide and resulting in hundreds of millions of dollars of losses. CIH is notorious for its destructive payload, which overwrites critical areas of a computer's hard drive, leaving the data inaccessible. On some systems, it also intentionally corrupts the system's flash BIOS firmware stored on the motherboard. This makes the computer unable to boot, leaving the computer unusable until the BIOS chip or the entire motherboard is replaced.
The spread of the virus was extremely destructive. CIH spread primarily through infected software distributed over the Internet and on physical media, including pirated programs, software updates, and cover CDs attached to computer magazines. It exposed both security weaknesses in the Windows 95 and Windows 98 operating systems and risky user practices, including the widespread use of pirated software and the storage of important data without backup copies. It is one of the first widely distributed computer viruses known to be capable of damaging system firmware.
CIH was created by Chen Ing-hau while he was a computer science student at the Tatung Institute of Technology in Taiwan. He placed his initials in a text string within the virus code, leading to the name of the virus. It was written and first discovered in 1998, and spreads by infecting Portable Executable (PE) files used by Windows programs. When an infected program is run, the virus becomes memory-resident and infects other executable programs on the system. In the aftermath of the damage caused by the virus, Chen was questioned and detained by law enforcement agencies, but ultimately was never criminally charged.
History
The creator of the virus wrote several different versions of CIH beginning on April 26, 1998, identifying each of them with text strings that included "CIH" and a version number. The antivirus company Sophos obtained its first sample of the virus in June1998 from an infected file it received from a customer in Taiwan. It identified CIH as a previously unknown Portable Executable (PE) file-infecting virus. Researchers initially took interest in the new virus because of its unusual method of concealing itself within an infected file. At first, they thought that its payload was a destructive but otherwise unremarkable process that overwrote a critical section of the computer's hard drive with garbage data, corrupting the data stored there, but days before the June 26 trigger date used by two of the variants, they discovered an additional code section designed to damage the computer's BIOS. By August, most major antivirus companies had received at least one variant of the virus from their customers, and several had confirmed the existence of multiple variants.
Technical characteristics
CIH is a hardware-damaging computer virus that infects Portable Executable (PE) files on Windows 95, Windows 98, and Windows ME computers. The source code was later released to the public by the author.
PE files are the standard file format used by Windows for programs and related components. They contain all of the compiled code and data needed to load and run an application. A PE file is divided into a number of sections, or objects, each of which must start at an address aligned to a multiple of a fixed number of bytes, from 512 bytes to several kilobytes. When the end of one section does not exactly reach the start of the next aligned address, the remaining bytes are filled with null characters to create "slack" space, which is essentially unused or wasted space. PE files commonly have five or six objects, each with some slack space at the end.
The CIH virus takes advantage of the wasted space between objects in a PE file to store its code, allowing it to infect the file without increasing its size. This technique of storage in slack space, called cavity infection, had been seen before; the MS-DOS Lehigh virus, written in 1987, used a method similar to this. By leaving the size of infected files unchanged, the virus is able to conceal the fact that the file has been modified.
Infection mechanism
Computers have signals that programs can use to notify the processor of an event that requires immediate processing, called interrupts or traps. The operating system maintains a list, called the interrupt descriptor table (IDT), of what programs should execute, called interrupt handlers, when it receives one of these signals. When the processor receives an interrupt, it temporarily stops what it is doing and runs the program listed in the IDT as the interrupt handler for that event.
When a CIH-infected program is run, the virus first makes a change to the IDT so that when a certain interrupt is received, the system stops what it is doing and runs the virus's code. The infected portion of the application then immediately triggers the newly-hooked interrupt. Since the virus was designated as the interrupt handler, the operating system relaunches the virus at a higher privilege level than a user application, giving it kernel-level access to otherwise restricted system memory and processor signals.
The virus uses its kernel-level access to check the value stored in debug register 0. If the value is non-zero, CIH assumes that it is already resident in memory and returns control to the original program without doing anything. The use of debug register 0 appears to be designed to make analysis of the virus difficult, since many debugging programs use debug registers 0 and 1 during analysis.
Once the virus determines that it is not already resident in memory, it takes the steps to become memory-resident. It places a non-zero value in debug register 0, then it allocates memory in the area used by Virtual Device Driver code and uses that space to reconstruct its executable code from the fragments that are stored in the infected file. After reassembling itself in memory, the virus triggers the interrupt handler again, and uses its kernel-level privileges to install a file system hook, which causes its memory-resident code to be run every time the operating system opens, saves, or executes a file.
After receiving a call from the file system hook, the virus examines the file that was being opened to determine whether it is a Windows PE file that has not already been infected. When it finds a potential target, it analyzes the PE header and section table to calculate how much of its code can be inserted into the unused padding space between each aligned section. If there is enough space in the file, the virus writes portions of its code into the slack space of each section and modifies the PE header so the virus will execute when the program runs. In the relatively rare case that the virus encounters a file that does not have enough slack space between the objects to fit its code, it will leave that file uninfected, but will still tag it as infected so it will not analyze the same file later. After the alteration is complete, the virus returns control to the operating system and the file operation proceeds normally.
During normal operations, a computer executes many programs, so the virus can quickly infect many files on the computer. The simple act of opening a clean file would cause it to become infected as long as the computer had write access to it, even if the computer was accessing it from another system over a network.
This infection method allows CIH to function on operating systems in the Windows 9x family. However, the stronger protection mechanisms in Windows NT, Windows 2000, Windows XP, and newer operating systems prevent user applications from modifying protected kernel resources, including the Interrupt Descriptor Table. Because CIH relies on this modification to initially gain kernel-level access, it is unable to install its memory-resident component or intercept file operations on these systems.
Trigger and payload
Depending on the variant, CIH has annual trigger dates of April 26 or June 26, or monthly trigger dates on the 26th day of each month. If any infected file is executed on a computer on the trigger date while the virus is already in memory, the virus activates its payload.
Flash BIOS attack
The first part of the payload attempts to overwrite a small but critical section of the computer's BIOS chip, leaving the system unable to boot. The BIOS chip, installed on the computer's motherboard, performs basic hardware initialization and locates and launches the operating system when the computer starts.
Early BIOS firmware was stored in ROM or EPROM chips that were programmed when they were manufactured. If an error was found on the chip, or new hardware support needed to be added, the programming on the chip was difficult or impossible to change. Later systems stored BIOS firmware on erasable chips that could be reprogrammed by removing the chip from the motherboard and reprogramming it with specialized hardware, but that was still relatively difficult for the end user.
By the mid-1990s, flash ROM BIOS chips had become increasingly common. These chips were not only less expensive to manufacture, but they could also be reprogrammed without removing the chip from the motherboard. To prevent accidental reprogramming, flash BIOS chips usually had some way to write-protect the chip during day-to-day operation. To reprogram the BIOS, the write protection needed to be disabled, often through a jumper or switch on the motherboard. However, in an effort to make it easier for end users to install BIOS updates, many manufacturers shipped motherboards and computers with the write protection already disabled, or without write protection at all. It was still difficult to develop software that was capable of reprogramming the BIOS without having a detailed knowledge of the flash memory chip as well as the motherboard chipset, but in many cases, the necessary information could be obtained from the manufacturers.
When CIH attacks the BIOS, it only attempts to write a single byte to the flash chip. Because flash memory has to be written in fixed-size blocks, the writing of the single byte ends up erasing the rest of the block that was written to. When the computer is restarted, the corrupted BIOS prevents the system from completing its startup process and launching the operating system, leaving the computer unusable until the BIOS chip or motherboard is replaced.
Differences in flash memory chips and motherboard chipsets meant that not all computers were vulnerable to this attack. The attempt to write to the flash BIOS was only successful on systems using flash BIOS chips from certain manufacturers in combination with several popular Pentium motherboard chipsets, while attacks on systems with different types of BIOS chips had no effect.
Hard drive attack