Deflecting from the dark side or why people write VIRUSES

Most of us at some time or another, have suffered disruption -at the very least- to our businesses, through being infected by computer viruses. No doubt you have wondered what drives someone to write these infuriating viruses. Natasha Stanley, an anti-virus consultant with leading anti-virus software developer, Sophos plc, delves into the mind of the virus writer.

One of the most baffling things about computer viruses is why anyone would actually want to write one. There is no money to be made from infecting innocent computer users, and virus authors don't appear to be fighting for a particular cause - despite what they may say to the contrary.

The typical virus writer is male and aged between fourteen and twenty-four. For some reason few girls seem to be interested in writing malicious code -perhaps they have more productive ways of passing the time?Although often excellent at communicating with their computers, virus authors are usually lacking in the ability to interact socially with other human beings.

Once virus writers grow up, become interested in girls and develop a social life they tend to stop writing viruses. Unfortunately for the rest of us there is always likely to be a crop of adolescent males eager to take their place.

So, why do people write viruses?

If you asked the actual authors themselves they probably wouldn't know either. Some might claim that they do it for research purposes, others may tell you that they are actually helping users and software manufacturers by pointing out the weaknesses of their operating systems. Neither of these explanations sounds too convincing.

Writing a virus is rather like spraying graffiti on a wall or painting rude messages on street signs. To the rest of the population it all seems rather pointless, but perpetrators believe that they have a point to make to the rest of society. Similarly, some virus writers think that they are making some kind of statement by spreading their code.

Perhaps the more truthful amongst them will admit that they get a kick out of corrupting other users' work and data and causing them unnecessary grief. Some do it out of boredom or because they don't have anything better to amuse themselves with - wich is a pretty sad state to be in.

Virus writers also look for recognition amongst their peers and try to attain some form of kudos within the virus writing community as a whole. If they can create a worm which infects hundreds of thousands of users, like-minded individuals will probably be fairly impressed - even though the most virulent often just "get lucky".

One of the questions anti-virus vendors are often asked is whether or not they would employ a former virus writer. The assumption being that those who write the code in the first place are most likely to be able to write the antidote. However, this isn't necessarily the case.

Writing viruses and coding detection routines for viruses require very different skill sets - not to mention mindsets. Many virus writers simply reuse pieces of virus code to produce variations on a theme or use a virus writing toolkit, so they need little or no technical know-how. The authors themselves don't know how or why their creation works - but the analysts in the laboratories have to find out and be able to produce protection against it. Taking apart a virus is a meticulous and precise skill, and is rather like solving a puzzle or a crossword. Many viruses are badly written, meaning that virus analysts have to work out how the virus should have worked as well as why it doesn't. The simple fact is that the majority of virus authors do not have the aptitude to become virus analysts.

There is also the issue of trust. An anti-virus vendor would never be able to place complete confidence in someone they knew to have written viruses in the past. Not only that but giving a virus writer a job could be construed as rewarding them for their efforts, and encouraging others to write viruses in order to gain employment. It simply isn't worth the risk - especially when it is possible to find more scrupulous and talented individuals who are more suitable for the job.

Unfortunately it is unlikely that people will stop writing viruses, in fact we are seeing more viruses each month than ever before. Only a few of these will ever infect anyone, but all of them need to be detected by anti-virus software.

It isn't all doom and gloom however. Today's anti-virus software is able to detect all known viruses and protect users from them. Not only this, but users following safe computing procedures will also dramatically reduce the chances of infection. A combination of these measures will provide an effective defence against the threat, and thwart those youths who choose to sit in their back bedrooms creating viruses instead of getting on with their lives!

Source : EMA NOVO 2/02, written by Natasha Stanley Anti-virus Consultant at Sophos UK. 2002

Up