The Virus Wars

By Alexandra Robbins
July 13, 2004

The future of viruses might lie in the hands of someone like BlueOwl, a 16-year-old in the Netherlands who started writing viruses when he was 14. BlueOwl isn't interested in destroying your hard drive; he just likes to experiment. A member of the Ready Rangers Liberation Front, he has written a Web site infector, a couple of genetic mass mailers, some polymorphic viruses, and a genetic polymorphic virus—some of which he posted, none of which he spread. In an instant message he writes:

I do it for the pleasure of creating something, seeing that it works, and making something that could really survive, spread, and hold its own in the wild. A virus is something that lives. In real life you can't make a kind of animal. You can in the computer. It's like playing God.

The virus wars continue to escalate, with output poised to exceed even that of 2003—Year of the Worm—if we can judge by the increasing frequency and complexity of attacks so far this year. In March, 2 percent of all traffic the security firm MessageLabs received contained viruses. "We're still losing the battle," says META Group program manager Peter Firstbrook. "The last two years have been the worst for virus outbreaks, and this year's shaping up to be even worse."

The future direction of the virus wars, however, is something of an unknown, because it depends on so many variables, including the shifting motivations for virus writing. BlueOwl classifies virus writers into four groups: creators, who write for the thrill (he places himself in this category); students, who write for research purposes; script kiddies, writing to impress, "who think they are cool [but] their viruses suck"; and cyberterrorists, who spread viruses for the joy of not creation but destruction.

The creators, BlueOwl says, are a dying breed, quitting the virus scene out of boredom and not bringing new creators in. The students are also fading as schools get stricter about virus handling. By contrast, the number of script kiddies is growing, because "a lot of programming languages have become incredibly easy—with just a few lines these kids can make viruses that spread incredibly well, for example ILOVEYOU [the e-mail worm]. There is no real need to spend hours and hours learning how to write viruses anymore." Cyberterrorists, BlueOwl says, are steadily on the rise because of poorly protected networks and the low risk of getting caught.

Steven Sundermeier, vice president of products and services at security firm Central Command, adds another motivation to the mix: money. Because worm writers can install key loggers through backdoor portals to track passwords, credit card numbers, and other confidential information, the typical kid messing around with digital graffiti is giving way to the "professional" writing for profit.

Throw in some writer rivalry and the landscape gets even more complex. Since February, the Bagle and Netsky authors have been engaged in an ongoing, sometimes daily cyberbattle, taking turns using huge pools of zombie machines—adapting exploits left by others like MyDoom and SoBig—to spread new variants with code containing direct taunts. While they duke it out with messages like "Bagle is a [expletive deleted] guy, he opens a backdoor, and he makes a lot of money" (Netsky.R) and "Hey, Netsky, [expletive deleted] off you bitch!" (Bagle.K), with other authors occasionally weighing in, each new variant requires security companies to develop new emergency updates.

Central Command's Sundermeier comments, "Typically we don't see this tit-for-tat type of writing, because the motivation on the part of writers is usually a pride thing: You get a code out and start a career using those skills." The taunts aren't common between virus groups. In fact, according to Sundermeier, the writers may be working in collaboration, and the taunts may just be a distraction. "We're seeing a cat-and-mouse game, but all these author groups are keeping a watchful eye on the antivirus groups as well."

The virus writers are constantly trying to one-up each other by evolving their code with each new variant, but they're also trying to one-up the antivirus industry. Take Sundermeier's example of a recent back-and-forth: In the past, you might have found viruses on attachments boasting of nude celebrities, so businesses filtered executable extensions at the gateway. The virus authors then started zipping up their attachments.

In response, security firms had their scanning engines scan archives to block the ZIP files. Only days later, the authors fired back with password-protected ZIP files, which could bypass antivirus screening, as the software couldn't decrypt and take a guess at a password. As a result, Central Command learned to parse an e-mail message for the password and store it in memory so they could decrypt and virus-scan it. A week went by, says Sundermeier, and the authors "stopped including the password as a text file. It was a bitmap file, which completely screwed up our game plan."

Other current virus-writing trends include self-propagating codes with tie-ins to spammers, networks of bots created by members of organized crime to use in extortion, and codes shared with other writers, leading to blended threats. When sharing codes, writers don't even need to be sophisticated programmers to wreak havoc, as long as they can weave together existing attacks from code available through community resources. Gene Spafford, a Purdue University computer science professor and security expert, explains:

It's a "pay up or we'll disable your system" kind of thing. That's a very disturbing trend. Prior to a couple years ago, viruses were being written by loners, the majority of whom didn't intend for them to have wide-scale malicious impact. Perhaps some of those same authors are now doing it professionally and may be working in teams.

Writers speak of multiplatform viruses and viruses that will infect icons, cursors, or media files or damage CD-ROM and DVD-ROM drives. Advances in computing technology will inevitably extend the terrain for viruses; soon viruses could target instant messaging, peer-to-peer networks, voice-mail systems, handheld devices, Microsoft Xboxes and other consoles, and mobile phones (which will lead to cell-phone antivirus software).

BlueOwl believes the cyberbattles among authors will eventually breed worms that fight by trying to remove each other. What's more, he says, "virus authors have been inspired by real biological bacteria and evolution. So there have been thoughts about viruses which use genes when making new variants of themselves, and even female and male viruses that will be able to mate and have offspring resembling themselves." BlueOwl has seen only test runs so far, but he says, "If a mass mailer used it, it could really spread BIG."

Hence the million-dollar question: If virus writers are trending toward malice and developing new strategies to elude antivirus companies, why haven't we seen the Big One—a rapidly spreading virus that attempts to destroy data? roy g biv, a 25-year-old Austrian writer for the group 29A, says it's not that easy: A virus has to "get lucky" to spread far, or it needs a widespread hole to exploit so it can spread quickly. If it spreads quickly, however, it will be detected quickly. What's more, if the payload runs too soon, the virus will destroy itself, and if it runs too late, the antivirus companies will stop it.

Patrick Hinojosa, CTO of Panda Software, points to the increasing complexity necessary for viruses to elude antivirus software. The metamorphic virus, for instance, is code that rewrites itself each time it mutates. As a result, signature-based scanners have to decrypt it and then scan it to find the underlying code.

"It doesn't seem like there are many [virus writers] of that caliber to take up that mantle as there used to be," says Hinojosa. "A lot of today's viruses aren't written in assembler; they're written in Visual Basic. You can't program something like the metamorphic virus in Visual Basic."

Hinojosa also points to the vulnerabilities in Windows and the number of critical patches Microsoft has issued. "The reason they're critical is that people can take over the machine. Those are the most dangerous [viruses]. With that type of vulnerability somewhere near the network edge, you could write a virus or worm like Blaster with malicious payload."

Targeted attacks. In the increasingly contentious arena of global sociopolitics, it's possible that those payloads could be targeted at specific groups. "I wouldn't be surprised if in the next few years we saw political or ideological messages," Purdue's Spafford says. He explains that a virus or worm could spread but trigger damage only on machines with interfaces in a particular language. "More targeted attacks and more malicious attacks, particularly with ideological underpinnings, I think are just a matter of time."

The cycle looks to be never-ending, because the whole point of the process is to be constantly creating something new, no matter whether the virus writer is a script kiddie or a cyberterrorist. But on the other end, the antivirus companies are optimistic. Experts agree that virus hunters are able to respond increasingly quickly, and antivirus companies now have more effective suites. The best suites combine programs that monitor spam with antivirus and antispyware capabilities, in addition to firewalls that can handle Blaster-type worms.

Scanning engines have also become more sophisticated. Five years ago, the scanning process was simple pattern matching. As Panda's Hinojosa puts it, "Advances in virus writing and polymorphic viruses have made pattern matching increasingly obsolete....Because these things spread so fast, there isn't necessarily time to get our signature file to the users. So heuristics started getting beefed up."

With more intelligent heuristics, scanners could interpret macro instructions and find them in specific parts of a file. They would look for files that were doing something suspicious and work on a point system. For example, if a file were searching for e-mail addresses, that would be one point. If it were trying to start up an SMTP engine, that would be another.

A chilling effect. Academics expect that in five years, viruses will still have a large-scale impact on businesses—but not because of direct virus attacks. A major reason the virus problem has become so widespread is the same reason it will get worse in the future: user apathy.

Individual users are the most susceptible to viruses, because they don't always install or update antivirus software and firewalls. They have platforms that are highly vulnerable to viruses. They naively click on attachments. And they don't necessarily have the training to know when they've been infected.

It's those users whose machines become part of the networks of bots that harvest information. "As more of this goes on, it may actually have a chilling effect on people's willingness to go online," says Spafford, "so it'll have an indirect effect on businesses, many of which depend on online markets. If users are afraid to put their credit card numbers online because threats of viruses or spam get too much, they won't do it."

It's difficult to guess how the virus landscape will look ten years from now, when we don't know which operating systems will be primarily used. Ten years ago, Windows 95 hadn't been released, networks weren't used commercially, and Digital Equipment Corp. was the second-largest computer company in the world. If some experts' predictions hold true, in 2014 we may be using hundreds of specialized systems that are immune to viruses, like, say, a microwave. Then again, if the scale of viruses, spamming, and crime reaches the tipping point, governments might conceivably increase law enforcement efforts to reduce the impact and frequency.

It would make sense for ISPs to play a larger role in combating viruses. ISPs could offer services that scan all incoming and outgoing mail for viruses; if a machine were taken over, the ISP would block the traffic, notify the user, and perform an automatic disinfection. This kind of policy could allow ISPs to charge a fee and grow their business.

On the other hand, "ISPs are loath to take a drastic step forward as far as prescanning traffic before it hits the end user," Hinojosa says. "If you were doing a war scenario—no holds barred—the place you'd do it for consumers isn't on their machines as much as it is at the ISP." But that takes money at the ISP, already a low-margin business. "You [also] have the privacy concerns, but you'd just have to go, 'The hell with all that, we're just locking it down and we're scanning everything at the ISP,' where you can have the server power to do so."

Meanwhile, as the antivirus companies continue to improve response times, the environment is going to grow more difficult for virus writers. Even the halting attempts that Microsoft is making with Service Pack 2 for Windows XP will make it more difficult to spread the types of worms that are happening now.

"Microsoft screwed up in the past with their paradigm on security," Hinojosa says. "But as slowly as they're doing it, they're making it tougher and tougher. As the top of the animal gets armored scales, virus writers have to find the soft underbelly, and that's probably going to be on the consumer front. So you're going to see [virus writers] having to trick people into stuff, say 10 to 15 years from now. The attacks will be more effective on the consumer than they are on the corporate network end."

So-easy social engineering. This kind of social engineering is "so easy," says roy g biv. "Bagle.A had a message body that said 'test,' and people still clicked the attachment. The password-protected attachment was a great idea, since people trust encrypted files."

Other writers aren't impressed by viruses that depend on duping the end user. Among them is Stephen Mathieson, a Detroit tenth-grader and already a veteran virus writer, who has provoked complaints about his work in the wild:

I hope writers will stop relying on stupid users and start actually coding viruses that use exploits in software instead of a person's intelligence. Look at how Blaster spread: It had nothing to do with how gullible the user was but how poorly made Windows was. It's lame to trick someone into opening your program; the only users that will be infected are idiots. If [virus writers] use exploits, everyone will be infected.

Virus writers expect to remain ahead of the game as long as the security community continues to make what the writers say are egregious mistakes. They cite, for instance, bulletins alerting users to gaps in security—bulletins that writers use as how-tos on exploits. DvL, a 19-year-old writer in Romania, says the security community is lacking "smarter people. They will never think like us."

BlueOwl adds that "stupid things programmers once programmed" are allowing writers to become cleverer with social engineering. He says:

MyDoom shows fake error messages that [look like] the real thing. Netsky lets users believe the mail came from someone they know, by extracting e-mail addresses from files in a specific way. And it's possible when using SMTP to send an e-mail to anyone from any address. So, for instance, I could send a mail under your address to your girlfriend saying something horrible and she'd think you wrote it to her. (But I wouldn't.)

Antivirus companies rely on signatures that are out of date by the time they ship, roy g biv says, "which means they are always behind and is a serious mistake." Other virus writers say that the security community would do well to pay more attention to forums and chat groups to remain apprised of "underground" developments. Mathieson says:

If I were them, I would make contact with the virus writers themselves to ask how their things work. If I were asked by them, I would explain how and why my theories and/or code work, because I'm not against them. I just enjoy writing viruses. More power to them if they know what they're doing.

Antivirus companies are well aware that the technical challenges of neutralizing viruses are shifting. Currently they have to analyze what the entry points could be—instant messaging, e-mail, Web servers in which Blaster-type attacks seek flaws—and the speed at which viruses are spreading. Hinojosa explains:

So the challenge now becomes: How do you generically stop something through behavior-based phenomena? Because with something that gets spammed out to 10 million people, you don't necessarily have time to get it analyzed, a signature file deployed, and the users updated in 5 minutes worldwide. This moves us into having to detect malware at the network level before we know what it is. That is the wave of the future.

One strategy that hasn't yet panned out for the industry is sandboxing, which creates a virtual OS so sophisticated that when a piece of code comes in, it's fooled into operating on the virtual OS instead of on the actual one. The engine can then analyze what the code is trying to do and handle it without letting it ever reach the actual OS.

Experts say, however, that current sandboxing methods are too resource-intensive. "We can get better at coming up with ways of preventing viruses due to security problems," META Group's Firstbrook says. "The other thing that needs to happen is that the antiviruses have to get cheaper and easier, because consumer PCs with broadband connections are the Typhoid Marys out there."

More feasible future strategies include packages of systems that can be largely immune without having continuously updated antivirus programs; all-in-one antivirus programs that address viruses, self-propagating e-mail worms, spyware, and adware; the use of antivirus technology to track down virus writers or quarantine poorly managed networks; intrusion prevention integrated into firewalls to block malware at the border; and systems that have security built-in from the beginning rather than added on.

Spafford has three recommendations for future antivirus strategies. One is that security firms should do a better job of addressing the changing nature of end users:

We're pushing competing technology into the hands of more and more people with less and less training. So the controls, interfaces, and explanations of these problems need to be developed for individuals with limited or no reading skills for us to be able to protect those systems. That's a huge ongoing challenge for the IT arena—understanding that change.

Another strategy should be to get out of the habit of creating monocultures:

The belief that one operating system, architecture, word processor, and language are good for everything is one of the reasons we have a problem. We don't do that in any other arena of technology. If you're having a house built, you don't see every craftsman—window guy, plumber—using the same Swiss Army knife.

And third, the computing industry should take care not to pigeonhole victims of viruses. For instance, MyDoom spread mostly through propagation from users downloading content at P2P sites such as Kazaa—users who might be less likely to red-flag bad code because they were in the process of downloading something illegally. In Stafford's words:

It's like venereal diseases, especially AIDS, because people tended to target a subculture they believed was immoral. So we have to look at this as a public-health issue and try to develop methods to protect against any kind of misbehavior without saying a particular group deserves it. The RIAA wanting to be allowed to hack into machines and send viruses to file sharers is an extremely bad idea. People with moral ambiguities believe it's okay to write viruses. If we open that up so different groups who believe they're being aggrieved in some way should have that ability, then you've removed that moral distinction.

BlueOwl doesn't write viruses because of moral ambiguities; he writes because of a fascination with the "magical little creatures traveling through computers." He says he can envision the landscape going either way—either toward a "massive rise" in viruses, proportional to the rise in communication methods, or toward a major decrease in viruses as the creators (his first category of virus writers) dwindle, reducing the number of tricks shared with other virus writers.

Steven Sundermeier describes the possibilities on the antivirus side another way. "You'd be kidding yourself if you said you were 100 percent foolproof—because you never know what's going to happen tomorrow."

Alexandra Robbins is a freelance writer and author of "Pledged: The Secret Life of Sororities."