Notes from the virus Underground...

Computer viruses are the terrorist threat of the digital age.
The inside story of who creates them and why...
By Kim Neely

This article originally appeared in the Sept 16th, 1999 issue of Rolling Stone magazine.

It's three in the morning on the internet relay chat channel #codebreakers, and Opic is waiting. It has taken a week of cryptic e-mail missives, bounced around the world and back again via a chain of anonymous remailers, to arrange this meeting, but the enigmatic twenty one-year old is here when he said he would be. "Sorry about all the confusion," he types. His welcome appears on the screen after a slight lag, a symptom of the proxy servers he's routing himself through to cloak the address of his internet service provider.

Opic is a "coder", part of a ten man internet virus-exchange (VX) group known as CodeBreakers. He writes computer viruses. In and of itself, this isn't a pursuit that would require anyone to go into hiding. Writing viruses is perfectly legal in the United States.

Intentionally spreading a virus to unwitting computer users, though -- thats a prosecutable offense. Especially if that virus turns out to be the fastest spreading piece of self-replicating code in history. You wouldn't want to be linked to someone even suspected of pulling a stunt like that. This is why Opic and other members of CodeBreakers have been so skittish lately.

Computer viruses are small, parasitic programs that attach themselves to other programs and reproduce. They've been around since the mid-Eighties, but the general public didn't become aware of them until 1992, When the data gobbling Michaelangelo became the first "celebrity" virus. Ten years ago, there were only about thirty known computer viruses. Today, according to Symantec and Network Associates, the top antivirus software companies in the United States, there are some 40,000 viruses in existance.

Anything that a virus does besides replicate is called it's payload. Some viruses contain no payload at all and can reside on a PC for years without being detected. Others display jokey screen messages, print text or play music. Some viruses cause gradual, insidious corruption of data files; others like dormant throughout the year and then destroy files or reformat hard drives when a certain date rolls around.

Viruses that permanently wipe out files or erase hard drives are the least common type. Still, virus researchers contend that there is no such thing as a benign virus. Even some "non-malicious" viruses are so sloppily programmed that they result in software malfunctions, crashes and file corruptions not intended by their authors. Theoretically, if a virus was buggy enough to disrupt the day-to-day operations of a crucial machine or network- say that of a hospital or an airtraffic control system - and happened to hit on a day when that organization's backup system was down, even the most harmless virus would have the potential to be life-threatening.

This spring Microsoft users everywhere met Melissa, a technically harmless - it contained no data destroying payload - but alarmingly prolific Word 97 macro virus. Among the viruses known to be actively spreading today, macro viruses are the most common. They are written in the Visual Basic for Applications programming language included in the popular software package Microsoft Office - the user-friendliness of which makes viruses fairly easy for even non-programmers to create - and travel via infected Microsoft Word or Excel Documents.

Melissa upped the ante for virus spreading. Instead of relying on users themselves to transfer the infected documents from machine to machine via disk or email, the virus operated like a chain letter from hell, corrupting Word documents and, if Microsoft Outlook e-mail software was installed on an infected machine, peeking into the user's address book and sending e-mails - each with an infected document attached - to the first fifty addresses found.

Melissa clogged email gateways, panicked PC users and sparked an FBI manhunt that at least initially pointed to a retired member of the CodeBreakers known as VicodinES. Vic, as he's known in the clannish virus underground, was first linked to Melissa when simularities were discovered between Melissa, and an earlier virus PSD2000, that he had created and that was available for download on his Website. The FBI began sniffing around the CodeBreakers a few days after Melissa surfaced, shutting down two Web sites containing viruses written by VicodinES: CodeBreakers.org, the groups own site, and SourceOfKaos.com, a domain that hosted Vic's personal site.

Working from logs provided by America Online, investigators later traced the usenet post that triggered Melissa's joy ride to a thirty year old Aberdeen, New Jersey programmer named David L. Smith. Smith now faces charges that could carry a maximum penalty of fourty-years in prison and $480,000 in fines.

Authorities have yet to reveal whether Smith and VicodinES are one and the same. The CodeBreakers have maintaining from the beginning that Melissa was neither written nor spread by Vic. Rather, they say, Smith simply cobbled Melissa together out of two earlier viruses, one of them Vic's PSD2000. This is entirely possible: Files containing viruses are swapped like trading cards on the Internet, and coders often modify existing viruses to create their own new mutations.

Interest in the group on the part of law enforcement appears to have cooled in the months since Smith's arrest. So aside from the precautions they take to protect their identities, the CodeBreakers have returned to business as usual. They're still writing viruses, still making them available to anyone who cares to download them via an electronic zine, CodeBreakers VX zine, Edited by Opic. "After much internal dialogue," he explained in the zines first post-Melissa issue, the CodeBreakers had simply decided to "continue doing what they have always done: find new, innovative and interesting viral techniques."

Opic has agreed to this late night chat not because he is eager to rehash the Melissa sordidness but he because he was approached with what for him must have been a powerful lure: genuine curiosity about why he - or anyone - writes viruses.

Sarah Gordon, an anti-virus researcher with IBM who has been studying virus writers for nearly a decade, says it's impossible to tell how many coders are currently practicing, because many never tell anyone about their activities. She conservatively estimates that there are several hundred writers with a presense on the Net and that they make up roughly fifteen "active, findable" VX groups. Of those writers, only a small minority are very prolific. "There are always the little cliques and clubs that don't get the attention," she says.

Coders come in all different stripes, and their motivations and ethics vary widely. For every stereotypical fifteen year old bully who writes nothing but data destroying code that he e-mails to his enemies, there's also a middle aged Silicon Valley exec who downloads a virus from the internet, plays with it out of idle curiosity and accidentally infects his firms network.

Opic would seem to fall somewhere between those two extremes. A college student who focuses on the arts, he's been writing viruses for two years. He has no formal computer training; he's entirely self-taught. He usually reveals his interest in viruses to his girlfriends (if only to explain the long hours he spends at the keyboard), but his parents and other relatives don't know about it. ("Why involve loved ones who don't need to be involved?" he asks.)

Opic got his start by hacking into local university systems with a friend. Once he began learning about viruses, he was hooked. "I found it fascinating that I could actually make this computer do what I wanted," he types, "that I could write something that would travel from computer to computer. It's a classical art concept, playing God and all."

According to Gordon, many coders see what they do as a creative endeaver. At least one virus writer with whom she has had extensive contact, a Bulgarian coder known as Dark Avenger, channels his emotions into his code the way an artist would channel them into a painting.

"There was a certain frantic yet very deliberate way that he wrote his programs," Gordon remembers, "Some of the things that he'd put in the source code would just lead you around and around through this maze. And then there would be this part where the code was very calm, laid out very methodically. It was really interesting to see that during the times when things were really confusing in his life, he was writing code that if you looked at it, was like looking at a pile of spaghetti."

Opic is more imaginative then most coders. Instead of the requisite Iron Maiden lyrics or "Too bad, lamer!" brag messages, he salts his viruses with Fugazi lyrics and snippits of his own peotry. ("There is a path to the transcendence of the dollar: Embark rich beggars...."). Opic doesn't write data destroying viruses; a user whose pc is infected by one of his programs is more likely to be annoyed by pesky text messages that appear on a given day of the month or to be haunted by a printer with a mind of it's own. "I'm into making points through ambiguity, rather than the tried and true 'in-your-face' method," he says.

Most of the viruses he's writing these days are "proof of concept" programs, created to shine a big embarrasing spotlight on software vulnerabilities. One such virus is Caligula, the bit of code for which Opic is most widely known. A word macro virus, Caligula searches for the file containing a user's private encryption key - the key that enables users of the popular Pretty Good Privacy (PGP) utility to decode their encrypted documents and e-mail and uploads it to Opic's FTP site.

Opic says he had no intention of using the files to gain access to anyone's encoded documents. "I had no interest in impersonating or violating anyone or debunking PGP, which is a great asset to myself and millions of others," he says. "But it was vulnerable due to Microsoft's platform and some lazy or non-security conscious programmers. Had I not coded it, it's possible that someone with more malicious intentions would have."

Gordon says she's heard that argument from virus writers before. She views it as an attempt to legitimize irresponsible behavior. "if that's what you have in mind," says Gordon, "there are more responsible ways of working toward solving such problems rather than just posting something on the Internet and saying, 'Oh, here's a new problem; so that everybody in the world can go out and exploit it."

Opic concedes that in making their viruses available to anyone who's curious enough to seek them out, VXers do play a role in any damage caused by programs that fall into the hands of individuals with malicious intentions. But he counters, it's "an indirect role in the same manner that gun manufacturers play a role in thousands of murders each year." Still, why wouldn't Opic consider contacting a software manufacturer discretely when he's written a virus aimed at vulnerabilities in that vendors product?

"Ever tried it?" he asks, "That's obviously the least intrusive route, but it doesn't work. The world is overrun by bureaucracy." He points to Caligula as an example. "What I did was nothing new," he says. "Many have known it was possible; many people in fact, have written and published papers on the problem. But no one did anything about it until I illustrated the point."

Rob Rosenberger - a security expert whose Web site, Computer Virus Myths, attempts to educate consumers about hoaxes and media hype related to viruses - says he believes that a small minority of virus writers do ultimately contribute to the greater good. "This is a controversial opinion," Says Rosenberger, "but I really think the guys who are writing at the state of the art should be left alone to do what they do, because they also force an advancement in the antivirus-world. They make the world more secure."

Not all viruses are inspired by security holes. Sometimes personal politics turn up between the lines of code. One of Opic's favorite creations, Koyyanisqati, was a macro virus that launched a "ping flood" attack - a barrage of data packets that overloads servers and disrupts internet connections - on four different websites. Two of the sites were devoted to kiddie porn; the other two were racist hangouts. Koyyanisqati Opic says, was his "attempt at a 'good' virus." Still, he can understand why someone like Sarah Gordon wouldn't see it as an achievement. "I suspect she would agree with my feelings in case, but not my methods," he says.

Gordon is one of the few people in anti-virus (AV) circles who deign to hobnob with the VXers, and though they don't always agree with her opinions, most coders who have met her view her with respect. She and Opic have been engaging in lengthy e-mail debates about virus writing lately. "She's very open," he says of her. "She's the only AVer I've met who is willing to actually discuss things rather than just sit around and mudsling." Many VXers despise those who work for anti-virus-software vendors, claiming that they exaggerate the threat virus writers represent in order to sell more software. "It's part of the deal," says Opic. "They have to demonize us in order to capitalize on the computer virus phobia that users have."

There's no question that the anti-virus-software industry - which has retail sales that are predicted to reach $1 billion by 2002 - stands to gain from nurturing virus hysteria. Anytime the threat of an especially sexy virus surfaces, the anti-virus companies race to develop fixes, issue "virus alerts" and bend the ears of quote-hungry reports. And invariable, after a virus outbreak that recieves national media attention, there is a subsequent spike in anti-virus-software sales: According to the Reston Virginia, computer-industry market research firm PC Data Inc., virus-protection-software sales increased by more than sixty-seven percent between March 28th and April 3rd, at the height of the Melissa scare. Most users know so little about the reality of viruses that it's easy for AV vendors to indulge in gloomy hyperbole to gain an edge.

"The threat of virus infection is now greater than ever!" claims the Product webpage for VirusScan at McAfee.com. "The need to protect your PC has become vital, as there are now over 40,000 known computer viruses, with more than 300 new viruses being created each month."

Figures like that strike fear into the heart of PC users. What most of them don't realize is that of the estimated 40,000 viruses in existence, only about 150 are currently known to be actively spreading. The rest are cooped up in anti-virus research labs. And while AV firms often incorporate terms like deadly, dangerous and malicious into their sales literature, only a small minority of viruses pose any real threat to a user's data. A quick look at the July wildlist, a monthly tabulation of viruses known to be "in the wild," provides a more realistic picture. Total number of viruses known to be actively spreading: 132. And of the eighteen most common viruses reported in the July Wildlist, only three - CIH, ExploreZip and One_Half - destroy data.

There's an interesting symbiosis between VXers and AVers. The members of each group generally profess to despise the members of the other, but both groups in a sense are dependant on each other. Virus Writers need the antivirus industry to challenge them as well as to provide them with notoriety. In VX circles, having the antidote to your virus latest virus turn up in a new release of Norton AntiVirus or McAfee VirusScan entitles you to major bragging rights. In turn, virus writers are fond of pressing the notion that they keep an entire industry employed.

The friction between the two groups can be intense; frequent bickering matches erupt on Usenet newsgroups such as alt.comp.virus and comp.virus. The AVer's favorite ploy is to hit coders in the ego, accusing them of shoddy programming skills. Every once in a while, a coder strikes back. Nick Fitzgerald, a consulting editor for Virus Bulletin Magazine, once made the mistake of publicly scorning a virus writer for his "pathetic" programming abilities and later found himself on the recieving end of a creation called Cold Ape. A.k.a The Love Monkey Virus. Users infected by ColdApe unwittingly sent e-mails to Fitzgerald's address at Virus Bulletin, informing him that they wanted to make "hot monkey love" to him. Fitzgerald says that ColdApe cost him and Virus Bulletin "hundreds of hours" of work.

"If you did make this virus then first off, damn you," reads a June 2nd Usenet post by one Marcin Mirski. "And second, how can I get my infected files back?"

Messages like this turn up fairly often in the alt.comp.virus newsgroup. Mirski has come to the group to ask about the happy faces that keep showing up on his screen when he's using Windows 98. The happy faces, he reported in an earlier post, are accompanied by a message reading, "Oops! I've got such terrible munchies. TERMiTE v1.0 RAiD [SLAM]".

Within twenty-four hours, Mirski's query has been answered with a post by RAiD, the proud papa of TERMiTE, a.k.a. HLLP.5000. "Isn't he kewl?" asks RAiD in his response. "Have you seen my graphical payload yet? Does it look like crawling termites to you? Have you seen my other payload yet? You're still here, so I guess not."

Other posters add to the thread, explaining to Mirski the steps he needs to follow to get rid of TERMiTE. before it launches the randomly triggered second payload, which will wipe his hard drive. In the midst of advice giving, David Chess, a highly respected antivirus researcher with IBM, pointedly addresses TERMiTE's author: "Just out of curiosity, RAiD, did you feel any impulse whatsoever to apologize to Mr. Mirski for having written a damaging virus in the first place?"

"None Whatsoever," RAiD fires back. "I'm rather proud of that virus, why on earth would I apologize for something it was designed to do? Mind you, I didn't expect it to get as far as it has, but that's neither here nor there."

A member of the VX group Slam and one of the loudest, most unrepentant coders on the Net, RAiD is the kind of virus writer who makes antivirus workers - and often other virus writers - gnash their teeth in frustation. He's the guy who pops into the mind of PC users as they nervously scan their disks with AV software. Not only does he write viruses with malicious payloads, he also takes a fairly obvious measure of delight in watching them spread.

What drives coders like RAiD? During an informal late-night Internet Relay Channel chat, he offered several clues. While his buddies - guys with handles like CyberYoda and VirusBust and Knowdeth - were standoffish RAiD was clearly itching for a piece of the spotlight. He expressed doubt about whether or not his comments would be accurately reported, writing that "the media have made us out to be villians," but he couldn't seem to resist sharing his views anyway. "Personally, I'm interested in exploits," he wrote, "and new ways to infect things. if it can be infected, I want to infect it. Not to cause harm to people," he added, "but to see if I can."

Two days later, an Anonymous email arrives, with a file "toad10.zip" - attached. "You get a sneak peak of the next virus that will be released eight hours from now," it reads. "You'll find it's a bit more complicated than a Word Macro virus, while enabling excellent worm functions."

"Because of the way it works," the missive continues, " the entire world will see it. Er, well, I hope." The message is signed, "Regards, RAiD [SLAM]"

As of yet, the entire world hasn't seen Toadie, RAiD's latest virus. But a few people have, By late July, posts under the subject header "REQ Toadie v1.0 Help" began cropping up in alt.comp.virus, and RAiD is happily holding court.

"Does anyone have any concrete reports on how far and widespread the Toadie virus is?" he asks. "We've seen four or possibly five people on Usenet infected, but has anyone been able to actually confirm any infection?"

"RAiD, I like your style," someone quips the next day. "I compare this to pissing through someone's letter box and then knocking on the door and politely asking, 'How far did it go?'"

According to Opic, RAiD is in the minority of virus writers today, one of a small number who are unapologetic about "opening [Pandora's] box and loving it." From what she's seen of RAiD's activities, Sarah Gordon agrees. "He's not very representative at all of the current crop," she says.

"There are malicious people out there, but they're not accepted around us," says Evul, a twenty-nine-year-old coder from the group Ultimate Chaos, whose members frequently associate with the CodeBreakers. "With me, it's about creating and sharing your creativity, as opposed to maliciously or subversively using it on somebody." Spooky, 17, one of Opic's compatriots in CodeBreakers, quit writing in April, when he examined the log files sent back to him by one of his viruses, marker, and learned that it had infected organizations like Blue Cross- Blue Shield. "There have to be limits, and I think I have found mine," he explained on his Web site at the time.

Most people find it surprising that virus writers have any moral or ethical boundaries. When Gordon presents her research on VXers at industry conventions, she says, most of her audiences view virus writers as "Antisocial kids with no girlfriends," They're shocked to learn that in tests of ethical development, coders are usually withen the norms for their ages. "A lot of the people who do this are, in all aspects, normal, decent people," says Gordon.

Virus Writers who do happen to witness firsthand the human pain and problems wrought by a digital catastrophe often become ex-virus writers very quickly. "On a computer, you don't have contextual clues," Gordon explains. "People lose touch, and they don't realize the impact they're having on another persion. It's very possible that sometimes when virus writers say, 'Viruses don't really hurt people,' they believe that. They haven't seen that other person crying because they lost their thesis."

The most public guilt-induced defection to the VX underground has seen in recent years was that of Mike Ellison, a.k.a. Stormbringer, a former member of the Phalcon/Skism group. Ellison was fourteen and already interested in computer programming when the Stoned virus turned up on his machine. (One of the oldest known viruses, Stoned displays the message "Your PC is now Stoned!" on start-up.) At the time, he says, viruses were "mysterious, something you kinda had to learn on your own from disassembling them." He and a friend studied Stoned to see how it worked, and before long he was experimenting with a virus of his own. Ellison still remembers the day he wrote his first successful virus. "It was a bit of a rush," he says.

"Viruses are unique and quite interested in that they can travel without additional human intervention." Creating such a thing, he adds, is "a pretty neat feeling when you're that young."

By the time he was sixteen, Ellison was a card-carrying member of Phalcon/Skism as well as a second ground, the Trinity; he had a respectable rep in the underground and had written a slew of viruses. As Stormbringer, he wrote Key Kapture II, designed to capture the keystrokes made by a user and save them on any writable drive when the drive was changed. Writing for the Trinity, he produced Crucifixion, a virus that activated only when a user hit CONTROL-ALT-DELETE on Sundays in March or April; once deployed, the virus displayed a picture of Jesus on a cross, accompanied by music and animated sing along lyrics: "If your the Messiah and you know it, clap your hands." ("What can I say?" says Ellison. "I was bored.")

Ellison says that the members of Phalcon/Skism, with "one or two notable exceptions," were "very much against writing destructive code. That wasn't the point. The point was to learn and explore, and occasionally to one-up each other and other groups with skill." Although he did publish the source code for his viruses in the Phalcon/Skism zine, 40hex, he never let live viruses stray from his own machine. For the length of his tenure with the group, he believed that the only outside copies of his viruses existed in anti-virus research labs.

"I really didn't think any of my viruses would ever be seen in the wild," he says. "At the time, I didn't worry too much about publishing the source of my viruses, either. For one thing, I wanted to provide information and techniques to other virus writers and anyone else who was interested. But also, I really didn't expect some random loser to compile one of my viruses and go off infecting machines with it."

Reality hit in 1994 when Ellison was contacted by a user whose system had been zapped by Key Kapture II. A third party had acquired Ellison's source code, compiled it and loaded the virus onto the user's machine. When Key Kapture II began filling up the hopeless user's hard drive with captured keystrokes and he discovered he had only two megs of space left on his disk, he e-mailed Ellison to find out how to get rid of the virus. Ellison phoned the fellow to help him disinfect his machine. Today he describes that conversation as "traumatic."

"It really shocked me," he says, adding that he felt "very depressed and guilty." to learn that he had "somehow unintentionally managed to hurt someone on the opposite side of the world who had done nothing to me." Even worse, as Ellison later noted in a post on the Net, the Key Kapture-infected user "was kind, almost like he didn't really blame me... For some reason, this really shook me." Ellison quit Phalcon/Skism the next day, posting a public retirement letter on the Net.

Today, Ellison, 23, works as a software developer in Texas, "I've lost quite a few weekends myself cleaning up after viruses that found their way into companies," he says. "And while I've never seen a real loss of data, the lost man-hours and trust of the users in their computers is substantial."

Ellison still believes that "writing a virus in and of itself is in no way wrong." But, he adds, "allowing it to spread into the wild, either by one's own hand, which is malicious, or by another's, which I see as negligent, is."

Asked how he views the currently active VX groups in terms of their collective ethical mind-set, Ellison says the prevalent attitude today is "rebellious but not intentionally destructive. There are a handful of people who go into it with the intent of destroying random people's hard drives and others who basically feel that they are spraying the electronic equivalent of graffiti." Still others, he adds, genuinely do feel that they are serving the greater good. "People trust computers and technology too much, when so few really understand them," Ellison points out. "Viruses, by that view provide a destablizing force to remedy such unfounded trust."

Nick Fitzgerald claims that maliciousness in virus writing circles or, as he puts it, the "screw them over and trash their data" ethic - has become increasingly common within the last two or three years. But to Opic and his friends, the public image of the "typical" virus writer as a cyberterrorist hellbent on inflicting harm is just plain passe. According to Opic, few of the writers he knows are still interested in creating viruses that destroy data; the wave of the future is programs that collect it. The PGP-key stealing capabilities of Caligula, he says, merely scratch the surface in terms of what is possible.

Virus writers he points out, would not be such a threat to the computing public if it weren't for the constant dumbing down of PC technology - a result of the ever-increasing consumer demand for more-automated, user-friendly software and the eagerness of companies like Microsoft to meet it. There are a number of unsettling advances on the horizon that play into this dynamic. The VX community is now exploring viruses that propagate via programming languages like HTML, and Java, which are commonly used to write Web pages. Executable code can be embedded into HTML files, and because some newer communications programs automatically execute HTML when it's found in an e-mail, it's conceivable that viruses could be spread simply by users' viewing their mail. Java, says Opic, presents the possibility of "remote and automatic infection" - ie, visit a Website containing infected Java files, now you're infected. New internet languages create the possibility, Opic says, for "global infection in hours. A virus can spread to millions of computers before anyone even suspects there's a problem."

Asked if he can understand why most people find that idea scary, Opic says they should find it scary. Still, he contends that virus writers and their creations are only a symptom; the problem itself is the "overall development mentality" - namely, the low priority given to security issues by software manufacturers like Microsoft - that allows them to flourish. As long as there are operating systems and software programs with vulnerabilities that can be exploited, virus writers are going to exploit them - sometimes for no better reason than the fact that they can.

It's five in the morning, and lines of text are still marching across the screen. "Humans are almost forced to open Pandora's box at times," Opic writes. A few seconds later, a server message appears in the chat window: "Opic has set the topic on channel #codebreakers to 'Curiosity Killed the cat.'"