THE VIRUS HOAXES
A review of Myth-information and Virus Scammers

David J. Stang, Ph.D.
QUARTERDECK ANTI-VIRUS RESEARCH CENTER

INTRODUCTION

CASE STUDIES

UNDERPINNINGS OF THE HOAX: THE HUMAN

IN THE WILD: THE BIGGEST SCAM OF ALL

THE EFFECTS

DISCLAIMER

INTRODUCTION

On March 6, 1992, millions of PCs around the world would stop working, billions of bytes of data would be lost forever and enormous amounts of both labor and money needed to reset the computers in the days thereafter - or so some "experts" tried to make us believe. On March 6, 1992 a computer virus named "Michelangelo", which was programmed to overwrite data stored on hard disks, was to strike our unprepared global information society in a surprise attack.

On March 7, it turned out, millions of PCs around the world worked as usual. The predicted "computer apocalypse" (the title of a paper published by a virus researcher) did not happen and only a few hundred computer users " unfortunately - lost any data due to Michelangelo.

A virus scanner is a product that looks for viruses. A virus scammer is a human who creates or perpetrates myths about viruses. This paper is about scammers. We are not interested in this aspect of the world because we are negative misanthropes, but because we are afflicted with a moderate interest in seeing the truth known. We start with a quick look at the major players.

THE PLAYERS

There are five villains in the virus scamming business: vendors of anti-virus products, virus researchers, virus authors, the press, and the public. Each of these bears some responsibility for the mythology and myth-information we have seen. In this section, we look at examples of the role each has played. We must emphasize that not every player within a category normally behaves the way our caricature would suggest.

ANTI VIRUS VENDORS

Vendors of AV products are the source of most of the information provided to the public about viruses, and so whenever we need a good hoax, we are likely to turn to them for ideas. Most of the vendor-sponsored hoaxes seem designed to sell more product.

VIRUS RESEARCHERS

Many virus researchers look much like vendors; but others look much like lawyers. They are all officially opposed to hoaxes, but most have willingly played along with such hoaxes as "the wild list". Most of the researcher-sponsored hoaxes seem designed to sell more product.

VIRUS WRITERS

With a small marketing/PR budget, virus authors can do little to create a hoax, other than to code. Many viruses contain the essential qualities of a hoax: severe but believable disinformation. Most of the author-sponsored hoaxes seem unintentionally designed to sell more product.

THE PRESS

The press have worked closely with vendors to tell their story, regardless of its plausibility. This necessarily comes from assigning someone who knows little about viruses to the task of converting a press release from a vendor to an exciting story by 5 PM. Most of the press-sponsored hoaxes seem designed to sell more product.

THE PUBLIC

The public loves a good thrill, and has been willing to pay for good stories in the press, thus furthering the cause of vendors, researchers, and authors. Of course, the public is not uniformly gullible. But most organizations have a senior resident scammer that helps ensure that e-mail about the latest scare is sent to the full organization at least once a month. The public's fundamental determination to remain ignorant seems designed to sell more product.

CASE STUDIES

Having managed to offend everyone, let me now address my critics (and anyone else who might have come today) with some examples. Perhaps a few good examples will put things in perspective. We will address these scams by scammer category.

ANTI-VIRUS VENDORS

We start with vendors, because they are the best known, most trusted source of virus information. We list just a few scams.

- "Detects All Known Viruses." This claim has not been true since 1990, when we had a hundred or so viruses to worry about. I was in the office of the most senior developer of a major anti-virus firm the day they shipped version 1.5. In the developer's inbox was a huge stack of diskettes with a post-it note: "New from Asia." On the back of the box was this claim: "Detects all known viruses." (Note: this claim has now shifted to "Detects all Viruses Found in the Wild". The truth of the claim remains questionable.)
- "Better than Ever." Products have gotten better, but not in relation to the problem. Whereas detection rates (percentage of all viruses detected) were close to 100% a decade ago, they have dropped substantially in recent years. (Of course, our test suites have not kept up with the problem either, so test results only suggest how products perform relative to each other, not how they perform relative to the problem.) Our tests are no longer against all viruses, but rather of all those in this directory, or perhaps even all we happen to possess. Unfortunately, it is a simple matter to scan a large collection with any scanner and find several thousand viruses that it does not detect.
- "Virus X is Out There. It's Gonna Kill Ya. Only We Can Save You." We hear this every other month from a vendor. We heard it about Michelangelo. We heard it about Junkie. We heard it about Hare. We heard it about Laroux. The alarms are always sent as soon as the product is able to detect and remove, but long before the virus has been found in anyone's computer. The frustration is that the vendors making the claim do understand that the virus is not out there yet.
- [Oops]. This category refers to any bodacious claim made by a vendor which is officially made in error, but never retracted. For example, in August of this year, this claim was made by one vendor: "is certified by the National Computer Security Association (NCSA) to detect 100 % of the world's known viruses, including over 1,000 macro viruses in real time-neutralizing them before they can affect critical computing resources." This sentence in the press release only contained four factual errors: NCSA 1) is not testing against 100% of the world's known viruses, 2) is not testing against over 1,000 macro viruses, 3) is not testing real-time; 4) is not testing removal (or whatever neutralizing means.) The privately offered explanation is that the virus expert was on vacation, and the public relations department did this.
- "Detects All Viruses in the Wild." This claim is made so frequently that it bears very careful examination, which we will do later in this paper. For now, let us say the statement is unproved and unproveable for any product.
- "The First." First is best. Check the dictionary. When last is not least, we are obliged to say so. So some vendors have claimed to be the first when they were likely the second or third - as in the case of a vendor who claimed to be the first to offer web site-based scanning of a desktop machine -- and other vendors have claimed to be first with a product when they had no product (one vendor's marketing staff announced in January of 1996 that they could protect against Java, but their head developer, present at the announcement, had no idea on how they would do this.) But anti-virus developers did not invent the concept of vaporware, and shouldn't be singled out with these observations.

VIRUS RESEARCHERS

Researchers are generally a kind, gentle bunch - until they get together at an NCSA AVPD meeting. Then they are prone to change personalities. We will look at only one researcher-based scam, that of the Wild List. And because we have so much to say, we will do this at the end of the paper.

VIRUS WRITERS

Virus writers are not as full of virtue as they might imagine, even if you have read the Virus Creation Labs. Consider these scams:

- "For Educational Purposes Only" Viruses are routinely posted on bulletin board systems and web sites with a disclaimer such as "I will not take any responsiblity for any misuse of these programs which can result in ARREST OR ANY DAMAGES TO YOUR COMPUTER. Please keep in mind that virii are very harmful and can and will destroy your computer and if you destroy other people's computer, you will personally be held responsible. These files are for educational purposes only."
- "Totals Your Machine". We can be grateful that most such claims by authors are false. And we can understand both why such a claim would be made (fun to scare 'em) and why it would be false (who would want to test and debug such a scary option? And since virus authors love computers, why would they want to hurt one? Better to scare a user.) So we find many claims in such viruses.

THE PRESS

The press has little interest in publishing a scam, but an equally slight interest in verifying whether a story they run is a scam or not. As a result, they willingly pick up on stories. It was the press who nearly single-handedly terrified the world about Michelangelo, after being fed the story by one vendor.

THE PUBLIC

Our friends the public have contributed to the problem. Not only are they the most important victims, but they are likely the biggest victimizers. Scam artists to the core, they love a good fear. One of their most common fears is that they can be destroyed by seemingly innocent acts, such as reading e-mail.

E-MAIL HOAXES

The most remarkable contribution of the public to this general scam has been through its unrelenting fear of e-mail viruses. In such a hoax, the original sender claims that reading e-mail with certain subject lines will cause the untimely demise of the local hard drive. Dangerous subject lines have included "Good Times" (December 1994 through the present), "xxx-1 will infect your computer.", "PENPAL GREETINGS!" (December 1996 through the present), "Deeyenda Maddick" (November 1996) "Join the Crew" (August, 1997 through present) etc.

Researchers have wondered how reading e-mail could be dangerous, but the e-mail hoaxes typically carry an explanation such as "The act of loading the file into the mail server's ASCII buffer causes the "Good Times" mainline program to initialize and execute."

Such e-mail hoaxes don't become a problem until each recipient forwards the e-mail to numerous other recipients, so they all contain messages such as "Forward this to all your friends" Of course, the public is willing to do much more. On April 2, 1995, during the Tom Sullivan show on KFBK 1530 AM radio in Sacramento, California, a police officer warned listeners not to read email labeled "Good Times", and to report the sender to the police.

And not all e-mail hoaxes concern viruses. "the FCC is considering a tax on modems and online services.", "Make Money Fast", and "Craig Shergold needs your get well cards" are all examples of e-mail sent to lists who forwarded it to lists who forwarded it…

UNDERPINNINGS OF THE HOAX: THE HUMAN

For some reason, experts, journalists, consultants and average PC users all tend to think about computer viruses in a very mystical way. We give them interesting names. We conceive that they are somewhat "alive" with a character, a life, some goals. At the worst of this mythology, viruses can be anywhere, do anything, and not get caught.

Separate clusters of myths can be easily identified and analyzed I would like to call three by mythological names: Pan, Alberich and Armageddon. Looking at those myths and comparing them with the actual facts reveals some serious misconceptions people harbor about computer viruses and reveals how these misconceptions wrongly influence which precautions users take. It may even explain why users take the wrong precautions.

PAN -- THE MYTH OF RAPID WORLDWIDE SPREAD

Vendors like to talk about viruses as if they could become worldwide epidemics in mere days. One vendor's web site has a link to "New Virus Outbreaks" and stories such as "Hare Virus Set to Strike" The Pan of mythology seems to come from all directions at the same time and people run away in "pan"ic.

The Michelangelo story shows how effective this scam can be. In October 1991, leading anti-virus vendors helped fund the first NCSA virus prevalence study. Corporations were asked to list all the viruses with which they had been infected. Michelangelo was never cited. Just 3-4 months later, however, one vendor was claiming that about 10% of U.S. PCs were currently infected with the virus. The boom in sales of anti-virus software was never greater. Store shelves were empty. The vendor went public. And the world was saved by, as the vendor said, the helpful response of the press and the sudden acquisition of anti-virus software.

Pan is a myth and so is the possibility of immediate infection of all PCs with a computer virus within days of its creation.

ALBERICH -- THE MYTH OF ABSOLUTE INVISIBILITY

Alberich, the king of the dwarfs, can become invisible, whenever he needs to, according to an Indo-Germanic myth

Invisibility, so goes the modern myth, is a feature of the most wicked viruses. Some call it "stealth" to associate it with the expensive bomber, others compare it to radiation. Invisible to human eyes and undetectable by ordinary means, we imagine the virus floating in the computer's ether (or phlegm, if you are running a thick GUI).

Viruses are said to completely encrypt themselves, to survive low-level formats and to reside in the CMOS memory. Consider the report of the Hackingburgh virus (hoax virus): "The FCC has just released a new virus warning of a email virus named "Hackingburgh". This virus is spread throughout networks and email servers. The infected message has random titles with one attachment and one Java applet. When the person reads the message, the virus would be evoked automatically by the commands of the suspicious Java applet. However, since the virus is so small, executing it would be undectable."

All of these support the myth of absolute invisibility. The myth of Alberich is great for fairy tales, but there is no need for us to resort to it just because something is not plain visible to us at first look.

ARMAGEDDON -- THE MYTH OF TOTAL DESTRUCTION

The myth of Armageddon is the story of the mother of all battles and the total destruction which follows. The stories about damage caused by computer viruses resemble the myth of Armageddon. After the famous 1989 Internet worm incident, for example, the CVIA (a one-person organization run by a vendor) estimated total damages of about 100 million dollars. A couple of weeks later the Boston Globe ran a story reporting damages of about 180 million dollars. Subsequently a subcommittee of the ABA lobbying for tougher computer crime laws calculated more than 200 million dollars of damage caused by the worm. Such estimates were later shown to be high by a factor of 100 or more.

If even such a fairly benign worm can cause such damage, then surely a maliciously programmed computer virus can bring about a complete Armageddon. Consider the Death69 (hoax virus) which was described in e-mail as follows: "There is a horrible new virus on the loose! Created late November by elite hacker "DEATH-BLAZE". The virus is full stealth Trojan, once thought never possible, it first formats the hard drive, then it physically eats at the materials of the drive. Researchers are stunned, they say it is possible the most destructive virus ever created."

The only fact on computer virus damage, we have, however, is that during the court proceedings against the worm's author, Robert Morris Jr., the uncontested total amount of damages was set to just over one million dollars, 1/100 of all the well-published previous estimates and clearly not Armageddon.

Pan, Alberich and Armageddon are myths of ancient tunes, fears of the incomprehensible, and symbols for similar myths or misconceptions of computer viruses.

POP PSYCHOLOGY OF THE VIRUS

In a life of tedium, a good virus scare always rescues a failing heart rate. A scare pulls us from our lethargy. As children, we liked to hear scary stories - as long as they weren't too scary. Perhaps the first virus was born in a campfire, with the night swirling around.

The virus provides us with a proper scary story, when told just right, with some imagination. And as long as our anti-virus product will protect us, we can sleep comfortably when the story is over.

IN THE WILD: THE BIGGEST SCAM OF ALL

Simply raising the public's fear is not enough. Perfect product marketing, as exemplified with Michelangelo, requires both describing a problem, then presenting a solution.

Consider this problem: viruses are being created faster than vendors can obtain them and develop detection and removal instructions. A good case in point is WM/CAP, which was created in December 1996, and has become one of the most common viruses in the world. One reason: few anti-virus products were able to detect it within 6 months of its release, so it had ample time to spread.

How would a vendor deal with such a problem? The easiest way is to dismiss this rapid emergence of new viruses by claiming that only a handful of such viruses are "in the wild" and pose any threat to users. The rest, the claim goes, are only possessed by researchers, who are very careful to not share them with anyone.

Consider this claim, from one vendor's white paper on their web site: "There are over 8,000 known computer viruses in existence but the vast majority are contained in virus research labs and have had little to no general distribution. Only approximately 200 viruses have actually been discovered in the wild, or in general distribution. A researcher at IBM named Joe Wells maintains the Wild List that is considered the industry standard. The important detection rate to consider when choosing anti-virus software is its ability to detect and cure viruses in the wild." In short, if the virus is one of the 200, it is important, if not, don't worry about it. Choose a product that is able to detect these 200 viruses, and relax.

Considering this rhetoric, it is easy to understand that concept of "in the wild" emerged as a salve for vendors, who had once boasted that their products detect "all viruses", now realize that no one would believe such claims, but want to detect 100% of something. To claim "all viruses found in the wild" seems believable, if only such a list is known and modest in size.

A virus that is "in the wild" is one which is not confined to the collections of a few virus researchers, authors, or collectors, but is, as we speak, having fun in the computers of one or more users somewhere in the world. No one will argue that some computer viruses are not more common than others, or that the relative abundance of a virus changes over time. But the popular lists of "in the wild" viruses are incomplete, dysfunctional, and are used in ways that mislead and deceive buyers of anti-virus software.

WHY A GOOD WILD LIST IS NOT POSSIBLE

There are several reasons why a good wild list is simply not possible, no matter how many resources are thrown at the project.

- The problem of scanner precision is that because scanners are so imprecise, we are never able to know exactly what virus has been reported, and can never extract from a collection a sample that, with certainty, matches the report.
- Under-reporting of rare viruses usually results in these viruses not appearing on a wild list at all. While we somehow assume that a "rare" virus that doesn't appear on the list has only been found "a few" times in the wild, a virus that infects 1,000 computers per month won't appear on a wild list either.
- The problem of rate of spread is that viruses can spread much faster than wild lists can be updated. Wild lists always trail actual infections, so have limited use in preparing us for new viruses.
- The problem of purging viruses is that the popular lists assume that viruses go away if not reported. Yet it is not at all likely that viruses suddenly become extinct. More likely is that their numbers diminish, or that anti-virus products are eventually able to easily defeat them, when found, and their numbers are unreported.

MISUSE OF THE LISTS

If there is a problem with the concept of an "in the wild" list, it is not with whether a particular virus belongs on the list or not. It is with the use of the list.

One use of the list is to define a test suite of viruses, for the purpose of evaluating anti-virus products. The NCSA testing is done using the upper portion of Joe Wells list - those viruses reported by two or more researchers to him. In the March, 1997 release of this list, that meant that 240 viruses would be tested against - in May or June, and 153 would be omitted. In short, while there may be problems with the coverage of the complete list, NCSA admits to only testing against 240/(240+153)= 240/393 = 61%

It is not surprising that an "easy" test would attract its adherents. Consider this excerpt of a white paper published on one vendor's site: "Many reviews of anti-virus software start (and unfortunately end) with just a comparison of detection rates. While detection is an important consideration, it is just one aspect of the software. Detection rates will vary dramatically depending on the types of viruses used for testing. One program may detect 90% of several thousand test viruses while another may detect 80%. Results like these are not conclusive and actually can be misleading.

This vendor argues that if the product passes NCSA certification, it is good; if it does poorly in another test of detection rate, it is not necessarily poor. And thus the vendor discounts its standing in Virus Bulletin's tests, in which it scores relatively poorly.

Are the best products NCSA certified? We compared NCSA certified and non-certified products on their scores in VB's tests. If we look at the average scores of products tested by Virus Bulletin which are NCSA certified, and compare them with the average scores of products tested by Virus Bulletin which are NOT NCSA certified, and if we omit only one product - Microsoft Antivirus (which has not been revised since it was introduced four years ago, and should not be expected to perform well), we find that NCSA certified products score lower (average detection of 91.86%) than non-NCSA-certified products (average detection of 94.06%)!

Further, if we compare performance in Virus Bulletin's In the Wild test suite with NCSA certification, we find that those products not certified by NCSA score higher in the Virus Bulletin Wild test (97.61%, on average) than those certified by NCSA (97.18%, on average) - again omitting Microsoft Antivirus.

Equally interesting is this observation: A product which detects all of the in the wild viruses in the NCSA suite is likely to miss about 3% of the viruses in the wild according to Virus Bulletin. This does not point to the superiority of the Virus Bulletin tests or test suite, but rather to the groundlessness of claiming that all the viruses that are in the wild happen to appear in a particular collection of samples.

THE ERROR IN JUDGMENT

To go from a list of "some viruses reported to an individual" to a list of "All the viruses in the wild" (as some vendors have done) requires only a change in wording. Any wild list can only be as good as the level of reporting. And any wild list must be the victim of under-reporting.

In the case of the Virus Bulletin list, the respondent must presumably know the Virus Bulletin phone number, and be willing to place a call to England.

In the case of Joe Wells list, information is only obtained from 46 or so respondents. While these respondents are surely well connected, it is likely that the majority of the earth's computer-using population has never heard of one of these people, does not have their phone number or mailing address, and does not have the time or interest, if they did, to capture a sample and ship it off. And people with viruses to report are quite likely to receive an e-mail message such as "The WildList already has a lot of reporters from the U.S., and are not in need of any more at this time. Since only reporters to the list are on WildTalk mailing list, I can't add you now, but if we start any other lists which may be of interest to you, I will let you know and invite you to join."

THE EFFECTS

You might be able to tell that I am not happy about virus scammers. I am not in favor of myth-information.

I think there are profound, and generally negative effects of not telling the truth, or of not knowing the truth.

- Lost productivity is one of the big losses. We have experienced it as we have fielded calls about hoaxes or as we scrambled to try to find a virus that some other vendor was claiming would destroy the world. Users have experienced it.
- Lost credibility is another big loss. I have never given a virus seminar in which I wasn't asked "Do vendors write viruses?" Only a profession as shabby as ours, who sees no distinction between dishonesty and marketing, could be so maligned.
- Lost integrity is the ultimate loss. We have entered the age of sue and countersue (Maybe that's what WM/Colors means!) Of pirate code and deny it. Of let marketing make it up while we are on vacation.

I think we have plenty of real things to worry about:

- Viruses are emerging faster than products are adding detection and removal
- New classes of viruses, such as Java viruses, are emerging, and we aren't doing anything much about it.
- After a decade of opportunity, vendors and researchers are not yet collaborating as closely as virus authors do.
- Some vendors are spending more on litigation against each other than on R&D.
- Product testing is largely owned by the vendors.
- Windows 97-98 is coming, and with it a tidal wave of security problems, most notably through ActiveX.

We must work to deal with these problems. We must work together, if we can, or alone if we must. But we cannot let the shame of these stories fill our lives.

I am glad to be working for a company committed to telling the truth. We should all try to work it in to our marketing plans.

DISCLAIMER

The opinions expressed herein are solely those of the author, writing as an individual. This paper does not present an official or unofficial view of Quarterdeck Corporation nor its employees.