CATCHING THE VIRUS WRITERS
Jim Bates

INTRODUCTION

During my work in analysing virus code I have been privileged to be asked to help the Police on a number of occasions and some of my experiences and observations will be described here.
In this presentation I shall try to highlight the problems that computer viruses have caused and how the authorities in the U.K. are dealing with them. I will describe some virus writers and the environment that they work in to produce their programs. I will introduce some of the reasons they have given for writing viruses and in some cases why they feel aggrieved at being "persecuted" by the authorities. Without going into too much detail that might help the really malicious virus writers, I will present details of some of the cases I have been involved in and how the Police tackled the problem of locating and identifying those responsible for particular virus incidents.

WHY DO WE NEED TO CATCH VIRUS WRITERS?

There are several reasons why we should want to catch these people-the main reason is quite simply to bring them to book for the loss and disruption that they cause. Another reason is that viruses are a non-productive threat which diverts genuine creative effort from helping to fuel to progress of computing in general. If we accept this then it becomes obvious that we should use any means at our disposal to stop people from writing them and distributing them. It should also be remembered that some at least of the virus writers display an obvious talent for programming and it is a sad loss to the industry that such skill is wasted.
There is still a public perception that viruses are just a nuisance and only cause minor annoyance to large companies-"... who can easily afford it." This is just not true-there are documented instances where ordinary people have suffered serious loss and even life-threatening situations as a direct result of virus activity.
So, another vital reason for catching them is to deter others.

VIRUSES BREAK THE LAW

In the U.K. it is illegal to access or modify the contents of a computer without proper authority. It can therefore be argued that a computer virus, since it does not ask for permission to replicate, breaks the law simply by spreading.
If a virus is executed without the knowledge or permission of the computer owner and the author of that virus can be identified, he or she can be charged under Section 3 of the Computer Misuse Act (1990). This offence carries a maximum sentence of five years in prison and it is one of the few laws where the offence can be committed outside the U.K. Thus it is quite possible for a virus writer to break the law in the U.K. without ever having set foot in the country. Extradition treaties will no doubt be updated by the time computers become obsolete.

VIRUSES CAUSE LOSS, DISRUPTION AND DAMAGE

By far the largest loss and disruption suffered by the victims of a virus outbreak is that arising from downtime while installations are checked and disinfected. A recent outbreak of the Pathogen virus in a college in England affected 4 file servers and 90 work stations. The college had to be closed for four days while the systems were checked and cleared. The commercial loss of such a shutdown can be imagined. Official complaints to the Police concerning outbreaks of the Pathogen and Queeg viruses (produced at the trial of the virus author) listed estimated losses approaching 500,000 pounds sterling.

Two other incidents will server to show just how serious virus outbreaks can be:

1) An old established small family bakery in south east England was hit by the Casino virus in January. This resulted in the partial loss of both their stock control and their accounts data. Two months later they were hit again, this time by the Michelangelo virus, with the total loss of all data. Backup and protection procedures implemented by a so-called expert after the first incident proved ineffective and very little data was recoverable. The company, employing nine people, went into receivership bankrupting the owner. He lost his business and his home. When I spoke to him, his wife was distraught-not knowing how she was going to care for her two little girls.

2) A local medical practice in the English Midlands maintained a computer system containing patient records. The system operated by printing a copy of the patient's record in the surgery when the patient arrived in the reception area. While one of the Doctors was on holiday a locum undertook his workload and prescribed a small dose of Penicillin for a regular patient. The computer system was infected with the Nomenklatura virus and some of the records had been corrupted with the result that this particular patient's record was shown incorrectly and did not indicate that the patient was strongly allergic to the drug. The database access system did not signal any errors when displaying or printing records and the locum was unfamiliar with the patient's allergy. These two facts, coupled with the effects of the computer virus meant that the patient who received Penicillin suffered a nasty and uncomfortable reaction. It does not take a long stretch of imagination to the life-threatening potential of such an incident.

VIRUSES ARE UNETHICAL

Quite apart from the damage and nuisance that viruses cause;and the fact that many countries have now criminalised them-viruses are just not ethical. It is thoroughly mean and nasty to write computer programs designed to deliberately damage data. Every virus writer that I have met has admitted to the cowardly and craven nature of their activities. It somehow reflects upon all of us that human nature can sink so low as to transfer some of its own baser instincts for destruction into an environment which is arguably the most thrilling development since the invention of the wheel.
There are those who will argue passionately for the freedom to write what they like on their own equipment and I for one am not seeking to prevent them. However, with the ever wider use of computers, the skill to make them do our bidding brings with it a pressing responsibility.
There are arguments attempting to liken computer viruses to primitive life-forms. Some people actually believe this and do not respond favourably when it is pointed out to them that similar arguments have been advanced and defeated for crystalline replication or even the growth and spread of fire. In most cases however, these arguments are used simply as a retrospective excuse.

THE FIELD OF PLAY

When the virus problem first arrived and began to grow, several far-sighted individuals saw that some form of defence was going to become absolutely essential if the well-being of computing was to survive. These people could be divided into two groups depending on their original motivation-some rushed to the defence of computing just because it was the right thing to do;other simply saw an opportunity to make lots of money. Sadly, as the problem has grown over the years, the latter group seems to have grown at the expense of the former. We now seem to have a symbiotic relationship between virus writers and anti-virus companies-each feeds on the efforts of the other. It is interesting to speculate that if suddenly all virus writers were to stop their activities, some very large companies might suffer serious financial setbacks. The virus writer (apparently) make no money from their efforts, while the anti-virus companies trade in a market worth many millions each year. There have even been suggestions that some viruses originate from the anti-virus companies themselves. I should add that to date as far as I am aware, none of these suggestions have been substantiated.

So we have a situation where virus writers-who often take an anti- establishment stance-are actually feeding the coffers of the very people who they claim to despise. Add to this a few despicable individuals who-in the name of freedom of information-choose to collect and make publicly available who collections of virus code containing all the intricate technical details, and you have a thoroughly confused and tangled industry in which the opportunities for intrigue and deception are rife.

In the midst of this shambles is the computer user-caught in the crossfire so to speak. The typical user neither needs nor desires to know how computers work-it is sufficient for him that they DO work. It is understandable therefore that when information built by their own efforts is destroyed by a deliberate indiscriminate act of malice, they should be saddened and angered. Bearing all this in mind, the authorities are right to legislate against the distribution of virus code and we should all try to help in the fight to bring them to justice.

WHO ARE THE VIRUS WRITERS?

My own observations, confirmed by other people similarly engaged in trying to track them down, are that virus writers are generally 'loners'.
Most right thinking people reject the idea of indiscriminately damaging something, especially when it does not belong to you. For this reason a virus writer cannot discuss his hobby with friends or acquaintances. True he may be able to establish contact with like-minded people across computer communication links but even there he must maintain a protective anonymity and so he tends to be a loner.
Working alone on something as technically challenging as computer virus code takes an enormous amount of time and concentration. The dedicated virus writer may therefore become obsessive and shun any other activities which may take him away from his obsession. This lack of social interaction makes them withdrawn and uncommunicative as well as leading to a general tendency to social inadequacy.
The reasons they become attracted to virus writing in the first place seems to vary widely but are usually preceded by a technical curiosity and in some cases a fascination with the spurious argument that viruses may mimic a simple life-form. As they become more involved, they tend to lose touch with the real world and live almost entirely within the electronic environment that they work in a cyberspace that may seem more real to them than the normal humdrum of human existence.
The inclusion of damaging payloads and intricate trigger mechanisms become just another technical exercise where they can demonstrate their superiority over the rest of us.
Depending upon the degree of their social degeneration, their activies can be described as ranging from irresponsible and stupid to malicious and hateful. I have not yet come across a virus writer who simply wrote and did not distribute his programs. Distribution in the sense meaning loosing them into the computing community in a way that would ensure their survival and growth.
The intensive and technical nature of virus writing is such that they will usually work from home. A small proportion being their activities within open computing environments at school or college but the large majority either start at or graduate to, a semi-secret existence at home. When they are asked to give their own reasons for writing viruses they often have difficulty.
Remember that most of those that I have met have been under investigation precisely because their programs have caused damage at large. In these cases they are aware that their activites have had serious effects and there are probably serious consequences for them to face. They may attempt to justify themselves by suggestion that they were "only testing" or "researching viruses". One incredible argument went as follows:-

The virus writer was asked why he wrote and distributed viruses-he replied that he "wanted to be a virus researcher-but no one would give me any so I thought I'd write my own." His interrogator observed, "it's a good job you weren't interested in brain surgery."
The latest reasoning, from the Black Baron, was that he used the viruses as a platform to test and advertise his polymorphic engine. He argued that the SMEG polymorphic code had potentially useful capabilities in copy protection. This highlights another of the most common arguments-that virus code might somehow be beneficial. In nine years of work in this field I have yet to see a demonstrably beneficial use for virus code but still they think that can be a justification for indiscriminate destruction.
Whether you classify them as thoughtless or malicious, these people are criminals and must be caught and punished. The damage they are doing is incalculable.

SO HOW DO WE FIND THEM?

Let us look at a possible sequence of events which might lead to catching a virus writer.
First someone suffers loss or damage of a sufficient magnitude to persuade them to make an official complaint. The complaint will need to contain details of the virus-including a sample-and details and costs of the damage or disruption suffered.

This can be a problem since the first objectie of the victim is to destroy the virus and resume normal operations as soon as possible. In the Black Baron case I analysed in excess of 57 virus samples from various complainants. The most from any site was 9 samples but the majority sent only one or two. The presence of a "generation number" within the virus code made it possible to identify which samples had actually introduced the virus in some instances but a greater number of samples would have made the job of tracing the infection so much easier. It is this tracing process which is so difficult.
Victims are rarely able to pinpoint exactly where the infection came from- particularly is the virus is designed to infect slowly and quietly. Once an origin has been established, enquiries can be made to try to trace further back along the chain. A major problem for virus writers is how to get their code into the computing community. Some may upload infected files to Bulletin Boards or Internet sites. Others may try physically passing infected programs around. Whichever method is chosen it is this initial distribution which is the most dangerous area for the virus writer. In the Black Baron case the Police followed up complaints received and were able to determine that initially infected software had been downloaded from various Bulletin Boards. With help from the BBS operators and the telephone company, activity logs and telephone billing records revealed the source of the original uploads. There were other considerations which need not be discussed here but the net result was that the Police knew exactly when and where the infected programs had come from.

A number of complainants asked for complete confidentiality and this was respected because there were plenty of others willing to stand up in court. However, users must accept that if they want justics they must be prepared to make their complaints public.

Once the originator of the infections has been detected and identified, the Police enquiries can focus in earnest and will eventually result in a search and seizure operation. A search warrant is issued and the suspect's home (and possible his workplace) will be visited and all computing equipment seized for investigation.

The suspect is interviewed and questioned about the alleged offences and his equipment is examined in minute detail for any evidence linking him to viruses.

In one case, the suspect became aware of Police interest and took measures to thoroughly disinfect his computers and his his virus source code. He also sent his machine for safe keeping to a friend, thinking that this left him safe. When the Police did arrive, no computing equipment of any kind was found and he denied any involvement in computing. Sine the Police were well aware of his recent activities-and could prove them-this denial simply confirmed that he had something to hide. The Police knew about the friend and had visited him too! Several computers were seized and the hidden source code was rapidly found and identified. Even without the source code charges would still have been brought, but finding it made the case much stronger.

HOW YOU CAN HELP

For the best chance of conviction, a series of events must be shown to link the virus writer with the damage. You as a potential victim should bear this in mind so that if you do get hit you can provide a solid start for the Police to investigate the chain of events. What new program or disk brought the infection in? Where did it come from-and when? What damage/disruption did it cause and how much did it cost you as a result?

In the U.K. arrangements can be made to take detailed image copies of infected machines so that as much evidence as possible is preserved with the minimum of disruption to you. You can then proceed with the disinfection process and a rapid resumption of normal working.

If you operate a Bulletin Board or Internet site, do you log incoming software and callers? Could you provide the evidence that the Police need?

The quicker you can provide this information, especially in the case of hitherto unknown viruses, the better the chance of catching the perpetrator.

If you are a virus writer-remember that you are not completely anonymous. There are big risks and when you are caught there are heavy consequences. As interesting as you find virus code-are you prepared to go to prison for it?