The Unsorted BBS Collection/thegreatunsorted.tar/thegreatunsorted/bbs_file_lists/i2v.005

Text File | 1997-08-02 | 16KB | 280 lines

NCSA Virus Paper


The computer virus problem began in the late 1980's when a few computer
viruses existed both for DOS and Macintosh microcomputers. At that time
computer viruses were a novelty. Technical users and the computer press
were full of "what if a virus changed data in a spreadsheet costing the
organization millions......" and "wouldn't it be terrible if a virus changed
information in a hospital PC causing people to die...." and speculation that
a computer virus could damage a computer's monitor or processor or other
hardware.... and so on.

But most of our preconceptions were wrong!
Now, seven years and thousands of virus strains later, we know quite well
the problems that computer viruses create. Every single Fortune 500 organization
has experienced computer viruses first hand. Most experience them monthly.
Corporations with 1000 PCs currently have about one virus incident every month.
If trends continue, the problem will double again within 18 months.

We now know that viruses never physically harm computer hardware, nor is it
likely that any have changed spreadsheet data or hospital information in a
way that went un-noticed. In fact, it is rare for computer viruses to actually
erase or destroy data. Many viruses are capable of destructive activities, but
most of the damage that viruses cause, day-in and day-out, relate to the simple
fact that contamination by them must be cleaned-up.  The problem is that unless
you search through all the personal computers at your site, as well as all the
diskettes at your site, you can have no assurance that you have found all
copies of the virus that may have actually infected only four or five PCs. Since viruses
are essentially "invisible" the engineer must actually go looking for
them on all 1000 PCs and 35,000 diskettes in an average corporate computer
site.  And if even a single instance of the virus is missed, then other computers
will eventually be re-infected and the whole clean-up process must start again.

We know that viruses are almost never planted in our organizations intentionally.
They come to us the same way that human flu virus comes to us -- by normal,
non-malicious, interaction of working people. We get the flu by shaking people's
hands who have the virus, but who are not yet sick.  We get computer viruses
by using the same diskette in our computer that a cohort used in her computer
though she did not know her computer was incubating a virus either.

Virus Costs
The costs of computer viruses to society are astounding. A recent NCSA study
shows that the world-wide costs of simply detecting and recovering from computer
virus incidents (from virus contamination alone - not including any costs of data
loss or disaster recovery) amounts to approximately 1 Billion US Dollars yearly.
This is an annual cost of about $800 per infected computer per year or an average
of about $10 for every computer owner per year, whether they suffer an infection or not.

If the virus issue has generated anything, it has generated misconceptions.
Sadly, even most technical computer users and analysts still adhere to many of these.
The fact that most organizations who experience computer virus problems will not talk
about them for fear of hurting their public image furthers the problem. The result is
that most approaches we collectively take to combat the virus problem are based on
premises which simply are not true.

Misconception #1: Computer bulletin board software should be avoided because BBSs
are a leading source of computer viruses.

The fact is that the most common viruses (the boot track type) could not possibly be either
loaded to or down loaded from a bulletin board by any normal or accidental means.
Of the computer viruses which could move this way, most simply do not. Bulletin board
operators and users are actually a very conscientious lot. This means that any policy
against using modems, bulletin boards, public-domain software or shareware, will have
no significant benefit in reducing an organization's virus problem.

Misconception #2: Software piracy is the leading cause of virus spread.
Viruses travel more with program diskettes than with data only diskettes.

The fact is that boot legged software does contribute to the virus problem, but the
much more significant contributor is diskettes which contain only data (or even no
data like blank formatted diskettes). Although it is true that computer viruses cannot
infect data per-se and survive to reproduce, the most common viruses can and do
infect the diskettes carrying only data. And when those diskettes are used, the
virus can infect the next computer's hard drive or files.

Misconception #3: Most viruses intentionally cause damage by erasing files,
formatting disks, etc.

The fact is that most viruses do not intentionally cause any explicit damage.
And even the viruses which are programmed to trigger a damaging activity
almost never cause harm by this programmed activity. This is because most
virus instances are discovered before the programmed "trigger date." Once
discovered, the real costs of computer viruses come into play -- the work in
trying to find all instances of them in your computer and at your site, and in
trying to remove them and de-contaminate the computers, disks and programs
that the viruses have infected.

Misconception #4: There are good viruses and bad ones.

This is a very common misconception. Those who write and distribute
computer viruses commonly claim that theirs is a "benign" virus because
 it has no malicious trigger event and does no intentional harm. They are
duped by the same set of misconceptions that have duped the rest of
us -- that the problems computer viruses cause are mainly due to the
trigger events. In fact, because all viruses replicate without the c
omputer user's or owners' knowledge or consent (by definition), the
 very act of replicating is an act of contamination and is itself harmful.
It is much like cancer. The cancer cells themselves are normally not
harmful or poisonous, but the fact that they keep growing and cannot
be easily discerned or separated from the non-cancer cells makes
finding and getting rid of the invasion particularly difficult.

Misconception #5: The virus problem waxes and wanes every few years.

Despite the fact that the news about computer viruses comes in waves
 (mainly the Friday the 13th - Columbus day wave in October 1989, and
the Michelangelo wave in February / March 1992), the computer virus
problem has grown rather steadily and predictably since it began.
During the Michelangelo "crisis", 95% of problems that users experienced
from computer viruses were actually (and predictably) caused by virus
strains other than Michelangelo!

Misconception #6: Computer security is effective against computer viruses

One would think that the reason we have so many computer viruses
is that our computers are not "secure". In fact, traditional computer
security - that is computer secrecy including access controls and encryption,
have almost no effect on computer viruses. During Desert Shield, a
 significant part of our own command and control network (a
quite "secure" network, as you might imagine) was, in fact
infected by the then most common computer virus. The virus,
called Jerusalem, works quite well in a system where everything
 is encrypted -- it too becomes encrypted, and only becomes
un-encrypted when it needs to infect something.

Misconception #7: Another common misconception is that the computer
hardware manufacturers or the computer operating software vendors
ought to provide us with systems which cannot become infected.

The fact is that computer viruses are just computer programs.
Computers are designed to run computer programs. And there
is nothing universal about computer viruses that would allow
them to be distinguished in advance from any other program.
Then we arrive at the unfortunate truth that -- computers are
made to run computer viruses! Although it is possible to make
it more challenging for computer virus creators, it is not possible
to make a virus-proof computer (unless we do not let that computer
 run any new programs).

Win '95, OS/2, DOS and even Windows NT systems are all easily and
equally infected by the dozen most common computer viruses. It is true
that some of these operating systems inhibit the replication (spread) of
some viruses, but many current computer viruses operate "well" in all
of these systems. The newest versions of DOS and Windows including
Win '95, DOS 7, and Windows NT do not and will not include any
anti-virus software or utilities. It will be completely up to the user to
deal with the computer viruses problem.

The virus problem is exceedingly costly

Despite the fact that viruses don't often cause the kinds of
damage we originally feared, they are indeed a very expensive
 and productivity-draining problem which is only getting worse.
NCSA's "Computer Virus Cost Analysis" shows the average computer
site (with 1000 PCs) will spend more than $300,000 on computer
virus clean-up this year! As a group, computer viruses have
conservatively cost US computer users over a Billion dollars
in the past two years!

The Data Super Highway could make things considerably worse

Unless we address the right problems, not the misconceived virus,
security and system management issues, the increased connectivity
that a nationwide data path will provide will inevitably spell total
chaos -- not only with regard to computer viruses, but also from
other computer security, management and ethical issues. Since
computers, televisions, radio, telephone, libraries, money, credit
and a host of other things that we think of today as separate entities
will soon all converge into the same or co-existing digital systems,
the chaos may potentially extend to society-crippling proportions.

So what are the solutions?

If banning bulletin board use and stopping the use of all pirated software
and invoking pentagon-level computer security won't solve the problem,
then what will?

The most important reason that computer viruses invade and
grow among microcomputers is that microcomputers are not
 centrally managed. Indeed, microcomputers are inherently
very difficult to "manage" in the ways we manage mainframes.
It is unlikely that microcomputers will ever be centrally managed
 in ways sufficient to prevent computer viruses.

Use Anti-Virus Software -- Fortunately controls which effectively protect
against all likely computer viruses do currently exist. All anti-virus
products which are "NCSA certified" are tested and certified to have
virus scanners which detect 100% of all computer viruses which are
known have recently infected any computers worldwide. These anti-virus
products are generally unobtrusive, easy to use and effective.

However, too few people use anti-virus software regularly or properly.
To be effective, anti-virus software must either be used regularly, or
installed to offer full-time protection. According to data from NCSA, if
just half of the computers world-wide made frequent or automatic use
of anti-virus software, the virus problem would decrease by as much
as one hundred-fold in less than a year! This means that the problem
would decrease from a billion dollar problem yearly, to one which
costs the average computer user less than ten cents in time and
energy finding and recovering from computer viruses per year!

The root of the problem -- computer ethics & lack of education

Another thing we learned during our virus experience, is that most
of those who write and intentionally distribute computer viruses do
not think that their particular virus is bad or damaging or harmful.
Most think that they are experimenting -- legitimately, and that they
are well within their rights to do so. Most are young, and have not
yet developed a social conscience or a global awareness or a
world-view. Most find the computer and communications medium
which insulates them from their "victims" to be intoxicating. (Most
don't even know that victims exist.)

The medium allows for anonymity while being a voyeur. It allows
one to ignore or even not believe that human beings are the ones
who are ultimately harmed. It allows one to tempt fate with a
Pandora's box -- and to have the thrill of creation of a self-sustaining
organism -- a computer virus. But mostly, it is a medium which
provides community -- with the same social pressures, social
acceptance, and the need to "belong" that any community has.

Virus exchange bulletin boards

There are dozens of "virus exchange bulletin boards" and virus
exchange sites on the internet in the US alone and more in the rest
of the world. These are much like the much more pervasive, legitimate
bulletin boards, in that users can access them to upload and download
programs and messages through the regular telephone system, but
the virus exchange BBS system operators knowingly accept and
provide viruses for general distribution to those who want them.
And many curious teenagers in the world, who have a need to "belong" want them.

These virus BBSs often have a thousands of different viruses available
for downloading. But most will not allow just anyone to download a virus.
Instead, many require the authorized user to "belong". In order to
become part of the "in" group that can share in the viruses, most
virus BBSs require the user get points -- most often by uploading
some viruses. So a young adult, who has a natural curiosity,
and a natural need to belong, and who reads endless message
 "threads" which expound on the "benign" viruses and how
viruses are not illegal, and therefore are OK, sometimes succumbs.
 But in order to get to the viruses, he must usually provide some.
The simplest way to provide one is to create one, then upload it.
There are even programs (the "Virus Creation Lab" is one) which
allow users to pick various characteristics of their desired virus
from a group of menu selections, then the program will automatically
create the virus with the desired characteristics for the user. Poof -- no
programming needed! Another virus is born.

Ethics

We are in a unique time. Most computer users do not have parents
who are also computer users. Therefore, the majority of computer users
never got the same kind of sand box training for computing ethics and
etiquette from our parents which guides our social interactions in the non-computing world.

In fact, the ethics of computing are no different than the ethics of
any other social interaction. The problem is that many young computer
users (and some adult one's too) never quite figure out that networked
computers are in fact, a community, that this community is composed of
people, and that wreaking havoc around the community is harmful to those
same people.

By sponsoring Virus Awareness Day we are acknowledging that education and
awareness about computer viruses is of paramount importance. The myths
must be dispelled. Especially myths like: virus writing is "cool" and
that virus writing and distribution is protected, free speech, and that everyone
has a right to write computer viruses, just like everyone has a right to an
obnoxious opinion.


Copyright 1995,  Peter S. Tippett  NCSA, all  rights reserved. This document  may be
freely distributed without explicit permission, provided it is distributed in full, and that
NCSA receives proper attribution. NCSA is the registered trademark of the National
Computer  Security Association. Other brand and product references herein are registered
trademarks or trademarks of their respective holders.

File date: August 1, 1995