NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/virus/4847

Internet Message Format | 1993-01-06 | 5.5 KB

Path: sparky!uunet!dtix!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Fred Cohen)
Newsgroups: comp.virus
Subject: On the definition of viruses
Message-ID: <[e-mail]>
Date: 6 Jan 93 03:30:03 GMT
Sender: [e-mail]
Lines: 99
Approved: [e-mail]


    Computer viruses do not have to be malicious, they do not have
to be Trojan horses, and they do not have to enter without the
knowledge or consent of the user.  Any definition that depends on
these properties depends on peoples' opinions, skills, and knowledge,
and are thus not "testable" in the scientific sense of the word.  (See
Popper and others for more details).  For example:

    The "stoned" virus is not apparently malicious - perhaps
others do not agree - perhaps this is why we should not make our
definition depend on that property (i.e. peoples' opinions).  Is it a
virus for you but not for me?

    The "Brain" virus notifies you of its presence with a
copyright message displayed whenever you do a directory of an infected
disk.  It doesn't fit the Trojan horse definition by my understanding
if it announces itself.  Is it not a virus?

    If I know I am placing a Jerusalem virus in my computer, is it
not a virus?  It entered with my knowledge and consent, thus it is not
a virus by the third criterion above.  Is it a virus for you and not
for me?

    The mathematical definition first published in 1985 is
testable, and appears to properly differentiate viruses from
non-viruses.  Perhaps someone else wishes to do a better job, but
let's not make definitions that are senseless.

    So what is a computer virus? In simple terms, it is a sequence
of instructions that, when interpreted in an appropriate environment,
"replicates" in that at least one relica also "replicates", etc., ad
infinitum.

    Want an example? A backup program replicates by making an
exact copy of itself (if it does a good job) on the backup media.  In
many environemnts, you can run a program from the backup media (e.g.
a remote file system backup).  If you run the backup program from the
backup media, and it again replicates, etc., ad-infinitum, then it is
a virus! Suppose we put the backup program for DOS in an IBM
mainframe? in that environment, it would probably not be a virus,
because it wouldn't probably operate in the mainframe operating
environment.  Thus we see the intimate link between a virus and its
environment.  I don't want to waste more space here, but there is a
good deal more to know and think about in applying this definition.

On benevolent viruses:

    If a virus doesn't have to be malicious, perhaps the same
technology can be beneficial! When I published this idea in 1984 (in
the paper that first described viruses to the scientific community),
nobody commented on it, but when I published the results of 7 years of
research with benevolent viruses in The Sciences, I was very publicly
called a heretic.  The loudest complaints came from the academic
community! It seems they are not as open minded as they claim to be.
They were closely followed by the anti-virus industry, which has been
using the press to make money by claiming that all viruses are bad.
At least they have well understood motives.

    I don't so much mind that these people have their opinions,
everyone is entitled to that.  I do mind when they force their
opinions on others - for example, when they tell people to write
letters to The Sciences telling them that it is wrong to publish the
concept that viruses can be used for good, and when they claim that I
am telling people about the possibility of benevolent viruses only to
sell a product.  If that were true, I wouldn't publish my results, I
would only use them for my financial advantage.  It is certainly true
that the anti-virus vendors (which I am no longer one of) stand to
make money by convincing people that all viruses are bad and that they
are a major threat.

    Another upsetting example is the censure at the DPMA, ACM,
IEEE Annual Computer Virus and Security Conference held in New York
each March.  In this conference, they blank out portions of papers and
provide full text only to conference attendees.  So if I publish
details of benevolent virus techniques and how to make them safe, only
the attendees will see the details, and the paper will look like swiss
cheese.

Does the fairness doctrine apply to electronic media? Do the DPMA,
IEEE, and ACM have such a lock on research in the computer field in
the US that we allow their censorship to prevent us from hearing about
ideas that aren't popular? Do the universities support this censorship
of ideas? Do they do it for grant money in computer security? (They
must be pretty hard up if the grant money in this field is enough to
sway them into anything.)

    Maybe this posting is about a little bit more than just
viruses.  It seems to me that censorship in all its forms leads to
ignorance and all of it's evils.  To quote Maxwell Smart: "If only
they could have used their power for goodness instead of evil."

    I am glad that other people who read virus-l don't rule out
the possibility of benevolent viruses.  I'm sad that so many virus-l
readers have been misled about the true meaning of viruses.  I'm even
sadder that our university people in the US don't think that new and
different ideas are good and decide to try to censure them.  I'm
really glad that I no longer sell virus defenses, because I think it's
a pretty shady business (except for a few good companies that tell the
truth about viruses and their products).