SPYWARE BOOK (3 page)

Today was a bad day. Students sat with their heads cradled in their hands, trying to keep them up. His tiredness had left them bored and fatigued, as if just watching him was somehow draining their energy. Students listlessly checked their email on their netbooks and slate computers. One young man in the back was asleep at his desk, his baseball cap pulled forward to block the harsh glare of the fluorescents overhead. Ray had sympathy for them, and tried to keep his energy up, but it was a losing battle.

Ray felt his armpits go slick and his face began to burn with a wave of embarrassment as he slurred his words and repeated himself. He was bombing and he knew it. He hated the feeling and wondered briefly if this was how it felt to be a comedian with a silent crowd. He paused for a moment, fumbled with his notes and tried to think.

Then he decided to switch topics to a sure-fire winner for this class. The long struggle he and Brenda had had with the system last night gave him the idea.

“Class,” he said suddenly. “Let’s talk about viruses.”

The effect was electric. Slumped students whom he’d long considered narcoleptic sat up blinking. Ray gave them a gratified smile. Setting aside his notes, he turned his full attention to the class. For the moment, he had theirs as well.

“Viruses are a major topic for this class, of course,” he began. “In years gone by, I would have assigned you all a final project in which you created your own virus for purposes of study.”

“All right,” muttered someone.

“I’m listening,” said a student who appeared to be sleeping in an upright position. Her name was Magic Avila and she normally spent every class with her eyes closed. She never took notes and rarely asked questions. True to her name, when it came time to take a test, she would get a perfect ‘A’ every time. Her effortless method of learning did seem like magic.

“Fortunately or unfortunately, those days have passed us,” Ray continued.

A collective groan of disappointment rose from the class.

Ray smiled and felt their attentiveness. He took a deep breath and pressed ahead.

“I know all too well why you want to hear about viruses. People are always fascinated by the dark side of their craft. Viruses represent power. They are destructive and illegal. Among software professionals, there is no greater crime than their creation. People who create and release software viruses are vandals, nothing more nor less. To us, they are what an arsonist is to a firefighter—what a biological warfare researcher is to a family doctor —what a heretic is to a cleric.

“I will not ask you to write one, but you will gain the knowledge nonetheless. I can’t help that, for in order to understand them you must surely be given the secrets of their creation. Who, after all, would make a better arsonist than a firefighter?”

There were scattered chuckles and the class leaned forward and settled in. He knew he had them now, they were ready for a good lecture. His head still burned, but he could push that aside now. He had a topic that he loved to lecture on and an interested audience. It was times like these that made teaching fun.

“Let us first define what we are talking about. When your computer is infected with a virus, it isn’t an organic thing, like one of the two hundred-odd variations of the rhinovirus we call the common cold. Computer viruses are software, programs, sets of instructions for computers to follow that someone has deliberately created and distributed in order to cause others annoyance, grief or financial loss. Unlike the common cold, which has been with us for millennium and was never purposefully created by humanity, viruses don’t occur naturally. They are specifically designed and ingeniously constructed by one of
us
. Most often, in fact, by one of
you
,” here he paused and swept an accusing finger and eye over the crowd. The students responded to his dramatics with smiles and side-glances to their friends. They knew his lecture style by now.

“Most viruses are written by graduate students in computer science. Many others are written by intelligence agencies, ours or those of foreign powers, for the express purpose of wreaking havoc among the computers of an enemy government.

“Why us?” interrupted Alicia, a female student who always sat in the front row. Ray turned to her and noticed that she seemed more surprised by her interruption than he was. She was the quiet type, who rarely spoke out of turn in class, unlike some of the other overly-bright hooligans that Ray had to contend with on a daily basis.

“Because,” sighed Ray, “you’re young, you have time on your hands, and most of all—” he paused, “—because you want to see if you can do it. You want the challenge.”

“But that’s awful,” said Alicia, her face pinched.

“Yes, possibly, but predictable. At this point in your careers, you have the time, and you know just enough to be dangerous. You are at the point in your lives that you are impressed by feats of beer consumption, last decade’s muscle cars and empty sexual conquests. If you’ve made it this far in the difficult field of computer science, then you are also impressed by original and creative coding.

“But let me tell you right now, class, that the creation of wantonly destructive software is a federal crime and that I would not hesitate to turn in any of you who created and distributed such a thing.

“You’d turn us in? Your own students?” questioned Magic. Her eyes were uncharacteristically open. There was a slight, pouting smile on her lips as she asked the question. She was an attractive girl, and the look on her face made Ray wonder if she had a crush on him.

“Just as surely as I’d turn you in for building a bomb or setting fire to the dorms,” replied Ray evenly.

“But it’s not the same thing,” protested Magic, “No one gets hurt.”
“While it’s true that viruses have yet to cause any known deaths—unless you count the viruses used to disable Iraqi air defense systems in the Gulf Wars, that is—it is only a matter of time until they do. Please realize that there are millions of chances a day for software to cause a death. Car ignition and braking systems are controlled by software. Pilots fly airliners in blinding conditions, trusting their intelligent instruments. If these systems become susceptible to attack, many lives are at risk.

“But let me backtrack a bit. In order to more thoroughly understand my position on this, we must examine the nature of viruses in greater detail. Classifying them in terms of behavior, viruses come in three primary flavors. One: the annoying virus. Built to sell something in most cases, rather than vandalize, the annoying virus is more of a prank than a felonious assault. One example I recall vividly. It simply caused a large image of a person’s hand to be drawn on your computer console every time you booted up your machine. The annoying part was that middle finger of this blue hand was extended upwards in a pose that we are all probably familiar with.”

The class laughed aloud.

Ray nodded to them, “Yes, well... Now, that was it for the virus. That’s all it did. If you hit any key, the image was gone and you could go on with your work for the day. Many of us found it mildly amusing and harmless and generally not worth the trouble of hunting down and erasing the carefully hidden files. The virus would of course attempt to spread itself to other machines whenever possible, so that soon everyone in the office was enjoying “Big Blue” as it came to be known.

“After a few weeks, however, the humor wore thin. People gradually realized that they didn’t enjoy being flipped off by Big Blue every morning. It took us a few days to eradicate it from every disk we had, but we finally did it one weekend, with only a minimum of overtime and downtime.”

“Do you still have a copy of that one on disk, Dr. Vance?”

“Ah, no Magic, I’m sorry. As I was saying, there are a fair number of oddballs like that one. I recall another that caused my word processor program to only print in foreign character sets. Umlauts, accents and the like were rampant until you could get it cleaned off. About seventy-five percent of viruses are sales viruses or search engine hijackers. They perform mild trick like that. Unfortunately, some viruses aren’t harmless pranks. The second behavioral type, the data-destructive virus, is fairly common. Approximately twenty percent plus of viruses come under this category and amount to vandalism. In general, these viruses go for the most valued element of any computer system, the hard disk. They use many approaches, from the brute force of a low-level reformat to a subtle jumbling of the file allocation table, but the result is always the loss of hours upon hours of work. Often, this sort of thing does more damage to individuals rather than to companies, as companies tend to more carefully back-up their data.

“Last on the list is the rarest and perhaps most feared type: the hardware destructive virus. These are indeed rare, but do exist.”

“How can a program damage hardware?” asked Magic. Her question was very serious, but her eyes were still closed. Ray took this in stride, he was used to her by now and no longer found it disturbing to answer questions from a student who listened closely while she looked asleep. He suspected her mental circuitry operated differently than it did for most people. Many computer people, when tested by experts, had odd brain behavioral patterns.

“In most cases it can only be done by someone who has specialized knowledge of the hardware, such as the chip-burning virus that irreparably damaged the motherboards of personal computers by repeatedly sending a signal to them until some of the integrated circuits actually burned out. More recently, viruses have been reported that will destroy the hard disk physically by simply causing the read/write head to seek from one end of the platter to the other, banging it back and forth as fast as it will go until the actuator arm breaks.”

“Jeez,” muttered another student. Ray always forgot his name and thought of him as the “guy with the baseball cap in the front row”.

“Indeed,” said Ray. “Viruses can be nasty things.”

“But how do they spread?” asked Alicia.

“Ah! Now therein lies the true genius in any virus. Only part of the code of any virus is dedicated to ‘doing its thing’. The rest is dedicated to spreading itself, generally by copying a file from place to place at some point. There are many schemes here. Some viruses rely on an immediate and devastating effect, such as the moment you run the infected program, it erases your hard disk. The problem with this one, of course, is that the victim is far less likely to transmit the virus to someone else’s machine after such a gross and fatal attack. Much like an organic virus that kills its host too soon, the computer virus that attacks prematurely will not have much of a chance to spread before it is eradicated.

“In fact, most viruses wait for a specific condition to attack, often waiting for weeks or even months before striking. This gives them a lot of time to spread before the threat can be realized. One classic example of this is the Michelangelo virus that was programmed to strike on February 17th, Michelangelo’s birthday. This type of virus is called the ‘time bomb’.

“Another type, known as the Trojan horse, starts off attached to a program such as a shareware game that users might want to give to their friends. Hidden within the game file is the virus, which will wait to act until the game program is executed.

“Commonly known as the Logic Bomb, a third scheme one encounters is a virus that is looking for a certain, specific event to occur before it attacks. This virus is often used by people seeking revenge. For example, a logic bomb might go off and delete the hard drive of a network server when a certain employee record is marked: terminated. That way, the employee gets instant revenge on the company that fired him or her.”

“But wouldn’t that be too obvious?” asked Magic. “I mean, wouldn’t they know that the anti-social programmer that they just fired had done it?”

“Possibly, but that is a far cry from catching the responsible party. In truth, perpetrators of software vandalism are rarely penalized for their actions.”

“But why not, Dr. Vance?” demanded Alicia, scandalized.

Ray rubbed his chin for a few moments before answering. “Several reasons. Firstly, the people in the legal establishment don’t really understand computers yet. New technology tends to change everything it touches, sometimes in a bad way. We create whole new businesses, but we also create new methods of crime at the same time. A fiftyish judge or legislator has probably had little understanding of the latest tech. Secondly, computer crimes are all but invisible and somewhat nebulous.”

He produced a flashdrive and held it up for them to examine. “A chip like this may contain a million dollar piece of industrial espionage. It might contain a million credit card records with matching social security numbers. It might contain a federal report, not yet released to Wall Street. It might even contain a fortune 500 company budget, or a secret formula for the next kind of rocket fuel.

“Or, it might be completely blank. The point is that to a white-haired judge, it looks the same either way. If you go out and burn down a one hundred million dollar building, or blow up an airliner, or steal a nice car, they will throw the book at you. Because they can
see
the damage and clearly measure it in their minds. Since the crime is obvious, they will respond appropriately. But with information crimes, the very hidden and nebulous nature of it tends to mask the magnitude of the damage done.”

“How much time would someone do for getting caught with the source code to a data-destructive virus, Dr. Vance?” asked Magic. Her eyes were still closed.