Sarah Gordon
The 6th International Virus Bulletin Conference, Brighton, UK
September 1996
A brief summary of research on the ethical development of four individuals involved in the virus writing subculture is given, followed by an examination of the current virus writing "scene". A completely different type of virus writer is introduced. Recent developments, trends and forecasts are presented, and some suggestions for minimizing the impact of virus writers both globally and organizationally are considered.
Even in areas of scientific investigation, there can be the danger of overgeneralisation and stereotyping. In the case of virus writers, one manifestation of this danger has been that of assuming that there existed some homogeneous group of people who write viruses, that they were all ethically deviant, and that it was possible to talk about the psychology of "the" virus writer. It was with this in mind that we undertook our original research, which resulted in proving that there is no such thing as the generic or homogenous virus writer. Along the way, we also learned that the virus writers we spoke with were totally within the norms for ethical development. However, we were still left with unanswered questions -- the foremost being "How do you stop people from writing viruses". Following a brief summary of earlier findings, we will examine some of the issues which may help us answer this question.
The Generic Virus Writer (TGVW) [1], completed in 1994, presented four case studies of individuals involved in the virus writing subculture. The research data was obtained in part by using surveys, and interviews, arranged via electronic mail (e-mail ), electronic chat and in-person sessions. Information relating to the subjects' relationships, perception of self and others including family and peer group, family history, and cognitive reasoning ability was collected. This data was used to examine the individuals' moral development in light of ethical and moral developmental models based on the research of Lawrence Kohlberg [2]. (Gender based issues in virus writing were examined using the model developed by Carole Gilligan [3]). The individuals were selected from four categories:
The first three categories appeared to be generally representative of the comparatively small [4] virus writing population. The ex-virus writer was an anomaly for reasons which we are yet unable to measure. In TGVW, we traced ethical development of one individual chosen from each of the four categories. We found these individuals to be within the norms for ethical development as defined by longitudinal studies done by Kohlberg [5]. Based on our findings, we predicted that the youngest of the virus writers would slowly begin to disassociate himself from virus writing. We showed how we expected the next oldest person to stop writing viruses very soon, and stated we expected the ex-virus writer to continue to refrain from virus writing. We felt the adult could easily continue to distribute viruses, as he had passed the age range during which one would be expected to disassociate from the behaviour. Over the past three years (two years since the presentation of the original work), we have maintained contact with three of the four subjects. Let us examine how well we managed to predict the paths they would follow, based on our research and Kohlberg's model.
The adult in our original study initially exhibited an ethical developmental model lower than average for his age. Whereas adult males typically are shown to have development on the Kohlberg scale of at least 4, and sometimes 5, our adult did not demonstrate a 5 (or 6) at any time. He has, unfortunately but unsurprisingly, continued to distribute viruses. He remains a polite and interesting, albeit controversial, individual.
The young man categorized as an adolescent [typical Level 1 Stage 2] in our earlier research is now, obviously, an older adolescent. He has apparently shifted from virus writing into virus distribution. He publicly, amongst his peers, states virus writing is "wrong". He has, however, continued to be involved in the virus writing subculture, although to a lesser degree than two years ago. He appears to be progressing quite normally for his age, into Level 2 Stage 3.
The college student has continued to exhibit an interest he expressed during our previous conversations -- programming and communications. He has indeed stopped writing viruses and has become professionally employed in the software industry, where he has held respected positions of considerable responsibility.
If research in the field of ethical development shows us anything, it shows us there are some reliable standard models and that behaviour in one setting does not typify necessarily behaviour in other settings.
Integration of morality becomes more consistent, however, as one ages. This is exemplified by the progression of this student. He initially stated virus writing was wrong, but that it was basically okay if he did it in a way he considered to be non-harmful. Specifically, he never intended for any of his viruses to affect users. "I wrote viruses for several reasons, I suppose, but primarily they were for my own personal learning." Later, after being confronted by a user who had in fact caught one of his viruses, he publicly stated that not only was virus writing harmful, but a wrong action for himself as well as others, regardless of intent. He then stated he would no longer write viruses. Upon pressure from peers, he stated he was going to live up to his words, and not do it any more. To the best of our knowledge, he has held true to this statement. We asked him why he had not gone back to virus writing despite observed pressure from peers. "There are probably four main reasons I have remained retired", he stated. "First of all, I value my word very highly, and while I made no promises when I retired, I still feel compelled to maintain what I stated". Time constraints, personal involvement and no real reason to do it were cited as the other reasons. His Level 2 Stage 4 ethical responses from two years ago appear to have progressed quite normally into Level 3, Stage 5 post-conventional morality. For those who are ethically within behavioral norms, but who are involved in the virus writing subculture, "aging out" still seems to be the main force which contributes to their stopping the actual virus writing. As they age, they are less vulnerable to peer pressure and begin to integrate what they know is right behaviour into their actions, until eventually they simply do the right things no matter what the situation is. Whether or not it will become the norm for those who age out of the behaviour of virus writing to remain as part of the subculture has not yet been determined.
The ex-virus writer from our original study has continued to maintain a good relationship with both parents and girlfriend. He has continued his non-involvement in virus writing. At the time of our original project, he stated he had worked as a volunteer in the library and hospital environments. Since that time, he has done work for a major software company, and continues to be trustworthy, talented and a positive example for the younger individuals. He has this to say regarding peer pressure:
"They know that I have stopped; it's pretty obvious, at any rate. I don't feel excluded in any way simply because coding isn't everything; most of the people never coded to any significant degree to begin with. Anyway, I'm fun to talk to :) Or not. Maybe they just tolerate me. But I think most of them like me whether or not I coded. Who I am and what I've done only gives them more incentive to talk to me when I first meet them. At this point its irrelevant; it just makes me the alpha male of the pack. So I can bully people around :)"
To reiterate our original position:
"Little reason exists to believe that crime and delinquency can be eliminated merely by the fear of legal punishment alone. More evidence exists that fear of social disapproval and informal penalties, criticisms and punishments from parents and friends may actually be a greater deterrent to crime than legal punishments"[6].
During any discussion of virus writers, the question can arise: "Why did they do it?" Their own answers and justifications still vary. Reasons for writing viruses which have been cited include relief from boredom, actively seeking fame, exploration, malice, and peer pressure.
There does, however, seem to be a notable absence of one reason which at one time was thought by some to be a factor in encouraging virus production: the vX BBS. According to one respondent (and this thought was mirrored by many),
"I don't think that the vX BBS was ever a real incentive for new viruses. I think that Todor's BBS was unique in this regard because of timing. At the time (forget that BBS' name; virus exchange?), very few viruses were readily available. And so it was difficult for novices who weren't proficient in assembly to learn how to write viruses. The best way to learn (at least Vesselin seems to make us think this way) was to call up the BBS and download Vienna, disassemble, and churn out new variants. By the time viruses became big in the U.S., I think that virus production had accelerated elsewhere in the world to feed the vX scene continuously. So U.S. people were lazy and didn't need to write viruses; they just needed to be good collectors. Additionally, the U.S. bbs's had a pitifully large number of non-viruses. Ambulance Car and the SPAM fiasco come to mind. I have yet to see a 'WWW virus scene' develop (is ILF on WWW?) I think the interesting thing to do on the WWW is to create a page which automates virus creation; i.e. set the parameters, run g2/ps-mpc, and return file to the user. the only thing really stopping this is the lack of source code for most virus generators. So the short answer is that the motivation for writing viruses hasn't changed much. These People write to get famous or because they're bored."
Is the way to stop them simply to allow them to grow up? This would be a viable solution if there were not new ones coming along to step into their shoes. We will now turn our attention to the current virus writing scene, i.e. the "Next Generation Virus Writers", discussing the current crop of virus writers and exploring their impact on the general computing population. We will briefly examine their responses to recent legal decisions related to virus writing, and to "acceptable use policies" of Internet service providers and universities as we consider how these young people can best be dissuaded from writing and distributing viruses.
Who are the Next Generation Virus Writers? Initially, upon reentering the old haunts of what was once the virus underground, we found ourselves met by what appeared to be a violent, mouthy, nasty group of obnoxious kids who had nothing better to do than talk about ways to hurt people and destroy information. It was only a matter of a few days and a few conversations before what had been so apparent (and what has provided many journalist with sensationalistic fodder) was in fact found to be much the same type of "show" which we had observed years before. Actors, roles and scripts are used not only on stages, but in communications between adolescent peers [7].
It initially appeared that some of the new breed were much leaner, meaner and more technologically advanced, but while we eventually determined there was some evidence of a heightened awareness of technology, for the most part these virus writers' abilities were generally observed to be comparable to those of their predecessors. There are some exceptions:
"I guess people may write to be famous, but in my opinion, the better the AV programs get, the more motivated some people will be. I for example get my motivation from challenging AV programs. As they get more advanced (i.e. better behaviour blocking, heuristics, etc.,) the more of a challenge and therefore motivation there is. People in it just for the fame generally fail...there has to be some technical motivation".
The geographical hot zones had changed. Australia and Sweden/Norway now seem to dominate the virus scene. This should be no surprise: the scene was Bulgarian [8] before it was Canadian, and for a while it was American. Quoting an anonymous source: "The Internet in general -- anonymous, cheap, global communications. Better than any BBS." " The Internet has enabled us to spread the scene around. its easier to talk directly with people from around the world about viruses", said another virus writer, "though very little has gotten done in the past few years, at least from the standpoint of organized virus groups." In fact, most of the virus writers thought the good old days were gone for good. When asked for comments about the relative stability of the virus writing scene during the course of this study, we received various comments.
Rock Steady, former front man for the virus writing group known as NuKE, was said to have a "dead end job as a bank teller or parking attendant". Aristotle, sometimes NuKE, sometimes not, was frequently cited as still "on the scene", and it was suggested by many that he appears to be a permanent fixture. To quote one individual, "Aristotle never changes. He needs his own little world ... so cannot risk changing it." Few people remembered the name Masud Khafir, and many of the other FIDONet Virus and Virus_Info participants were not mentioned at all. Groups that once dominated the scene were almost a non-issue. According to one virus writer,
"There was a funny pattern that emerged from the virus scene -- rabid begat yam begat NuKE begat VLAD. The groups are all the same. They crave attention yet lack talent. They talk loudly but have no substance behind it. It's pretty sad. Damn near every one of the VLAD viruses is part of the "intended family". Another group, dc, appears to be thought of as somewhat of a successor to NuKE."
Another virus writer, used this word-play to comment on one of the Australian-based groups:
"VLAD went for total global domination. At least they INTENDED to".
The ages of the virus writers still varied, with one virus writer stating age 20 appeared to be the average age of his peers. Questioned further, he stated he had in fact asked them and that 20 was both the median and mode, with 20.74 being the mean age. We have no idea how large his sample was, but do admire his approach. The views we found on social life, society, and anti-virus software have not changed much: i.e. there was still no Generic Virus Writer.
Universities seem to be spawning more virus writers now, but this is not surprising. At the recent IFIP TC11 Conference in Samos, Greece, a workshop for Education and Information Security [9] was held, during which one professor stated he was aware of some virus writers in his University, but they were in another department, not his. This seemed to be a matter of little concern for him and in fact, he had virus writing as an acceptable "exercise" in one of his security courses. Another professor has been observed on the WWW, offering NATAS as a simple virus for new assembler students to "examine"[10]. The role of students is usually to learn, and with viruses being taught or tacitly condoned, we should not be suprised at the form of education or its outcome in these circumstances.
There was a more heightened awareness of "responsible behaviour" on the part of the people we spoke with, and they were willing to discuss this with us in depth. We found that in spite of this willingness to discuss the issue, the definition of what constitutes responsible behaviour was varied. Generally, making viruses available via CD-ROM, FTP, or BBS to the willing/knowing was seen as responsible management of viruses. While we were unable at this time to do extensive survey or study of these virus writers, the fact that the slightly-older virus writers appear to be within ethical norms, with the exception of their activities related to viruses, leads us to hypothesize that viruses are not seen as the "bad things" they once were.
The majority of virus writers we talked to have much more clearly defined goals than were found in the "good old days". Programming and other jobs in computer related fields dominate. Some of them already have such jobs. This brings us to the next topic, the Next Age Virus Writer. To be sure, there is a new breed of virus writers. However, we suggest to you that it is not merely the old breed repackaged and gently aged: not the young, bored, fame-seeking youth of the past, residing in different countries with the same general skillset which we have just discussed. Certainly, that sort of virus writer still exists. We see him embodied in viruses like Boza[11]. He is the sort of virus writer who forces software prices up by flooding the market with simple viruses which are more annoyances and irritations than real threats. Most of his creations are never even found in the wild and if the numbers game would self-destruct, his impact would be even more minimal [12]. However, the virus writers who appear to be having the real impact are those with real skills, talent and perseverance - programmers with style and elegance, who, unlike virus writers of the past, could make a living writing real software. According to an ex-virus writer who wishes to remain anonymous:
"You have to be smarter today than you had to back when the scene started simply because viruses today incorporate so many features. Polymorphism, for example, was unheard of 5 or 6 years ago (ok, not unheard of, but it was not a standard technique). Today, if you can't do poly, don't even bother. Stealth, too, is something that you simply must know how to do. Viruses are more sophisticated than ever." He continued:
"So you either have to be smarter or more experienced, i.e. older, than you had to be in the past. I think most people who were in the scene have aged out and stopped, as you say. As for people starting, I haven't heard of too many newcomers to the scene. Have you?"
While we must not underestimate the contributions of user apathy and global connectivity, we are now technologically somewhat more prepared for the types of virus virus writers we have discussed so far. However, we are not prepared for the new spawn of virus writing subculture: The New Age Virus Writer.
As we have shown, much of the secretive atmosphere which was pervasive throughout the virus writing underground has given way to a new openness. This openness has been facilitated in part by a the media. In WIRED, we find "Viruses Are Good for You"[13] suggesting that many of the "most promising visions of how to coordinate the far-flung communication and computing cycles .....converge on a controversial solution: the use of self-replicators that roam the Net." The individuals examined as virus writers in the article are referred to as "developers interested in harnessing the power of self-replicating programs, scientists interested in the abstract behaviours of viruses", and "unnamed renegades of the virus writing underground". The article goes on to discuss the virus as a fascinating and powerful life form, seen by the creators as useful for "the fertile creation of yet more powerful digital devices" and "reckless individual expression". The anti-virus community is described at one point as "nervously policing the boundary between the great unwashed and those trustworthy enough to handle 'live' specimens......the world of anti-virus research offered its initiates a thrill somewhere between the delightful romance of butterfly collecting and the grim camaraderie of working for the National Security Agency". Mark Ludwig, one of the subjects discussed in the article, is described as wandering the "lonely intellectual wilderness reserved for those who practice science on the fringe, outside the cozy realms of institutional affiliation, professional consensus or methodological decorum". While the article does suggest Ludwig could present his subject with a little more sober attention to devising anti-virus countermeasures, it does not draw any conclusion on his contribution to the legitimization of virus writing. It does not mention the impact of the viruses which were made available on CD-ROM by Ludwig; specifically, the fact that these CD-ROMS have helped bring the computer virus into many businesses and households as part of "anti-virus test material", despite the fact that such materials are unsuitable for testing [14]. While the article does point out that many see the virus writing books as incitement to digital vandalism, it does also state Ludwig has elevated the computer virus from the digital equivalent of a can of spray paint to an object of almost lifelike behaviour. The article states he "transformed a tool of vandals into a field of scientific study", although we would argue he has in fact given virus writers a sense of legitimacy as they carry out their own brand of unscientific "research". The article concludes with this offering: "For executable DOS virus code on disk, send a check for $US50 (payable to Virtual Life) to xxxxxxxx" (Address deleted).
The sale of viruses is but one of the ways in which the entire "virus writing underground" has become a more accepted "above ground" community (one might argue that virus writing has always gone on above ground - but that is a topic for another paper.). The "Webification" of vX sites has essentially removed the "I'll show you mine if you'll show me yours" attitude to virus collections and exchange. Infectious code is now just a point and click away. While there is deliberate flippancy here, there is an important point to be made. By allowing viruses to be made readily available via the WWW, we as a society have demystified them; some would say we have even legitimized them. Of course, it can be argued that to disallow such "information" to be distributed would constitute censorship. This, too, is beyond the scope of this paper. However, we have observed that exposure of the computing community to Web sites which contain many thousands of viruses, all available for download, tends to contribute to the desensitization of the population on the inherent dangers involved. Virus distribution is much more acceptable now than it was even two or three years ago.
Another development brought by the Internet is the somewhat curious group alt.comp.virus [15]. Here, a bizarre collection of industry experts, virus writers, and users gather to debate the latest viruses and their countermeasures. The group, which was allegedly formed to overcome the "censorship" of the more restrained virus-L (comp.virus) was initially utilized by those who wanted to distribute or exchange virus code. However, of late it has become significantly more balanced, and even has its own FAQ, credited with appropriate thanks to Dr Alan Solomon, Vesselin Bontchev, Rob Slade and other "good guys". The newsgroup has by its evolution encouraged people who do not approve of virus writing and/or distribution to say so in a public forum. However, individual differences combined with the international nature of the Internet have continued to work together to highlight one real stumbling block to agreeing on what constitutes "responsible behaviour". The interactive nature of the group is an excellent opportunity for rational positions regarding the unethical nature of virus writing and distribution to be presented, and for this reason, should be encouraged. Such interactions can only lead to eventual understanding on the part of those still forming their own value and belief systems, and may encourage others to think their positions through more carefully. Notwithstanding, in August of 1996, there could be counted a number of posts which contained either a plea for virus sites, URLs to virus sites or uuencoded virus code, both in binary and source formats. Once again, the desensitization continues. Virus writing is very definitely becoming more mainstream. Perhaps this must happen before it can be examined and determined unacceptable behaviour. Only time will tell if this is the case.
In many ways, the mainstreaming of virus writing was made more clear during the furor regarding the "discovery" of the Boza virus. The following quote is taken from an interview with the alleged author of the virus [16], and provides interesting food for thought:
"Bizatch [Boza] was completed in late November last year. We went into beta testing in early December, which basically meant handing it over to people we knew who were running odd configurations of Windows 95. Testing was completed in mid-December and I fixed a number of bugs - we found that it killed certain 'new' Windows 95 executables..."
The introduction of formal Beta test cycles for viruses should be cause for anyone who believes that we are winning the fight against computer viruses to carefully reconsider their position.
"Our cultural motifs, our educational system, our communications media had failed this man. What the society permitted to trickle through was mainly pretense and confusion. It never taught him how to distinguish real science from cheap imitation. He knew nothing about how science works".
This quote from The Demon Haunted World [17] exemplifies our observation of the media and in some cases, the international educational system's approach to computer viruses. While it was written by Carl Sagan to illustrate the ways in which many New Age tenets or premises are actually pseudoscience embraced by those who had not been exposed to real science, it applies in no small portion to our observations of virus writers and more importantly to those who have a good deal of influence on potential virus writers. It is our belief that many of those who contribute to virus writing via media representation, arguments of "free speech", actions based in large part on some type of situational ethics, and calls for university "research", do so largely because they are unfamiliar with the technical scientific information related to viruses [18]. They choose instead to follow whatever the current trends are, be they vX BBSs, "research" for the most politically naughty virus, or acceptance of acts which may put them or their company at significant risk of data loss because it is easier to do these things than to examine and accept the facts about viruses. For this reason we have called our next group of virus writers "The New Age Virus Writers".
Given the sorts of influences briefly discussed above, the appearance of yet another new type of virus writer is not wholly unexpected. The New Age Virus Writer seems to have two incarnations. The first is the most familiar and is the type we will discuss in this section. This type is the product of boredom, curiosity, mixed messages and technological glut. We will consider viruses, methods and possible motivations. The second observable type of New Age Virus Writer will then be examined in the next section.
As the writers of many of the new viruses are not well known, we are forced to draw conclusions in some part from their creations. Perhaps one of the best examples of the work of the New Age Virus Writer is Zhengxi, an extremely complex virus analyzed in Virus Bulletin in early 1996 [19]. This analysis states:
"At 7K long, it [Zhengxi] is one of the most involved [viruses] I have ever seen. It is a sort of 'all-in-one' virus, which infects EXE and OBJ files, and attaches infected COM droppers to ZIP, and RAR archives (both static and self-extracting). Its very complex polymorphism resembles that of SMEG, but has loops often exceeding 2K in length, concealed by vast quantities of junk subroutines, and Int 21h and CP/M calls.
Zhengxi infects EXE files either by appending its code to the end of the file in the standard manner, or by looking through the file for C or Pascal subroutines and modifying these to execute the virus (as Lucretia). The OBJ infection technique is similar to that of Shifter [see VB March 1995, p.11], and that of archive modification was first seen in Dementia [see VB November 1995, p.12]."
Even without specialist assembly language knowledge, it is easy to see that Zhengxi is more of a programming exercise than a virus designed to spread. Its author must have known that the features which he was adding were just a display of skill. Clearly, it is not the work of a child, but of a programmer who could earn real money writing real programs in the real world. This is the world of the New Age Virus Writer.
As we have seen above, this sort of virus writer can be demonstrably more sophisticated. Consider also the WordMacro/Concept [20] virus, currently one of the most widespread viruses in existence according to some sources [21]. The source code for this virus demonstrates the use of the Hungarian naming convention; a set of detailed guidelines for naming routines and variables. While it is used within the C programming language, especially in Microsoft Windows programming, few virus writers we spoke with were aware of it. [Note: according to Code Complete , "the term "Hungarian" refers both to the fact that the names that follow the convention look like words in a foreign language and to the fact that the creator of the convention, Charles Simonyi, is originally from Hungary." [22] ]
The New Age Virus Writer may be motivated by a desire such as some consider apparent in WordMacro/Concept: to force applications designers to act in a certain manner. He may be trying to prove their point in the only way they feel the applications designers will understand. He may be motivated by a desire to use viruses in what he thinks is a "good" way, to help his company or department gather certain information in what he hopes will be an unobtrusive manner [23].
The New Age Virus Writer worships at the altar of technology, and uses other's lack of understanding of the issues and their implication as a vehicle to advance his own particular form of magic. Consider this implementation of certain techniques: WordMacro/Spoof [24], which creates its own custom dialogue box for Tools Macro, hiding the presence of its own installed macros. According to the author of this virus, the only copy he has distributed was sent directly to me; thus, the virus has not been distributed to any other researchers, in the hope of containing the technology. (This is a recognized and approved course of action within the anti-virus industry when a researcher strongly believes he or she has the only sample in existence of a particular virus.) In the world of the New Age Virus Writer, there is access to powerful computing equipment. Unlike the early days, even as recently as 2-3 years ago when the our initial study was begun, the viruses seem to indicate there is now access to various operating systems, applications, and programming tools.
You won't usually find the virus writers' names spattered all over their creations, or bandied about the Internet; you will rarely find their creations first on virus exchange or virus WWW sites. Observation shows these individuals tend to be a bit older and more cautious than the Next Generation Virus Writer. They do not share "accomplishments" with peers, perhaps because they are old enough to be held responsible for their negligence in releasing viruses.
This type of virus writer is not likely to "age out" for two reasons. One, he is already an adult, and two, the concept of "aging out" applies to behaviours which are perceived as morally unacceptable by the society and which are left behind during the natural course of individual ethical progression . As we have just shown, while virus writing may in reality be an unacceptable activity, the perception of it fostered by the media, some adults, some Universities and some ISPs combine with the "Cult of the Internet" to produce some very mixed messages.
We have speculated in the above that the New Age Virus Writer is somewhat older, employed and does not make his identity known. Given this, how can we go about the job of stopping him? The suggestions given below are made to facilitate a discussion on what may or may not be acceptable. We do not in any way advocate government censorship or control of information: however, we feel that responsibility must come along with freedom and for this reason do not find public virus distribution acceptable. With this in mind, we have gathered various perspectives on controlling the problems addressed herein.
While laws to punish those who are caught intentionally spreading computer viruses to the unknowing and unwilling are one tool which can be used to discourage this sort of negligent and criminal behaviour, the nature of virus writing and distribution highlights the need for additional, more effective tools. The main tool we have at our disposal is that of communication. We must attempt to change the attitude of as many as possible regarding computer viruses. Obviously, this is the "big picture" approach. Without cooperation from educators, legal policy makers, judiciary, parents, and the media, there is little hope that the virus writing phenomenon will subside. It will continue to shift, becoming more and less, less and more acceptable to engage in the activity.
To discourage these sorts of behaviours, people may wish to consider voicing their displeasure publicly. This could include informing their Internet service providers (who lend viruses an air of credibility by allowing them to be distributed) that they consider this irresponsible and unacceptable. This could also be made evident in several other ways: it may take the form of a vendor disallowing distribution of their shareware from sites which openly allow virus distribution (such an approach has been attempted by Frisk Software) or it may involve individual or corporate users discontinuing the use of service from providers which allow users to make viruses available. Both of these suggestions have been made publicly by members of the anti-virus community, but we have no way of knowing the actual result. It has been suggested that it may prove effective to write letters voicing concern to the appropriate persons at various service providers, or writing letters thanking those who act responsibly. Universities, which in some cases are privately funded, may be open to suggestions from supporters. Publicly funded universities have been known to investigate irresponsible behaviours of other types once alerted; some people have tried informing universities which are known to have viruses on their sites. However, according to one university site which wishes to go unnamed, the person reporting the files as "unacceptable" first ftp-ed the entire virus collection before making his report. This obviously sends a real mixed message, and should be avoided.
Destructive behaviours should not be encouraged under the guise of "science": the problem with viruses we find in many universities seems to be a lack of understanding on the part of most professors of the issues involved. Taking an active role in the educational process at the university level, and clearly voicing a concern over ethically questionable methods may help avoid placing the university at risk from both a technical and PR standpoint. Vendors and users may wish to consider advising testers who may be testing anti-virus products using questionable methods which are linked to virus production or legitimization that such methods are unacceptable. It could prove effective to disallow advertising in magazines which utilize such methods, or to write letters to the editors and publishers, stating displeasure with the situation. Making a public issue out of irresponsible behaviours has sometimes worked to discourage the behaviours. However, this kind of action can have the opposite effect. Therefore, this should be considered a matter of individual discretion and should not be undertaken lightly without full regard for possible ramifications. Finally, we as a society must be willing to relay the message of responsible computing to our children, who may be encouraged and influenced by the media and Internet culture. We recognize this is a long term approach to the problem; there are no immediate solutions.
There are, however, things you can do now to lessen the impact of the second type of New Age Virus Writer, which we will now discuss. This type of virus writer has all the skills and motivations mentioned so far in this paper, with the additional contributory factors of office politics and incorrect organizational security policies. This type of virus writer may be working for you.
One action you can take now is to examine your own company. Do you have IT staff , locally or regionally, who can be found "playing around" with viruses? As we have shown, the secrecy and contraband image of viruses is gone. The viruses are easy to obtain now and there is much less stigma attached to both obtaining them and "learning". Macro viruses, written in well-documented, easier to comprehend languages such as Visual Basic for Applications (VBA) are all too easy to obtain, to understand and to modify or write. A well-intentioned IT Manager can inadvertently modify an existing Macro virus while attempting to see what it does. Adding a REM comment could create a new variant. If viruses are seen as something which can be toyed with at leisure (many e-mail messages are received by some anti-virus vendors every week which contain the dreaded line "I've played with the virus a bit and found...") there is always the danger that that exploration might be taken, intentionally or unintentionally, too far. Regardless of the intent, the impact on a company can be devastating.
When you have a virus outbreak, it is imperative to find out where the virus came from. Of course, this should be done not in a finger pointing or blaming manner, but as a routine part of your security processes [25]. It should be determined that viral infections are not the result of, for instance, in-house Web cruising of virus distribution Internet sites. Your security policies should outline acceptable practice with those viruses which are discovered, and those practices should exclude "experimentation" which can lead to accidental modification. This should apply whether the viruses are .COM and .EXE infectors, Macro viruses, or any other sort of virus. Every so often, we get reports of a new virus in the wild from a customer who has experienced a small outbreak of a "Zoo" virus. Often, these viruses are buggy, and stand little or no chance of being globally successful; they have been introduced to the company by an employee who was testing anti-virus software, or "experimenting".
In this paper, we have continued the work started in TGVW, following the ethical development of four virus writers. As predicted in the earlier work, those who have continued a normal ethical development have aged out of virus writing. This may well continue to be the only effective way that many of the current virus writers will stop.
However, there are two disturbing trends developing within the virus writing community, and the computing industry in general. First, there are virus writers who seem to be motivated by different reasons than the old "virus underground". We believe that some of these virus writers are older and more skilled than before. Viruses like Zhengxi and Concept point to an advanced knowledge of programming techniques; the reasons for the development of attacks may well be changing. Coupled with this is the steady legitimization of virus writing, making it "less wrong" in the eyes of the general public. This will act to prevent those involved from "aging out" even if they follow a normal ethical development, and is cause for significant concern to those in the anti-virus industry and all those concerned about data security. This legitimization and desensitization contributes to the writing or modification of viruses in companies as well as by the classic "Virus Writer". Whether we like it or not, our own actions and words communicate to the next generation what is acceptable socially, ethically, and legally and what is not. By our actions, or lack thereof, today, we ourselves are creating the virus writers of tomorrow.