Computer viruses get more contagious as user defences slip

Viruses have been very much in the public mind ever since the first global viruses, such as Michelangelo and Melissa, wreaked…

Viruses have been very much in the public mind ever since the first global viruses, such as Michelangelo and Melissa, wreaked a destructive path through home and business computers three years ago.

But in the wake of the September 11th terrorist attacks on the United States, cyber attacks have been added to the list of digital fears - so much so that many jittery computer-users worried that the recent, nasty Nimda worm was part of the assault.

There are plenty of unpleasant concoctions of destructive code circulating around the internet, says virus expert Mr Vincent Weafer, chief researcher at the advanced response centre of anti-virus software company, Symantec.

But the rumours that Nimda had been released a week to the day and hour of the time the first plane hit the World Trade Centre were untrue, he says.

READ MORE

Still, Nimda was a miserable experience for millions, marking a frightening new phase of viruses - those you can catch simply by receiving it or by visiting an infected website. No longer do you need to at least open an e-mail or an attached document.

"The bar has been raised," says Mr Weafer, who hails from Mullingar, Co Westmeath, but now works at Symantec's Santa Monica research facility.

Even worse, such unpleasant innovation in the virus-hatching field comes at a time when we are making ourselves more vulnerable to attack by viruses or hackers, despite the growing awareness of the need for good, constantly updated anti-virus software.

For home users and smaller businesses, the culprit is the availability (well, almost, in the Republic) of always-on internet connections via cable modems and DSL.

"The rise of permanent connections has created all sorts of new problems," Mr Weafer says. "Computers now are homogeneous, high-end and always on - perfect targets."

This allows for more complex viruses and makes it easier for these bugs to replicate and send themselves on to other victims. More sophisticated machines always connected to the Net also become attractive to hackers and their new "blended" viruses, which mix the characteristics of several types of virus.

Such viruses might invade systems in the form of a mass e-mailed bug, then take control of a user's computer - turning it into what Mr Weafer calls a "zombie" computer.

Your home PC is then under the remote control of the hacker who sent the virus and is typically used as one of thousands of similar computer foot soldiers for mass, automated hacking attacks.

What's a poor computer-user to do? Predictably, Mr Weafer says everyone should be running up-to-date anti-virus software. But that's not all. He also favours use of a firewall, a defensive item that is no longer just for the big corporates.

A few gung-ho types will be thrilled at the thought of their own personal firewall, but the rest of us can only groan - as Mr Weafer acknowledges, they are tricky to set up. But, he insists that they are far more user-friendly than ever before and, with a bit of fiddling, will do their job well.

Anyway, it seems we have no choice now that global viruses - those which can spread quickly and viciously - are becoming the norm. "Global viruses used to be pure luck," says Mr Weafer, but that is no longer the case.

Who hasn't heard of Michelangelo and Melissa, Code Red, Iloveyou and Nimda? These days, such well-known bugs are spreading much faster, because nearly everyone runs the same operating system - Windows - and uses Microsoft's Outlook or Outlook Express e-mail software.

Virus creators can design a virus to spread itself quickly by e-mailing itself from the contact addresses held in Outlook.

As a result, says Mr Weafer, viruses that used to take a day or two to wrap themselves around the world can do so in under eight hours, as with Nimda. Fortunately, truly destructive global viruses only pop up two to three times a year, he notes. Websites themselves are increasingly used to nail victims too, he says.

"Shady" websites such as pornography or obscure gambling sites often offer people free passwords to access content on the sites. But download the password and you also get unwanted code that creates a back door for viruses. Or it might change the numbers a modem dials to get Net access so that a computer user is unknowingly connected to a costly toll number.

Symantec's advanced response centre's job is two-fold. It serves as the firefighter coming to the rescue of computers or networks that are under attack or at risk - by creating antidotes to the viruses. It also does the advance research work that helps anti-virus and security companies such as Symantec to keep pace with whatever the hackers think up next.

Symantec's advanced response centre receives viruses daily from computer-users using Symantec software, which, like most anti-virus programs, enables users to isolate and mail on to them a suspect virus - resulting in a total of some 120,000 mailings a month. Its researchers can turn around an antidote surprisingly fast - in 20 minutes for a simple macrovirus - although a complex, metamorphosing virus such as Code Red might take three to four days, according to Mr Weafer.

"The most important thing we do is not even virus definitions, it's information."

Once computer-users are aware of a virus problem, they can at least find out how to prevent picking it up, even if a system fix is not available.

However, the US attacks have many people worrying about virus and hacker assaults of a far more serious nature than ever before - attacks that might take out the crucial infrastructure of a country, manipulate its nuclear plants or close off its communication systems.

"I think we all agree that those sort of attacks are very possible," admits Mr Weafer. "There's certainly going to be a higher degree of awareness.

"In general, that will act as a deterrent, too. Many people will believe it's not worthwhile to put out a virus when the chances are so much higher that they'll be caught."

However, many of the fears people have - that terrorists might gain control of millions of home PCs and use them in a co-ordinated cyber attack or garble flight control systems - are "science fiction, not science fact".

He says there's also a somewhat changed environment after the US attacks.

Many people who might previously have created malicious or even simply mischievous programs may now question whether it is right to do so any more. Already, more than one resource website on and for hackers - both the benign and the belligerent - has asked people to refrain from doing anything that might damage systems and interfere with security investigations into the US attacks.

Overall, Mr Weafer says he wishes he could find some way of getting virus creators to realise "there's real people at the end of this" - people who lose crucial work, valued documents, sometimes information collected over many years.

Some people contact Symantec's advanced response centre in a state of complete anguish, having lost doctoral dissertations, important contracts, digital photos - whatever can be turned into bits and stored on a computer.

The most rewarding aspect of his job, he says, is simply "helping people. Especially when it comes down to a personal thing."