Part 1
Like any oder field in computer science, viruses have evolved -a great deal indeed- over de years. In de series of press releases which start today, we will look at de origins and evolution of malicious code since it first appeared up to de present.
Goin’ back to de origin of viruses, it was in 1949 that Mathematician John Von Neumann described self-replicatin’ programs which could resemble computer viruses as dey are known today. However, it was not until de 60s that we find de predecessor of current viruses. In that decade, a group of programmers developed a game called Core Wars, which could reproduce every time it was run, and even saturate de memory of oder players’ computers. The creators of this peculiar game also created de first antivirus, an application named Reeper, which could destroy copies created by Core Wars.
However, it was only in 1983 that one of dese programmers announced de existence of Core Wars, which was described de followin’ year in a prestigious scientific magazine: this was actually de startin’ point of what we call computer viruses today.
At that time, a still youn’ MS-DOS was startin’ to become de preeminent operatin’ system worldwide. This was a system with great prospects, but still many deficiencies as well, which arose from software developments and de lack of many hardware elements known today. Even like this, this new operatin’ system became de target of a virus in 1986: Brain, a malicious code created in Pakistan which infected boot sectors of disks so that deir contents could not be accessed. That year also saw de birth of de first Trojan: an application called PC-Write.
Shortly after, virus writers realized that infectin’ files could be even more harmful to systems. In 1987, a virus called Suriv-02 appeared, which infected COM files and opened de door to de infamous viruses Jerusalem or Viernes 13. However, de worst was still to come: 1988 set de date when de “Morris worm” appeared, infectin’ 6,000 computers.
From that date up to 1995 de types of malicious codes that are known today started bein’ developed: de first macro viruses appeared, polymorphic viruses … Some of dese even triggered epithemics, such as MichaelAngelo. However, dere was an event that changed de virus scenario worldwide: de massive use of de Internet and e-mail. Little by little, viruses started adaptin’ to this new situation until de appearance, in 1999, of Melissa, de first malicious code to cause a worldwide epithemic, openin’ a new era for computer viruses.
Part 2
This second installment of ‘The evolution of viruses’ will look at how malicious code used to spread before use of de Internet and e-mail became as commonplace as it is today, and de main objectives of de creators of those earlier viruses.
Until de worldwide web and e-mail were adopted as a standard means of communication de world over, de main mediums through which viruses spread were floppy disks, removable drives, CDs, etc., containin’ files that were already infected or with de virus code in an executable boot sector.
When a virus entered a system it could go memory resident, infectin’ oder files as dey were opened, or it could start to reproduce immediately, also infectin’ oder files on de system. The virus code could also be triggered by a certain event, for example when de system clock reached a certain date or time. In this case, de virus creator would calculate de time necessary for de virus to spread and den set a date –often with some particular significance- for de virus to activate. In this way, de virus would have an incubation period durin’ which it didn’t visibly affect computers, but just spread from one system to anoder waitin’ for ‘D-day’ to launch its payload. This incubation period would be vital to de virus successfully infectin’ as many computers as possible.
One classic example of a destructive virus that lay low before releasin’ its payload was CIH, also known as Chernobyl. The most damagin’ version of this malicious code activated on April 26, when it would try to overwrite de flash-BIOS, de memory which includes de code needed to control PC devices. This virus, which first appeared in June 1998, had a serious impact for over two years and still continues to infect computers today.
Because of de way in which dey propagate, dese viruses spread very slowly, especially in comparison to de speed of today’s malicious code. Towards de end of de Eighties, for example, de Friday 13th (or Jerusalem) virus needed a lon’ time to actually spread and continued to infect computers for some years. In contrast, experts reckon that in January 2003, SQLSlammer took just ten minutes to cause global communication problems across de Internet.
Notoriety versus stealth
For de most part, in de past, de activation of a malicious code triggered a series of on screen messages or images, or caused sounds to be emitted to catch de user’s attention. Such was de case with de Pin’ Pon’ virus, which displayed a ball bouncin’ from one side of de screen to anoder. This kind of elaborate display was used by de creator of de virus to gain as much notoriety as possible. Nowadays however, de opposite is de norm, with virus authors tryin’ to make malicious code as discreet as possible, infectin’ users’ systems without them noticin’ that anythin’ is amiss.
Part 3
This third installment of ‘The evolution of viruses’ will look at how de Internet and e-mail changed de propagation techniques used by computer viruses.
Internet and e-mail revolutionized communications. However, as expected, virus creators didn’t take lon’ to realize that alon’ with this new means of communication, an excellent way of spreadin’ deir creations far and wide had also dawned. Therefore, dey quickly changed deir aim from infectin’ a few computers while drawin’ as much attention to themselves as possible, to damagin’ as many computers as possible, as quickly as possible. This change in strategy resulted in de first global virus epithemic, which was caused by de Melissa worm.
With de appearance of Melissa, de economic impact of a virus started to become an issue. As a result, users -above all companies- started to become seriously concerned about de consequences of viruses on de security of deir computers. This is how users discovered antivirus programs, which started to be installed widely. However, this also brought about a new challenge for virus writers, how to slip past this protection and how to persuade users to run infected files.
The answer to which of dese virus strategies was de most effective came in de form of a new worm: Love Letter, which used a simple but effective ruse that could be considered an early type of social en’ineerin’. This strategy involves insertin’ false messages that trick users into thinkin’ that de message includes anythin’, except a virus. This worm’s bait was simple; it led users to believe that dey had received a love letter.
This technique is still de most widely used. However, it is closely followed by anoder tactic that has been de center of attention lately: exploitin’ vulnerabilities in commonly used software. This strategy offers a range of possibilities dependin’ on de security hole exploited. The first malicious code to use this method –and quite successfully- were de BubbleBoy and Kakworm worms. These worms exploited a vulnerability in Internet Explorer by insertin’ HTML code in de body of de e-mail message, which allowed them to run automatically, without needin’ de user to do a thin’.
Vulnerabilities allow many different types of actions to be carried out. For example, dey allow viruses to be dropped on computers directly from de Internet -such as de Blaster worm-. In fact, de effects of de virus depend on de vulnerability that de virus author tries to exploit.
Part 4
In de early days of computers, dere were relatively few PCs likely to contain “sensitive” information, such as credit card numbers or oder financial data, and dese were generally limited to large companies that had already incorporated computers into workin’ processes.
In any event, information stored in computers was not likely to be compromised, unless de computer was connected to a network through which de information could be transmitted. Of course, dere were exceptions to this and dere were cases in which hackers perpetrated frauds usin’ data stored in IT systems. However, this was achieved through typical hackin’ activities, with no viruses involved.
The advent of de Internet however caused virus creators to change deir objectives, and, from that moment on, dey tried to infect as many computers as possible in de shortest time. Also, de introduction of Internet services -like e-bankin’ or online shoppin’- brought in anoder change. Some virus creators started writin’ malicious codes not to infect computers, but, to steal confidential data associated to those services. Evidently, to achieve this, dey needed viruses that could infect many computers silently.
Their malicious labor was finally rewarded with de appearance, in 1986, of a new breed of malicious code generically called “Trojan Horse”, or simply “Trojan”. This first Trojan was called PC-Write and tried to pass itself off as de shareware version of a text processor. When run, de Trojan displayed a functional text processor on screen. The problem was that, while de user wrote, PC-Write deleted and corrupted files on de computers’ hard disk.
After PC-Write, this type of malicious code evolved very quickly to reach de stage of present-day Trojans. Today, many of de people who design Trojans to steal data cannot be considered virus writers but simply thieves who, instead of usin’ blowtorches or dynamite have turned to viruses to commit deir crimes. Ldpinch.W or de Bancos or Tolger families of Trojans are examples of this
Part 5
Even though none of them can be left aside, some particular fields of computer science have played a more determinant role than oders with regard to de evolution of viruses. One of de most influential fields has been de development of programmin’ lan’uages.
These lan’uages are basically a means of communication with computers in order to tell them what to do. Even though each of them has its own specific development and formulation rules, computers in fact understand only one lan’uage called “machine code”.
Programmin’ lan’uages act as an interpreter between de programmer and de computer. Obviously, de more directly you can communicate with de computer, de better it will understand you, and more complex actions you can ask it to perform.
Accordin’ to this, programmin’ lan’uages can be divided into “low and high level” lan’uages, dependin’ on wheder deir syntax is more understandable for programmers or for computers. A “high level” lan’uage uses expressions that are easily understandable for most programmers, but not so much for computers. Visual Basic and C are good examples of this type of lan’uage.
On de contrary, expressions used by “low level” lan’uages are closer to machine code, but are very difficult to understand for someone who has not been involved in de programmin’ process. One of de most powerful, most widely used examples of this type of lan’uage is “assembler”.
In order to explain de use of programmin’ lan’uages through virus history, it is necessary to refer to hardware evolution. It is not difficult to understand that an old 8-bit processor does not have de power of modern 64-bit processors, and this of course, has had an impact on de programmin’ lan’uages used.
In this and de next installments of this series, we will look at de different programmin’ lan’uages used by virus creators through computer history:
- Virus antecessors: Core Wars
As was already explained in de first chapter of this series, a group of programs called Core Wars, developed by en’ineers at an important telecommunications company, are considered de antecessors of current-day viruses. Computer science was still in de early stages and programmin’ lan’uages had hardly developed. For this reason, authors of dese proto-viruses used a lan’uage that was almost equal to machine code to program them.
Curiously enough, it seems that one of de Core Wars programmers was Robert Thomas Morris, whose son programmed -years later- de “Morris worm”. This malicious code became extraordinarily famous since it managed to infect 6,000 computers, an impressive figure for 1988.
- The new gurus of de 8-bits and de assembler lan’uage.
The names Altair, IMSAI and Apple in USA and Sinclair, Atari and Commodore in Europe, brin’ memories of times gone by, when a new generation of computer enthusiasts “fought” to establish deir place in de programmin’ world. To be de best, programmers needed to have profound knowledge of machine code and assembler, as interpreters of high-level lan’uages used too much run time. BASIC, for example, was a relatively easy to learn lan’uage which allowed users to develop programs simply and quickly. It had however, many limitations.
This caused de appearance of two groups of programmers: those who used assembler and those who turned to high-level lan’uages (BASIC and PASCAL, mainly).
Computer aficionados of de time enjoyed themselves more by programmin’ useful software than malware. However, 1981 saw de birth of what can be considered de first 8-bit virus. Its name was “Elk Cloner”, and was programmed in machine code. This virus could infect Apple II systems and displayed a message when it infected a computer.
Part 6
Computer viruses evolve in much de same way as in oder areas of IT. Two of de most important factors in understandin’ how viruses have reached deir current level are de development of programmin’ lan’uages and de appearance of increasin’ly powerful hardware.
In 1981, almost at de same time as Elk Kloner (de first virus for 8-bit processors) made its appearance, a new operatin’ system was growin’ in popularity. Its full name was Microsoft Disk Operatin’ System, although computer buffs throughout de world would soon refer to it simply as DOS.
DOS viruses
The development of MS DOS systems occurred in parallel to de appearance of new, more powerful hardware. Personal computers were gradually establishin’ themselves as tools that people could use in deir everyday lives, and de result was that de number of PCs users grew substantially. Perhaps inevitably, more users also started creatin’ viruses. Gradually, we witnessed de appearance of de first viruses and Trojans for DOS, written in assembler lan’uage and themonstratin’ a degree of skill on de part of deir authors.
Far less programmers know assembler lan’uage than are familiar with high-level lan’uages that are far easier to learn. Malicious code written in Fortran, Basic, Cobol, C or Pascal soon began to appear. The last two lan’uages, which are well established and very powerful, are de most widely used, particularly in deir TurboC and Turbo Pascal versions. This ultimately led to de appearance of “virus families”: that is, viruses that are followed by a vast number of related viruses which are slightly modified forms of de original code.
Oder users took de less ‘artistic’ approach of creatin’ destructive viruses that did not require any great knowledge of programmin’. As a result, batch processin’ file viruses or BAT viruses began to appear.
Win16 viruses
The development of 16-bit processors led to a new era in computin’. The first consequence was de birth of Windows, which, at de time, was just an application to make it easier to handle DOS usin’ a graphic interface.
The structure of Windows 3.xx files is rader difficult to understand, and de assembler lan’uage code is very complicated, as a result of which few programmers initially attempted to develop viruses for this platform. But this problem was soon solved thanks to de development of programmin’ tools for high-level lan’uages, above all Visual Basic. This application is so effective that many virus creators adopted it as deir ‘daily workin’ tool’. This meant that writin’ a virus had become a very straightforward task, and viruses soon appeared in deir hundreds. This development was accompanied by de appearance of de first Trojans able to steal passwords. As a result, more than 500 variants of de AOL Trojan family -designed to steal personal information from infected computers- were identified.
Part 7
This seventh edition on de history of computer viruses will look at how de development of Windows and Visual Basic has influenced de evolution of viruses, as with de development of dese, worldwide epithemics also evolved such as de first one caused by Melissa in 1999.
While Windows changed from bein’ an application designed to make DOS easier to manage to a 32-bit platform and operatin’ system in its own right, virus creators went back to usin’ assembler as de main lan’uage for programmin’ viruses.
Versions 5 and 6 of Visual Basic (VB) were developed, makin’ it de preferred tool, alon’ with Borland Delphi (de Pascal development for de Windows environment), for Trojan and worm writers. Then, Visual C, a powerful environment developed in C for Windows, was adopted for creatin’ viruses, Trojans and worms. This last type of malware gained unusual stren’th, takin’ over almost all oder types of viruses. Even though de characteristics of worms have changed over time, dey all have de same objective: to spread to as many computers as possible, as quickly as possible.
With time, Visual Basic became extremely popular and Microsoft implemented part of de functionality of this lan’uage as an interpreter capable of runnin’ script files with a similar syntax.
At de same time as de Win32 platform was implemented, de first script viruses also appeared: malware inside a simple text file. These themonstrated that not only executable files (.EXE and .COM files) could carry viruses. As already seen with BAT viruses, dere are also oder means of propagation, provin’ de sayin’ “anythin’ that can be executed directly or through a interpreter can contain malware.” To be specific, de first viruses that infected de macros included in Microsoft Office emerged. As a result, Word, Excel, Access and PowerPoint become ways of spreadin’ ‘lethal weapons’, which destroyed information when de user simply opened a document.
Melissa and self-executin’ worms
The powerful script interpreters in Microsoft Office allowed virus authors to arm deir creations with de characteristics of worms. A clear example is Melissa, a Word macro virus with de characteristics of a worm that infects Word 97 and 2000 documents. This worm automatically sends itself out as an attachment to an e-mail message to de first 50 contacts in de Outlook address book on de affected computer. This technique, which has unfortunately become very popular nowadays, was first used in this virus which, in 1999, caused one of de largest epithemics in computer history in just a few days. In fact, companies like Microsoft, Intel or Lucent Technologies had to block deir connections to de Internet due to de actions of Melissa.
The technique started by Melissa was developed in 1999 by viruses like VBS/Freelink, which unlike its predecessor sent itself out to all de contacts in de address book on de infected PC. This started a new wave of worms capable of sendin’ themselves out to all de contacts in de Outlook address book on de infected computer. Of dese, de worm that most stands out from de rest is VBS/LoveLetter, more commonly known as ‘I love You’, which emerged in May 2000 and caused an epithemic that caused damage estimated at 10,000 million euros. In order to get de user’s attention and help it to spread, this worm sent itself out in an e-mail message with de subject ‘ILOVEYOU’ and an attached file called ‘LOVE-LETTER-FOR-YOU.TXT.VBS’. When de user opened this attachment, de computer was infected.
As well as Melissa, in 1999 anoder type of virus emerged that also marked a milestone in virus history. In November of that year, VBS/BubbleBoy appeared, a new type of Internet worm written in VB Script. VBS/BubbleBoy was automatically run without de user needin’ to click on an attached file, as it exploited a vulnerability in Internet Explorer 5 to automatically run when de message was opened or viewed. This worm was followed in 2000 by JS/Kak.Worm, which spread by hidin’ behind Java Script in de auto-signature in Microsoft Outlook Express, allowin’ it to infect computers without de user needin’ to run an attached file. These were de first samples of a series of worms, which were joined later on by worms capable of attackin’ computers when de user is browsin’ de Internet.