May 16, 2001, 2:26 PM — The friends and business colleagues who send you the likes of the
unloving LoveLetter virus attachments and other unpleasant e-mail surprises are
unwitting messengers, of course. Who's really responsible for computer viruses?
And what's their motivation, anyway?
The popular perception of virus writer as a dysfunctional, pasty-faced
teenager with no girlfriend and no life, who taps out malicious code to a
backbeat of trance music, is too pat and not accurate, says Sarah Gordon, a
researcher at IBM's Thomas J. Watson Center who has been profiling virus
writers since 1992.
Gordon became curious about viruses when she found one in a
shrink-wrapped software package years ago. She recently published a survey about the effect of antivirus legislation on virus writers.
"Most virus coders are well-adjusted youths who have normal
relationships with their family and friends and intend no real harm with the
viruses they write," she says.
One such subject agrees.
"Most virus writers I know have girlfriends or are married," says
"Doctor Owl," a 20-year-old virus writer. "I don't think we're different than
anyone else."
Gordon has interviewed more than 100 virus writers since first visiting
virus Web sites and chat rooms almost ten years ago in an attempt to understand
the community. One writer even dedicated one of his creations to her.
The image of the virus writer as an angry social malcontent bent on
destruction is generally wrong, Gordon says. Most -- especially the
teenagers -- code for thrills and are often disconnected from the reality of what
their creations can do, she says.
"They don't believe that their code can actually hurt anyone," Gordon
says. It's actually a normal level of ethical development for their age group,
she adds. "Most teenagers don't really think about the effect their actions
will have on other people."
The community harbors a few malcontents, but virus writers come from all
ages, backgrounds, countries, and skill levels, with varying motivations and
intents. They are teenagers and college students and middle-aged professionals,
Gordon says. Some are female.
Virus Writing: Entry to the Underground
Virus writers are at the bottom of the distinct hierarchy in the
computing underground, which places hackers at the top of the pyramid. Most
hackers, even those who once wrote viruses, disdain the inferior skills of
virus writers, especially the newbies or "script kiddies" who trade on already
written exploits or put together a simple macro. "There's very little
originality among virus writers today," Gordon says.
Virus writers are the wild, unpredictable younger siblings whose
unleashed programs are uncontrollable. Hacking involves different, refined
skills. A hacker tends to target a specific computing system and pinpoint where
the program lands.
"Hacking is really about control," Gordon says, "and virus writing is
about ... uncontrolled mayhem."
Like any adolescent, virus writers tend to mature and change their ways.
Most quit the activity once they began to consider the consequences of a virus
unleashed in the wild, Gordon finds in her study.
"Evul" is one who says he stopped spreading viruses once he saw himself
in his victim's shoes. Now 30, he began coding six years ago after a hiatus and
unleashed several programs with his e-mail address embedded in the code. He
felt a bit chastened when recipients wrote to him and described the data they'd
lost because of his creations. But he didn't stop until an Internet service
provider terminated his Web site account for posting viruses at the site.
"The first thing I yelled was, 'What gives you the right to destroy my
hard work!'" Evul recalls. "After a moment of reflection, it hit me like a
brick wall ... what gives me the right? I decided I don't have the right to tamper in
anyone else's hard work."
He still writes file and boot sector viruses, but says he posts only the
source code, which he claims is too complicated for most would-be writers to
cobble into a program. He says he intensely dislikes anyone who intentionally
writes and spreads a virus that could destroy someone's work.
The Changing Profile of the Virus Writer
