March 19, 2001, 9:41 AM —
Everyone knows what a virus is. It doesn't take too many encounters with the likes of Melissa and I Love You to forge an indelible memory. However, most people don't really know the nature of a virus. Everyone has heard of the type of problems that can befall their systems, but they can't clearly differentiate a virus from a worm, or explain why a virus works.
Not every attack against computers is a virus, but because of the frequency at which viruses appear, many users have begun to assume that every problem they have is virus-related. A virus is a program that copies itself into other programs -- similar to the way biological viruses invade the host's cells -- and becomes active when a program is run (e.g., clicked on). From there, a virus infects other files.
What exactly is a virus, and how is it different from other forms of attack? Do viruses preferentially or exclusively attack Windows systems? Can they be subverted and used for altruistic purposes?
One reason for the confusion is that experts don't necessarily define a virus in precisely the same way. Some experts, like Bruce Schneier and Elizabeth Zwicky, claim a virus consists of two parts: a propagation mechanism and a payload. Others describe a virus as just the transport mechanism. In any case, when a virus infects a system, there are generally two components at work: one that handles the replication and one that does the damage.
Some authors further distinguish between propagation (local replication) and migration (getting from one system to another). Clearly, there's plenty of reason for the average man on the street (or in the next cubicle) to be confused. Consider the Melissa virus, which struck in March 1999 and was one of the first viruses to receive popular attention. Described as a virus, Melissa was said by some to be both a virus and a worm. The worm component allowed Melissa to move from system to system; the virus part managed the replication on the local system. If we consider a virus to be the transport mechanism only, we will likely see payloads that we would identify as time and logic bombs, buffer overflow exploits, and Trojan horses.
Important definitions concerning viruses include:
- Propagation/migration: how a virus replicates locally and over a network
- Payload: mechanism through which a virus causes damage or has an effect
- Signature: pattern with which a virus is detected by antiviral software
- Detection avoidance: method by which a virus attempts to hide itself
- Trigger: action through which a virus comes to life
Propagation and migration often involve reading data files and sensing the environment. Many recent viruses have read the user's address book in order to send the virus to other systems. Others have infected applications in such a manner that files created with that application were infected; those files then carried the infection to other systems. Some viruses infected floppy disks so that systems were infected when the disks were read.
Payloads can be anything from innocuous banners to severe filesystem damage. A virus isn't necessarily harmful -- in fact, many early viruses were harmless pranks. On the other hand, some viruses have caused so much damage that a simple reinstallation of the operating system was insufficient to repair them.
Viral signatures are the patterns used to identify a virus within a file. In order for a virus to be detected, it must be identified and its signature established and distributed. Frequent updates of the data files associated with antiviral software can protect users from known viruses. Unfortunately, there's a significant difference between the time a virus is first released and the time a pattern allowing its detection is available. What is needed, but is extremely difficult to develop, is a way to recognize the character of a virus and differentiate it from normal system activity.
Many viruses attempt to hide themselves. They may insert themselves into unused space within a binary so as not to change the size or other characteristics of those files (though they would affect a checksum). Others simply store themselves in obscure files and locations.
