http://www.nytimes.com/library/tech/99/04/biztech/articles/03virus.html
April 3, 1999
The Anarchic Lure of Virus Writing
By MATT RICHTEL and JOHN MARKOFF
In the world of cyberspace, the sport of virus writing has become the
latter-day equivalent of the urge to write "Kilroy was here" on the wall
of the school auditorium. And it is a hobby with a growing following.
The emergence of the Melissa virus a week ago, and the announcement
yesterday of an arrest in the case, underscores the growth on the Internet
of a community of virus writers and collectors. They freely trade
malicious code, combine efforts to best the work of antivirus researchers,
and post their creations on the Internet for anyone to download and
release into the wild.
"It's like candy," said Sarah Gordon, an antivirus researcher for I.B.M.
who spent five years researching the virus-writing subculture. "A child
can get these, a 12-year-old can get these." She said it required little
technical expertise to introduce a virus once it was obtained.
"It's trivial," she said. "All you do is download it to a computer, click
on it and there you go."
As the computer has become ubiquitous, the image of the bad guy of the
technology era, the bespectacled introvert who attacks computer networks
by keystroke, has emerged. Within this category, there exists a subset of
virus writers, a subculture within the subculture.
The International Computer Security Association, an industry corporation
based in Carlisle, Pa., estimated last year that there were 15,000 to
20,000 viruses in circulation, with 1,000 emerging each month. Only a
small number are widely circulated, or "make it into the wild," in the
industry vernacular.
But their proliferation has given rise to a highly competitive industry of
companies that seek out the latest strains and find and market software
antidotes.
Over the years, virus writing has been perceived as having less status in
the hacker set than cracking into government and corporate computers. But
virus writing appears to have become more attractive to hackers as
publicity around viruses has grown, say computer buffs and executives at
antivirus companies.
One early group of virus writers, 40Hex, which published a magazine,
emerged in the early 1990's, said Jeff Moss, the founder of Defcon, an
annual gathering of the computer underground. "They were going to cause
the downfall of civilization, but then they got bored after a while,"
Moss said.
"There wasn't that much happening in virus writing," he added, "so the
more motivated people went off to normal hacking." As opposed to hacking,
which can demand a range of skill levels, virus writing traditionally
attracted a more technically oriented set. Virus writers "are very much
into super-down-and-dirty programming," Moss said.
But in recent years, virus writing has experienced a resurgence, generally
attracting a less technically adept group. Increasingly, simple templates
are available for use in virus writing and breaking into computers, making
the endeavor open to copycats and less adept programmers.
In the underground, these copycats are known as script kiddies. In the
world of virus writing, they are termed scripters, a name Ms. Gordon gave
to them.
Ms. Gordon said virus-writing enthusiasts had evolved from the late 80's.
"It used to be a small group of people with these interests," she said.
"With the advent of the Internet, the community has widened and
accessibility of applications to young people has increased."
That may have particular currency in the case of the Melissa virus. Some
computer security experts have suggested that David L. Smith, the New
Jersey man arrested in the case yesterday, cobbled together his own virus
code with virus templates he found on the Web.
Authorities in New Jersey said they did not believe that Smith is the
virus writer known as VicodinES, whose handle has been linked in Internet
postings with the creation and dissemination of Melissa. What is certain
is that VicodinES, whoever he or she is, has a Web site that advocates the
creation and use of viruses, and that Smith's name was found in several
documents on that Web site dating back at least a year, said Richard
Smith, an independent software developer in Cambridge, Mass., who is an
amateur computer sleuth.
The Web site, which was taken down on Tuesday night by Access Orlando, the
Internet service provider in Orlando, Fla., where the Web server was
situated, served as a bulletin board and downloading site for viruses. It
contained commentary by the author who identified himself as VicodinES.
But some virus writers contend that it is far too simplistic to
characterize all virus writers as malicious. Some are attracted to virus
writing because they want to deconstruct programming code, see how it
works, and poke holes in it as an intellectual endeavor, said a longtime
virus writer known as Attitude Adjuster.
"The idea that all of us out here are malicious teen-agers is quite a
fallacy," said Attitude Adjuster, who was contacted by E-mail and declined
to give his real name. "There are those of us who still exist in the
community who write viruses because it's fun. We don't give our viruses to
the public and nobody gets hurt."
-o-
Subscribe: mail majordomo@repsec.com with "subscribe isn".
Today's ISN Sponsor: Hacker News Network [www.hackernews.com]
Received on Mon Apr 5 17:33:23 1999