We'll be right back.
We'll be right back.
Well, it's one week, almost, after the famed Michelangelo virus was to have hit and caused massive destruction throughout Western civilization.
It didn't happen.
And tonight, on Off the Hook, we're going to try and figure out why.
And we're also going to try and predict the future and see if something like this could actually happen in the future,
or if it's just a whole lot of media hype.
We have a couple of special guests that we'll be talking to, and we'll be, of course, taking your phone calls at 279-3400.
One book that deals with computer viruses, one of the few books that deals with computer viruses,
is called The Little Black Book of Computer Viruses.
And, in fact, there's a couple of books.
Some are being thrown across the room at me right now.
It's another one by Dr. Frederick Cohen, who's in the studio.
Thanks for throwing that over here.
A Short Course on Computer Viruses.
We'll be getting to that as well.
And we have on the phone, from Arizona, Mark Ludberg, the author of The Little Black Book of Computer Viruses.
Are we coming through loud and clear out there?
Yes.
Okay.
You've published a very interesting book.
Actually, I understand it's part one of three, is that correct?
Right.
And perhaps you could tell us what the other two are.
Well, the first volume is just basic, you know, how-to, how these things work,
some instructional examples of computer viruses, both viruses that attach themselves to files
and viruses that are boot sector viruses.
The second volume is going to be kind of scientific applications,
how computer viruses can be used for, you know, in positive ways.
And then the third volume is going to be kind of military applications
and how the military can use these things.
Okay.
You're speaking in the future tense there, so I assume those books have not yet come out.
No, they haven't.
Okay.
When do you expect those to be published?
Volume 2 is planned for kind of the end of this year,
and Volume 3 is probably a year after that.
Okay.
As I mentioned, we also have Dr. Frederick Cohen in the studio with us.
He's written a book called A Short Course on Computer Viruses
and also is an attendee at the Virus Conference,
which is taking place right now at the, what do they call that place, the Marriott Marquis?
It used to be the Penta.
That's how everybody knows it, I think.
The Summit.
The Summit now?
The Summit.
Okay.
Well, it's all over the place.
It's all over.
Now, what is your view on the Michelangelo scare?
Was that something that the media just created, or was that a bonfire virus?
The media didn't create it.
It was created by some of the vendors of virus defense software
and some of their media organizations to, I think,
to sell software that was on the shelves too long.
After software sits on the shelf for about 150 days, the vendors return it,
and you have to give them their money back.
So you have to do something to create sales, so that's one way to do it.
And do you think that's what happened here?
Oh, I'm pretty sure of that.
If you listen to the media, you heard a couple organizations,
a national computer security something or another,
and another one was national virus something something,
announcing there would be millions of these things
and that virus defense software was the fastest-growing part of the industry,
which, of course, is a fiction.
So when you have people creating a fiction and the media picks up on it,
not knowing the difference between the fiction and the reality,
then they make a lot of sales and almost defraud the public.
Now, speaking of Michelangelo, I just saw this press release from a guy out in,
where is this, Australia?
Australia.
And he's claiming the credit for actually naming the virus the Michelangelo virus.
Now, that's a question that has been brought up a couple of times.
This is a boot sector virus.
There is no real file attached to it,
yet everyone's running around calling it the Michelangelo virus.
So where did they get that name for it?
Yes, it takes place on Michelangelo's birthday,
but was that the original intent of the virus?
I myself think that that's quite doubtful,
as there really wasn't much space in there for intent to be gotten across.
It was not the intent of the virus writer.
The guy that named it actually had a friend whose birthday was on March 6th,
and he was going to name it after his friend.
And his friend said, it's also Michelangelo's birthday.
So he said, okay, we'll call it the Michelangelo virus.
Well, is that just conjecture on your part?
No, I talked to the guy this afternoon who named it.
The guy who named it, but the guy who wrote it.
Oh, nobody knows who wrote it.
Right, okay.
Let me ask Mark Ludwig.
Do you have any idea who could have written this virus?
Could have been just about anybody, really.
You know, in writing my book, one thing I've found was
that computer viruses are really tremendously easy to write.
Anybody who knows a little assembly language and sits down and wants to do it, could do it.
Have you written one?
Yeah, there are four in my book.
Uh-huh.
You have written yourself?
Yes.
Now, when you've written these computer viruses,
how do you test them out to see if they will actually spread?
Well, I have a few computer systems of my own
that I test them on.
Uh-huh.
And they've never gotten out, have they?
Um, well, probably sold about 700 books now.
I'm sure they have.
Uh-huh.
No, I'm saying from your computer.
I haven't let them go, no.
Uh-huh.
Has it come close at any time?
I've not, too.
Any panics, thinking that maybe these things are about to spread?
Um, not really.
Uh-huh.
I've, uh, you know, I've tried to be real careful with them
and, uh, use, uh, red discs and stuff like that
rather than the black ones when I'm playing around with the viruses.
Right.
Now, how do you think a virus like Michelangelo,
let's say somebody writes a Michelangelo virus or the equivalent,
how do they get it to spread?
What do they do?
They just leave a floppy disc lying in an office and that's it?
Well, if I wanted to get it to spread, I'd take it down to a university.
Mm-hmm.
That's a great place for them to spread.
Lots of students who don't have a whole lot of money and like to copy software
and, uh, it's just a good place.
And how would you get them to copy that software?
Well, I'd just, uh, go into the computer science department
where they have some PCs sitting around and, uh, infect the hard disc.
And, uh, with the Michelangelo, then, anybody who puts a floppy disc in, in the drive
and, uh, copies something off or something like that
automatically gets the virus with it.
Very interesting.
Uh, as I mentioned, the, um, uh, the announcement from Australia
that, uh, uh, this gentleman named Roger Riordan, uh,
was actually the first person to call this the Michelangelo virus.
Um, he says,
In my talk last year, I mentioned we had found a new boot sector virus a few weeks before.
Uh, this overwrote the hard disc if you ran an infected PC on March 6th.
And as this was Michelangelo's birthday, we had named it Michelangelo.
Thus, you can claim that the first public announcement in the U.S.
of this now notorious virus was made at last year's conference.
If this is of any value for publicity purposes, feel free to use it.
And I'm sure it's very valuable for publicity purposes here.
And, uh, that's, uh, that's the story of Michelangelo.
In case all those people out there were curious as to how it got the name,
this is apparently where it came from, from Australia.
Does that make sense to you, Dr. Cohen?
Uh, yeah, that's clearly where that particular name came from.
Mm-hmm.
I don't think it's particularly interesting where the names came from, you know.
Well, it's something that the media doesn't seem to, uh, have a fix on
because, uh, we've been hearing all kinds of, of, of scary stories
about this virus that was set to go off on Michelangelo's birthday.
And that makes you think, well, that would mean it has to be somebody from Europe
and, you know, people have all kinds of, uh, assumptions.
That's a fiction.
There are well over 1,000 viruses now out in the world.
So on the average, any given day of the year,
there will be about three of them that will go off.
Mm-hmm.
So, so it's no particular indicator that it's March 6th.
There's one that goes off Friday the 13th.
That's a very common virus.
That's, uh, coming up in two days from now.
There's another one that goes off, uh, the 16th of March.
And, and almost any day you want to name.
What about the St. Patrick's Day virus?
Is that not coming up?
Uh, I'm sure that if you want to have one, it's easy to have one.
I just made it up.
But, uh, it's, uh, I, I think you're right about that.
That almost any day there'll be a virus of some sort.
Have you ever been a victim of one?
Uh, no.
I've never had a problem with viruses because I use, uh, very safe precautions.
I've, actually, the person that wrote, uh, the viruses in the first experiments
and did the first experiments on viruses.
So I'm very familiar with how you're, uh, how you'd be careful, et cetera.
Uh, and, uh, also a lot of people misunderstand that viruses are not just a PC phenomenon.
Our first experiments were on time-sharing systems, and, uh, we found you could take over
an average time-sharing system in under a half hour by launching a virus.
So it's not just a PC thing, but that's where people seem to notice the most today.
Now, you claim to be the person that coined the phrase originally, computer virus.
Uh, yeah, actually.
When was that?
1983.
Uh-huh.
And before that, there was no such thing?
Or nobody had a name for it?
There were self-replicating programs.
I, uh, came up with the term computer virus.
Actually, Len Adelman, who was a professor of mine at the University of Southern California,
I was a Ph.D. student there at the time, uh, came up with the word virus.
And so his, uh, name should be credited with the name computer virus.
Uh, but I'm the person that published the first scientific papers on it.
I, uh, figured out that these things could spread through our best military, uh, secure computer
systems and throughout the world and these sorts of things.
Uh-huh.
So, uh, and there were, sorry, there were viruses before this.
In fact, there was a, a famous, uh, worm program that ran at Xerox, uh, that was used
for parallel and distributed processing that, uh, there was a bit error somewhere in the worm
program and it brought down the whole Xerox worldwide network for a period of time.
Mark Ludwig, uh, what is your definition of computer virus and how would that, uh, um, compare
to, say, a worm, a Trojan horse, all these different phrases we hear bandied about?
Mark Ludwig, um, got the guy who, uh, coined the phrase right there.
Uh, I, I kind of consider a virus as something that attaches itself to another program with
the purpose of reproducing.
Um, a lot of people give it the, uh, added connotation of being something that's destructive,
but, uh, the destructive nature is, uh, is not necessarily, is not necessary for a program
to be a computer virus.
Mm-hmm.
Now, do you have any, um, instances of a computer virus that's not destructive?
Well, the, the four viruses in my book are, are not intended to be destructive, certainly.
Um, they don't have any code in them that's, you know, designed to destroy a hard drive
or anything like that.
Uh, their sole purpose is to reproduce.
Um, there are, you know, a fair number of viruses out there which are not destructive.
They're called benign viruses.
Well, apart from being non-destructive, are there any that are beneficial?
Is it possible for a virus to be beneficial?
Well, um, I think that's kind of a subject of debate right now.
Uh, you know, all the press they get is, is that they're, they're destructive.
Um, kind of, trying to look at them in terms of what they might benefit science.
Uh, you know, they might not benefit the average guy on the street who has one on his system,
but, uh, they might be very beneficial in terms of, uh, what can we learn about life?
What can we learn about, uh, subjects like evolution through computer viruses?
Um, one very interesting thing about them is that, uh, unlike a living organism, which,
you know, we can't create in a laboratory right now, we can, we can devise all kinds of computer
viruses and control them very carefully.
So I think there's some interesting possibilities there.
I'd like to, uh, to read you something on, uh, benevolent computer viruses.
We'll get back to the definitions in a moment.
Um, advanced systems protection released.
Today, I assume it's today, uh, because that's when I was handed this piece of paper.
Uh, the first widely available commercial application for, of, uh, benevolent computer
viruses.
Payback is an automated bill collection system that uses benevolent computer viruses to automate
the bill collection process.
For each unpaid bill, payback births a tiny expert bill collection virus from a virus gene
pool.
Each virus individually replicates and evolves reacting to the specifics of the individual collection
case and responding individually.
Unlike malicious computer viruses, paybacks viruses are very safe.
Safety is maintained in payback through the use of a special viral computing environment
designed so that paybacks viruses can only operate on machines where that environment is
installed.
This makes payback completely safe from the undesired side effect of malicious viruses that
spread to machines where they are not desired.
Fred Cohen, any, uh, comment on, on this particular benevolent computer virus?
Yeah, and, in fact, from the beginning of computer virus research, we knew that there were benevolent
applications.
The, uh, the initial research results showed that anything that you can do with computing
on a computer, you can do through evolution of computer viruses.
The only issue, then, is what's the more efficient way to do things?
So with computer viruses, we have some advantages.
For example, in a distributed system, viruses distribute themselves throughout a network without
anybody having to explicitly tell them where to go.
If a machine has more time, more viruses can live on that machine.
So there are some big advantages to using viruses, but, of course, there's a big disadvantage
in the potential safety hazards.
So you have to find a safe way to implement it.
But otherwise, it's a perfectly reasonable way to perform computing.
Also, I should point out that in the first paper on this, in 1984, there was a compression
virus that was intended to spread throughout a computer system, compressing executable files and
decompressing them at execution time.
This would save approximately 50% of the disk space on typical computer systems in exchange
for a small increased time to start running them.
I see.
Now, just to finish off with the definitions we started with, Trojan horse, anybody want
that one?
A program that does something that's not documented.
Okay.
And a worm?
A worm is a special case of a computer virus.
It's commonly now defined as a program that replicates and then runs the replica after
replication.
As opposed to a virus, which...
It can run or not run the virus replica after replication.
Most computer viruses today don't automatically run the replica.
Rather, if somebody runs the program containing the replica, then it continues to grow.
So the sole purpose of a virus is to replicate?
Replicate and evolve are the properties that make something a virus, but it doesn't necessarily
have to be the sole purpose.
A virus can include any additional code with it, and that code is brought along during
the replication process.
So it's a very convenient way to distribute processing across a network, for example.
Okay.
Mark Ludwig, are you in agreement here?
Any major differences in terms?
Yeah.
I might just say that a Trojan horse is really a program that does something that's not documented
intentionally, as opposed to a buggy program.
Okay.
It's like in Troy, right?
Yeah.
Okay.
Now, recently we heard something else in the media about the Gulf War printer virus.
Now, it sounds almost absurd that through a printer, a virus could be set loose to do all
kinds of things in time of war to cause military problems for the enemy.
What, I'll give this to Fred Cohen first, what do you think that actually was?
Is it just propaganda we're being fed, or is it possible to actually set a virus loose
to a printer?
Well, you asked a couple of questions there.
One of them is the U.S. military does do research, funded research, on the potential use
of computer viruses as a military weapon, both against us and against our enemies.
In addition, it is possible to write a computer virus that will start at a printer on many of
today's printers and networks, and the reason is printers today are not like printers of
the past.
Printers of today now have network connections and can send packets over networks, and they're
used in a lot of different ways.
So it's possible.
The third part of your question was, do I think it really happened in the Gulf War?
And the answer is, I doubt it.
Mark Ludwig, your interpretation.
Yeah, I, you know, I think it's a pretty far-fetched thing.
Uh-huh.
You know, it's possible.
There are a lot of things that are possible, but to get the virus in there, to get it to
do what it supposedly did, and at just the right time, seems like a very difficult proposition.
You'd have to know as much as the NSA or something to do that.
Well, no, that's something that I was mulling over myself.
If such a thing were possible, why would they take such pains to tell us that it was possible?
Wouldn't that be sort of self-defeating for any future such application?
And then that leads me to ask, well, then, what is this all about?
I guess nobody really knows.
Okay.
Now, for those people out there, listeners that are living in fear now with their computers
that we convinced them to get years ago, now they have them, and now they think that any
day now something horrible is going to happen, apart from just telling everybody to back things
up, what should we be passing along?
What bits of wisdom and what kind of care can they be taking to avoid tragedy?
Fred?
Well, I'll go back to the United States government.
The U.S. government has this strange policy of protecting secrecy, and they've pushed this
so hard into our society and pushed so hard against maintaining integrity in our computer
systems that our computer systems simply don't have anything to maintain integrity.
So there is a problem, and the problem is that we haven't pursued integrity in computer
systems the way we should have.
There are a lot of products on the market now that are reasonably effective against current
and many future viruses, but if you hear somebody say, my product will protect you against
all current and future viruses, you should not buy their product because they're not telling
you the truth.
Okay.
Mark Ludwig, your comments.
Well, that's true what Fred said.
I think you really set it back up.
You know, anybody who had the Michelangelo virus on their system and backed up Thursday night
would at most have an interesting morning the next morning.
Do either of you know anybody that was affected by Michelangelo?
I disinfected the system on Thursday before it went off.
The worldwide reporting is that approximately four-tenths of one percent of the computers
worldwide that tested for it had it.
However, that's somewhat speculation because approximately that percentage of all the computers
in the world on any given day will have a disk failure that does about the same thing
as the Michelangelo virus anyway.
Well, now, I assume by that you mean that four-tenths of all PCs that were tested for it,
or do you mean four-tenths of all computers because a lot of computers are not PCs?
Well, it turns out that well over 90 percent of all the computers are PCs,
so the numbers wouldn't be very different.
But, yes, we're talking about PCs.
Okay.
All right.
Now, we'd like to invite our listeners to give us a call, and if they have any questions.
We'd also like to know who's been affected by Michelangelo.
We'd like to know if people actually had their hard drives trashed,
if there are any listeners out there that felt the wrath of this kind of thing.
And also, we'd like to know what you did.
Did you not turn your computer on on Friday?
And those of you that don't have computers, feel free to call us, too,
and let us know how your particular perspective on all this has changed.
What do you think?
Do you think we're all mad for living with computers and dealing with this kind of thing?
Do you think it's going to get worse in the future?
And we have with us Mark Ludwig from Arizona, who has written a book,
The Little Black Book of Computer Viruses.
It's available on American Eagle Publications.
Their address is P.O. Box 41401, Tucson, Arizona, zip code 85717.
Mark, I believe there's a phone number, too.
People can order it by.
Is that correct?
If they'll just send 1495 to that address, that's the best way to do it.
Okay.
And we also have Dr. Frederick Cohen in the studio with us.
He's written, I imagine you've written more than one book, is that correct?
A number of them, yeah.
All right.
We have here a short course on computer viruses, which is available on ASP Press.
And how can people get a hold of this?
You can call 412-422-4134.
Okay.
Well, she's in Pittsburgh, is it, huh?
Yes, it is.
Okay.
All right.
Our phone lines are open to you, our listeners, 212-279-3400.
If you want to ask either of these experts a question on computer viruses or just lend
your particular observations to this discussion.
Good evening.
You're on the air.
Hi.
I've got basically two questions.
One is, what do your guests feel or know about the psychology of the people who write
these destructive viruses?
What does it, is it just ordinary vandalism or does it go deeper than that or, you know,
that kind of question?
And the other thing has to do with, as I understand it, all the antiviral programs are based on
some kind of pattern recognition of existing viruses and similar viruses in the future.
But does anybody know of or have any plans to create kind of an intelligent antiviral program
that would be based on understanding a kind of what you want the computer to do and defeating
anything that prevents that from happening, like the human immune system, that kind of
thing?
Is that possible?
A couple of questions you asked.
First of all, who writes them?
It's typically not the people that you'll hear in the media, the so-called hackers.
They do not tend to write these things because it's a very different sort of thing than what
most hackers tend to do, if you believe that the term hacker is a good term.
In terms of more generic defenses, there are much better defenses than the ones that you're
talking about.
What you really see is that the companies that are selling the most defenses are selling
virus-specific defenses, but there are another class of defenses called integrity shells that
have been proven mathematically to be optimal, and there are a number of products on the
market that offer this much better protection that's much more long-term.
When you say integrity shell, is that along the lines that I just drew, sort of like an
intelligent program that recognizes how the computer is supposed to work as sort of a homeostasis
and then will defeat anything that upsets that?
Well, the integrity shell technique examines the information when it's installed, and
then whenever anything changes in the computer system, it identifies that change, and based
on automated decision-making that you dictate to it, it might automatically recover from
online backups, refuse to run the program, attempt a virus-specific cure, et cetera.
But if you install something that's botched in the first place, it's not going to know the
difference?
That's true.
On the other hand, the virus will not be able to spread successfully, because as soon as
it takes one step of infection, it'll be detected and tracked down immediately.
So the integrity shells have the property that they detect all primary infection and prevent
all secondary infection, which in effect prevents viruses from spreading very far.
I would just admit that I feel, even though I don't even own a computer, I'm thinking about
buying one, and hearing all this stuff about viruses really puts me off, because you think,
well, here's a realm in which logic and intelligence and all these good qualities of human nature
can finally come to dominate.
And even in this realm of computers and data processing, the kind of downright evil, destructive
nature emerges.
And you've got this just like, you know, I put it down to petty, nasty vandalism coming from
sick people, and it's very sad that as systems become more and more complex and more and
more interactive, that complexity and interactivity is going to be defeated.
We have to have our guard up, even in this blossoming technology.
I think it's sad.
Let me ask the listener the question, then.
What kind of person do you think wrote this virus, or writes viruses in general?
Do you think it's a person?
Do you think it's a bunch of people?
I think it's most, more often than not, my instincts would say it's an individual person
rather than a group of people, because it's harder for a group of people to conspire in
such a sick way.
I think it's more likely an individual person is probably very smart and may feel frustrated
by some unfairness or injustice or suffering in their life, and they just want to basically,
you know, lash out.
It's the same kind of reason people do vandalism in general.
You know, it's a negative emotional reaction that takes the form in the existing world
of a destructive act, and it just seems that, again, I say it's sad because in this realm
of computers, the technology is so potentially good and constructive and life-affirming in
the long run, but even this sort of new horizon for human activity has become polluted with
the, you know, with this crap.
But I guess we just have to, like I said earlier, and as you said, you know, deal with that by
designing some kind of a computer immune system.
Let me ask our other resident expert, Mark Ludwig.
Do you agree with that assessment?
Well, I mean, I think there are a number of possibilities, you know, as to who wrote it and why.
It's really hard to assess, you know, not knowing who it is.
You know, it might have been somebody who was just ticked off.
It might, you know, whether they're ticked off at The World or they were ticked off at
one individual employer or something like that, you know, you just don't know.
So the results could wind up killing somebody, let's say a hospital or a doctor's office where
data is precious, you know, some patient's information gets botched up or missing and
precious time is lost for a heart transplant.
I mean, there's all kinds of scenarios that could be not just disastrous in terms of
but killing people, and that's pretty bad.
Well, technology is a two-edged sword.
You have to also realize that there are computer systems out there that are used effectively
to track people and perhaps even to kill them through one method or another.
For example, there are countries in the world that track the entire history of everybody
in their population and down to where if they get mad at somebody, they'll go and arrest
everybody in their family line.
So in that circumstance, if a virus got in there, destroyed all that data, you would
think it was saving human lives.
So I think you have to take things as two-sided and consider the ramifications of what you do.
And if such a scenario does not exist already, certainly a scenario like that, given today's
technology, would not be too far in the future.
I think, though, countries like Myanmar, Suriname, places like that, where people numbers are
becoming a...
Yeah, in fact, the UN committee, I believe, gave an award for the best use of new technology
to a country that did this.
I think it was some people in one of the computer societies that said that that particular
country should win an award for having the best database of all their citizens.
Well, that's something to be proud of, I guess.
Let's take another phone call.
Good evening.
You're on the air.
Oh, good evening.
I have a couple questions about viruses.
One, has there been any studies where people have, or not people, but computer professionals
have sat down and looked at, like, the level of generation of the program language to determine,
you know, what kind of viruses are being written for that, whether or not they're being written
at, like, the machine-level language or some other higher-level language?
You're asking what languages are the most popular?
No, which level, as far as, like, you know, like, generation of languages are being attacked
by these viruses?
Well, the viruses will attack essentially any program.
They tend to be written in assembly language more often than other languages, but there
are, for example, viruses written in the macro language used by D-Base, so they actually
spread from database file to database file.
So if they're written in assembly...
So if they're written in assembly...
No, no, no, not written in assembly, written in the D-Base macro language.
Okay.
So if they're written in a D-Base macro level, which generation of languages would that be?
Well, I don't know how you classify generations.
I think most people would say that that's a third-generation language.
Okay.
What about issues of robustness as far as how viruses affect the robustness of a system?
Have there been any studies based upon that?
Not that I know of.
Okay.
How about different platforms for computers?
Have there been any studies on that as far as which platforms?
Because there seems to be a lot on the PC end, but what about some of the other platforms?
There have been viruses on essentially every computer platform that I'm aware of.
Now, remember, over 90% of all the computers in the world are PCs.
Also, PCs are inexpensive and therefore widely accessible, so you would expect that 90 or
so percent of all the viruses would be PC viruses, and that's about right.
Now, when you say 90% of all computers are PCs, you're talking about MS-DOS computers, PC compatibles?
Yeah, IBM-type PCs.
Are you talking about on the personal level?
No, no, it's worldwide sales of computers.
90% are PCs, maybe 8% are Macintosh, and the rest are everything else.
And workstations are now getting to be a larger percentage of sales, but there are a couple
hundred million computers in the world, and almost all of them are PCs.
Are you counting mainframes?
What kind of data structures or algorithms are we talking about when people, not people,
but when someone has created a virus, what kind of data structures and algorithms?
Can you speak on those?
The smallest virus we know of is approximately eight characters written in the command language
of Unix.
Worldwide containing copies of computer viruses, so we don't need to put them in our defense
products to get them out there.
They're out there anyway.
In terms of the defense products protecting themselves, most of the better defense products
have methods to detect whether they have been corrupted, and if they have been corrupted,
then either they will identify it or attempt to automatically correct it.
Now, none of these mechanisms are perfect.
There is no perfect defense against computer viruses except absolute isolationism.
That is not getting any information from anywhere.
On the other hand, if you were completely isolationist, you couldn't put any programs in your computer,
and it wouldn't be very useful.
Yeah.
I'd like to also just, someone mentioned about Michelangelo, and I was just agreeing with
him that I had the same suspicion that it must have been someone in maybe some software
company that had put this into play, because I know there are a lot of viruses, yet I've
never heard a virus covered so much by the mainstream media as this was.
And why do you suppose the media harped on it so much?
Another aspect to that, it was covered a lot, and it was also covered well in advance of
the actual date to give people plenty of time to go out and buy antiviral software.
And a lot of people did, and a lot of software companies made quite a bit of money off this.
So, you know, you have to ask yourself who benefited.
Right.
Mark, any comments on that?
Well, that's true.
You know, I would hate to think that somebody did that.
On the other hand, I've talked to several people who, you know, work in this field, and some
of them have been totally ticked off at me, wanted to have me arrested for writing the
book.
Some of them have said, oh, that's great.
You know, we'll sell more software, and you can sell more books.
So, you know, there are a wide variety of attitudes out there, and it's certainly not
beyond the realm of possibility that somebody writing the viral software could have done
this.
Now, on the back of your book, there's a warning.
It says, this book contains complete source code for live computer viruses, which could
be extremely dangerous in the hands of incompetent persons.
You can be held legally liable for the misuse of these viruses, even if such misuse is unintentional.
Do not attempt to execute any of the code in this book, unless you are well-versed in
systems programming for personal computers, and you are working on a carefully controlled
and isolated computer system.
Do you have any guilt pangs, thinking that maybe somebody might try to compile something,
and it'll get out, and it'll all be your fault?
Well, the viruses in the book are benign, so hopefully they won't cause too much damage.
You know, there could be the system that they're not compatible with, or something like that,
where they could crash it.
But, you know, I really think that this country was founded on the principles of freedom and
responsibility that go hand in hand.
When you say benign, they do replicate into systems without permission, and a lot of people
would claim that that feature alone makes it malicious.
That is, the fact that it comes into my system without my permission makes it malicious as
far as I'm concerned.
So that is a case for saying that there is no such thing as a benign virus, at least if
it's designed to operate in the environment that's commonly available.
Right.
Oh, that's true.
I won't apologize for it.
Can I ask you a question?
Yeah.
Why did you provide source code for workable viruses instead of taking the tactic that
I and many other researchers have taken to write pseudocode so that people can understand
how it works without giving instant access to potential damage?
Well, I mean, I think that, you know, I've read some of these books that give pseudocode,
and it's nice, but as a programmer myself, you know, you can only come to a certain level
of understanding with that.
You've really got to be able to explore it personally.
Okay, let's take another phone call.
Good evening.
Hello, Eric, John.
A couple of things to come up tonight.
First, you mentioning people having remote, having databases all over the world in these
countries.
That was brought out in the inslaught stories that we have put out to the country's products
that they can keep track of their citizens.
Second point, on defining who writes viruses, we're oversimplifying.
We know there are people that have written viruses just to see how to do it, to see if
they could get it out there.
They're not necessarily malicious, perhaps irresponsible, but I think it's overstating to say that they're
have a chip on their shoulder and they're out to be vandals.
You think it's just an experiment that might have gone wrong?
Yeah.
I think irresponsible in some cases is better than vandal.
Third thing, we talked about the press overreacting to Michelangelo.
There was also a whole bunch of misinformation that this show and the computer show last week
tried to get rid of.
But even on the day that the virus hit, like it was published in any place that if you had Macintosh,
you had nothing to worry about.
Well, in fact, some folks with Macintosh that were running soft PC did get hit because they
got hit on the PC side.
And no one had ever thought that step through and said, well, how about this?
Also, of course, people running OS2 and in some cases Unix on Intel-type machines could have
gotten hit and did get hit at times.
So I think we made a big deal of the Michelangelo virus, but we also put out some misinformation.
And have you mentioned the virus conference that Fred and you are going to be at?
Yeah, we'll give the information for that at the end of the program as far as exactly
where it's taking place and how people can get involved and that kind of thing.
So any further questions for our guests here?
No, I'll see you tomorrow.
Okay.
Okay.
Thanks for calling.
Good.
And our phone number is 212-279-3400.
I'd like to ask both of you a question concerning the publishing of code because, as we mentioned
last week on this program, that we are planning in 2600 to publish the code for the Michelangelo
virus.
And, of course, a lot of people don't think that's a good idea.
A lot of people think it's something that deserves to be seen by the general public.
Let me ask both of you, if a computer can be completely compromised by a page or two
of text, is there something fundamentally wrong with the way the computer is designed?
Fred, why don't you go first?
Well, it turns out that any computer system that allows sharing and general-purpose programming
is capable of being attacked by a computer virus.
It's just the nature of the beast.
So, but another issue that you bring up is whether it's reasonable to publish the code
of this particular virus.
I have very mixed feelings on it.
On one side, I believe that anybody who seriously wanted to get a copy of it could get one without
much problem.
And, in fact, anybody who wanted to write one of their own could probably write one without
much problem.
It's not a very complex virus.
So I'm not particularly worried about a great hazard from you publishing a copy of this.
On the other hand, there are certainly some people out in the world that perhaps would
modify it to have a different date on it, and maybe if there are 364 of them, then we'll
have one that goes off on every day of every year everywhere, and that may not be too friendly.
Well, what do you think would happen if such viruses started running rampant?
What would happen?
What would people do to defend themselves against that?
Well, you know, if you go to a different sort of software, instead of going to the software
that looks for specific known viruses, of which there are well over 1,000 now, and there
will probably be 2,000 by the end of this year, if you go to a more generic defense, there
are defenses that have been out in the market since about 86.
And, in fact, one of the defenses that's been out in the market since 86 would have successfully
defended against the Michelangelo virus without any difficulty at all.
So there are different sorts of defenses than the ones that we're going after right now that
are much more long-term sorts of solutions that I think are a better idea.
Mark Ludwig, do you think there's something fundamentally wrong with today's personal
computers if they can be so easily attacked by viruses?
Well, I don't think so, because they can be so easily defended as well.
Like Fred said, there are good defense mechanisms out there.
People back up their computers.
Computer virus is not the kind of threat that will destroy years of your work.
It won't do any physical damage to your machine.
I have to take a small exception to what you're saying, that what you said is true of virtually
every virus that's out in the world today.
However, if you look in a little bit more depth, it's very straightforward to write a
virus that, for example, doesn't do any damage for 6 to 12 months.
Then it will be in all of your backups.
And so you do your backups diligently, and then you get destroyed, and you recover from backups,
and everything gets destroyed again.
And you go back two months, and it gets destroyed again.
And you go back three months, and it gets destroyed again.
Evolutionary viruses, if they were also caught in your backup system, you wouldn't be able
to detect them simply by looking at copies of the thing that did damage.
So there are certainly sorts of viruses that we haven't seen dominantly in the real world
yet, but that are feasible, that are much more disastrous, and that backups are completely
ineffective at defending against.
Do you think it's possible to write a virus that surreptitiously inundates itself among
your system and other systems, and have it develop to the point where if you were to
get rid of it, then your system would collapse?
A virus that you become dependent upon.
Let's say you put a virus in that encrypts files until you ask for them, and then it decrypts
them.
Now, were you to destroy that virus, you wouldn't be able to look at any of your files.
Has such a thing ever been tried?
Do you think it's even possible?
It has been done experimentally.
There are a wide variety of much more interesting viral attacks than the sorts that you've seen.
I say interesting.
You might call them very nasty.
For example, you can create a virus that weaves itself into the code of another program so that
it becomes such a vital part of that program that if you tried to take out the virus, the
program would collapse under it.
However, we do, for most programs, have original copies.
So even if you completely destroy the viability of the program, go back to the original copy
and you're relatively safe.
There are also these so-called encrypting viruses, for example, that could encrypt most
or all of the data that's on a disk, only decrypt it during execution, as you described, and
that would certainly be a more serious threat.
However, if you have reasonable integrity precautions on your system, not security, integrity precautions
on your system, this thing is extremely unlikely to occur.
Okay.
Let's go to another phone call.
Good evening.
You're on Off the Hook.
Yes.
Someone mentioned the fact that something had existed since 1986 to deal with viruses.
I was wondering, what exactly was that?
Fred, you mentioned that.
Yeah.
I'm here as a scientist, so I don't want to name product names, but there are products that
have been on the market since that time, and a couple of them are relatively well-known
companies.
Well, how is it possible that a product of five years ago would be able to look for something
that was only invented, say, last year?
How would it know to look?
Well, because the nature of the defenses in these products are relatively generic.
For example, some of the products will automatically recover memory to a previous known state of
memory and then start examining parts of the computer system.
If they happen to look at the partition table, which is the part of the system impacted by
this particular virus and check to see if it's changed, they'll notice that it's changed
and then presumably recover from an online backup.
This is now very commonplace.
So any sort of defense like this that's generic would have not only detected but automatically
corrected this virus the moment it entered your computer and prevented it from spreading
further.
Mark Ludwig, do you agree with that?
Yeah.
Okay.
Let's go to another phone call.
Thanks for that particular call.
Good evening.
You're on the air.
Are you there?
Yes.
Go ahead.
Uh, yes.
Uh, hi, Art.
This is me, Art.
Uh, do you remember me?
No, I can't say that I do.
Good evening, you're on...
No, I can't say that I do.
Uh, we don't want to hear that again.
Please, uh, take the phone away from the radio and begin speaking now.
Yes, I'd like to have you read the book Madame Curie that was published in the 1920s or 30s
and tells that Madame Curie won two Nobel Prizes, died of radiation poison, and she invented
x-rays.
So remember, I have proof.
Okay.
Well, thanks very much for...
Uh, it must be something about those lower phone numbers down there.
We always get the strange people there.
Uh, good evening.
You're on the air, and you're at the very top, so you must be normal.
Okay.
I find that, uh, it's kind of hard for your guests to speak about a virus.
I mean, as far as me believing them, as far as the virus being benign, I have mixed feelings
because they said they haven't done any serious studies in relationship to robustness.
I have problems with that.
Also, um, can you...
It sounds like you were on before.
Were you on before?
And also, can you all comment or give out any heuristics that someone may want to use
as far as, uh, discovering and handling viruses?
Okay, I'll let either one of our guests, uh, take that one.
Uh, Mark, how about you?
You want a shot at that?
Uh, as far as discovering and handling viruses, like what?
What do you want to...
Well, actually, our caller has left us, but, uh...
There's a well-known consultant in the New York area named John David who says if you get
hit by a computer virus, you should turn off your computer and call an expert.
And for that particular caller, I think that would be appropriate.
It seems like, uh, the defense, though, is probably very simple.
Regardless of what kind of computer system that you have,
if you keep backups, I mean, is there any way that keeping backups can, can hurt you?
Except that it takes time to take the backups.
But once you get into the habit of doing it, uh, it's, it becomes something that you do maybe
once a week?
It's much better than that.
Many networks now have automated systems for performing backups, so they'll regularly perform
a backup to the file server, and then from the file server it gets put on a tape.
Well, those are networks.
What about personal computers?
Oh, you have to go to those, uh, sick backup programs with the floppy disks.
And if you use the one that comes with DOS, you're in big trouble.
That one takes forever.
Uh, and you have to pre-format the disks.
You don't know how many disks you have to pre-format.
And God forbid you, you miss by one.
Yes, you get to the 89th disk, and you find out you needed 90, and you only had 89 ready.
Okay, that's, that's, that's incredible.
Uh, Mark, any, um, any advice for people with, uh, personal computers?
Should they back up once a week, or, uh, or how often?
Well, the way I, the way I advise people is you decide how much you can afford to lose.
If you can afford to lose a week's worth of work and not be really upset about it, then
back up once a week.
If you can afford to lose a day's worth of work, then back up once a day.
Okay, 212-279-3400, good evening, you're on the air.
Yeah, uh, reminds me of a story of a, an auto glass place that used to go out at night and
break windows.
Hmm.
Which came first, the, uh, the virus or the, or the, uh, the answer to it?
When, when did we first discover this Michelangelo virus?
Did we hear about it in advance by people who, uh, kind of supplied us with the answer to it?
Is that what's going on?
It was discovered about a year and a quarter ago in, uh, Australia by, uh, I believe Mr.
Reardon is, is his name, uh, Dr. Reardon, one time a professor at a university in Australia
who went into the virus defense industry.
And, uh, we've known about it for some time, and it's a minor variation on another virus
that's been around for a number of years beyond that.
And what virus is that?
Uh, the stone virus, which, uh, people believe originated in New Zealand and, uh, puts a
marijuana leaf on the screen and says legalized marijuana, which may, uh, account for its
great ability to spread.
I know there's no way to prove that, uh, someone is doing this for profit, but it just seems
like someone created a market, you know?
Well, it's, it's certainly not inconceivable.
Thanks for calling.
And, uh, again, our telephone number is 212-279-3400.
Good evening.
You're on the air.
Hi.
Well, to follow up to the last caller, uh, you think it was just the antiviral software
people who were responsible for all the hype about Michelangelo?
Mark, could it be a deeper conspiracy by a government who wants to make its citizens, uh, less tolerant
of so-called hackers?
Well, there could be, uh, all kinds of, uh, of, of possibilities.
Mark, what's your personal opinion?
Well, I, I mean, it might have been, uh, you know, somebody in, in, uh, you know, the
antiviral industry who started it.
I really questioned whether, uh, whether it was somebody like that who was really responsible
for all the media hype.
Um, I don't, I don't know why you were-
If you think about it, the whole, the whole concept of some computer virus in an office
gobbling up data on machines is just so bizarre and, uh, so foreign to most people that, uh,
it makes a good news story.
Oh, it makes a great news story.
All the, uh, all the media outlets were full of it, uh, in more ways than one over the last
week.
Yeah, I mean, it's, it's just a natural form.
They gobble it up.
Yeah, but I don't know why anybody would think it was a conspiracy.
I mean, maybe 10 years from now, you'll hear it as one of the great marketing ploys of
all time.
Yeah.
Uh, you know, I don't, I don't see it as a conspiracy, really.
Mm-hmm.
Now, uh-
I think the antiviral people have that much clout with the media.
Uh-huh.
Well, I don't think it takes too much to fool them, to, to get them to, uh, to do your work
for you.
Uh, but then again, that's something that's, that's open to conjecture.
Can you give us an idea of, um, of what we have ahead of us?
We've got the Friday the 13th virus, we've got the Ides of March.
What are those viruses supposed to do?
Where, where do they come from?
Mark?
Uh, they're all kinds.
Uh-huh.
Do you know those two in particular?
Yeah.
Um, the Friday the 13th virus.
Uh, I'm, I'm really not familiar with, with some of those.
Mm-hmm.
As to what they do.
I know, for example, that Jerusalem goes off on Friday the 13th.
Um.
Uh-huh.
And what does the Jerusalem virus do?
It trashes, I believe it trashes out EXE files on your system.
Executable files.
Yeah.
Okay.
Um.
All right, Fred, do you have, uh, do you agree with that?
That's about right.
Okay.
You know, I think about the Ides of March, uh, virus, which is, uh.
Uh, well.
So for Sunday.
Well, first of all, when you talk about particular viruses, uh, you're giving names to viruses
that actually represent, uh, maybe 30 or 40 different variants each.
Mm-hmm.
The Jerusalem, the first copy of the Jerusalem actually, we think, came from Jerusalem.
It was, came out at Hebrew University, I believe it was 1988.
It became widespread.
At that time, it apparently moved into the Mossad, and then from the Mossad, which is the
Israeli Secret Service, into the U.S. Secret Service, turned from there into other places.
It showed up that year on IBM bulletin boards and impacted a fairly substantial number of
systems.
Uh, it was, uh, detected and disinfected, uh, in large part because of the efforts of the,
uh, researchers at Hebrew University at that time.
But because it spread far enough, then there were maybe several, 20, 30 different people
that made variations on it, changing dates, adding extra features, uh, improving, in quotes,
upon that virus.
Okay.
Uh, we're out of time.
I want to thank those people for, uh, for calling in and giving us, uh, their questions
and feedback.
Uh, I've been speaking to Mark Ludwig, author of A Little Black Book of Computer Viruses,
and Dr. Fred Cohen, uh, who is, uh, a virus expert and has also written many books on,
uh, on such things.
I'd like to give both of you the opportunity to, uh, tell people how they can get more
information from you.
Uh, Mark, why don't you tell us how people can get a hold of, uh, A Little Black Book
of Computer Viruses?
You can get The Little Black Book of Computer Viruses from American Eagle Publications at
Post Office Box 41401, that's in Tucson, Arizona, 85717, and it's $14.95 postpaid.
Okay.
And, Fred, how about, uh, how about your particular book and...
Dial 412-422-4134.
And what is that number?
That goes to...
ASP.
Okay.
The publisher of, uh, Short Course on Computer Viruses.
All right.
And that's, uh, going to just about do it for us here today.
This has been Emmanuel Goldstein.
The program has been off the hook.
We'll be back again, uh, next week with, uh, with a scandal.
Yes, we've got a special scandal to, uh, to unfold for everybody.
And, uh, those of you interested in, uh, computer viruses might be interested in the
Fifth International Computer Virus and Security Conference taking place, uh, tomorrow and Friday
at the New York Marriott Marquis and Summit.
And I believe, uh, this phone number here is the right number to get a hold of.
800-835-2246.
That's the number to call anybody interested in, uh, that particular conference.
Thanks again for listening.
Stay tuned for the Personal Computer Show here on WBAI, New York.
Oh, I cut myself while shaving.
Now I can't make a call.
It couldn't get much worse.
But if they could, they would.
Bum, diddly, bum, but the best, it's back the worst.
I hope that's understood.
Bum, diddly, bum!
Bum, dodly, bum!
Bum, dodly, bum!
Bum, dodly, bum!
Bum, dodly, bum!
Bum, dodly, bum!
Bum, dodly, bum!
Bum.
Be sure it's true when you say
I love you
It's a sin to...