Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Historically important articles about malware defense

• Retro-viruses - how viruses fight back
• Dark Side of the Moon What Motivates Virus Writers
• Establishing Ethics in the Computer Virus Arena
• Polymorphic Viruses -- Implementation, Detection, and Protection Prepared by Tarkan Yetiser (tyetiser@umbc5.umbc.edu)
• The Bulgarian and Soviet Virus Factories (several mirrors exists, for example, The Bulgarian and Soviet Virus Factories) -- a paper about Bulgarian virus factories by Vesselin Bontchev (as it's now clear the author was wrong -- the hysteria about Bulgarian virus writers was pretty much a marketing trick).  It's now nice to read his analyses of the time socialism was essentially dead and when almost nobody have PC at home. The article was written around 1992, after the first USSR anti-virus conference which he attended and partially based on discussions at this conference. It's clear from the text of the article that author at this time never heard about GNU and that really decent programmers with free time contributed to GNU instead of writing viruses -- writing viruses is too primitive task for a good programmer  :-)

Computer viruses are created in all parts of the world, not only in Bulgaria. However, the portion of them that are created in our country is extremely high. Therefore, in the whole world there exist preconditions that make virus writing tempting, but in Bulgaria there exist specific conditions as well. ...The first, and most important of all is the existence of a huge army of young and extremely qualified people, computer wizards, that are not actively involved in the economic life. ... In fact, computers and planned economics are quite incompatible --- computers help you to produce more in less time and with less effort and money, while the goal of a manager in a planned economics is to fulfil the plan exactly as it is given --- for no more and no less time, and with no more and no less money. However, the communist party leaders in Bulgaria decided that we should computerize --- mainly to be able to supply computers to the Soviet Union and circumvent the embargo. ... Instead of producing our own software and to try to sell it in the West, we began to steal Western computer programs, to change some copyright notices in them, and to re--sell them (mainly in Bulgaria, in the Soviet Union, and in the other countries of the former Eastern block). ... Instead of training our skilled people in writing their own programs, we began to train them to break copy protection schemes. And they achieved great success in this field. The Bulgarian hackers are maybe the best in cracking copy protected programs. Besides, they had no real hope in making and selling their own programs, since, due to the total lack of copyright law on computer software, it was impossible to sell more than two or three examples of a computer program in Bulgaria. The rest were copied. Since the introduction of computers in the Bulgarian offices was not a natural process, but due to an administrative order, very often these computers were not used --- they were only considered as an object of prestige. Very often on the desk of a company director, near the phone, stood a personal computer. The director himself almost never used the computer --- however sometimes his/her children came to the office to use it --- to play games or to investigate its internals. While the price of personal computers in Bulgaria was too high to permit a private person to have his/her own computer, it was a common practice to use the computer at the office for personal reasons. At the same time, the computer education was very widely introduced in Bulgaria. Everyone was educated in this field --- from children in the kindergartens to old teachers that had just a few years until pension. Since this kind of science is better comprehended by younger brains, it is no wonder that the people, who became most skilled in this field, were very young. Very young and not morally grown--up. We spent a lot of effort teaching these people how to program, but forgot to educate them in computer ethics. Besides, the lack of respect to the others' work is a common problem in the socialist societies. The second main reason is the wide--spread practice of software pirating (which was, in fact, a kind of state policy) and the very low payment of the average programmers. Since all kinds of programs (from games to desktop publishing systems) were copied very often, this greatly helped for the spread of computer viruses. At the same time, the work of the average programmer was evaluated very low --- there were almost no chances to sell his/her software products. Even now, a programmer in Bulgaria is paid 100 to 120 times less than the programmer with the same qualification in the USA. This caused several young people to become embittered against the society that was unable to evaluate them as it should. There is only one step in the transformation of these young people into creators of destructive viruses. Some of them (e.g., the Dark Avenger) took this step. The next reason is the very weak organization of the fight against computer viruses in Bulgaria. Just now our country is in a very deep economical crisis. We lack funds for everything, including such basic goods as food and gasoline. At the same time, the organization of the virus fight would require money --- for the establishment of a network of virus test centers that collect and investigate computer viruses, centers equipped with the best hardware, centers that are able to communicate between themselves and with the other similar centers in the world in an effective way. Such an effective way is the electronic mail system --- and Bulgaria still does its first steps in global computer communications. All this requires a lot of money --- money that our government just does not have now. ...However, this is not a very important reason. Usually those, who have decided to make a virus already know how to do it, or, at least, can figure it out by themselves. They do not need to take an existing virus and to modify it. The proof is the prevalence of original Bulgarian viruses over the variants of known ones, as well as the fact, that many new ideas for virus writing were first invented and implemented in Bulgaria. ...It is often rumoured that the superpowers are working on the problem how to use computer viruses to destroy the enemy computers' software. It is even very probable, that in several countries such research is performed. There are reports on this from the USA, France and the USSR. ..The huge number of known Bulgarian viruses causes also indirect damage to the West community, even if the viruses themselves do not escape from Bulgaria, but only examples of them are supplied to the anti--virus researchers. These researchers have to develop anti--virus programs against these viruses (just in case the latter succeed to spread outside Bulgaria). Therefore, they have to waste their time and efforts. Furthermore, the user is forced to buy new anti--virus programs (or pay for updates of the old ones), in order to feel safe against these viruses.

• See also a pretty weak and paranoid article from Wired MEME 3.05
• ftp://ftp.uu.net/pub/security/virus/texts/viruses  -- a small collection of historical documents

Jimmy Kuo.  Director of AV Research at McAfee Associates.

• Jimmy Kuo: "Free Macro Anti-virus Techniques"   --  although employed by McAfee ;-), Jummy managed to write an interesting article about macro viruses from non-vendor perspective.
• That's Not a Virus! -- Again a very good article. Paradoxically McAfee was the best virus hype propagandist in the world and owns a large part of his fortune to it.

Vesselin Bontchev

• Possible Virus Attacks... And How To Prevent Them
• Future Trends in Virus Writing
• Analysis and Maintenance of a Clean Virus Library

Yisrael Radai

• Integrity Checking for Anti-Viral Purposes: Theory and Practice ZIPped PostScript

Sung Moo Yang

• Productivity Technology and AntiVirus Industry
• The Behavioral Solution
• The Behavior Cruise
• Wandering and Cruise
• Autonomous Mobile Cyber Weapon
• AMCW - A New Weapon for the New Millennium

Woody Leonard

• Macro Evolution -- weak article from rather knowledgeable  author (he wrote a decent book on VBA), but still much better than regular AV stuff.

Sarah Gordon

• Who Writes these #@^%$@#! Things? The Generic Virus Writer by Sarah Gordon (IBM Anti-Virus Online.)
• What happened to those virus authors? The Generic Virus Writer II, a follow up by Sarah Gordon (IBM Anti-Virus Online)

Bruce Sterling

• Sterling vs. Virus Writers -- a controversial article by a controversial (but definitely gifted) writer (I remember that he had written a complete nonsense about Russian virus writers in one of the early issues of  Wired magazine (1994, No.1 I think))