OT: Virus thing getting scary

peeplj · Post by **peeplj** » Sun Jul 28, 2002 8:09 am

Warning: long post, and possibly upsetting content, about the origins of computer viruses.

A lot of virus writers are youngsters who have a little computer talent and too much unsupervised time.

These are the kids who, had they been around 20 years ago, their parents would have gotten cable TV to act as a babysitter for their kids. The idea that you have to raise kids by spending time, lots of time with them, just never occurs to parents like that. Why? Well, their parents didn't spend much time with them either, did they? So they are doing what has caused so much tradegy through human existance: raising their children the way they themselves were raised.

But there wasn't much mischief you could really get into with cable TV. The Internet is different, and the "dark side" of Internet subculture is really going to appeal strongly to some kids. Some of these kids may also have the kind of brain that would make them a good programmer, and they start to find out and be fascinated by the kind of low-level information about how computers realy work which most of the rest of the world would pay money not to have to try to learn. And they think it would be neat to "leave their mark" on the systems they crack, so they write virus code--but these days just writing an "I'm here" virus doesn't get you much prestige in that culture, so they make it a little destructive and they make it capable of infecting other machines through email, or open shares, or mapped drives, or any one of a hundred other ways.

This is the "hacker" stereotype portrayed in the media, and I use the work "hacker" with revulsion, because that's just not what the word means, the proper term is "cracker."

More often though, the kid doesn't have any real programming experience or talent, they just order a "virus kit" online from the many dark alleys of the internet. These kits allow someone to produce different types of commonly found viruses in a simple, "point and click" way. These kids are known in the industry as "script kiddies."

These kids write the majority of viruses out there.

But then you have a virus like Klez, which by its complexity shows it wasn't written by any script-kiddie or at-home dark-side hobbyist. These are sometimes produced by foreign governments or their agents, or by independent groups within foreign nations, and are used as a means of annoyance and attack on both our country and also against the fact of the existance of the Internet itself. Most governments, including our own, really wish the Internet would just go away. Governments, including our own, have historically controlled their people via the information (and dis-information) they release to them. The Internet has made this traditional type of control seem impossible. I say "seem" because evidentally it still works pretty well in practice, thanks to the fact that most people are both gullible and "reasoning challenged."

The Klez virus is believed to have originated somewhere in Asia.

Whoever used the term "terrorist" earlier in the discussion may have been more accurate than you might credit at first glance, at least regarding the origins of some of the most novel and destructive viruses found "in the wild."

At work I encounter people of many different levels of experience with computers, everything from very talented programmers and analysts all the way down to nurses who they they that "rebooting" means to power cycle your monitor.

Those who are not internet-savvy think it's horrible when they find their teens have been looking at dirty pictures on the internet.

Those who are a little more aware of what kind of trouble a kid can really get into on the 'Net these days find their kids looking at lichen and think, "Whew! Thank God he's just looking at pictures of naked people!"

Best wishes,

--James
http://www.flutesite.com

[ This Message was edited by: peeplj on 2002-07-28 10:10 ]

Dewhistle · Post by **Dewhistle** » Sun Jul 28, 2002 10:35 am

On 2002-07-28 06:25, jim stone wrote:
What motivates people to invent
viruses?

Well, some of them might be young enough to think it's funny. Some viruses may be invented with a specific target by someone angry enough or heartless enough not to care who else they're hurting. I was going to disagree with blackhawk about his idea on it, but really, I suppose with terrorists anything is possible. He was speaking more generally, I believe, but it still could be.

Dewhistle · Post by **Dewhistle** » Sun Jul 28, 2002 10:37 am

Oops, didn't see your note, peeplj, I missed page 2.

What he said.

Post by **Dale** » Sun Jul 28, 2002 11:50 am

I really don't know whether or not I sent out any infected email, given what's been said about all of it. When I scanned for viruses, it showed one infected file. The person that gave me details about the infected file they received said it came from chiffandfippleowner@yahoogroups.com which is an email address that I don't actually use to send emails. (It's a long story). So, who knows.

Thanks for the notes on McAfee vs. Norton. I'll switch to McAfee!

Dale

jim stone · Post by **jim stone** » Sun Jul 28, 2002 11:10 pm

Thanks for the answers.
I've lived abroad quite a lot and certainly
there is widespread envy
of the USA, and I suppose that could motivate
people to try to screw up the internet.
And yes I remember what it was like
to be 14 and amoral--we just stole things then. I suppose it's more boys than girls.
'Virus kits,' eh? Sheesh!

Yes, it's paradoxical--because the internet
really is pretty subversive by nature.
If you wanted to screw us up
you would do better to leave it alone.
Thanks to all.

blackhawk · Post by **blackhawk** » Sun Jul 28, 2002 11:38 pm

On 2002-07-28 12:35, Dewhistle wrote:
I was going to disagree with blackhawk about his idea on it, but really, I suppose with terrorists anything is possible. He was speaking more generally, I believe, but it still could be.

I was speaking generally, but I read an article in Newsweek (I think) recently that was talking about where the terrorists will hit next and they were saying that one can kill with a computer as easily as with a gun or bomb. After thinking about it for a while, I realized they were right. What if hackers disabled the air traffic control computers at a New York or Los Angeles airport? There are many examples, and people who create viruses just enjoy destroying things. I doubt they care about human life.

peeplj · Post by **peeplj** » Mon Jul 29, 2002 9:36 am

There is very little chance a dedicated system like air traffic control computers would be Internet connected where it could be "hacked," and industry best-practice would serve well to keep such computers very well protected.

There are serious issues on other types of computer systems, though, which could have very serious consequences if they were compromised by being "hacked" or by being infected by a virus.

I think the idea of using a computer as a lethal weapon is right now still more media hype than grounded in reality, though. The real issues are the vast amounts of time and money lost by dealing with viruses and security issues.

Fortunately, nothing is ever quite as bad as the media makes it seem.

Best,

--James
http://www.flutesite.com

Martin Milner · Post by **Martin Milner** » Mon Jul 29, 2002 10:13 am

RE: Raising children, who was it who pointed out that you have to have a license to own a dog, but any moron can have a child?

Actually, I don't think you need a license in the UK anymore, so that's sorted that one out.

dakotamouse · Post by **dakotamouse** » Mon Jul 29, 2002 11:24 am

Thanks Peeplj,

I tried the free software you suggested. I ran it and came up clean. I got to thinking about and then decided to get the online McAffe virus service. I uninstalled the free software and ran the McAffe it found a virus called W32/Hybris plugin@MM. It deleted the files associated with it and so far things look OK.

Sometimes I wish I had two computers. One for work stuff and one for the internet and mail. I'd feel less vulnerable then.

ChrisA · Post by **ChrisA** » Mon Jul 29, 2002 3:29 pm

I have a friend who works for the department of transportation giving computer support for the Air Traffic Control software across the country; immediately after September 11th, they went in to work figuring that it would be an -easy- day... no flights means no support calls, after all... but actually, they spent the entire time over the next few days working their tails off on 'securing' the system.

The system was -never- connected to the internet, of course, and was connected only to other secure government nets. It is now not connected to -any- nets at all, or to any direct dial phone lines or ISDN lines; the only connections are direct-wire connections that make up the ATC network itself. This part has to be networked, of course, so that airports have each others traffic information and a flight can be followed across the country.

I believe that the takeoff-and-landing negotiations at each airport are, in turn, not connected the flight path / flight tracking network.

It is also worth noting that if someone -did- change the flight path of an airplane that this is advisory to the pilot- giving the pilot a flight path that flies into a mountain, a skyscraper, or whatever, does not mean that the pilot will do it! You simply cannot tweak a bit in a computer and tumble airplanes out of the sky;

In order to wreak serious havoc, your best bet would be to route all the planes in the country to one airport... but this, of course, will a) show up on that airports monitors as the number of flights approaching suddenly floods the screen, b) result in confused pilots radioing for confirmation, and c) cause little to no damage anyway, because the flights would simple be ordered to circle as they came in and landed in order-of-least-fuel, or else redirected to another airport -despite- computer routing information.

Similarly, power plants, dams, etc, may have -information- networked out, but are not going to have -controls- on those same network, and so on and so forth.

This is not, of course, to say there's -no- danger; there could, somewhere in the country, be a poorly implemented system where the monitoring software feeding out to the world is on the same 'net as the control software and on less-than-perfectly-secure systems - but, it's also possible that somewhere, there's a radar array that's infiltrator-accessible because the maintenance crawlspace is left unlocked in a publically accessible place, and with about the same likelyhood.

It is known that you don't connect insecure spaces, physical or network, to secure spaces by unnecessary channels (whether networks or crawlspaces), and if you neglected this, you still know to lock down all your entry points in the secure area (computers or access doors), and if you neglected this you have real live human guards who went through rigorous security checks... and if you neglected -all- of this, somehow, then you still have to be -found out- ... if you're found out by the government, people will be fired and security will be restored; if you're found out by a terrorist organization (with much more limited manpower, limited funding, lack of legal privileges to inspect secure sites at will and look through them for such flaws), then, and only then can anything be done.

In any case, I will pretty much guarantee that no 'risk' that there is media-hype about is going to materialize, for the simple fact that people's attention, in government and elsewhere, will focus on that risk and reduce it, which increases the risk of a failure for the terrorist operative, who will instead choose a different plan and target.

It's also probably worth noting that there is, effectively, no such thing as a high-tech terrorist. In order to train people with tech, you have to use tech; using tech creates heat and electronic noise which is findable and monitorable to a frightening extent (look for 'Tempest' on the web... I can, theoretically, read everything on your computer screen from a distance... never mind what infrared, power-fluctuation analysis, etc., can do...); creating secure electronic systems requires an technological infrastructure that would be impossible to hide. bin Laden remains at large by avoiding, as much as possible, the use of technology that could betray him with its emissions... his taped addresses are a risky thumbing of his nose at our intelligence forces, of course, since they'll be combing them for any hint of his location. Any-way, this ramble is becoming quite long, but I think the above points make it clear why you can't have a high-tech training camp for terrorists... it would be essentially un-hideable; combined with reasonably prudent security measures being taken to protect ourselves, this risks of 'net' terrorism becoming vanishingly small.

--Chris

blackhawk · Post by **blackhawk** » Mon Jul 29, 2002 5:50 pm

On 2002-07-29 17:29, ChrisA wrote:
I think the above points make it clear why you can't have a high-tech training camp for terrorists... it would be essentially un-hideable; combined with reasonably prudent security measures being taken to protect ourselves, this risks of 'net' terrorism becoming vanishingly small.-Chris

No high tech training camp...such as a flight school...run by Americans. Hmmm, I seem to remember something happening last September 11, with terrorists who had trained in plain sight. I can't seem to remember what exactly happened....

Dewhistle · Post by **Dewhistle** » Mon Jul 29, 2002 7:34 pm

What the... I got another klez e-mail. Since Dale has a handle on his virus problem, I suppose that clears him. (Sorry Dale

)

But I suppose it's useless to wonder where it's coming from? I've only had 3 e-mails in as many days and they've all been Klez-carriers! What gives?

Daniel_Bingamon · Post by **Daniel_Bingamon** » Mon Jul 29, 2002 8:28 pm

It's the same thing that makes folks crash planes into skyscrapers in NYC. Figure that one out and you'll have a handle on the computer virus thing.

You really nailed that one! I've actually wondered at times (even before 9/11) if viruses were written by a faction of these terrorist networks.

I use the old Compuserve email read. Can't read HTML email but if doesn't run anything automatically.

If terrorism operatives worked at Microsoft, computer system under that platform could be become extremely vulnerable. After all, Microsoft is vulnerable enough as it is.

[ This Message was edited by: Daniel_Bingamon on 2002-07-29 22:37 ]

drewcifer · Post by **drewcifer** » Mon Jul 29, 2002 9:29 pm

Wow.
Looks like the Terrorists have really done a job on the American psychie.

jim stone · Post by **jim stone** » Mon Jul 29, 2002 10:12 pm

If I may try to put the matter a bit
more in focus, the terrorists have on
several occasions said there were two reasons
for the attack. The first is the presence
of American troops in the Moslem holyland,
that is, in Saudi Arabia which is where
Mecca is located. The second is America's alleged 'one-sided support for Israel
in its war against the Palestinian people.'
I believe they did what they did largely
for the reasons they gave. I don't suppose
computer viruses are being spread
for these reasons, at least not many
of them.

Also the 9-11 attack was
a pretty low-tech affair in a way--
box cutters plus the ability to fly
an airplane. I doubt that these people
are now in a position to develop devilishly
clever high tech options (though certainly
one can't rule out the possibility).
We are probably better at combatting
such things than they are at developing
them. The chief danger
is middle-tech, I think, that is, enough tech
to do damage but not so much that it's
hard to get and use. They thought 'outside
the box,' using airliners as missiles. Probably we are now thinking
outside the box, too. Hopefully the window of
opportunity for such attacks has become
a lot smaller. Peace.