http://www.nytimes.com/library/tech/99/04/biztech/articles/03virus.html April 3, 1999 The Anarchic Lure of Virus Writing By MATT RICHTEL and JOHN MARKOFF In the world of cyberspace, the sport of virus writing has become the latter-day equivalent of the urge to write "Kilroy was here" on the wall of the school auditorium. And it is a hobby with a growing following. The emergence of the Melissa virus a week ago, and the announcement yesterday of an arrest in the case, underscores the growth on the Internet of a community of virus writers and collectors. They freely trade malicious code, combine efforts to best the work of antivirus researchers, and post their creations on the Internet for anyone to download and release into the wild. "It's like candy," said Sarah Gordon, an antivirus researcher for I.B.M. who spent five years researching the virus-writing subculture. "A child can get these, a 12-year-old can get these." She said it required little technical expertise to introduce a virus once it was obtained. "It's trivial," she said. "All you do is download it to a computer, click on it and there you go." As the computer has become ubiquitous, the image of the bad guy of the technology era, the bespectacled introvert who attacks computer networks by keystroke, has emerged. Within this category, there exists a subset of virus writers, a subculture within the subculture. The International Computer Security Association, an industry corporation based in Carlisle, Pa., estimated last year that there were 15,000 to 20,000 viruses in circulation, with 1,000 emerging each month. Only a small number are widely circulated, or "make it into the wild," in the industry vernacular. But their proliferation has given rise to a highly competitive industry of companies that seek out the latest strains and find and market software antidotes. Over the years, virus writing has been perceived as having less status in the hacker set than cracking into government and corporate computers. But virus writing appears to have become more attractive to hackers as publicity around viruses has grown, say computer buffs and executives at antivirus companies. One early group of virus writers, 40Hex, which published a magazine, emerged in the early 1990's, said Jeff Moss, the founder of Defcon, an annual gathering of the computer underground. "They were going to cause the downfall of civilization, but then they got bored after a while," Moss said. "There wasn't that much happening in virus writing," he added, "so the more motivated people went off to normal hacking." As opposed to hacking, which can demand a range of skill levels, virus writing traditionally attracted a more technically oriented set. Virus writers "are very much into super-down-and-dirty programming," Moss said. But in recent years, virus writing has experienced a resurgence, generally attracting a less technically adept group. Increasingly, simple templates are available for use in virus writing and breaking into computers, making the endeavor open to copycats and less adept programmers. In the underground, these copycats are known as script kiddies. In the world of virus writing, they are termed scripters, a name Ms. Gordon gave to them. Ms. Gordon said virus-writing enthusiasts had evolved from the late 80's. "It used to be a small group of people with these interests," she said. "With the advent of the Internet, the community has widened and accessibility of applications to young people has increased." That may have particular currency in the case of the Melissa virus. Some computer security experts have suggested that David L. Smith, the New Jersey man arrested in the case yesterday, cobbled together his own virus code with virus templates he found on the Web. Authorities in New Jersey said they did not believe that Smith is the virus writer known as VicodinES, whose handle has been linked in Internet postings with the creation and dissemination of Melissa. What is certain is that VicodinES, whoever he or she is, has a Web site that advocates the creation and use of viruses, and that Smith's name was found in several documents on that Web site dating back at least a year, said Richard Smith, an independent software developer in Cambridge, Mass., who is an amateur computer sleuth. The Web site, which was taken down on Tuesday night by Access Orlando, the Internet service provider in Orlando, Fla., where the Web server was situated, served as a bulletin board and downloading site for viruses. It contained commentary by the author who identified himself as VicodinES. But some virus writers contend that it is far too simplistic to characterize all virus writers as malicious. Some are attracted to virus writing because they want to deconstruct programming code, see how it works, and poke holes in it as an intellectual endeavor, said a longtime virus writer known as Attitude Adjuster. "The idea that all of us out here are malicious teen-agers is quite a fallacy," said Attitude Adjuster, who was contacted by E-mail and declined to give his real name. "There are those of us who still exist in the community who write viruses because it's fun. We don't give our viruses to the public and nobody gets hurt." -o- Subscribe: mail majordomoat_private with "subscribe isn". Today's ISN Sponsor: Hacker News Network [www.hackernews.com]
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:21:52 PDT