The dying art of computer viruses

2013-08-01

Graham Cluley

Independent commentator, UK
Editor: Helen Martin

Abstract

‘I had a sneaking regard for the graphical payloads some of the virus writers were building into their creations.' Graham Cluley.


The first time I heard someone mention computer viruses was in 1988. I was studying computing in the leafy home counties of England, when I played a joke on a friend: I showed him that every time I typed the letter ‘s’ on my keyboard it would come up on the screen as ‘sh’, and every now and then a loud ‘-HIC!-’ would be injected into the text.

‘You must have a virus!’ my classmate exclaimed, his eyes opening widely. The truth was that he had just encountered a joke TSR program I had written called ‘Drunk Simulation’. It hid in the background and messed around with whatever you typed. But for the first time, I had seen how strange behaviour on a computer could raise the pulse of onlookers.

It wasn’t until December 1991, when I went for an interview to become a programmer at Dr Solomon’s, that I encountered some real computer viruses.

In those days, it was often hard not to be aware that you had a virus. The New Zealand virus declared ‘Your PC is now Stoned!’, the Italian virus bounced a ping-pong ball across your screen, and the Maltese Casino virus played Russian Roulette with your file allocation table.

Sure, all of these viruses were irritating – they spread without your consent, and ate up system resources – but only some of them were deliberately destructive. In many ways, a lot of the malware could justly be compared to an electronic form of graffiti – the Green Caterpillar, for instance, which crawled across your screen, eating up letters and pooping them out in a shade of brown.

Even as malware turned nastier and more destructive, there was still some art to be seen. Virus-writing gangs like Phalcon/SKISM used colourful ANSI-style art to declare that they had infected your computer. Viruses like Phantom, with its use of 256-colour palette cycling and displaying a large skull, and Spanska, with its simulated flight across the Mars landscape, probably demonstrated a high point for art in viruses.

Even though I knew malware was wrong, and not to be encouraged, I had a sneaking regard for the graphical payloads some of the virus writers were building into their creations. I recognized that this was a form of art.

And there was art in the malware code as well. Virus writers would often spend months tweaking their code, using innovative new techniques in an attempt to make it undetectable by anti-virus products. I didn’t agree with what they were doing, but had to admire the coding skill deployed by some of them. Like much modern art, you didn’t necessarily have to like it to acknowledge the skills used to produce it.

But then things started to change. Malware got commercial. The reasons for writing a virus or (increasingly) a trojan became more about stealing data, or recruiting a PC into a botnet, than about displaying a silly message or gory graphics.

The new malware creators didn’t care about getting attention through visual payloads, and they didn’t care much about the quality of their mass-produced programs either. They were churning out new trojans, unbothered by the fact that some anti-virus products spotted them generically, so long as there might be some people who would get infected – besides, if their latest trojan wasn’t any good, there’d be three more along in a minute.

Today, anti-virus researchers are dealing with hundreds of thousands of silent, stealthy pieces of malicious code every day, which have no intention of drawing unnecessary attention to themselves, and most of which are from families of malware that have been seen hundreds of times before.

The art has gone from malware. The commercial cybercriminals rule the roost, and the hobbyists who incorporated dramatic visual payloads and cared about the quality of their code (the artists, if you like) have largely disappeared, frightened off by stiff punishments and prison sentences.

Are we better off because of it? I don’t think so. I hanker for the old days, when viruses did something visual to entertain you, as you reached for your back-up.

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…


Bulletin Archive

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.