ENCYCLOPEDIA OF Espionage, Intelligence, and Security Volume ...

Computer Virusdesigned to spread themselves over the Internet and aretherefore “worms.”A program that appears to perform a legitimate orharmless function, but is in fact designed to propagate avirus is often termed a Trojan Horse, after the hollow,apparently-harmless, giant wooden horse supposedly usedby the ancient Greeks to sneak inside the walls of Troy andoverthrow that city from within. Another interestingsubclass of viruses consists of chain letters that purport towarn the recipient of a frightening computer virus currentlyattacking the world. The letter urges its recipient tomake copies and send them to friends and colleagues.Such hoax letters do not contain executable code, but doexploit computerized communications and legitimate concernover real, executable-code viruses to achieve selfreplication,spread fear, and waste time. Chain lettershave also been used as carriers for executable viruses,which are attached to the chain letter as a supposedlyentertaining or harmless program (e.g., one that will drawa Christmas card on the screen).The first “wild” computer viruses, that is, viruses notdesigned as computer-science experiments but spreadingthrough computers in the real world, appeared in the early1980s and were designed to afflict Apple II personal computers.In 1984, the science fiction book Necromancer, byWilliam Gibson, appeared; this book romanticized thehacking of giant corporate computers by brilliant freelancerebels, and is thought by some experts to have increasedinterest among young programmers in writing real-worldviruses. The first IBM PC computer viruses appeared in1986, and by 1988 virus infestations on a global scale hadbecome a regular event. An anti-virus infrastructure beganto appear at that time, and anti-virus experts havecarried on a sort of running battle with virus writers eversince. As anti-virus software increases in sophistication,however, so do viruses, which thrive on loopholes insoftware of ever-increasing complexity. As recently asJanuary 28, 2003, a virus dubbed “SQL Slammer” (SQLServer 2000, targeted by the virus, is a large softwarepackage run by many businesses and governments) madeheadlines by suspending or drastically slowing Internetservice for millions of users worldwide. In the UnitedStates alone, some 13,000 automatic teller machines wereshut down for most of a day.All viruses cause some degree of harm by wastingresources, that is, filling a computer’s memory or, like SQLSlammer, clogging networks with copies of itself. Theseeffects may cause data to be lost, but some viruses aredesigned specifically to delete files or issue a physicallyharmful series of instructions to hard drives. Such virusesare termed destructive. The number of destructive viruseshas been rising for over a decade; in 1993 only about 10%of viruses were destructive, but by 2000 this number hadrisen to 35 percent.Because even nonmalicious or nondestructive virusesmay clog networks, shut down businesses or Web sites,and cause other computational harm (with possible realworldconsequences, in some cases), both the privatesector and governments are increasingly dedicating resourcesto the prevention, detection, and defeat of viruses.Twenty to 30 new viruses are identified every day, andover 50,000 viruses have been detected and named sincethe early 1980s, when computers first became integratedwith the world economy in large numbers. Most virusesare written merely as egotistical pranks, but a successfulvirus can cause serious losses. The ILOVEYOU virus thatafflicted computers globally in May, 2000 is a dramaticrecent case that illustrates many of the properties ofviruses and worms.The ILOVEYOU virus was so named because in itsmost common form (among some 14 variants) it spreadby looking up address-book files on each computer itinfected and sending an e-mail to all the addresses itfound, including a copy of itself as an attachment namedLOVE-LETTER-FOR-YOU.TXT.VBS. (“VBS” stands for VisualBasic Script, a type of file readable by World Wide Webbrowsers.) If a recipient of the e-mail opened the attachment,the ILOVEYOU virus code would run on their computer,raiding the recipient’s address book and sendingout a fresh wave of e-mails to still other computers.ILOVEYOU first appeared in Asia on May 4, 2000.Designed to run on PC-type desktop computers, it rapidlyspread all over the world, infecting computers belongingto large corporations, media outlets, governments, banks,schools, and other groups. Many organizations were forcedto take their networks off line, losing business or suspendingservices. The United States General Accounting Officelater estimated that the losses inflicted by the ILOVEYOUvirus may have totaled $10 billion worldwide. Monetarylosses occurred because of lost productivity, diversion ofstaff to virus containment, lost business opportunities,loss of data, and loss of consumer confidence (with subsequentloss of business).National security may also be threatened by computerviruses and similar software objects. During theILOVEYOU incident, the U.S. Department of Health andHuman Services was disrupted for many hours. An officialof the department stated that if a biological outbreakhad occurred simultaneously with this ‘Love Bug’infestation, the health and stability of the nation wouldhave been compromised with the lack of computer networkcommunication. An official at the U.S. Departmentof Defense stated that so many personnel had to beshifted from their primary responsibilities to deal withILOVEYOU that if the incident had continued much longer,reservists would have had to be called up. All this damage,and more, was accomplished by a virus not even especiallydesigned to do so. Governments are, therefore,concerned that specially designed viruses and other formsof cyberattack may be used deliberately by hostile governmentsor terrorist groups to cripple the military or theeconomy. The U.S. National Security Agency has statedthat at least 100 governments are developing viruses andother cyberweapons, as well as terrorist groups. To countersuch threats, the U.S. government has established a264 Encyclopedia of Espionage, Intelligence, and Security