Virus Vendors and Mass Press Virus Hype

Virus hypodrom is classic case of security hype and probably is the most developed area of security hype in general. As such it can serve an instructive case for studying security hype in general and might be helpful for understanding of other types of security hype (for example Network IDS hype).

Major players in virus hype includes both commercial AV companies and journalists.  Clueless or corrupted journalist are often promote an equally clueless and corrupt "cyber-wizards" . Did you remember JPEG virus scare ?  In case you didn't a press release from McAfee that warned "potentially, no file type could be safe". Actually the virus was just someone's project, e-mailed directly to McAfee by its creator. It never became an infection, much less an epidemic.

Critics say the fact that McAfee -- a division of Santa Clara's Network Associates -- sent out a press release containing this FUD is a classic example of virus hype aimed to pump up sales of the $30 to $50 antivirus software packages that McAfee and Symantec sell.

That hype is having a "cry wolf" effect that could make things worse when the next serious virus threat hits.  Here is a couple of relevant quotes:

Quote 1: Virus hype - Media circulate the alerts, but some say antivirus firms are pumping up the fear

"I think their motives were that they saw the possibility of getting coverage from the major media," said David Perry, global director of education for Trend Micro, a smaller company that also sells antivirus software.

Customers and computer enthusiasts posted hundreds of messages about McAfee's recent press release on www.slashdot.org, a technology community site, echoing Perry's view. But most of them used much stronger language.

Antivirus programs sell like umbrellas in a rainstorm when word of a big computer infection hits the newspapers and TV. When the Code Red and Nimda viruses made headlines worldwide last fall, Valley firms Symantec and Network Associates both reported jumps in consumer software sales.

McAfee says its intentions with the JPEG virus release were much more pure. The company said it had a duty to inform its 50 million customers it had learned about a new kind of virus, and that the news media is the most effective way of reaching out to them.

"If we didn't do anything last week, I have the feeling that somebody would have picked up the story somewhere down the line, and our customers would be asking us why we didn't tell them," said Vincent Gullotto, senior director of McAfee Avert Labs in Beaverton, Ore.

Actually, McAfee's press release made it clear that the new virus, while a potential future threat, posed no immediate risk.

"There may have been more concern if they had seen it on our Web site, without having us explain what it was," Gullotto said. Antivirus companies say they prevent undue panic by clearly labeling virus press releases as high, medium or low risk.

"Even looking around at the other antivirus companies, in general you find that people are pretty good about highlighting the high-risk ones," said Vincent Weafer, director of the antivirus research center for Internet security firm Symantec.

The only reason antivirus companies sometimes alert the media about low- risk viruses, Weafer said, is to educate the public about a new kind of virus that could be a harbinger of things to come.

The recent JPEG virus alert fell under that category, McAfee's Gullotto said. But industry critic Rob Rosenberger said the JPEG virus wasn't newsworthy even as a new potential kind of virus.

"It's just another virus. Conceptually it's nothing new," said Rosenberger, who runs www.vmyths.com, a Web site critical of the antivirus industry. But because this virus used JPEGs, a popular format for e-mailing photos, McAfee knew reporters would jump on it, he said.

The media has all too often been a willing accomplice in exaggerating the danger of new viruses, said George Smith, another editor at Vmyths.com. He recalled the great press attention given to 1992's "Michelangelo" virus, which was programmed to activate on the Renaissance artist's birthday, March 6.

A Chronicle story at the time, just one of hundreds of media reports, warned that Michelangelo was "set to destroy data on millions of personal computers."

But on March 7, The Chronicle reported the virus had actually "claimed relatively few victims." Michelangelo was never that serious of a threat at all, Smith said. On the other hand, it's unclear whether the extensive media coverage helped prevent a catastrophe by encouraging computer users to protect themselves.

The same scenario repeated itself seven years later, this time with news stories predicting Y2K viruses that never materialized.

"The antivirus industry started the hubbub about it, but the news media glommed onto it and decided it was a good story," Smith said.

There's nothing wrong with the goal of all these warnings -- getting consumers to install antivirus software, which even experts unaffiliated with the industry recommend. The problem is that the warnings are starting to have the opposite effect, said Chris Wraight, a technology consultant with the British antivirus firm Sophos.

"Every week people hear about this killer virus out there, and it never materializes," Wraight said. "I think people start to become a little bit inured to it, the classic 'Boy Who Cried Wolf' kind of thing."

That attitude may explain why a low-level virus called Klez has been popping up in people's e-mail boxes over and over in recent months. Antivirus software can zap Klez, but only if users have updated their subscriptions. Wraight thinks people aren't installing or updating antivirus software that could stop Klez because they've become jaded about the virus threat.

Sophos and Tokyo's Trend Miro pride themselves on avoiding the temptation to hype up viruses, and they don't hesitate to criticize their larger rivals' marketing tactics. But Smith disputes Sophos and Trend Micro's self-description as hype-free antivirus companies. "As a whole in the industry, no one can say that they have never engaged in sending out press releases speculating on a newly received computer virus," he said.

Quote 2: Older sample of the self-promotion among AV companies (Sophos calls for calm over Smash virus hype):

Sophos Anti-Virus, Europe's leading developer of corporate anti-virus solutions, has advised computer users not to panic over the W95/Smash virus, following significant media attention the virus has received as a result of another anti-virus vendor's press release.

Sophos points out that, although W95/Smash is programmed to activate today, the virus does not pose a significant threat.

"The average user is more likely to be abducted by the Martians from the Smash mashed potato advert than get hit by this virus," said Graham Cluley, senior technology consultant for Sophos Anti-Virus. "Not only does this virus not appear to be spreading in the wild, but most anti-virus products have been protecting against it since the beginning of May!"

Sophos has published information about the Smash virus online here.

NEWS CONTENTS

Old News ;-)

Virus Hype Is The Sky Really Falling - by Ed Lamaster

Antivirus myth busters, Vmyths.com, had dubbed the phenomena "hystericanes" (hysteria hurricanes). According to Vmyths, there are three kinds of hystericanes. The first type seem to follow a 3-4 year cycle, with such names as Columbus Day, Michaelangelo, Hare, and the Y2K viruses. The second type are the result of hoaxes and urban legends, such as Good Times, AOL4FREE, and others. The third type comes as a "red alert" (touted by the usual suspects) that some virus attack is in progress such as Melissa, ILoveYou and Kournikova. It's not that these virus outbreaks aren't real, it's just that they are completely overblown in proportion to what really is going on.

I'm sure there are going to be emails this time from well-meaning system administrators who are going to tell me that they spent sleepless nights battling computer viruses. I have done so myself. I don't discount the reality of these events, but merely want to point out how overblown they become in the media and the dangerous effect of repeatedly warning that the sky is falling. The end result of virus hysteria is that the average person with a computer has no idea what to pay attention to, and so most people simply do nothing.

Slashdot Dyson On Grey Goo, Bioterrorism, and Censorship

Government Executive Magazine - 1-29-03 The worm that turned A new approach to hacker hunting Hacker hype in its best. See also Slashdot Feds Working to Stop Worms. I like the following quote: "Worms were the most vicious new beasts to stalk the Internet. But Gerber had never seen a worm quite like the one he confronted that sweltering Wednesday morning in June. It was named Leaves after "w32.leave. worm," the poisonous file it implanted in unsuspecting computers. Like all worms, Leaves bored through cyberspace, probing Internet connections for holes in personal computers or Web servers. It slithered inside the machines and spewed venomous strings of data that threw its victims into electronic shock. " What a classic sample of virus hype :-)

By Shane Harris
[email protected]

Wednesday, June 20, 2001
6:30 a.m.
FBI Headquarters,
Washington

After 23 years as a CIA analyst, having briefed the president and his team on every conceivable threat to national security, Bob Gerber was scared. More scared than he'd been in a long time.

Holed up in his cramped, 11th floor office on a stark, colorless hallway at FBI headquarters in Washington, Gerber's stomach turned as he took his first look at a new enemy.

Gerber was a hunter, one of the government's best. These days, he was hunting worms, malicious computer programs let loose into the wild of the Internet by some of computerdom's most brilliant hackers. Two months earlier Gerber, 56, had left his job at the CIA, where he helped write the president's daily intelligence briefing, to head the analysis and warning division at the FBI's National Infrastructure Protection Center. There, he and his crew of more than 60 tracked worms, viruses and other computer evils, as well as the hackers who create them. Both threatened daily to shut down the engines of modern life-electrical power grids, the banking system, water treatment facilities, the World Wide Web.

Worms were the most vicious new beasts to stalk the Internet. But Gerber had never seen a worm quite like the one he confronted that sweltering Wednesday morning in June.

It was named Leaves after "w32.leave. worm," the poisonous file it implanted in unsuspecting computers. Like all worms, Leaves bored through cyberspace, probing Internet connections for holes in personal computers or Web servers. It slithered inside the machines and spewed venomous strings of data that threw its victims into electronic shock.

Leaves was hardly the first worm to infest the Internet. In fact, the pests became so common in 2001, that security cognoscenti dubbed it the "Year of the Worm." Worms wrought all sorts of damage. They forced computers to delete critical files or erase entire programs. They also allowed hackers to steal personal information from computers' memories. Once they infested their victims, worms made clones, then used their hosts as launching pads for more worms, whose numbers grew exponentially.

In 2000, Gerber and his team began battling a new species of even more virulent super worms. Rather than devour computers' innards, these worms hijacked their victims' controls, rendering them powerless zombies. With a gang of zombies at his command, the creator of a superworm could mob a Web site or computer system, flooding it with bogus electronic transmissions until it drowned in the data torrent.

In the spring of 2000, Gerber's colleagues took on a 15-year-old hacker who called himself Mafiaboy. The teen-ager turned his zombies loose on World Wide Web giants Amazon.com, eBay and Yahoo!, launching what is called a distributed denial of service attack that shut down business at the sites for five hours. It cost shareholders and the companies billions and shocked the Web world.

But compared with the Leaves worm, Mafiaboy's creation was a larva. Gerber's best analysts had worked late into the night trying to make sense of a sample of Leaves captured by worm watchers at the SANS Institute, a computer research center in Bethesda, Md. They let Leaves infect a computer, and then they watched how it behaved. What Gerber saw fascinated and appalled him.

Leaves was a zombie maker on steroids. It searched out computers already wounded by another Internet scourge called a Trojan, which installs back doors in the machines. Leaves used a Trojan called SubSeven as its entrance. Once transformed, the zombies awaited orders. To communicate with them, Leaves' creator ordered his zombies to rendezvous online through Internet Relay Chat channels. He also told them to visit certain Web sites and download encrypted information to receive instructions on what to do next. No one knew who was controlling the zombies, from where or why.

Reading the guest registries of chat rooms, Gerber discovered that an army of 1,000 Leaves zombies already was on the march. Mafiaboy, by contrast, had a few hundred conscripts and sometimes used only a dozen to attack a Web site.

What's more, Leaves contained an electronic gene enabling its creator to control every zombie at once from any Internet connection in the world.

Gerber never had seen a worm so sophisticated or terrifying.

But to exterminate it, Gerber needed more samples to dissect and more time. Pulling out the lines of computer code that told the worm how to behave might help him shut it down. Or, if he could identify the worm maker's ultimate goal, Gerber might be able to head him off.

The FBI group usually worked alone or with a few select federal officials and private sector consultants. But even Gerber's top-flight team was daunted by Leaves. It was time to call in help. Only a public-private posse of America's best hacker trackers could gut this worm.

By pulling such a group together for the first time and then letting it operate largely unsupervised, Gerber created a new model for federal computer crime fighting.

June 29
FBI Strategic Information
and Operations Center,
Washington

Gerber called the most seasoned and cunning code crackers, worm gurus and cyber soldiers from government and industry to meet at FBI headquarters. On a Friday afternoon, 10 days after Leaves was discovered, the posse gathered in the FBI's crisis headquarters, the Strategic Information Operations Center.

It was the most concentrated arsenal of computer crime-fighting talent the government ever had gathered. They came from leading security companies Symantec and Network Associates, the FBI, the White House and the Defense Department.

But there was a hitch. The private experts were uneasy. Could they trust the G-men? Uncle Sam was a bumbling bureaucrat. His security was notoriously lax. Hackers had been penetrating military and intelligence agency computers for years. What could federal officials possibly know about fighting an enemy as elegant as Leaves?

The two sides eyed each other warily as Gerber laid out what he knew. The evidence seemed to show that Leaves' creator was preparing a massive denial of service attack. Everyone would have to work together to stop it. Mistrust would keep them apart. It took Marcus Sachs, a cyber soldier from a Pentagon unit trained to attack foreign networks, to bridge the suspicion gap.

Sachs dazzled the room with his observations and theories about Leaves. With casual command of hacker lingo and the history of worms and their attacks, he demonstrated both the expertise of the government corps and the urgency of defeating this unique and dangerous foe.

The ice melted. Slowly, a simple sheet of paper passed around the room. First one, and then the next, wrote down his name, e-mail address and phone number. The Leaves posse came to life and it readied for a fight.

Days later
Los Angeles

Jimmy Kuo left the meeting to conduct an electronic autopsy.

Kuo, a research fellow at the security firm Network Associates, took samples of the worm home to Los Angeles. Many in the Leaves posse returned home to operate on their own turf, not from a single base in Washington. "In this line of work, it doesn't matter where you are, as long as you have a laptop computer and a phone," Kuo says.

The Leaves code was a jumbled mess. It was encrypted and compressed-data had been squeezed together to save space. Mr. Leaves, as some in the posse had begun calling the worm's creator, knew his creation would be captured. He ensured the worm wouldn't easily give up its secrets. Kuo ripped apart layers of code with powerful programs to reveal the deeper truths Leaves was hiding.

Other members of the posse were ripping Leaves, too, untying its knotted innards. One wrote a program to mimic the Trojan that Leaves used as a back door. The posse laid the trap across the Internet.

Sharing their discoveries by phone and e-mail, the code crackers found eight variants, or mutations, of the worm. Mr. Leaves was tweaking his weapon, finding new ways to deliver it. And he was moving faster than the posse.

While Kuo ripped in Los Angeles, a posse member watched for abnormal Internet traffic from SANS in Bethesda. Still others huddled at the FBI. The group worked smoothly because nobody was in charge, Sachs says. "Egos didn't get in the way of progress." They worked fast, but as days passed, their analysis yielded fewer new results. They learned much about the worm's attributes, but little about its purpose.

Mr. Leaves had directed the zombies to synchronize their clocks with the Naval Observatory clock on the Web. The army was prepared to attack in unison. No doubt, Mr. Leaves soon would begin his onslaught.

Unless someone could find him first.

Early July
FBI headquarters,
National Infrastructure Protection Center
computer investigation unit

FBI Special Agent Michelle Jupina wanted two things: to find Mr. Leaves and to lock him up. The bureau sought Leaves' creator on criminal charges of unlawfully entering a computer. Jupina was at the first posse meeting in June, but she kept a low profile. Assigned to the infrastructure protection center, Jupina, 36, was well-versed in cyber jargon. She understood how hackers thought and maneuvered.

The posse saw Leaves as a marvel of engineering. But to Jupina, the worm and its maker were just garbage to clean up. Short, quiet and hidden under a mane of frosty blonde hair, Jupina didn't seem capable of bursting through a hacker's door and yanking him off his keyboard. She was so unobtrusive that a posse member recalls he didn't even know she was a cop until she got up from her seat one day and "I saw a cannon strapped to her side."

But as the posse ripped Leaves apart, Jupina was a constant eavesdropper, digging for evidence in the pile of Leaves' secrets the posse unearthed. Even as new revelations slowed, Jupina and the agents under her command feverishly followed leads. Steadily, they shut down the Web sites Leaves' zombies used to receive instructions. They planted tracking devices to pick up the hacker's footprints.

Second week of July
FBI Strategic
Information
Operations Center

Weeks passed. The zombies remained quiet.

Gerber had issued a public warning about Leaves on June 23. The private sector posse members had warned their customers. News that Leaves was on the loose circulated through the computer security trade press. But still no attack.

Ripping continued. The zombie army grew. By July, at least 20,000 computers were encamped in chat rooms or patiently waiting for their orders. "That scared the hell out of us," Gerber says.

Mr. Leaves was getting wily. Whenever the team shut down one Leaves chat room the worm automatically created a new one. Mr. Leaves tried new methods, too. On July 9, one of the companies in the posse found an e-mail claiming to be a security bulletin from Microsoft Corp. The bulletin warned of a new virus, and told users to download a file to protect their computers. In the file was Leaves.

The bogus warning was badly written and eerily self-congratulatory:

"Yesterday the Internet has seen one of the first of it's downfalls. A virus has been released. One with the complexity to destroy data like none seen before."

Today, hackers often mask their worms as official security warnings, but this was the first use of the tactic. Like many outlaws, Mr. Leaves inspired a certain grudging admiration within the posse chasing him. "I had a feeling I was dealing with an artisan," Gerber says.

Or possibly a common crook.

Perplexed by the lack of attack, someone in the posse posed a new theory: Perhaps instead of damage, Mr. Leaves sought money.

The posse knew that some companies paid Web surfers to click on advertisements on their sites in order to inflate estimates of the success of the ads. With 20,000 zombies to click for him, Mr. Leaves could make a killing. Some of the sites the zombies visited contained these ads. If the FBI could find an account where Mr. Leaves put the funds, trace it to a physical address and tie it to him, the case might be solved.

Convinced Leaves had to have been created for a denial of service attack, the posse scorned this theory. Pulling off one of the biggest attacks ever was the only glory befitting such a brilliant worm.

But something didn't make sense. Mr. Leaves was taking an awful risk by not attacking. Every time he logged on to communicate with his zombies, the FBI had another chance to trace him. Why expose himself? Why not just preprogram the zombies to act on their own? The scam began to seem more believable.

But before the posse could prove its theory, an attack began. It wasn't the work of Leaves.

On July 17, a new worm appeared-Code Red. It was named after Mountain Dew Code Red soda, the only thing that kept two private sector analysts awake as they tracked it day and night.

Leaves propagated like a rare illness, targeting only victims with weakened immunity. But Code Red spread like smallpox. The worm exploited a ubiquitous hole in one of the most popular brands of Microsoft Web servers. In a few hours, Code Red had eaten into more than 100,000 servers worldwide. The swarm of worms leaping from machine to machine caused an electronic traffic jam, slowing all Internet traffic. In the aftermath of the attack, companies would spend billions of dollars plugging the holes that let Code Red enter.

Able as it was, the posse didn't have the strength to fight both Code Red and Leaves at once. The choice was clear: Code Red took precedence.

The Leaves posse had built a new model for chasing Internet outlaws. They honed it battling Code Red. But fighting the new menace left Leaves on the back burner. All they could do was hope that Leaves was no more than an Internet heist or pray that Jupina and her crew could track down and nab Mr. Leaves before he, too, unleashed his zombie brigades.

For weeks, Jupina and her technicians had laid traps and tracers across the Internet. She wanted the hacker's Internet protocol address, the digits that identify anyone who sends information online. Hackers cover their tracks by erasing those addresses from the servers they use. But Mr. Leaves had slipped.

In a cache of addresses Jupina had pulled off a server in Oklahoma at the end of June, she found one used by Mr. Leaves. It was a hot lead.

But chasing the address could take Jupina around the world. And she could nab Mr. Leaves only if he lived in a country that considered hacking a crime. If he did, the company that provided his Internet service would have to cough up his home address and Jupina would have her man. Luckily, after some tracking, Jupina hit gold: Mr. Leaves' address originated in the United Kingdom, home to some of the toughest computer crime statutes in the world.

Jupina rang the Scotland Yard computer crime unit. Within days they traced the Internet address and attached it to a name and a place. The hacker was a 24-year-old man living in one of the seedier sections of London. Scotland Yard set up a stakeout at his digs.

July 23
FBI headquarters and
South London, England

Back at FBI headquarters, Jupina kept watch on a computer monitoring the Oklahoma Web server. When Mr. Leaves logged on again, Jupina would know. Jupina waited with Scotland Yard's phone number at the ready. Officers in South London sat tight outside the hacker's residence.

Nothing.

And then, there he was.

Jupina watched as the hacker connected to the Oklahoma server. She gave the word to Scotland Yard: Go. The officers arrested the creator of one of the most ingenious worms ever known.

Epilogue

The Leaves posse proved itself during the Code Red attack. Code Red made headline news. The FBI, the White House and security companies launched a coordinated campaign to track it, warn the public and take steps to protect vulnerable systems. Crippling of the White House Web site was narrowly avoided; Pentagon Internet connections were temporarily shut off. Damage was significant-estimates are in the billions of dollars-but it would have been worse had the response not been as fast and well organized. No perpetrator has been identified.

Mr. Leaves caused no major damage before the posse rounded him up. And the same team remains on guard against new worms or other cyber threats. When one appears, the posse comes alive. E-mails fly, home telephones ring as the members swing into action, sharing what they know, tracking, dissecting, devising traps and passing evidence to the FBI.

In November 2002, shortly before leaving the FBI and returning to the CIA, Bob Gerber sat in a new office at FBI headquarters. Next to a bookcase full of hacker treatises, with a can of Mountain Dew Code Red displayed prominently on a shelf, Gerber pondered Mr. Leaves' motive. The FBI never found evidence the hacker had stolen money using the worm. Gerber and Jupina had brought the case all the way to a collar, yet they might never know Mr. Leaves' ultimate goal. "As far as I know, no one ever asked Mr. Leaves why he did what he did," Gerber says.

And no one ever may get the chance. In November 2001, the man who confessed to British authorities that he'd created the Leaves worm received a "formal caution," a legal warning usually reserved for juvenile crimes and minor drug offenses.

The lead officer on the case insists the agency has information about the hacker's motives that the FBI hasn't heard. But Scotland Yard refuses to divulge what it knows. Citing British law, officials refuse even to reveal the hacker's name.

Tens of thousands of computers containing now-dormant Leaves worms await instructions from their master. Should they ever again awaken, a posse will be waiting.

• SecurityFocus HOME News Macro and script viruses dying off A nice example CodeRed hype

  Code Red

  TruSecure (and more particularly its affable "Surgeon General" Russ Cooper) came to notice in 2001 for predicting that the Code Red virus had the potential to "meltdown" the Internet.
  
  This warning was, we now know overstated. Cooper told us, when we met up with him before Christmas, that he did not regret the warning. He was acting, he said, on early analysis of Code Red and its possible spread through NT4 boxes. This turned out to be a lesser risk than first believed.

  Fair enough; but TruSecure is still banging on about Code Red-style attacks to this day. Thompson warning he expects "another attack in 2003 in the class and level of Code Red".

  If he means another outbreak of hysteria from sectors of the security community (which ought to know better) over some supposed Internet-crushing threat, how could we disagree?

• Yahoo! News - Computer Virus Writers Mostly Obsessed Males -- Expert Jan Hruska is not an expert, he is a marketer ("About 1,000 viruses are created every month by virus writers increasingly intent on targeting new operating systems"), but still some of his observations (the chronic lack of girlfriends as a definite characteristic of a virus writer is pretty funny ;-)

  SINGAPORE (Reuters) - Male. Obsessed with computers. Lacking a girlfriend. Aged 14 to 34. Capable of sowing chaos worldwide.

  That is the profile of the average computer-virus writer, an anti-virus expert said on Tuesday.

  About 1,000 viruses are created every month by virus writers increasingly intent on targeting new operating systems, said Jan Hruska, the chief executive of British-based Sophos Plc, the world's fourth-largest anti-virus solutions provider. "So far, we've seen no indication of decreased interest in virus writing," Hruska told Reuters in an interview.

  "Virus writers are constantly looking for new vectors of infection, targeting the vulnerabilities of operating systems to exploit them for their creations," he said.

  Hruska said the number of viruses created would continue to climb in the coming years.

  In almost all cases, virus writers were computer-obsessed males between the ages of 14 to 34 years, he said.

  "They have a chronic lack of girlfriends, are usually socially inadequate and are drawn compulsively to write self-replicating codes. It's a form of digital graffiti to them," Hruska said.

  In January, Welsh virus writer and web designer Simon Vallor, 22, was sentenced to two years' jail for spreading three mass-mailing computer viruses that allegedly infected more than 27,000 computers in 42 countries.

• Microsoft programs vulnerable to viruses -- this is an interesting example of going too far in accusing Microsoft. These billions in damages is a pure hype. I would agree with opinion of Fred Cohen, a security specialist who performed the first research on computer viruses, who "says Microsoft may be only the largest of a group of offenders. After all, he says, one could write a version of Microsoft's Office for Unix that would cause much the same sort of trouble. And Netscape's Internet browser and mail program is not only highly popular among Unix users but also quite insecure from a security specialist's point of view. "Go ahead and take a swipe at Microsoft," Cohen says. "They deserve it. But if 90% of the world was running Unix and everybody was running Netscape on it, we would have the same kinds of problems on Unix.".
• More than 45,000 viruses infect PCs running the Windows operating system worldwide. Several have caused billions of dollars in damage in the past 12 months. Hundreds more viruses appear each year, requiring armies of anti-virus programmers to isolate and kill the offending bugs.

  That's funny Macintoch as a more virus resistant system than Windows ;-)

  By contrast, perhaps 35 viruses have been written for the Macintosh and four or five for the Unix-based computers that run most Web sites, says Eugene Spafford, director of the Center for Education and Research in Information Assurance and Security lab at Purdue University.

  Aha ! Attachments are bad. What about Mime ?

  "PC operating systems have inadequate security," says Peter Neumann, principal scientist at SRI International in Menlo Park, Calif. "Attachments and executable content are features that should not exist if you are worried about security. Period."

  Other operating systems don't work this way

  Other programs on other operating systems could not behave this way, Forno says, because applications written for other operating systems - e-mail programs, word processors and the like - do not reach down into the deepest levels of the operating system to function.

  And true, Forno says, programs like Outlook and Microsoft Word work smoothly together in part because they share files that are also part of Windows. But that close connection to the operating system also let "new love" destroy those same system files, in effect destroying every file on the targeted computer's hard dive.

  The "love bug" and its progeny couldn't procreate so quickly on a Unix system, Purdue's Spafford says.

  For even though security specialists and computer vandals regularly find holes in Unix operating systems, they have one real strength that keeps them essentially virus-free: programs don't simply run of their own accord. Rather than clicking on an icon and waiting for a new program to set itself up, Unix users must go through a deliberate, sometimes tricky task of tweaking a software package so that a computer can actually run it.

  Is it as easy as Windows? No way, Spafford says. But that's a small price to pay, he says, when millions are clicking on files they should know better than to click on.

  ...It is anyone's guess how long the love affair with simplicity will last. The German government said Friday that it was considering dumping Outlook altogether in the wake of the latest virus outbreak.

Wild Idiotism

WildList Organization International -- a very interesting organization with a completely unscientific list by Joe Wells see my Overview of VB'97 for the critique of his approach.

Welcome to the World Wide Web Site of The WildList Organization International, the world's premier source of information on which viruses are spreading In the Wild. But don't take our word for it. Read what PC Magazine, MSNBC and others have to say about us here.

We've just added a new section, THANKS, to show our appreciation for all those who have helped us out over the years.

We're also in the process of re-doing our WWW site, adding features which you've asked for. For starters, we're going to be providing Virus Descriptions of the In the Wild viruses. Please keep in mind that your Antivirus product vendor is still the best source of information regarding the technical support of their products.

Names, names, names. How are viruses named? Which name is the 'correct' names? Read 'How Scientific Naming Works' by Joe Wells.

Recommended Links

Softpanorama Recommended

Top articles

Sites

Forbes.com Ten O'Clock Tech Handheld Virus Hype

Virus Threat and Virus Hype

Sophos UK press release Symantec and NAI slammed for Y2K virus hype

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019