Bolstering your computer's immune system.

IN TODAY'S INFORMATION-DEPENDENT society, viruses are becoming a greater threat than ever. Viruses have caused severe damage to computer systems throughout the world and are often not detected until most of the damage has already been done. Is there anything that can be done to help prevent this infection of viruses?

The answer is yes. In many cases, however, prevention tactics are not implemented in time or are circumvented, and the virus infects the system. However, even if a system has been infected, ways to recover and restore it to normal operation are available.

Preventing viruses is a difficult task because no system can be made 100 percent secure. However, many steps can be taken to help make a system safer. Securing a system against viruses should be done in conjunction with security for the system itself.

A computer virus is a program created specifically to infect other programs with copies of itself. It may attach itself to other software programs or infiltrate the computer's operating system, affecting the computer's normal operation.

Virus programs usually consist of relatively few lines of programming code that can be easily hidden in software. Viruses can be created on any PC and transmitted via communication lines or an infected disk to other systems.

A virus's mission depends on its author's intent. It could be as harmless as a simple, practical joke or as malevolent as an attempt to alter or destroy data. The reasons an individual develops a virus are just as diverse. The author could be a disgruntled employee, a computer-literate terrorist, or a mentally disturbed sociopath. Regardless of the author's motivation, he or she usually wishes to gain some sort of notoriety.

The history behind the computer virus dates back to 1940 and mathematician John von Neumann. In his paper, "Theory and Organization of Complicated Automata," von Neumann developed the concept of replicating programs. At the time, the concept was of little importance because he was so far ahead of technology. In addition, he lacked the proper equipment to test his theories.

In 1960, John Conway began the initial work on "living software," the electronic replicating mechanism that now is known as a virus. The software he created was the first step in the progression toward the contemporary computer virus.

Further research into these early concepts was performed by researchers from MIT working for Xerox and AT&T. Bored programmers attempting to amuse themselves after hours explored the potential of the core memory in their machines to manipulate that data and the programs contained in memory. They discovered that by altering the coding in the core memory they could make a program that was specifically designed to consume data and other programs as well.

This concept eventually developed into a sort of game of wits known as the "Core Wars." Programmers would devise programs with the ability to self-replicate and then, when triggered, consume the programs of opposing players. As the game evolved, these self-replicating "organisms" became more sophisticated. No one even considered the possibility of them getting out of hand until it happened. An organism got loose on a Xerox 530, and that is when management stepped in and put a stop to "Core War" activities.

The knowledge behind creating a computer virus did not become public until 1983 when Ken Thompson, the originator of the Unix operating system, gave a speech describing the early viruses of the "Core Wars." A year later, Scientific American published an article giving further information about viruses, even offering the reader details on how to write these programs themselves for a mere $2.

Viruses were soon being created and played with by students and staff at several American universities. At the same time, most computer users outside the academic environment remained unaware of the existence of viruses.

Initially viruses were created for harmless fun, but it was not long before they were being used for malicious purposes. The programmers who had pioneered the first virus programs were becoming increasingly alarmed about what was happening.

Professor Fred Cohen of the University of Cincinnati, who is credited with naming the self-replicating programs "viruses," attempted to warn the computer community of the potential threats from viruses, but few took him seriously.

The emergence of new technology combined with the rapid development of the virus has made the computer virus an even greater threat. Networking first developed in 1969, linking computers around the world, and networks have become the main conduits through which viruses spread from one system to another. Many documented viruses in the past few years have shown that all systems are vulnerable and, in many cases, easy to penetrate.

The INTERNET virus. On November 2, 1988, Robert T. Morris, Jr., showed society how vulnerable computer systems are to viruses. Ironically, Morris, a graduate of Harvard then studying at Cornell, is the son of Robert T. Morris Sr., chief scientist of the National Computer Security Center.

His virus program, coded in the C programming language, contained errors in logic. It was supposed to be harmless. Instead, through ARPANET (a system created by the Defense Advanced Research Projects Agency), it entered both MILNET (an unclassified network of the Department of Defense) and INTERNET (the world's largest research and development network).

Within minutes the INTERNET network was devastated, and many computer centers had to shut down. These included NASA's Ames Laboratory, Lawrence Livermore Laboratory, MIT, and the Rand Corporation. Luckily nothing was destroyed, but millions of dollars were spent to recover the data.

Morris intended the program to travel through the network, enter the computer, hide, and allow the computer to continue to process as usual. The program contained a list of common passwords. If one of these passwords did not work, it accessed the dictionary file found in most Unix systems and tried every word in the dictionary.

Once it infected a system, it found new addresses. It replicated by disguising itself as a legitimate user of the network and then by mailing itself to others. The bug caused it to also be sent to systems that were already infected. This process continued, slowing many systems down until they crashed.

Even though no harm was meant and nothing was destroyed, this is the most expensive incident in the history of computing--mainly related to the size of the network involved and the number of machines infected. Of the 1,200 networks and 85,200 host computers INTERNET serves, 6,200 were infected.

The total cost of the recovery has been estimated at anywhere from $1 million to $186 million. Most agree $98 million was spent to get rid of the virus and return the network to normal. The repair cost included eight million hours of lost access time and one million hours of direct labor.

On July 26, 1989, Morris was indicted on part of the 1986 Computer Fraud and Abuse Act. They claimed he intentionally and without authorization accessed the system.

Ten months later, Morris became the first person sentenced under the act. He received three years probation, a $10,000 fine, and 400 hours of community service. The judge stated he did not abide by federal sentencing guidelines because he did not think this incident caused fraud or deceit.

The Flu-Shot 4 virus. One virus that had a malicious intent was the Flu-Shot 4 virus that appeared on bulletin boards in early March 1988. It was created with the intent to deceive users into believing that it was a legitimate version of a viral detection program called Flu-Shot 3. The programmers of this virus achieved their goal.

The screens used for this virus program appeared strikingly similar to those for the original Flu-Shot 3. All of the same information was displayed, which convinced most users that Flu-Shot 4 was a legitimate program.

The users were given the option of installing the program into their system or simply reading the documentation about the Flu-Shot 4 program. In both cases, the virus would be executed. The purpose of the Flu-Shot 4 was malevolent in nature. It destroyed key clusters on hard disks and cluttered the disk parameter table (DPT) on floppy disks.

The Christmas tree virus. The Christmas tree virus appeared on IBM's communication network in December 1987. The virus originated in West Germany and spread to the United States through the BITNET network. It created a message on the screen that included a Christmas greeting and an image of a Christmas tree. This seemed to be a perfectly innocent action, but in reality it was a prank that eventually caused a big disruption of the IBM network.

The Christmas tree virus duplicated the original message and soon filled the network with exact replicates of itself. Each time a machine on the system was activated, that machine became infected as well as all the disks used by that machine. The Christmas tree virus did not destroy anything on the IBM network, but it did slow down the network. Luckily for IBM, the virus was detected and removed from the system before any major problems occurred.

The Aldus peace virus. The Aldus peace virus is another well-known virus. On March 2, 1988, a message appeared on thousands of Macintosh PC monitors in the United States and Canada. The message read: "Richard Brandow, the publisher of MacMag, and its entire staff would like to take this opportunity to convey their universal message of peace to all Macintosh users around the world."

This message was created by Richard Brandow, a publisher of a computer magazine, to show the computer world how widespread computer piracy has become. He started the virus in Montreal and thought it would only spread in the general vicinity.

Brandow put the virus in a popular computer game called "Mr. Potato Head." He left this game in the MacMag office for only two days. The message showed up in a program called Freehand, distributed by Aldus Corporation. This led to the recall of approximately 5,000 copies of this program. The Aldus peace virus was not considered destructive. No files were damaged, and it did not interfere with any computer functions.

The Pakistani brain virus. The Pakistani brain virus affected systems around the world. The virus originated in 1986 in pirate disks sold by two Pakistani brothers in Lahore, Pakistan. They illegally pirated copies of American software and then created the Pakistani virus for these copies. Foreign tourists' interests were drawn to these disks because of their attractive prices. A number of these infected disks were purchased by foreigners and eventually the virus spread throughout the world through exchanged disks.

The only positive effect of the Pakistani virus is the benefit felt by the software industry. The potential destructive properties of viruses has made individuals more likely to buy proprietary software, which is packaged and sold by the manufacturer. By purchasing programs directly from the manufacturer, the probability of viral infections is minimized.

The Pakistani virus has received much attention within the United States because it was the first virus to strike outside a test laboratory. It is also one of the most complex viruses to have found its way into computer technology.

This was the first incident that demonstrated how newspapers, magazines, and other sources have become vulnerable. The Providence Journal was infected by the virus, and one reporter lost six months of work as a result of the destruction. This occurrence was merely one of more than 200,000 estimated infections by the end of 1988.

The Israeli virus. The Israeli virus had political impact as its underlying motive. It was discovered in 1987 at the Hebrew University in Israel. Its goal was to wipe out files on Friday, May 13, 1988--the 40th anniversary of the liberation of Palestine. The virus had the potential to destroy important research findings, financial records, and other significant data. Fortunately, the virus was contained before it wreaked havoc.

The international perspective. Despite the potential damage of computer viruses in the United States, some hackers aspire to have influence on an international basis. These individuals have motives that range from personal gain to making a political statement or creating an act of terrorism.

On a global scale, the potential for destruction is almost entirely unrestricted. It is not difficult to imagine the horrifying ramifications of an individual with ill intentions who breaks into the defense systems of a nation.

Throughout Asia and the European Economic Community, computer viruses are a problem. In France, it is estimated that computer security is breached 20,000 times per year. In Japan, one virus struck the users of the NEC shopping network. It instructed systems to disclose the owner's password and identification number so the creator of the virus could make purchases using their accounts. The problem has escalated to the point that the government is giving tax incentives to companies that improve their computer security.

Despite the impact of viruses on an international scale, much of their destruction in other countries goes without notice in the United States. The principal reason is that viruses have not caused as much damage globally as they have locally.

There are not as many computers in other parts of the world as there are in the United States. For example, there are around five million PCs in Europe while there are some 30 million PCs in the United States. Computers also tend to be more expensive in foreign countries and thus less affordable.

One of the main problems concerning computer systems is their susceptibility to tampering. Other vulnerabilities include, user awareness, security controls, bugs and loopholes, and network misuse.

User awareness and security controls. Many people today do not understand how viruses function. Users often copy and share software without taking precautions to see if software is infected. Many PCs lack software and hardware security devices that prevent or detect unauthorized users. When such devices are present, they often are not sufficient.

Bugs and loopholes. A security control system often contains bugs or loopholes, which allow more knowledgeable users to break into the system. Entering a system does not always have to be through a backdoor. There may just be a failure to enforce physical access controls.

Network misuse. A computer system is also vulnerable to viruses if it is linked to a network. This link allows a greater number of users and forces the level of security to be higher. Good security measures can also be ineffective if they are misused. Some common misuses include passwords that are easily guessed and access to more levels than a user is entitled.

Computer viruses are a growing problem, but steps can be taken to reduce the risk of an infection. A virus prevention program includes

* implementing physical security measures, * limiting access, * using technical controls, * educating users, * monitoring the system, * managing software, * monitoring users and software activity, and * having contingency policies and procedures.

Implementing physical security measures. Physical controls are an effective method of security. Warning signs should be posted to deter unauthorized users. Visitors and authorized users should be required to sign an agreement that says they will comply with organization rules.

Users should not be allowed to enter a system through a remote access. They should be limited to the amount of freedom they have when logged on to the system. An organization should retain copies of the original software in secure places. Also, a thorough security check of employees should be conducted.

Limiting access. A good preventive measure is to limit machine and media access. This can be accomplished in several ways. First, a password can deter unauthorized users. The password should limit access on a need-to-know basis. One way to limit access is to force the user into an application instead of allowing log-in menus.

To further deter unauthorized entry, a record of all log-ins should be kept so if a break-in does occur, the culprit will be identified. After a user finishes with the software, it should be locked up in a secure facility to prevent theft or tampering.

Using technical controls. Technical controls help ensure the integrity of data and make viruses harder to implement. Technical controls should restrict unauthorized access and limit the extent of privileges to the different users. When technical controls are selected, the information should be ranked according to need. These controls work best when they are used with other types of controls.

Educating users. Educating users is probably the best and most secure step. Although it is the best step, it is also the most expensive because of the time and resources involved. An efficient education plan should include information about how viruses infect a system and company policies towards the back up, storage, and use of software.

Monitoring the system. Another effective control is monitoring a system to detect unauthorized use. Some good methods include keeping audit trails, using antiviral software, and checking for changes in file size and date.

Managing software. Preventing the spread of viruses can also be achieved by effective software management. The first way is not to share software with other users. Another way is to be sure that software is obtained from a reliable source. Before booting a system, the disk drives should be checked to ensure the write protection tabs are in place on any disk that is inserted. Finally, all new disks should be checked before they are loaded onto the system and then backups made and stored in a disk library.

Monitoring users and software activity. When buying new software, there can be many surprises from quirks in the system and from viruses implanted in the software. Therefore, a user must be careful when buying or using any software that is new to the computer system. The first and most important item to remember is to verify the authenticity of the source. If the software comes from a company that offers reliable products, there usually is no need to worry.

On the other hand, if buying from a relatively new company or a company that not much is known about, a few precautions should be taken. Have a waiting period of a few weeks before running the program. This will give time for any problems to be made public. If no news comes, run the program on an isolated machine. This will ensure that only one machine will be infected, not the entire network. Before running the software, back up copies should be made of all programs to ensure that recovery can take place if a failure occurs.

When the software is run, a user should check for viruses in a number of ways. The first task to be done is to keep a manual log of all file sizes. Then, if there is any change in the length of a file, there is the possibility of infection.

To check for this abnormality, a dummy execution file can be loaded into the computer that can be the target for any virus infection. After running the program, any hidden messages should be displayed.

Another common item that viruses use are variations in the date. Some of the common dates are one month ahead, one year ahead, Friday the 13th, and April 1.

Having contingency policies and procedures. A contingency policy should always be fully planned before a disaster occurs. Contingency plans could include hot sites and cold sites, along with written policies that state exact actions to take if disaster strikes.

Often even the greatest protection schemes cannot prevent a virus from penetrating a system. Various ways of attempting to recover from a virus infection exist.

The amount of difficulty involved in the recovery process depends on three factors: the type of virus that infects the system, how long the virus has been in the system and, how many computers the virus has infected. These factors help to determine how difficult it will be to recover from the infection.

Viruses attack different parts of a computer system, including programs, operations systems, and even the boot sector. Some viruses will infect only one specific area, while others will infect any or all parts of the system.

The longer a virus goes undetected, the more damage it can do. A virus can attach itself to all disks that come into contact with the system and spread into other systems. The infection to the system is broken down into the local memory infection, local disk storage infection, shared file system infection, and the infection of system-wide removable media.

A virus searches for programs in the local storage areas to attach itself to when it first enters the system. The virus may not attach itself right away. It may instead wait in memory until it finds something to attach to.

If the virus can be detected at this early stage, then recovery is relatively simple. The process includes powering down the system, rebooting with a clean diskette, running a utility program to check the integrity of the hard disk, and removing the infected elements on the hard disk. Whenever a virus is found, the original disk containing the virus should be properly disposed.

If the virus is not found early, the chance of the infection spreading to local storage is great. Depending on the type of virus, infection may occur in every program the virus comes in contact with or it may periodically infect programs.

If a virus is not found quickly, it does not matter which method of infection the virus uses because all files will become infected. This recovery process is more detailed and may result in the loss of data. The only way to regain normal operations may be to reformat the files.

Today, many businesses are set up as a network environment. Networking causes greater concern whenever viruses are involved. When a network's file server becomes infected, the entire network system will soon be infected by the virus. The various connections to the network become infected whenever an infected program is executed from the file server.

In networks, several different possible hosts for viruses exist. Some of the possible hosts are utilities, compilers, and tools. The recovery process for networks may be extensive and lengthy. All files will probably have to be reformatted before they can be part of the network environment again. If the virus infection is not cleaned from all stations, the virus is likely to reappear.

Here are a few simple guidelines to remember when recovering from a virus infection. These are taken from the book Computer Viruses, Worms, Data Diddlers, Killer Programs, and Other Threats to Your System by John McAfee.

* Don't panic. * Power down the machine. * Seek professional help or reboot from original system diskette. * Back up all nonexecutable files. * Low level format the disk. * Replace system and executable programs. * Restore data.

When a computer becomes infected, one of the most dangerous consequences is that all disks inserted into the computer may become infected. Infection is not limited to disks, however. Any form of wireable or removable media attached to the system stands a chance of being infected. A major problem is that a virus may get onto a backup copy that is archived and be around long after the system has been cleaned. The backup may be needed later and can reinfect the system all over again.

As soon as a virus is detected, a few basic steps can be taken to minimize the effects. First, try to determine the extent of the damage. Second, shut down all areas that are infected. Next, decide if it is possible that the infection has spread outside the business. Collect any and all infected items and allow no one to use any of the items. If no one in the organization has the ability to deal efficiently with viruses, contact a specialist.

In the 1970s there was growing concern over computer crime: data diddling, fraud, and the diverting of funds. In 1977, a Senate committee, realizing the seriousness of the problem, passed the Data Encryption Standard (DES), a specification for coding information and protecting data in the federal government.

Individual states have also begun to introduce computer legislation, but these laws provide little protection against viruses. It is also apparent from viruses, such as the Pakistani brain and the Israeli virus, that the problem is global. If viruses like these continue to appear, governments will recognize the need and enact some form of legislation to protect against them.

Preventing viruses from entering a computer system is absolutely essential in today's world. Although viruses cannot be totally prevented, steps can be taken to reduce the risk of a virus infection.

Obviously not all prevention tactics have been discussed, but those discussed provide a solid building block to securing a computer system. The difficulty of virus recovery depends mainly on how soon a virus is detected. The sooner a virus is detected, the less areas that will be infected.

Karen A. Forcht, PhD, is associate professor in the Department of Information and Decision Sciences at James Madison University in Harrisonburg, VA.

OCCURENCES OF VIOLENCE

1986: The Pakistani Brain Virus

* first virus to strike outside a test laboratory

* originated in Lahore, Pakistan

* infected illegally pirated American software

* tourists were attracted to the low prices

* may bring greater attention to proprietary software

1987: The Israeli Virus

* had political intentions

* discovered at the Hebrew University

* was to activate Friday, May 13, 1988--the 40th anniversary of the liberation of Palestine

* intended to destroy important research findings, financial records, and other significant data

1987: The Christmas Tree Virus

* spread through BITNET and appeared on IBM's communication network

* left a Christmas greeting and an image of a tree

* did not destroy anything on the IBM network

1988: The Flu-Shot 4 Virus

* appeared on bulletin boards in early March 1988

* tried to impersonate legitimate viral detection program

* destroyed data on hard and floppy disks

1988: The Aldus Peace Virus

* originated in Montreal

* intended to expose the extent of software piracy 

* was nondestructive 

1988: The INTERNET Virus

* most destructive virus to date

* apparently intended to be harmless

* affected many government, and business institutions

* total cost of recovery estimated at $98 million

Resources

Denning, Peter J. Computer Under Attack...Intruders, Worms, and Viruses. New York: Addison Wesley, 1990.

Hoffman, Lance J. Rogue Programs: Viruses, Worms, and Trojan Horses. New York: Van Nostrand Reinhold, 1990.

McAfee, John. Computer Viruses, Worms, Data Diddlers, Killer Programs, and Other Threats to Your System. New York: St. Martin's Press, 1989.

Vanacore, Maureen. Computer Viruses. New York: Deloitte, Haskins, and Sells, 1989.