The Responsibilities of the
Anti-Virus Researcher

1 Introduction

When we entered the field of anti-virus research in 1988, we could hardly imagine what awaited us there. We were attracted mainly by the technical challenge of studying a particular kind of “life-like” computer programs that were able to replicate and spread – and also, partly, by the challenge to measure our intellectual capabilities with those who were creating these programs and to attempt to defeat them. In other words, we were tempted by the perspective of receiving intellectual gratification while fighting on the side of the “good guys”. Little did we expect that we would get much more than what we had bargained for.

Oh, we certainly were not disappointed. Everything that we sought was there – the intellectual challenge of progressively more sophisticated viruses, the gratitude of the people we helped, the good feeling created by working in cooperation with other intelligent and similarly well-meaning people from all over the world. It’s just that there was so much more of it than expected that we are starting to feel a bit overwhelmed – not to mention the appearance of different kinds of problem we hadn’t even dreamed of.

This paper attempts to be a short summary of the challenges and responsibilities an anti-virus researcher is faced with nowadays – as seen from the point of view of the author. Some of them might seem controversial and some people will probably not agree with some of them. Still, we thought that sharing our view on the subject would be of some interest and that our 13 years of active experience in the field would put some weight behind it.

2 Technical Challenges

We came to this field seeking mainly technical challenges – and technical challenges we got aplenty, indeed. In a short paper like this one we cannot even dream of listing all the important technical developments in the past 13 years with any degree of completeness, let alone the challenges we are likely to face in the future. Whole monographies can be written on this subject. We have covered much of it in our Ph.D. thesis ([Bontchev98]) but even that is nowadays outdated to a large degree because there have been many new important developments since that work was published. To name a just few, macro viruses, 32-bit viruses and Internet-aware viruses have appeared and have developed into whole fields of their own. In the following subsections, we shall attempt to give only a general outline of the classes of technical problems, which a prospective anti-virus researcher is likely to face.

2.1 Work Overload

When we first started our career as an anti-virus researcher, the collection of all known viruses could neatly fit on a single 360-Kb floppy disk and we could afford to disassemble, analyze and comment carefully every single one of them. Nowadays no one in the world can tell exactly how many known viruses exist without making an error measured in tens of thousands. We no longer can afford to care what exactly a particular virus does (unless it is a virus that has become very widespread or has achieved notoriety in some other way), let alone to disassemble, analyze and comment every single one of them. We barely have the time to implement detection (and, occasionally, removal) of the hundreds, if not thousands of new viruses we receive every month from all over the world (but mainly from other anti-virus researchers) – and our backlog keeps increasing.

There was time in the past when a professional anti-virus researcher was expected to have a good deal of understanding of what every known virus did. This time is long past. We have been forced to specialize in some particular narrow area. For instance, the author of this paper has specialized in macro viruses; some of his colleagues have specialized in 32-bit viruses, script viruses, and so on – and even the developments in these much narrower areas have started to overwhelm us.

There used to be time when a single world-class anti-virus researcher could afford not only to analyze every single new virus he was receiving but also to develop an anti-virus product in order to handle all these new viruses. Nowadays we have whole research and development departments with different people working on different aspects of our anti-virus products and often not working with viruses at all.

The developments in virus writing and the requests of the users have forced our companies to acquire in a hurry expertise in completely different fields. We have been forced to master the intricacies of CPU emulation in order to handle polymorphic viruses; of data compression in order to scan inside archives; study the undocumented peculiarities of many operating systems and platforms; reverse-engineer arcane data formats in order to handle macro viruses for the applications that produce files with these formats; become experts in various fields of computer security in order to be up-to-date with the various security holes exploited by the latest worms.

No single human is capable of doing all this any more. Certainly, we have developed a multitude of tools to automate and facilitate our tasks. We have tools for automatic virus replication, we have tools that compare infected programs with their clean copies and automatically produce entries for the databases of our scanners which entries would remove the virus, we have automated virus analysis tools, we have implemented heuristics, neural networks and other generic detection capabilities so that once we implement a detection of a new virus, we will be reasonably likely to detect its future minor variants as well. We have developed tools that permit us to update our anti-virus products very fast – and to push these updates to our customers when a new virus appears – so that their scanners are always up-to-date.

Nevertheless, the workload is truly overwhelming – and it is getting worse every day. There are simply too many virus writers and too few capable anti-virus researchers. The situation is not helped by the fact that some office automation packages automatically create new viruses from the old ones, either ([Bontchev97]).

A new anti-virus company starting today would be faced with such a huge amount of work that they would find the work simply impossible to complete. Worse, many of the previously existing anti-virus companies have either given up, gone out of business and have been assimilated by their competitors – or have concentrated on some manageable niche in the field (e.g., only macro virus scanners, or only heuristic analyzers, or detecting only a small number of viruses known to be in-the-wild).

Moreover, the situation is not likely to improve in the future. In fact, it is likely to become even worse. New, improved viruses and new types of viruses will be created (see the next two subsections) – but this is not even the main problem; a good anti-virus company should be able to cope with that relatively easily. The main problem will be the appearance of even more new virusable platforms that will have to be reverse-engineered, understood and supported.

For instance, Linux viruses and worms are already becoming prevalent, more and more applications support some kind of Visual Basic for Applications programming language, viruses will appear for platforms like StarOffice ([Kaminski00]), KOffice ([Kaminski01]), .NET ([Hannay01]), PalmOS ([Molenkamp01]), mobile devices ([Hypponen00], [Chien00]) and so on.

There is no easy solution to all these problems. In fact, we are not convinced that there is a solution to them at all, in the long run. The anti-virus companies should continue to work on automatization of virus processing ([Bontchev93], [Morley01]), they should intensify the research of new, potentially virusable platforms, they should keep training new anti-virus researchers, specializing them in the subfields that a single human is still able to encompass.

2.2 Improved Viruses

Over the past 13 years, we have observed several main lines in the development of new computer viruses.

The most often observed line is that of trivial modifications of the known computer viruses – especially of those that have gained some notoriety for one reason or another. The reasons why this is the most often observed case is because the vast majority of the virus writers are mediocre programmers with little imagination but with a lot of ego and thirst for fame. So, when a particular virus becomes well-known for one reason or another (e.g., simply because it has become very common, or because it carries a “newsworthy” payload, etc.), lots of wannabe virus writers try to imitate it or just to modify it in some trivial way – in the vain hope to catch some of the “fame” that befell its author. While increasing the numbers of known viruses and the workload of the anti-virus researchers, this line of virus development is the easiest one to handle.

The second line of virus development that we have observed over the years is the implementation in viruses of ideas which are unique and “first” in one way or another. Typical examples include the first EXE file infector, the first MBR infector, the first memory-resident file virus, the first file system infector, the first virus written in a high-level language, the first macro virus, the first multi-platform virus, the first polymorphic virus, the first Windows virus, the first virus for some particular new virusable platform, etc. While sometimes such viruses cost the anti-virus researchers a significant amount of time and efforts (especially if the new virusable platform is not understood well yet and has to be reverse-engineered first), they pose serious practical problems to the users only very rarely. The authors of this kind of viruses are more concerned with being original than with being effective. Granted, in some cases the two coincide (e.g., the first macro virus became very widespread), but these are relatively rare. The anti-virus researchers usually have a significant amount of time to research the new threat before it becomes a practical one.

The third and most dangerous line of development in virus writing is the careful selection of viral properties, which, over the time, have proven their effectiveness in different ways and their combination into single, powerful viruses. This is the line of virus development, which poses the most significant threat – to users and anti-virus researchers alike. It is the line on which the anti-virus researchers should concentrate the majority of their efforts to counter.

A typical example of this line of virus development is the Nimda worm which used several (more than a dozen) security holes to invade remote machines and four different methods to spread itself – all of which were very effective. The worm combined several techniques used by other, very well-spread viruses – CodeRed.C, SirCam, Kak – and quickly managed to achieve a level of “widespreadness” higher than all of these viruses combined. However, Nimda is just a relatively benign example of what is practically possible even now and what we shall undoubtedly see in the near future.

A better example of what probably awaits us soon can be found in [Szor01]. The authors of that paper describe a virus (Zmist) which uses an extensive level of armoring – metamorphism (i.e., permutating parts of its body), entry point obfuscation, “code camouflage”, etc. – all of which make it extremely difficult to implement proper detection of it (let alone exact identification and/or removal) in an anti-virus program without a significant slowdown of the anti-virus program. It is very likely, the authors speculate, that in the very near future we shall see a combination of such a degree of sophistication in armoring with some kind of Internet awareness (e.g., mass-mailing), remote programmability via plug-ins (a capability which can be found in another widespread virus, Hybris), some kind of extremely damaging payload (e.g., Flash BIOS corruption, similar to the payload of the CIH virus) and even a “shotgun-like” approach as used by the Nimda virus to penetrate the system via a large number of security holes and replication methods. If such a virus is constructed and released, it will become extremely widespread very quickly – while most anti-virus companies will have a very hard time coming up with a reliable counter-measure on a short notice. If the payload of the virus triggers before the virus is reliably eradicated from most machines around the world, the resulting damage could be tremendous.

2.3 New Types of Viruses

Although it happens relatively rarely, occasionally new viruses appear which use a conceptually new way of spreading and which quickly achieve wide distribution before the concerted efforts of the anti-virus researchers can stop them. Some typical examples from the past include the first memory-resident file infector (Jerusalem.1813.A), the first fast infector (Dark_Avenger.1800.A), the first macro virus (the WM/Concept.A), one of the first mass-mailers (W97M/Melissa.A@mm), the first mass-mailing script virus (VBS/LoveLetter.A@mm), the first mass-mailer activated when the message containing it is just viewed (JS/Kak.A@mm), the first file-less worm (CodeRed) and so on.

It is impossible to predict in advance what kinds of “new type” viruses will appear in the future. The only thing that is certain is that they will appear. Furthermore, if one examines carefully the time periods separating the appearance of the viruses listed in the previous paragraph, one cannot help but notice that they are shrinking. That is, new types of viruses – “successful” enough to cause global epidemics within a very short time – seem to appear more and more often.

It is only reasonable to expect that this trend will continue for at least some time in the future. It is very likely that at some point of time the successfulness and speed of spread of these new kinds of viruses will exceed the capabilities of the anti-virus world to handle them. That is, it is very possible that the time will come when a new virus causing a global epidemic appears even before the anti-virus companies have managed to put down the “wildfire” caused by the previous global epidemic.

There is a variety of measures, which the anti-virus researchers from all over the world should take in order to alleviate this problem. We need a higher level of cooperation between us and of coordination of our efforts. We need a network of information centers and centralized virus reporting. We need more effective means of ensuring that the users are always running the latest versions of our anti-virus software. We need more successful (and usable!) means for generic virus detection and less reliance on known-virus scanners. We need to expand aggressively our virus labs and train more capable anti-virus researcher. We need to research actively every new virusable platform and get ready to handle viruses for it even before these viruses appear.

Unfortunately, all this is easier said than done. The work overload mentioned in subsection 2.1 prevents us from spending on pure research as much time as we would like to (or, sometimes, even as much as we need to). The average user simply does not have the qualification to use anything more sophisticated than a known-virus scanner – and does not want to acquire such a qualification. The mutually exclusive competitive interests of the anti-virus researchers (and sometimes issues of trust) often get in the way of mutual cooperation and coordination. The fact that the major producers of virusable platforms like Microsoft are not exactly forthcoming when it comes to providing technical details about the arcane file formats used by their applications does not help the situation, either.

2.4 New Usage of Malware

During most of the past 13 years, writing computer viruses has been mostly a perverted form of recreation for morally underdeveloped teenagers and the means by which irresponsible vandals could express their total disdain for the values of the society. However, recently an increasing number of much more dangerous people have started to realize that the computer is not just a toy – that it can be a weapon, too.

The first to realize it has been the organized crime. In the past couple of years there have been several cases when criminals have broken into computers with the explicit goals to steal credit card numbers and other sensitive information and to use it for profit. However, this is just the beginning of what lies ahead.

Contrary to popular belief, computer viruses are not very suitable to use as a military weapon – they are extremely difficult to aim at a particular target. In addition, the attractive military targets (e.g., anything more sensitive than logistics or public relations) are unlikely to be susceptible to virus infection. However, computer viruses are very well suited for use as a terrorist weapon ([Bontchev94]) – against civil, not very well-protected targets and when the attacker does not care which particular targets will be hit.

While most terrorists still prefer to use crude explosive weapons aimed mainly against human life, the world has truly changed on September 11, 2001. The terrorist attacks on that date against the buildings of the World Trade Center and the Pentagon showed clearly that no monstrosity is big enough for some terrorists to commit and that people nowhere on the globe are completely safe from terrorism. Furthermore, the denial-of-service attacks against the Web sites of CNN and Yahoo in the spring of 2000 showed that even relatively trivial attacks against high-profile civil computer installations can cause very unpleasant and costly disruptions. The final element of the picture is the realization that even not intentionally destructive viruses like Melissa, AnnaKournikova or CodeRed can cause tremendous amount of financial damage (measured in billions) just by spreading widely and using up resources. It will be only a matter of very short time until the terrorists of the world realize the full implications of the above.

Imagine a virus which spreads explosively all over the world in a matter of hours, like CodeRed did. Once it has successfully invaded a machine, it turns it into a “zombie” – a subordinate in a network of machines that can be controlled by the attacker and can be used to launch denial-of-service attacks against particular sites on the Internet. Imagine also that then the attacker instructs all the infected “zombies” (the number of which will measure in many millions, as suggested from the CodeRed and many other cases) to attack all the financially sensitive sites. Presumably, the most sensitive sites like the bank and brokerage computers performing financial transactions will be well-protected and not exposed to the Internet. However, it would be sufficient to attack simply the user-end computers of the on-line brokerage and financial quotes sites – so that the users will be unable to contact their brokers or get financial quotes of the stock prices. The damage – both in terms of personal losses because trades could not be made at the right time and price and in terms of lost business for the on-line brokerages – will be tremendous. Add to this scenario the stealing of the user name and password of the user when the latter is attempting to access his or her financial account and then siphoning the funds from that account, multiply it by millions of affected users and you will begin to get an impression of what can be done even now and what is likely to be at least attempted in the near future.

In fact, it is already beginning to happen. Although we have yet to see a large-scale terrorist attack using malware to target critical infrastructure computers in the developed countries, several parties have already realized that the computer can be used as a weapon and are working in a direction which will inevitably lead to a scenario similar to the one described above ([Vatis01]).

There is little the individual anti-virus researcher can do to prevent such a problem – it is mostly a task of the governments. But we can remain on alert and aware of the threat, educate the responsible parts of the governments and the law enforcement agencies, prepare means for rapid response and update of the protection used by our customers and so on.

3 Education

It is often said that education is an important part of fighting the virus problem successfully. The author agrees only partly with this statement. There are two very different kinds of education – education of the average user and education of new anti-virus researchers. We shall cover them in the next two subsections.

3.1 Education of the User

When people talk about education about computer viruses, they almost always mean educating the average user – probably because he or she is most often very ignorant on this subject and in dire need for such education. One does not need to go very far to see how ignorant indeed on this subject are the users – one only needs to ask a few of them. It will become immediately evident that they have no clear idea of what exactly a virus is (many confuse viruses with Trojan horses), how they can get infected by one (“I clicked on that attachment because it was sent by somebody I knew and said it was something interesting”), or how to protect themselves properly from one (“Backups? I don’t have time for backups!”).

However, in reality the situation is even worse – much worse. As demonstrated in [Bontchev01], roughly 97% (!) of the users simply do not care even when they are explicitly told by a specialist that their machine is infected with a computer virus. If one still doubts the vast levels of ignorance of the common computer user, one needs just to talk to the working in the technical support department of any anti-virus (or, indeed, any computer service related) company – any of them has many “war stories” to tell. Computer viruses are still a problem not for technical reasons (i.e., not because their authors are extremely clever or because the anti-virus producers are too inept) – they are still a problem for social reasons; because the vast majority of the users is ignorant about them and does not care. In other words, computer viruses are not a technical problem – they are a social problem.

For some, this simply means that there is a lot of educating still to be done and that the anti-virus people simply have not done a good enough job in this aspect. The author of this paper, having himself done a lot of user education in the past, tends to disagree rather strongly with this notion.

The problem is not that we have not tried hard enough to educate the users – the problem is that the users do not want to be educated on this subject. Moreover, why should they? They are accountants, physicians, architects – and any other kind of hundreds of other professions in which they are undoubtedly very knowledgeable and good at. They are not security experts and do not want to become such just for the privilege to be able to continue doing their main job. They expect us, the anti-virus researchers, to take care of the computer security problems – just like they are taking care of the problems in their specific field of expertise.

In addition, they are right. This is why any hope to solve (or even alleviate) the computer virus problem that relies on user education is a futile one and any attempt at general user education is doomed to fail. Oh, certainly almost any particular user can be forced to learn a few basic things. However, for every one we manage to teach, there are hundreds of thousands of others we cannot even reach, let alone teach.

There are two possible solutions to this problem. One is to require the users to already have some kind of basic computer security education before they are permitted to use a computer – or at least before they are permitted to connect to the Internet. For instance, one is required to take an exam and to obtain a driver’s license before one is allowed to drive a car and get on the highway. It could be argued that one should be similarly required to take an exam and obtain a user’s license before being allowed on the Information Superhighway. It is true that an incompetent driver can cause a lot of damage and even loss of human life – but an incompetent computer user can cause a lot of damage too – sometimes measured in billions of dollars. Unfortunately, we do not think that enforcing such a solution is very practical or likely.

The second solution is to force the users to behave properly from the point of view of computer security – even if they do not know what the proper behavior is and do not want to learn it. And, indeed, why should the users simply be informed politely that a new security patch (or anti-virus update or whatever) exists and why it should be left up to them to obtain and install it?! The users should be forced to do so.

That is, they must not be allowed to use their computers or to surf the Internet if it is detected that they do not have the very latest security-related updates installed. In fact, such policies are already in place in many companies; we only need to have them enforced world-wide even for the individual users.

It can be achieved in two possible ways. First, it can be achieved on a global scale by Microsoft implementing the proper controls in their operating systems. Then, instead of merely notifying the user that a new “critical update” is available, the operating system will not allow the user to surf the Internet (or even use his or her computer for a significant amount of time) until this update is downloaded and installed. Alternatively, even better, the operating system should automatically download and install the update as needed, as soon as the user connects to the Internet.

There are two problems with the above approach. One is that on some machines the update will probably fail or turn out to be incompatible with some other software installed on them or otherwise inappropriate – and Microsoft would not want to be widely known that it can (and sometimes does) force people’s machines to become unusable. Another problem is that Microsoft can use this approach only to close security holes in their own operating system – they cannot use it, for instance, to distribute anti-virus updates.

The second approach is to implement this kind of “security enforcement” at the different Internet Service Providers (ISPs). Even now there are several ISPs (e.g., Message Labs) which actively scan their users’ e-mail for known computer viruses and remove them from there, if any are found. Others block known security attacks (e.g., from the different worms like CodeRed or Nimda) from and to their users. They only need to take this one logical step further and ensure that their users are properly protected with the latest security patches and anti-virus updates before being allowed to connect to the Internet at large.

Of course, despite everything that was said above, there is a kind of user education, which still is – and will always be – a responsibility of the anti-virus researcher. That is, when the user contacts us with particular virus-related questions, it is our duty to provide exhaustive, precise and correct answers.

3.2 Education of Other Anti-Virus Researchers

While the author considers the attempt to educate the vast majority of average users about computer viruses generally a waste of time, there is another kind of education which is vitally important for the anti-virus industry. This is the education and preparation of new anti-virus researchers.

The number of competent, top-level anti-virus researchers is extremely small. According to this author’s estimate, it is about only three dozens worldwide – with each major anti-virus producer employing only 2-3 of them, on the average. There are several reasons for this – but the main one is that the job of the anti-virus researcher is extremely stressful one. It requires a vast knowledge in various (often seemingly unrelated) computer fields, a good knowledge of several programming languages (and assembly language in particular), experience with reverse-engineering, ability to work under constant stress and deadlines, high responsibility and concentration when working with potentially dangerous code, a certain level of pedantism and perfectionism, and so on.

Most of the above qualities are not taught at any school or university. Furthermore, people who are naturally bright and intelligent (one of the requirements for the anti-virus researcher) usually lack the pedantism to perform boring jobs like wading through kilobytes of clumsily written code (another such required quality). In the same time, the constantly increasing work overload mentioned in section 2.1 tends to overwhelm even the brightest anti-virus researcher as time goes by – and as they grow older, their ability to perform the various tasks of anti-virus research tends to deteriorate, too. Therefore, it is imperative for the anti-virus industry to constantly increase its pool of anti-virus researchers.

Since, as mentioned in the above paragraph, it is unlikely to find readily educated anti-virus researchers among the graduates of most schools and universities, the obvious conclusion is that the anti-virus industry has to train them itself. We have to get people who have the basic qualities (bright, intelligent, pedantic, hard-working, knowing several programming languages) and to train them to perform the tasks required by our profession.

Unfortunately, this is easier said than done. We are usually overloaded enough with everyday virus-related work and feel that we cannot afford to spare the time to teach apprentices. Furthermore, many of us simply do not know how to teach properly others to perform even the we know how to perform well. There are not a great many textbooks for training aspiring anti-virus researchers, either.

The point, which the author of this paper would like to get across, is that we simply cannot afford not to teach followers. If we do not, the increasing amount of work and our deteriorating capabilities to do it will simply overwhelm us completely. Any time spend to train another anti-virus researcher is time properly invested for the future – even if it is done at the price of processing a few new viruses less. Also, the self-taught anti-virus researchers are extremely rare; it is up to us, the existing anti-virus researchers, to train new ones.

Regarding the lack of teaching manuals, when the author of this paper wrote his Ph.D. thesis ([Bontchev98]), one of his main goals was to produce something which could be used as a textbook for training other anti-virus researchers. Since then, his thesis has been successfully used precisely for this purpose in several anti-virus companies.

4 Cooperation

There are many more virus writers than there are anti-virus researchers. The only way we can hope to gain any significant advantage in the war against them is by cooperating among ourselves and with the law enforcement.

4.1 Cooperation With Other Anti-Virus Researchers

Hundreds of new viruses appear every month – some of them are even automatically generated by the Microsoft Office applications ([Bontchev97]). New virusable platforms appear all the time. In short, currently the field of anti-virus research has become so vast that it is impossible for a single anti-virus researcher – or even for all the anti-virus researchers of a single anti-virus company – to encompass it completely. This is why the anti-virus researchers need to cooperate among themselves and with the different law enforcement agencies if they want to have any hope of success in the war against the virus writers and their creations.

4.1.1 Sending New Viruses to Each Other

As mentioned above, cooperation among the anti-virus researchers is vital. In the long run, it is more important than the commercial competition between the anti-virus companies. Even if the latter might produce higher returns for short periods of time, companies, which refuse to cooperate and put their main emphasis on competition, are doomed to fail in the long run.

There are many ways in which this kind of cooperation can take place. We shall describe them in this subsection.

Usually, when speaking about cooperation among the anti-virus researchers, most people think about the regular swapping of new viruses that often takes place. We prefer to avoid the term “virus exchange” in order to distinguish this kind of activity from the one that takes place on the so-called virus exchange (VX) sites – where people who are not legitimate anti-virus researchers (and, in fact, are often virus writers) exchange viruses with each other and/or make them freely available to the general public; an activity which we find highly irresponsible and unethical.

Besides, the term “exchange” implies some kind of swapping in a quid-pro-quo basis – something, which simply does not take place in the anti-virus world. A better description of what happens there is to say that the anti-virus researchers are sending viruses to each other – without requiring anything in exchange. The idea behind this kind of activity is that, in the long run, the ultimate duty of the anti-virus researcher is to protect the users from viruses – and that by sending new viruses to other anti-virus companies, they help these companies implement detection of these viruses and therefore to protect the users from them. In the long run, the benefits of this by far outweigh the benefits of the publicity an anti-virus company can gain by being the only one to have a product detecting some particular virus simply because no other anti-virus company has a copy of this virus.

Of course, one must never forget that computer viruses are inherently dangerous stuff and that access to them should be provided only on a need-to-know basis and only to competent and trustworthy individuals, as we shall describe in more detail in section 5.2.

There are several models of this kind of cooperation. In the first days of the computer virus era, the anti-virus researchers were usually sending “interesting” viruses (i.e., viruses that contained some unusual technique) to each other on a personal acquaintance basis. This kind of virus sending was relatively limited.

A much more advanced model of such cooperation was implemented by CARO – the Computer Anti-virus Researchers’ Organization. This organization was created in 1990. Its main goal is cooperation in the fight against the computer virus threat among the best anti-virus researchers of the world. Sending viruses to other anti-virus researcher is only one aspect of this cooperation. In CARO we have an agreement to send to each other all the new viruses we get. For some kinds of viruses (e.g., macro viruses, mass-mailers or other kinds of “urgent” viruses) this is done immediately, in securely encrypted form (we use PGP) and by e-mail. For other, less urgent kinds of viruses, this is done periodically – usually once a month. Each CARO member sends viruses only to competent and trustworthy anti-virus researchers – which in many cases covers only other CARO members or even just a subset of them.

A third model is used by some anti-virus companies who simply send every month batches of new viruses they have received during the past month to several other anti-virus companies. At a first glance, this model has the advantage that it does not depend on a particular person to do the sending or to receive the batch – i.e., it would ensure smooth operation even when a particular anti-virus researcher is not available for one reason or another. However, this relaxes the condition that viruses should be sent only to technically competent and trustworthy individuals – which, in the long run, is likely to misfire. And, indeed, we have observed that companies that subscribe to this model of virus sharing often commit different kinds of blunders – they send out things which are not viruses, they occasionally send things that really should not have been sent to anyone (e.g., an accidentally created new virus, a file containing confidential customer data, or other things that should have never left the company), and/or they send viruses to people who are either not sufficiently trustworthy or not sufficiently competent (or both) to handle such things. While major disasters are rare, relatively minor mishaps do happen quite regularly to the companies using this model.

Another model is used by the AVED (Anti-Virus Emergencies Discussions) organization. It is loosely based on the CARO model but the membership restrictions are much lower. That is, generally any technical person from a company anti-virus producer can be admitted, provided that there is no clear evidence that the person has been engaging in unethical acts or is not clearly incompetent. However, this organization limits itself only to sending out to its members viruses that are urgent in one way or another – e.g., likely to cause (or already causing) a global epidemic. It is considered that the benefits of having an “urgent” virus quickly available to the people in the industry whose direct responsibility it is to implement protection from it far outweighs the drawbacks of accidentally sending such a virus to a person with insufficiently high levels of trustworthiness and technical competence. After all, if the virus is already spreading wildly, the negative effects of giving it to an inappropriate person are relatively limited, since that person is likely to obtain it by other, natural means anyway. Of course, AVED still applies reasonable “due care” when selecting its members and uses secure ways of communication (PGP encryption) for the purposes of virus distribution.

Finally, a much more relaxed model is used by an organization called REVS. It is somewhat similar to the AVED model and has very similar goals. However, the restrictions on the organization’s membership is much more relaxed (even people who are not technical anti-virus researchers but are simply involved in virus-related work in big companies can be admitted as members), the rules regarding what kind of malware can and should be send are much fuzzier (which often allows the members to “hype” viruses that do not have a prayer of surviving in the wild – they do this by claiming that they are “urgent”, sending them to REVS, and publishing a press release about them “because they were sent as urgent viruses to REVS”), and the membership is on a company basis instead of on individual basis (which makes it much more difficult to forge relations of trust - after all, one doesn’t really know who is the person on the receiving end and what is their competence and trustworthiness). It is our opinion that the REVS model is not viable and, in fact, highly dangerous and irresponsible. It has begun, in fact, to die out – after several of the dangers the creators of REVS had been warned about have materialized and after the AVED model was implemented to achieve the same goals by more acceptable means.

It is substantial to note that sending viruses to each other, while of significant importance, is by far not the only (or even the most important) aspect of cooperation among the anti-virus researchers. Some companies have mistakenly concluded that this is the only kind of cooperation they should engage in (or even, in some cases, that they are entitled to receive this kind of cooperation from anybody else in the anti-virus industry just by the fact that they, too, work in this industry). They have often been unpleasantly surprised not to receive this kind of cooperation because they have not proven themselves trustworthy and technically competent and/or because they refuse to cooperate in other aspects.

4.1.2 Sharing Virus Research Tools

Each anti-virus company employs a set of tools that help their anti-virus researchers in their work. It could be something as simple as extracting the source of a macro virus from Word documents up to sophisticated automatic virus replication systems and whole GUI disassembler/emulation environments for virus analysis and automated generation of virus detection and disinfection database entries.

Naturally, most of these tools are for restricted use within the company that has developed them. Most of the time the reason is that they represent a significant amount of investment in terms of time and resources and are supposed to give some kind of competitive advantage to the company that has developed them. In other cases, they would simply be useless to anyone outside the company – because the other companies use virus handling methods, which are drastically different from the ones, the tool is supposed to facilitate.

However, in many cases the tools are relatively simple and of universal use to most anti-virus researchers. In such cases, the anti-virus researchers from the companies that have developed these tools often make the latter freely available to other fellow anti-virus researchers – even if these anti-virus researchers work for competing anti-virus companies. Finally, in some cases the tools are shared because their common use would be of benefit to everybody, including to the company that has produced them.

As examples of such tools developed by one company and shared with others we can mention program for listing the macro source of various macro-containing documents, programs for identification of scripts (e.g., script viruses), programs for identification of known non-viral crap that is often contained in the popular VX collections, and so on.

One excellent example of this kind of cooperation is the program F-VBACRC developed by the company the author works for – FRISK Software International. It is a program for VBA macro malware identification. It takes a Microsoft Office document containing VBA modules, locates the macro structures inside, calls a set of DLLs passing them these structures and outputs the result returned by these DLLs. Each DLL is developed by a different anti-virus company and outputs identification data which would permit that company to implement detection, recognition, identification and disinfection of the macro virus (or any other macro malware) contained in the document without even having seen the actual piece of malware. This tool permits the companies using it to share macro malware identification data without having to share the actual macro malware – therefore, allowing a much wider cooperation and ability to implement detection of new macro malware than would have been normally possible under the restrictions of sending viruses only to technically competent and highly trustworthy individuals.

4.1.3 Sharing Virus Information

As the numbers of known viruses, virus types, viral techniques and virusable platforms have increased beyond the capabilities of a single person to encompass, several anti-virus researchers have begun to specialize. For instance, the author of this paper has specialized in macro viruses; other anti-virus have specialized in other areas – such as 32-bit viruses, script viruses, mass-mailers, worms, Trojans, etc.

When a new, complicated virus appears, all anti-virus companies hurry to analyze it. However, the companies who employ anti-virus researchers that have specialized in the area of which the new virus is a representative are more likely to produce a more complete and error-free analysis of it. In fact, this is true not only for particular viruses but also for virus techniques, virusable platforms, various bizarre cases, and so on. In each one of these cases the anti-virus researcher who has specialized in that particular area is more likely to come up with high-quality results and explanations.

It is of the benefit of everybody – anti-virus companies and users alike – that the results of such analysis are freely shared among the anti-virus industry. The alternative approach of having every company do the necessary research entirely on its own would lead to an unnecessary duplication of efforts, to a waste of time and other resources and, necessarily, to a lower quality of results and information that can be communicated to the user. The end result will be that the user will be worse informed and less well protected – and at a higher cost.

Fortunately, most anti-virus companies understand this very well and are not opposed to this kind of cooperation – in fact, they encourage it very much. It is conducted on various levels – from personal communication to dedicated mailing lists such as VMacro (limited to macro virus discussions), VTech (limited to CARO members only), AVED (limited to discussions of “urgent” viruses) and so on.

We must note, however, one rather unfortunate aspect of this cooperation. Some companies go as far as to steal directly the virus analysis and descriptions of other anti-virus companies from their Web sites and press releases. Sometimes the theft is so blunt and incompetent that the original wording and even technical mistakes and typos are preserved. Needless to say, this is a kind of activity we strongly frown upon.

4.1.4 Coordination of Virus Names

One of the most annoying (for the user) problems of the anti-virus industry is the lack of coordination between the virus names used by the different anti-virus products. Because the different products often use different names for the same virus, the user is often unable to determine whether a product detects a virus just from the name of that virus. For instance, if the producer of product X issues a press release about a new virus called Foo, the user of product Y has no idea whether his product detects the virus – for instance, that product might use the name “Foo” for a completely different virus or not use it at all and call the virus mentioned in the press release with some completely different name – e.g., “Bar”.

Another problem is that one and the same user often uses more than one anti-virus product. In such cases, endless confusion is caused when the two products find some virus on the user’s machine – but report it under very different names. The user often concludes that s/he has more than one virus. According to Dr. Alan Solomon, in one such case the user used 13 different products, which reported 13 different virus names found on her machine. When one of these products was used to remove the virus it had detected, the remaining products suddenly stopped reporting any viruses. The user concluded that the remaining 12 viruses had seen her killing one of their fellows and had “gone into hiding”. The truth was, of course, that she had only a single virus – but it was reported under 13 different names by the 13 different products.

The problem is made worse by two major issues. First, some anti-virus companies have a policy of never changing the name of a virus, the detection of which they have implemented in their products. There are various good reasons for such a policy – for instance, if the company lists the names of the viruses their product detects in the printed documentation of their product, it is prohibitively expensive to change the virus names often.

Second, when some kind of “important” virus appears (e.g., one which uses a novel technique, or one which has become suddenly very widespread, or one with an extremely dangerous payload, or one which has become “popular” for other reasons), many anti-virus producers are in a hurry to publish press releases (which are most often than not thinly veiled advertisements) about it. They are usually so much in a hurry to publish ahead of their competitors, that they do not have the time to consult with other anti-virus researchers and agree on a commonly acceptable name for the virus. (In fact, sometimes some of them are so much in a hurry, that they forget to ask even the anti-virus researchers employed by them and leave the matter entirely in the hands of the marketing department; see also subsection 5.5.) If later it turns out that the virus name they have picked is inappropriate for one reason or another – or if it turns out that other companies have announced the virus under different name(s), it is usually too late (and too much of an embarrassment) for the company to change their press release and issue corrective statements. Therefore, the “wrong” (or just different) name remains permanently. There are countless examples of this happening in the past.

Some professional anti-virus organizations (which are a form of cooperation among the anti-virus researchers) are doing their best to avoid (or at least alleviate) this mess. For instance, CARO has constructed a virus naming scheme, which they are recommending to the anti-virus producers to adopt as a standard. AVED (which, too, has a large involvement of CARO members) does its best to coordinate the names of the “urgent” viruses when they appear – so that at least for them the different products use a common name (or at least very similar names).

However, there is still a lot remaining to be done in this area. For instance, usage of the CARO virus naming scheme is entirely voluntary and not always well-understood. Furthermore, neither CARO nor AVED nor anybody else has the power to enforce and centrally coordinate the names given by the different anti-virus products to every new virus. There is an urgent need for a centralized organization with enforcing power in this aspect. Unfortunately, such an organization is difficult to create, there isn’t any practical way in which it could enforce common virus names to the anti-virus producers, and in many cases a centralized organization would be too slow to react to a new and fast-spreading virus. After all, when a new epidemic is exploding, the anti-virus producers cannot afford to sit on their hands until some centralized entity decides what the name of the new virus should be – they are in a hurry to produce defenses against the new virus and to distribute them to their users; everything else has a lower priority.

Perhaps one way to enforce (or at least to strongly motivate) the anti-virus producers to stick to a common virus naming standard is to have the popular testers of anti-virus software (e.g., Virus Bulletin, VTC-Hamburg, ICSA, etc.) conduct tests of how well the different anti-virus products conform to a widely accepted virus naming standard and penalize those that do not.

4.1.5 Sharing Other Kinds of Information

There are several other kinds of information, besides the ones described above, the sharing of which among the anti-virus researchers has a beneficial effect to the industry and to the users. Examples include number and geographical location of virus reports, information about new possible virus and anti-virus techniques, information about virus writers, information useful for shutting down of virus distribution sites, and so on.

4.2 Cooperation With the Law Enforcement

While the anti-virus researchers cooperate most effectively and with greatest benefit among themselves, this is not the only kind of cooperation they should seek. It is equally important that they work with a close cooperation with the various law enforcement agencies.

Intentionally infecting other people’s computers without authorization is a crime in most civilized countries. In some countries even the process of the virus writing is illegal ([Bontchev98]). However, a law, which is not enforced, is not very useful – in fact, sometimes it could be harmful because it emboldens the criminals to break it.

In the same time, most law enforcement agencies still lack the proper education, knowledge, skill and tools to handle computer virus-related situations properly. A typical example is the National Infrastructure Protection Center (NIPC) in the USA – a branch of the FBI, its task is to protect the infrastructure of the USA, including such things as computer networks, telephone lines, etc. Clearly, handling of computer virus epidemics and hacker attacks is included in the set of activities of that organization. Yet in the recent past the NIPC has often issued unnecessarily panicky “virus warnings” that did more harm than good. At one point, they were even infected with the SirCam virus – a virus which mass-mails itself containing potentially confidential documents found on the victim’s machine. Obviously, the people at the NIPC could use a significant amount of education – education that the anti-virus people could easily provide them, e.g., on a consulting basis.

Also, very often the anti-virus people have much deeper insights than the law enforcement agencies into such things like the true identities of some virus writers, their intentions, likely reactions, and past deeds. The anti-virus researchers should actively seek contacts with the law enforcement and provide them with this kind of information.

It is more than time for us all to finally realize that the virus writers are not “intelligent young men” as some like to describe them but morally underdeveloped asocial individuals. They must be pursued and prosecuted like the criminals and terrorists they are. If somebody blows up a building, causing millions of dollars of damage, that somebody will be hunted down and punished harshly – even if no human deaths are involved. Why, then, should it be different for somebody who releases a computer virus that causes billions of dollars of damage?? Yet time and again we see such people getting away with mild punishments like “community service” – mainly because of inadequate laws, lack of direct complaints filed against them, because the damage is spread against many unrelated jurisdictions or various other, equally laughable reasons. If we want these things to stop (or at least to diminish), we must change our leeway attitude and actively help hunt down and prosecute the perpetrators with the full extent of the law.

5 Ethical Considerations

It is impossible for an anti-virus researcher to perform his or her tasks effectively if they do not subscribe to a very strident code of ethics. Even if an anti-virus researcher is technically very good at their job, the slightest ethical slip could sometimes damage their entire career, the reputation of the company they work for, and of the industry as a whole. In the following few subsections we shall try to present the most important ethical dilemmas an anti-virus researchers is likely to be presented with and the proper ways for resolving them.

5.1 Ethical Problems of Virus Creation

If you ask some general computer users who are not very close to the anti-virus world, you will discover that the vast majority of them are of the opinion that we, the anti-virus people, make computer viruses, so that we can sell our products better. The (rather primitive) reasoning behind this notion is the idea probably best illustrated in Charles Chaplin’s movie “The Kid” – with the street kid breaking windows and his father fixing them for money.

It used to be the firm opinion of the author of this paper that no self-respecting member of the anti-virus industry would ever engage in such a nefarious activity. Not only does it cast a shadow on the whole industry but it even seems unnecessary. After all, the virus writers are doing an excellent job of creating hundreds of new viruses every month and we barely have the time to process them – why should we waste our time to create even more?! Besides, nowadays how many viruses exactly does a product detect is no longer very important to how well it would sell – there are many other factors, like which viruses it detects (i.e., does it handle those that are in the wild), what kind of conveniences the product provides (e.g., centralized updates, multi-platform support, etc.).

Unfortunately, we were in for a rude awakening in 1997, when Microsoft Office 97 appeared. As described in [Bontchev98a], Word 97 automatically converts WordMacro viruses to Word97Macro ones, thus creating new viruses from the existing ones. At that time some members of the anti-virus industry who we used to respect started to push very hard the idea that the producers of anti-virus products should take all known WM viruses and produce their W97M counterparts (they are called “upconverts”) – so, that they could implement detection of the latter before they are created in a natural way by Word 97. Worse, those people tried to make the testers of anti-virus products to do the same kind of virus creation and to test which anti-virus products detected the newly created viruses. The main reason stated behind this idea was protecting the users – but we believe that the real reason was because the anti-virus product of the company these people worked for could detect the W97M upconverts (precisely because their company was engaging in such unethical virus creation) while most other products could not and those people wanted the tests to gain them competitive advantage.

In [Bontchev98a] we have explained at length why this excuse for creating new viruses is entirely bogus and how the users could be protected from the upconverts without the need for any new viruses to be created; a detailed discussion of the issue is outside the scope of this paper. We have also explained the dangers of engaging in such virus creation – that the newly created viruses will be “leaked” sooner or later, no matter what measures are taken to contain them and that, eventually, this kind of activity will be at the expense of the whole anti-virus industry.

Since then, life has proven us right. One anti-virus company who was engaging in this kind of virus creation once leaked accidentally a multi-megabyte collection of in-house made upconverts.

There are several other ways in which the anti-virus researchers (or, more generally, the people who work with viruses) create new viruses. For instance, some macro and script viruses spread only in encrypted (encoded, actually) form, in order to make their analysis and understanding more difficult. However, if they are decrypted manually, they would be able to spread in this decrypted form, too. And, indeed, way too often we have received such “manually decrypted” viruses from the virus collections of other anti-virus producers. Obviously, some people do not realize that they are creating new viruses this way and/or are not careful enough to limit their distribution.

Another example is HLL viruses (i.e., viruses written in some high-level language) which are self-contained (e.g., of the overwriting or companion type; see [Bontchev98]), are compressed with some compressor for executable files (e.g., PKLite, LZEXE, UPX, etc.) and spread naturally in this compressed form – however, if decompressed manually, would spread in uncompressed form, too. Again, way too often we find the decompressed forms of these viruses in the monthly collections we receive from other anti-virus researchers – obviously, somebody is creating them without understanding the ethical implications of what they are doing.

Another example is new VBA macro viruses, which have been created from the old ones by inserting some empty subroutine somewhere in their body. This can happen only too easily when somebody is playing with the VBA Editor while looking at the source of the virus. This kind of virus created is usually performed not by anti-virus researchers but by people who have discovered the virus and are “playing” with it without having the necessary technical competence.

These kinds of new virus creation have a deeply negative impact. First of all, they serve to enhance the belief of the public that the anti-virus people are making viruses in order to sell their products. That, on the other hand, reduces the trust the users have in us and make it less likely for them to believe us and to use our products – which makes them more vulnerable to the virus threat.

Second, they increase the pool of existing viruses. No matter what precautions are taken to contain the newly created viruses, accidents have happened, do happen, and will continue to happen. Sooner or later, some of these viruses will be leaked and some of them are likely to cause real infections – the responsibility for which would fall mainly on the anti-virus people who have created them.

Third, the existence of these viruses forces all the other anti-virus people to spend time and resources implementing handling of them in their products – despite the fact that these viruses might have never appeared in a “natural” way. The costs for this are, in the long run, eventually passed to the user. In other words, it is again the user who suffers from this kind of activity – the very same user it is our duty to protect.

Because of all this, we consider the virus creation to be deeply unethical – especially when performed by members of the anti-virus industry. People who engage in this kind of activities do not deserve the name “anti-virus researchers”. They are not worthy of respect. They and their activities should be loudly denounced.

5.2 Ethical Problems of Virus Distribution

As mentioned in subsection 4.1.1, one of the forms of cooperation among the anti-virus researchers consists of sending new viruses to each other. However, this should be done only with extreme care – or major problems can arise. In particular, it is the firm belief of the author of this paper that computer viruses and other malware should be sent only to technically competent and trustworthy anti-virus researchers.

Both “competent” and “trustworthy” have equal importance. For instance, regular users, no matter whether trustworthy or not, simply do not have the technical qualification required to handle computer viruses safely. They are only too likely to let some of them “escape” and cause damage. Yet at least one anti-virus company is known to have sent real computer viruses to its prospective customers, so that they could “better evaluate the company’s anti-virus product”. This is a major no-no in our book – and, indeed, that company has remained relatively isolated in the anti-virus world; with the other anti-virus researchers not wanting to have anything to do with it.

On the other hand, just knowledge of computer viruses is not sufficient, either – trustworthiness is equally important. For instance, it is pretty obvious that the virus writers are relatively technically competent (well, at least some of them) when it comes to computer viruses. Yet, they are definitely not trustworthy and giving them viruses would be equally wrong – because they are likely to misuse the information, release the viruses in the wild, give them to people who are not qualified to handle them properly, or use them to create new viruses of their own.

Of course, the above are only two extreme examples. The rule is much more general – access to computer viruses and other malware should be provided only to technically competent and trustworthy anti-virus researchers. That is, to individuals with these characteristics. It would be wrong, for instance, to give viruses to “moderately technical” and/or “seemingly trustworthy” people. Access to viruses should be provided only on a need-to-know basis; only to people whose job is to handle them. In addition, this should be precisely people, individuals. It would be wrong to give viruses to some anonymous and amorphous entity like and anti-virus company, for instance – simply because we have no way of knowing who exactly will be on the receiving end and what is their exact level of technical competence and trustworthiness.

Every time this rule has been relaxed for one reason or another, something bad has happened – viruses have been leaked to people who clearly shouldn’t have received them. Some people argue that nowadays, with thousands of viruses readily available to anyone who bothers to look for them at the VX sites, it is no longer important to apply the rule given in this subsection very strictly. We could not disagree more. It does not matter how readily available a virus is – if even one additional infection is caused because some anti-virus researcher has not followed strictly the rule, it throws a shadow not only over that particular anti-virus researcher but over the whole industry. It only serves to feed the (unwarranted) suspicions of the general public that we, the anti-virus people are making and spreading viruses in order to create more market for our products.

Of the organizations mentioned earlier in this paper, CARO and AVED subscribe very strongly to this model. Both are organizations of individuals. The requirements for technical competence and trustworthiness are lower for AVED members than they are for CARO members – but, then, only urgent, widespreading viruses are send to the AVED members. REVS, on the other hand, is an organization of companies instead of individuals – and the requirements for technical competence and trustworthiness are much, much more relaxed. The rule given in this subsection is not applied strictly there. It is not surprising, then, that the success of REVS has been somewhat limited.

5.3 Ethical Problems of Hiring Virus Authors

One ethical dilemma, which is often debated hotly, is whether the anti-virus companies should hire (former) virus writers. The (rather primitive) reasoning behind the idea is the proverb that “it takes a thief to catch a thief” and the misguided notion that virus writers know a lot about computer viruses and, therefore, should make excellent anti-virus researchers. One virus writers once went even that far as to demand at an anti-virus conference that we should hire him because of his superior knowledge.

It is the firm opinion of the author of this paper that that the answer to the question “Should the anti-virus companies hire (former) virus writers?” is a resounding “NO!!!”. In the rest of this subsection, we shall list the reasons behind this opinion.

First of all, the notion that virus writers know a lot about computer viruses is deeply mistaken. The vast majority of the virus writers simply produce copycat viruses by making minor modifications to somebody else’s virus – often without understanding what they are doing. Even the occasional smart virus writer usually has pursued just a few novel ideas during his career. As opposed to that, an experienced anti-virus researcher has usually analyzed hundreds of viruses and is familiar with dozens of ideas.

Second, as a rule and contrary to the popular opinion, the virus writers are very mediocre programmers. They usually have no idea how to properly design and develop a serious software project. They do not know what proper testing is and their code is usually riddled with various bugs. In fact, given the relatively small size of most viruses and the fact that they often contain so many bugs, it is our impression that the virus writers are the worst programmers in the world and the virus code contains, on the average, more bugs per byte than any other piece of software, including Microsoft’s.

Third, the sets of qualities necessary to become a successful virus writer are completely different from the sets of qualities that make the successful anti-virus researcher. Writing a virus is a task which is completely different than (and much, much simpler from) the task of writing an anti-virus program. In most cases, the people who are good at one of these two tasks are pretty mediocre at the other and vice versa.

Fourth, there is the issue of trust. Only highly trustworthy people should be given access to computer viruses and other malicious code. How can an anti-virus company ever trust a virus writer – a former enemy? How could he be trusted with access to viruses and to the internals of the company’s anti-virus product? Who can guarantee that he will not use the first opportunity to leak the company’s virus collection to his virus writing buddies and that he will not reveal confidential things about the inner workings of the company’s anti-virus product – so that it would be easier to write viruses which would be problematic for it?

Fifth, hiring a known virus writer would seriously damage the image of the anti-virus company that hires him. It is already bad enough that many people do not trust us and think that we write viruses in order to sell our products. The act of hiring a virus writer would be seen as a confirmation for this widespread belief.

In short, anti-virus companies must not hire virus writers (former or not) and the anti-virus researchers who know the personalities of some virus writers should do their best to ensure that these people never find a job in the anti-virus industry.

5.4 Ethical Problems of Using VX Sites

Some anti-virus researchers find it very tempting to regularly monitor the VX sites and download any new viruses or virus collections that appear there. In the past at least one anti-virus company has officially admitted to have a policy of regularly scanning the VX sites and even to have developed a whole automated process for downloading new stuff that appears there and trying to find new viruses in it.

The underlying idea is laudable – it aims at obtaining new viruses as they appear in the most likely places (virus writers are more likely to send their new creations to the VX sites where other virus writers and collectors can “appreciate” them better instead of releasing them in the wild) and implementing protection against them as soon as possible. Unfortunately, the obvious implementation of the idea is often somewhat shortsighted.

The main problem comes from the fact that the operators of VX sites carefully monitor the traffic. They are especially gleeful when they detect that people from the known anti-virus companies download files from their sites. They use this information in two ways.

First, they use it as a measure of “success” of any particular new virus. After all, if the anti-virus companies from all over the world are stumbling on each other to download some particular virus, this is a “proof” that the virus is an “important” and “interesting” one – since it has sparked their interest. This information is often provided to the author of the virus who later uses it to brag about its creation. We feel that the virus writers should not be granted this kind of gratification.

Second, the fact that at least some anti-virus people download files from the VX sites is used by the operators of these sites as an argument for the “usefulness” of their sites. After all, it looks as if they are providing a needed service to the anti-virus industry. There have been several cases in the past when operators of VX sites have used quotations of their traffic log files to “prove” their legitimacy and brag about it on the newsgroups of the USENET. Again, we feel that these people should not be granted this kind of gratification for the obviously harmful role (virus distribution) they play in our society.

An easy solution to both these problems is for the anti-virus people to download viruses from the VX sites in ways, which hide the fact that anti-virus people are doing the downloading. It should not be done from a easily recognizable corporate machine. Ideally, some kind of proxy should be used to hide the real location of the person who is doing the downloading.

Note that it is the firm opinion of the author of this paper that downloading stuff from the VX sites is a major waste of time. The virus collections found there are of very low quality ([Bontchev93]) – they contain mostly old viruses, corrupted viruses, intended (i.e., too buggy to work) viruses, Trojan horses, various innocent files and so on. The few new viruses that can be found there are usually not worth the (major!) effort to sort the wheat from the chaff and if they are real, likely to spread viruses the anti-virus people will most likely to receive them by other means, too. Besides, only too often our users regularly download stuff from these sites to “test” our scanners and send us all the things that are not detected (which are, alas, mostly crap).

5.5 Ethical Problems of Virus Scares

It is only natural that when some new, problematic virus appears (e.g., one which spreads very fast, has a dangerous payload, is the first virus for a new virusable platform, or is difficult to detect and/or remove), the anti-virus company that has discovered it wants to extract some advertisement value from the event. Unfortunately, some anti-virus companies tend to overdo it.

A typical example was the discovery of the XM/Laroux.A virus – the first macro virus for the Microsoft Excel platform. Such viruses had been predicted for years and their appearance was expected, especially once the viruses for Microsoft Word became common. Nevertheless, when Laroux was discovered 4-5 anti-virus companies independently (and wrongly) published press releases that they were “the first” to discover it.

Another example is when an anti-virus company claims that it is the “only” one that can handle some particular new virus properly – claims, which are often made without actually bothering to check the facts. We even have an abbreviation for companies that often make such claims – we say that their products are TOAST (The Only Anti-virus Software That…). The abbreviation was invented by Padgett Peterson.

Yet another example is when some anti-virus companies publish press-releases (often – at regular intervals) about new viruses – often without even checking whether the viruses actually work (sometimes they do not), let alone whether they are actually widespread and/or posing any practical threat. In one such case (around New Year’s Eve of 2000, when everybody was anxiously waiting for the much-hyped Y2K problem to manifest itself), one anti-virus company even issued a press release about a non-working BAT Trojan horse! Sometimes these press releases are disguised as “information”, “newsletter”, “Web site news”, etc. – but they are just thinly veiled advertisements, using scare tactics to play on users’ fears and incite them to buy the company’s product.

Such unethical advertisements have several negative implications. First of all, they raise unnecessary panic among the users – those very same users we, the anti-virus researchers, are supposed to protect. Second, they dull the attention of the users – after all, after several press releases about non-issues, the user is likely to start ignoring them and miss an important alert; for a virus which is actually posing a threat. Third, they undermine the trustworthiness of the anti-virus industry – they make the users see us as unethical, lying, greedy people for whom the main goal is to sell our products; not the protection of the user. Such a negative view tends to encompass all anti-virus companies; even those that do not engage in unethical advertisement by employing scare tactics. Fourth, they are an unnecessary waste of resources – again for all anti-virus companies; not only for the one that has issued the bogus virus alert. Once the users see it, they start contacting the producer of their favorite anti-virus product with questions about the new scary virus and whether that product detects it. Handling such questions (which sometimes overload the telephones of the technical support department, if the “virus alert” sounded especially scary) detracts useful resources at the anti-virus companies – resources, which could be employed more effectively elsewhere.

It is interesting to note that, despite the belief of the people issuing these virus scares, in the long run, they don’t seem to have any observable beneficial effect for the company that issues them. That is, the advertisement doesn’t seem to work. Companies, which most often engage in such scare-tactics advertisement, as a rule, have a technically inferior and not very popular product. They are often shunned by the rest of the anti-virus community – resulting in reduced cooperation with them which, in turn, reduces the effectiveness of their own anti-virus researchers.

There isn’t much that can be done against this negative trend. First of all, of course, the ethical anti-virus researchers should refrain from spreading virus scares for advertisement purposes.

Second, it should be noted that even within the same company, there is often dissent on this subject. That is, the technical anti-virus researchers in the company see how wrong these virus scares are and oppose them – while the marketing department simply seems to love them. This often means that at the companies which often issue such bogus virus alerts the opinion of the marketing people has more weight than that of the anti-virus researchers. Sometimes such companies can be “nudged” in the right direction by placing them in situations that give more power to their anti-virus researchers; this is one of the goals AVED tries to achieve.

Third, some form of negative motivation (i.e., punishment) should be used against the anti-virus companies that engage in such dubious behavior. They should be shunned and ridiculed in public and their tactics should be widely denounced. A good example in this aspect is Computer Associates Inc., who sometimes publish “counter press releases”. That is, when some anti-virus company publishes a bogus virus alert about some non-issue, CAI often publish a press release on their own, saying that it is not a serious problem. This has the double benefit of revealing the bogosity of the original alert and getting some publicity for CAI; it is an idea the application of which should be more widely adopted by the other anti-virus producers.

In the light of the developments after the September 11 terrorist attack against the World Trade Center, there are some interesting analogies that could be applied to the issue discussed in this subsection. A wide-scale virus or denial-of-service attack can be considered as a kind of terrorist attack. These, of course, should be punished severely – to the full extent of the law. However, spreading hoaxes about such attacks (e.g., sending letters containing innocuous white powder labeled “Anthrax” is also severely punishable (although, of course, not as severely as sending the real thing). Why, then, shouldn’t issuing bogus virus alerts be similarly illegal and punishable?

6 Conclusion

In this paper, we made an attempt to give a general overview of the main challenges and responsibilities that an anti-virus researcher is facing every day. Lest the reader concludes that the job of the anti-virus researcher is an easy and leisurely one, we are pressed to warn that we have mentioned these issues only glancingly. Unfortunately, the limits of this paper do not permit us a deeper presentation of the issue – whole books could be written on this subject. In reality, the job of the anti-virus researcher is anything but “easy” and “leisurely”. It requires an uncommon level of dedication, a high technical competence, a willingness to work very hard, and a strict abiding to firm ethical principles.

7 References

• [Bontchev93] Vesselin Bontchev, “Analysis and Maintenance of a Clean Virus Library”, Proc. 3^rd Int. Virus Bull. Conf., 1993, pp. 77-89.
• [Bontchev94] Vesselin Bontchev, “Future Trends in Virus Writing”, Proc. 4^th Int. Virus Bull. Conf., 1994, pp. 65-82.
• [Bontchev97] Vesselin Bontchev, “Macro Virus Identification Problems”, Proc. 7^th Int. Virus Bull. Conf., 1997, pp. 175-196.
• [Bontchev98] Vesselin Bontchev, “Methodology of Computer Anti-Virus Research”, Ph.D. thesis, University of Hamburg, 1998.
• [Bontchev98a] Vesselin Bontchev, “The Pros and Cons of WordBasic Virus Upconversion”, Proc. 8^th Int. Virus Bull. Conf., 1998, pp. 153-172.
• [Bontchev01] Vesselin Bontchev, “Anatomy of a Virus Epidemic”, Proc. 11^th Int. Virus Bull. Conf., 2001, pp. 389-406.
• [Chien00] Eric Chien, “Malicious Threats to PDAs and Prototype Solutions”, Proc. 10^th Int. Virus Bull. Conf., 2000, pp. 53-63.
• [Hannay01] Philip Hannay, Richard Wang, “MSIL For the .NET Framework: The Next Battleground?”, Proc. 11^th Int. Virus Bull. Conf., 2001, pp. 173-196.
• [Hypponen00] Mikko Hypponen, “WAP and Viruses – Can Your Mobile Phone Get Infected?”, Proc. 10^th Int. Virus Bull. Conf., pp. 71-76.
• [Kaminski00] Jakub Kaminski, “Linux Malware – Has the Next Battlefield Been Decided?”, Proc. 10^th Int. Virus Bull. Conf., 2000, pp. 365-379.
• [Kaminski01] Jakub Kaminski, “Not So Quiet On the Linux Front – Linux Malware II”, Proc. 11^th Int. Virus Bull. Conf., 2001, pp. 147-169.
• [Morley01] Peter Morley, “Processing Virus Collections”, Proc. 11^th Int. Virus Bull. Conf., 2001, pp. 129-133.
• [Szor01] Peter Szor, Peter Ferrie, “Hunting for Metamorphics”, Proc. 11^th Int. Virus Bull. Conf., 2001, pp. 521-541.
• [Vatis01] Michael Vatis, “Cyber Attacks During the War On Terrorism: A Predictive Analysis”, Institute for Security Technology Studies at Darthmouth College, 2001.