History of Viruses

8/6/2019 History of Viruses

1/22

The History and Details of

Computer Viruses

With Chuck Easttom

http://[email protected]


2/22

Terms

What is a virus

What is a worm

What is a Trojan horse


3/22

1981Apple Viruses 1, 2, & 3

1980s Fred Cohen

1987 Lehigh Virus1988 The first anti virus software

1990 The first polymorphic viruses

1991 Symantec releases Norton Anti Virus1992 The Michelangelo Virus

1994 Kaos4 virus spreads via adult websites.

1996The Concept virus

The History of Computer Viruses


4/22

The History of Computer Viruses II

1999 The Melissa Virus

2000 The I Love You Virus

2001 The Code Red Worm2003 The Slammer Worm.

2004 MyDoom


5/22

The History of Computer Viruses -

Details1981 Apple Viruses 1, 2, and 3 are some of the

first viruses "in the wild" or public domain.

Found on the Apple II operating system, the

viruses spread through Texas A&M via piratedcomputer games.


6/22


Details1980s In the early 1980s, Fred Cohen did

extensive theoretical research, as well as setting

up and performing numerous practical

experiments, regarding viral type programs. Hisdissertation was presented in 1986 as part of the

requirements for a doctorate in electrical

engineering from the University of Southern

California. This work is foundational, and any

serious student of viral programs disregards it athis own risk Dr. Cohen's definition of a

computer virus as "a program that can 'infect'

other programs by modifying them to include a

version of itself


7/22


Details1987 In November, the Lehigh virus was

discovered at Lehigh University in the U.S. It

was the first "memory resident file infector". A

file-infecting virus attacks executable files. Itgets control when the file is opened. The Lehigh

virus attacked a file called COMMAND.COM.

When the file was run (usually by booting from

an infected disk), the virus stayed in the resident

memory.


8/22


Details1988 In March, the first anti-virus software was

written. It was designed to detect and remove

the Brain virus and immunized disks against

Brain infection.


9/22


Details1990 Viruses combining various characteristics

spring up. They includedPolymorphism

(involves encrypted viruses where the

decryption routine code is variable),Armoring(used to prevent anti-virus researchers from

dissembling a virus) and Multipartite (can infect

both programs and boot sectors).


10/22


Details1991 Symantec releases Norton Anti-Virus

software.

1992 Media mayhem greeted the virus

Michaelangelo in March. Predictions ofmassive disruptions were made and anti-virus

software sales soared. As it turned out, the cases

of the virus were far and few between.


11/22


Details1994A virus called Kaos4 was posted on a

pornography news group file. It was encoded as

text and downloaded by a number of users.

1996Concept, a macro-virus, becomes the most

common virus in the world.

1998 - The "RedTeam" virus infects Windows

executables dispatches the infected files throughEudora e-mail.


12/22


Details1998: The emergence of the sensational

"BackOrifice" ("Backdoor.BO") - utility of that

allowed hackers management of remote

computers and networks.

1999 The Melissa virus, a macro, appears. It

uses Microsoft Word to infect computers and is

passed on to others through Microsoft Outlook

and Outlook Express e-mail programs.


13/22


Details2000 The "I Love You Virus" wreaks havoc around the

world. It is transmitted by e-mail and when opened, is

automatically sent to everyone in the user's address book

July 2001: The Code Red worm infects tens of thousands of

systems running Microsoft Windows NT and Windows 2000

server software, causing an estimated $2 billion in damages.

The worm is programmed to use the power of all infected

machines against the White House Web site at apredetermined date. In an ad hoc partnership with virus

hunters and technology companies, the White House

deciphers the virus's code and blocks traffic as the worm

begins its attack.

.


14/22


Details2002: Melissa virus author David L. Smith, 33,

is sentenced to 20 months in federal prison

Jan. 2003: The "Slammer" worm infectshundreds of thousands of computers in less than

three hours. The fastest-spreading worm ever

wreaks havoc on businesses worldwide,

knocking cash machines offline and delaying

airline flights.


15/22


Details2004: The "MyDoom" worm becomes the

fastest-spreading e-mail worm as it causes

headaches -- but very little damage -- almost a

year to the day after Slammer ran rampant inlate January 2003. MyDoom uses "social

engineering," or low-tech psychological tricks,

to persuade people to open the e-mail

attachment that contains the virus. It claims to

be a notification that an e-mail message sentearlier has failed, and prompts the user to open

the attachment to see what the message text

originally said. Many people fall for it.


16/22


Details2007: A new virus called "Storm Worm." is

released. This fast-spreading email spammer

disguises itself as a news email and asks you to

download film. The "Storm Worm" gathersinfected computers into a botnet, which it uses

to infect other machines. It was first identified

on Jan. 17 and within 13 days had infected 1.7

million computers


17/22


Details2009 9 million computers running on Windows

operating system were hit with "Conficker"

worm. The malware spread via the Internet and

the main tools that helped the worm spreadwere unpatched corporate networks and USB

memory sticks. First discovered last October, it

loads itself on to a computer by exploiting a

weakness in Windows servers. Once it has

infected a machine, the software also tries toconnect to up to 250 different domains with

random names every day.


18/22

The mechanics of Viruses

Delivery

a. Via email

b. Copying over a networkc. Direct communication with exposed ports.

Payload

Types of VirusesMacro virus

Script Virus

Executable Virus


19/22

How Anti Virus Software Works

Scanning for known files

Scanning for worm infection vectors

Heuristic scanning


20/22

Current Active Viruses

As of13 November 2005

Sober.S first noticed October13, 2005

Bagle variant started September19, 2005

Zotob-D August 16th, 2005


21/22

Rules for preventing viruses

Keep operating system and all software updated/patched

Use a virus scanner. McAffee and Norton are the two most widely

accepted and used virus scanners. It costs about $30 a year to keep

your virus scanner updated. Do it.If you are not sure about an attachment, dont open it.

You might even exchange a code word with friends and colleagues.

Tell them that if they wish to send you an attachment, to put the

code word in the title of the message. Without seeing the code

word, you will not open any attachment.

Dont believe security alerts that you are sent. Microsoft does

not send out things in this manner. Go check the Microsoft website

regularly, as well as one of the anti-virus websites previously

mentioned.


22/22

http://www.f-secure.com/virus-info/virus-news/

http://www.cert.org/nav/index_red.htmlhttp://securityresponse.symantec.com/

Anti Virus Information Web Sites

Documents

History of Viruses