Argument For A 'Good'
Virus
By MidNyte[UC]
April 1999
Introduction.
Vesselin Bontchev has (fairly) famously published an article stating that 'good' viruses are 'still a bad idea'. He failed to mention that this is just his opinion, and that he has no authority to decide this other than his own arrogance. I have decided to show how I think a good virus is possible, but I will not be insisting that this is a good virus, simply that Bontchev and his followers are wrong in the assumption that no virus could be 'good'. The scope of the original article in my opinion was not wide enough to cover all eventualities.
Background.
The conditions listed by Bontchev for defining whether or not a virus is beneficial are as follows. For a virus to be considered 'good', it must not compromise a single one of these.
-QUOTE-
1. Lack of Control.
Once released, the person who has released a computer virus has no control on how this virus will spread. It jumps from machine to machine, using the unpredictable patterns of software sharing among the users. Clearly, it can easily reach systems on which it is not wanted or on which it would be incompatible with the environment and would cause unintentional damage. It is not possible for the virus writer to predict on which systems the virus will run and therefore it is impossible to test the virus on all those systems for compatibility. Furthermore, during its spread, a computer virus could reach even a system that had not existed when that virus has been created - and therefore it had been impossible to test the virus for compatibility with this system.
The above is not always true - that is, it is possible to test the virus for compatibility on a reasonably large number of systems that are supposed to run it. However, it is the damaging potential of a program that is spreading out of control which is scaring the users.
2. Recognition Difficulty.
Currently a lot of computer viruses already exist, which are either intentionally destructive or otherwise harmful. There are a lot of anti- virus programs designed to detect and stop them. All those harmful viruses are not going to disappear overnight. Therefore, if one develops a class of beneficial viruses and people actually begin to use them, then the anti- virus programs will have to be able to make the difference between the "good" and the "bad" viruses - in order to let the former in and keep the latter out.
Unfortunately, in general it is theoretically impossible even to distinguish between a virus and a non-viral program ([Cohen89]). There is no reason to think that distinguishing between "good" and "bad" viruses will be much easier. While it might be possible to distinguish between them using virus-specific anti-virus software (e.g., scanners), we should not forget that many people are relying on generic anti-virus defences, for instance based on integrity checking. Such systems are designed to detect modifications, not specific viruses, and therefore will be triggered by the "beneficial" virus too, thus causing an unwanted alert. Experience shows that the cost of such false positives is the same as of a real infection with a malicious virus - because the users waste a lot of time and resources looking for a non-existing problem.
3. Resource Wasting.
A computer virus would eat up disk space, CPU time, and memory resources during its replication. A computer virus is a self-replicating resource eater. One typical example is the Internet Worm, accidentally released by a Carnegie-Mellon student. It was not designed to be intentionally destructive, but in the process of its replication, the multiple copies of it used so much resources, that they practically brought down a large portion of the Internet.
Even when the computer virus uses a limited amount of resources, it is considered as a bad thing by the owner of the machine on which the virus is doing it, if it happens without authorisation.
4. Bug Containment.
A computer virus can easily escape the controlled environment and this makes it very difficult to test such programs properly. And indeed - experience shows that almost all computer viruses released so far suffer from significant bugs, which would either prevent them from working in some environments, or even cause unintentional damage in those environments.
Of course, any program can (and usually does) contain bugs. This is especially true for the large and complex software systems. However, a computer virus is not just a normal buggy program. It is a self-spreading buggy program, which is out of control. Even if the author of the virus discovers the bug at a later time, there is the almost untreatable problem of revoking all existing copies of the virus and replacing them with fixed new versions.
5. Compatibility Problems.
A computer virus that can attach itself to any of the user's programs would disable the several programs on the market that perform a checksum on themselves at runtime and refuse to run if modified. In a sense, the virus will perform a denial-of-service attack and thus cause damage.
Another problem arises from some attempts to solve the "lack of control" problem by creating a virus that asks for permission before infecting. Unfortunately, this causes an interruption of the task being currently executed until the user provides the proper response. Besides of being annoying for the user, it could be sometimes even dangerous. Consider the following example.
It is possible that a computer is used to control some kind of life- critical equipment in a hospital. Suppose that such a computer gets infected by a "beneficial" computer virus, which asks for permission before infecting any particular program. Then it is perfectly possible that a situation arises, when a particular program has to be executed for the first time after the virus has appeared on the computer, and that this program has to urgently perform some task which is critical for the life of a patient. If at that time the virus interrupts the process with the request for permission to infect this program, then the caused delay (especially if there is no operator around to authorise or deny the request) could easily result in the death of the patient.
6. Effectiveness.
It is argued that any task that could be performed by a "beneficial" virus could also be performed by a non-replicating program. Since there are some risks following from the capability of self-replication, it would be therefore much better if a non-replicating program is used, instead of a computer virus.
(Ethical and Legal Reasons - The following arguments against the "beneficial virus" idea are of ethical or legal kind. Since neither ethics, nor the legal systems are universal among the human society, it is likely that those arguments will have different strength in the different countries. Nevertheless, they have to be taken into account.)
7. Unauthorised Data Modification.
It is usually considered unethical to modify other people's data without their authorisation. In many countries this is also illegal. Therefore, a virus which performs such actions will be considered unethical and/or illegal, regardless of any positive outcome it could bring to the infected machines. Sometimes this problem is perceived by the users as "the virus writer claims to know better than me what software should I run on my machine".
8. Copyright and Ownership Problems.
In many cases, modifying a particular program could mean that copyright, ownership, or at least technical support rights for this program are voided.
We have witnessed such an example at the VTC-Hamburg. One of the users who called us for help with a computer virus was a sight-impaired lawyer, who was using special Windows software to display the documents he was working on with a large font on the screen - so that he could read them. His system was infected by a relatively non-damaging virus. However, when the producer of the software learned that the machine was infected, they refused any technical support to the user, until the infection was removed and their software - installed from clean originals.
9. Possible Misuse.
An attacker could use a "good" virus as a means of transportation to penetrate a system. For instance, a person with malicious intent could get a copy of a "good" virus and modify it to include something malicious. Admittedly, an attacker could trojanise any program, but a "good" virus will provide the attacker with means to transport his malicious code to a virtually unlimited population of computer systems. The potential to be easily modified to carry malicious code is one of the things that makes a virus "bad".
10. Responsibility.
Declaring some viruses as "good" and "beneficial" would just provide an excuse to the crowd of irresponsible virus writers to condone their activities and to claim that they are actually doing some kind of "research". In fact, this is already happening - the people mentioned above are often quoting Dr. Fred Cohen's ideas for beneficial viruses as an excuse of what they are doing - often without even bothering to understand what Dr. Cohen is talking about.
(Psychological Reasons - These arguments are of psychological kind. They are usually a result of some kind of misunderstanding and should be considered an obstacle that has to be "worked around".)
11. Trust Problems.
The users like to think that they have full control on what is happening in their machine. The computer is a very sophisticated device. Most computer users do not understand very well how it works and what is happening inside. The lack of knowledge and uncertainty creates fear. Only the feeling that the reactions of the machine will be always known, controlled, and predictable could help the users to overcome this fear.
However, a computer virus steals the control of the computer from the user. The virus activity ruins the trust that the user has in his/her machine, because it causes the user to lose his/her belief that s/he can control this machine. This may be a source of permanent frustrations.
12. Negative Common Meaning.
For most people, the word "computer virus" is already loaded with negative meaning. The media has already widely established the belief that a computer virus is a synonym for a malicious program. In fact, many people call "viruses" many malicious programs that are unable to replicate - like trojan horses, or even bugs in perfectly legitimate software. People will never accept a program that is labelled as a computer virus, even if it claims to do something useful.
-UNQUOTE-
An Example Of A Good Virus.
It is my opinion that Bontchev misses a major point in all of this. This assumes that a virus is judged to be beneficial (or not) on one level. This is a glaring lack of scope. What if a virus is designed in such a way as to be a 'bad' virus working for a 'greater good'? Let me explain. Everyone agrees that freedom is a basic right that people should be born with and that oppression is 'bad', but what about criminals who are caught and imprisoned? They have their freedom taken for the greater good of every other person. If we were not open to this idea of a 'greater good' then we would think that locking someone in a room for years was appalling, but because we are saving many people from possible further crimes the act of taking away this person's freedom was 'good'. In fact most people would be appalled if this person was not imprisoned.
Can we apply this to a virus? I think we can. How about (as an example) a virus that is designed to test the defences/vulnerability of a network or system? Sure, the virus itself would compromise some (not all) of the conditions set out earlier, but then some of them would be invalid in this case due to being poorly chosen (ie, lack of foresight/scope). Something that is fundamentally 'bad' can sometimes be used for a 'good' purpose. Some vaccines for example contain a trace amount of exactly what they immunise against, giving the body time to create antibodies to combat a 'real' infection, thus ultimately being 'good'.
From here on in, I will refer to the proposed (theoretical) good virus as 'MGG' (MidNyte's Greater Good Virus), and will assume it to be running on a fairly large network of a fairly large company who have decided to use it. So how would MGG be beneficial? It would be used to subject the network to a 'controllable' virus to demonstrate weaknesses in the network, and to help develop defences against 'bad' viruses from the wild. It is effectively a utility of the so-called 'disaster-drill' type.
MGG would have the following features:
Let's go through the points that Bontchev made in his article, and see how they apply to MGG.
1. Lack of Control.
-QUOTE-
"Once released, the person who has released a computer virus has no control on how this virus will spread."
-UNQUOTE-
True, but then that's what a 'real' virus would do, so that's what we want to MGG to do so we can learn from it. Also, we can stop the spreading of MGG dead by simply editing a file in a pre-specified place (ie, MGG could check for the command 'REM MGG-PERMISSION GRANTED' in the autoexec.bat file in the root of the C: drive. This would not affect the functioning of autoexec because of the REM). If found, MGG runs as normal. If not found, MGG does nothing. If MGG finds the line 'REM MGG-DISINFECT' it disinfects the host and does not re-infect. This line would make the virus spreadable only when MGG did have permission to spread, and this permmision is given or denied in an un-obtrusive way. This system also acts as a failsafe, in that if the autoexec.bat file was somehow deleted, the default behaviour of MGG is to do nothing.
2. Recognition Difficulty.
-QUOTE-
"If one develops a class of beneficial viruses and people actually begin to use them, then the anti-virus programs will have to be able to make the difference between the "good" and the "bad" viruses - in order to let the former in and keep the latter out."
-UNQUOTE-
This doesn't really come into it in this particular case. From the point of view of the anti-virus program, MGG *is* a bad virus and should be detected and reported as such. This will show the users how well their system of using the anti-virus software (ie, Once a day scanning/Once a week scanning/memory resident scanning etc) is working. Also, when using MGG to simulate an undetectable (new) virus, the anti-virus software would be switched off.
3. Resource Wasting.
-QUOTE-
"A computer virus would eat up disk space, CPU time, and memory resources during its replication. A computer virus is a self-replicating resource eater. Even when the computer virus uses a limited amount of resources, it is considered as a bad thing by the owner of the machine on which the virus is doing it, if it happens without authorisation"
-UNQUOTE-
So would a normal virus. MGG is simulating what would happen. MGG is 'bad' in this limited scope, but remember we are trying to look at the behaviour of a system under virus attack. Showing this flaw is 'good' in the wider scope. It will also show users exactly how much or little resources are wasted, and show administrators whether users actually notice the difference or not.
4. Bug Containment.
-QUOTE-
"Some viruses suffer from significant bugs, which would either prevent them from working in some environments, or even cause unintentional damage in those environments. A computer virus is not just a normal buggy program. It is a self-spreading buggy program, which is out of control. Even if the author of the virus discovers the bug at a later time, there is the almost untreatable problem of revoking all existing copies of the virus and replacing them with fixed new versions."
-UNQUOTE-
As long as MGG doesn't spread without the permission message, it is not out of control. At any time MGG can be halted by denying permission, which will prevent further spreading. The bugs can then be fixed. Furthermore, bugs are a lot less likely as MGG will be used by someone who knows what system MGG is designed for, as opposed to a normal virus travelling through random computer systems.
5. Compatibility Problems.
-QUOTE-
"A computer virus that can attach itself to any of the user's programs would disable the several programs on the market that perform a checksum on themselves at runtime and refuse to run if modified. In a sense, the virus will perform a denial-of-service attack and thus cause damage."
-UNQUOTE-
Again, so would a real virus. MGG is pointing out which programs would not work under such circumstances. For example, if it was an essential program that stopped working when infected, MGG would be demonstrating a serious flaw in a system which relied on that program. (Note: the other paragraphs of the original point 5 are dealt with separately. Please see below.)
6. Effectiveness.
-QUOTE-
"It is argued that any task that could be performed by a "beneficial" virus could also be performed by a non-replicating program. Since there are some risks following from the capability of self-replication, it would be therefore much better if a non-replicating program is used, instead of a computer virus."
-UNQUOTE-
In this case, no. A simulator would simulate what the virus did, and may make a mistake under some unfavourable conditions such as a split in the network. MGG is a real virus and so would act as one.
This is also an invalid argument, as any future task should not be automatically assumed to be possible by another means. If you don't know what the task is yet, you cannot possibly know whether it is possible by conventional means or not.
7. Unauthorised Data Modification.
-QUOTE-
"It is usually considered unethical to modify other people's data without their authorisation. In many countries this is also illegal. Therefore, a virus which performs such actions will be considered unethical and/or illegal, regardless of any positive outcome it could bring to the infected machines. Sometimes this problem is perceived by the users as 'the virus writer claims to know better than me what software should I run on my machine'".
-UNQUOTE-
If MGG doesn't have permission in the form of the autoexec.bat line, it won't infect. If the line is there, the person who put it there must assume responsibility for doing so.
8. Copyright and Ownership Problems.
-QUOTE-
"In many cases, modifying a particular program could mean that copyright, ownership, or at least technical support rights for this program are voided."
-UNQUOTE-
We have witnessed such an example at the VTC-Hamburg. One of the users who called us for help with a computer virus was a sight-impaired lawyer, who was using special Windows software to display the documents he was working on with a large font on the screen - so that he could read them. His system was infected by a relatively non-damaging virus. However, when the producer of the software learned that the machine was infected, they refused any technical support to the user, until the infection was removed and their software installed from clean originals."
The test's administrator would simply remove the permission message, and the next running of the program would remove MGG. As previously stated though, the administrator would accept responsibility when using MGG, just they would if using a conventional program to test a system.
9. Possible Misuse.
-QUOTE-
"An attacke could use a 'good' virus as a means of transportation to penetrate a system. For instance, a person with malicious intent could get a copy of a 'good' virus and modify it to include something malicious. Admittedly, an attacker could trojanise any program, but a 'good' virus will provide the attacker with means to transport his malicious code to a virtually unlimited population of computer systems. The potential to be easily modified to carry malicious code is one of the things that makes a virus 'bad'".
-UNQUOTE-
If MGG were to be used on a system, the administrator would have to validate it's integrity just as they would have to validate the integrity of any other program to be sure it wasn't trojanised.
10. Responsibility.
-QUOTE-
"Declaring some viruses as 'good' and 'beneficial' would just provide an excuse to the crowd of irresponsible virus writers to condone their activities and to claim that they are actually doing some kind of 'research'. In fact, this is already happening - the people mentioned above are often quoting Dr. Fred Cohen's ideas for beneficial viruses as an excuse of what they are doing - often without even bothering to understand what Dr. Cohen is talking about."
-UNQUOTE-
This is hearsay and irrelevant. It is possible, but everyone who made a virus along the lines of MGG would have to prove it to be 'good' before they were trusted. The excuses of irresponsible people do not make a difference to this virus being 'good' or 'bad'.
11. Trust Problems.
-QUOTE-
"The users like to think that they have full control on what is happening in their machine. The computer is a very sophisticated device. Most computer users do not understand very well how it works and what is happening inside. The lack of knowledge and uncertainty creates fear. Only the feeling that the reactions of the machine will be always known, controlled, and predictable could help the users to overcome this fear.
However, a computer virus steals the control of the computer from the user. The virus activity ruins the trust that the user has in his/her machine, because it causes the user to lose his/her belief that s/he can control this machine. This may be a source of permanent frustrations."
-UNQUOTE-
This could contribute to a viruses chances of spreading and/or being reported to an administrator who could do something to stop it. This should be a part of the test. On the other hand, if a user knew of the test with MGG, it may belay some of those fears. This is irrelevant however, as the administrator is free to not use it if they do not trust it, this does not change whether it's good or bad.
12. Negative Common Meaning.
-QUOTE-
"For most people, the word 'computer virus' is already loaded with negative meaning. The media has already widely established the belief that a computer virus is a synonym for a malicious program. In fact, many people call 'viruses' many malicious programs that are unable to replicate - like trojan horses, or even bugs in perfectly legitimate software. People will never accept a program that is labelled as a computer virus, even if it claims to do something useful."
-UNQUOTE-
This is also irrelevant to the issue. MGG is a virus. It is there for a specific purpose. It is designed to be a virus with a 'safety feature'. It will only be used in very specific circumstances from which it cannot escape without permission. It should be accepted as such. If it is not trusted, it will not be given permission to infect and therefore not used on a system.
Practical Use Of MGG.
Each copy of MGG will provide a list of the last 100 hosts of that particular 'family', and the serial number of the drive on which that host resides. This will provide an accurate path of how the virus spread and point out any jumps from disk to disk. This could be valuable information for stopping the spreading of a 'bad' virus. This information about virus spreading could not be reliably emulated as simply as just releasing MGG. For this purpose, in this scenario, using MGG has provided accurate and useful information without causing ill effects. It removes itself at the end of the test. It does nothing 'bad', but does some 'good' things. I fail to see how this could be classed as a 'bad' virus.
Jon Gorney, the Executive Vice President of the National City Corporation Bank (one of the largest banks in the American Midwest) had an encounter with a virus, as recounted in 'Bank Battles Virus', a paper that can be found in VDAT. He is quoted as saying 'it was the best experience we could have had.' The bank needed the help of IBM to eradicate the virus, which took three days. During this time, they never had the ability to 'switch off' the attack. MGG would have given all the benefits of the real attack (without the risk of major damage), plus a few more that a 'real' virus wouldn't provide such as the logging of the infected files.
A Few Notes To Everyone Reading.
The fact that the scope of the original statement was too limited has meant that this use of a virus was not anticipated. This means Bontchev's entire article is missing a vital point and must be re-evaluated. Please take the time to re-examine his article with the proposed use of MGG in mind and see who you think is right. Remember though that Bontchev is stating categorically that no virus can be 'good', and I am simply stating that it is possible under some circumstances, and the idea should not be discounted.
A Few Notes To People Who Back Bontchev's Claim.
Bontchev quotes (in point five):
-QUOTE-
"Another problem arises from some attempts to solve the 'lack of control' problem by creating a virus that asks for permission before infecting. Unfortunately, this causes an interruption of the task being currently executed until the user provides the proper response. Besides of being annoying for the user, it could be sometimes even dangerous. Consider the following example:
It is possible that a computer is used to control some kind of life- critical equipment in a hospital. Suppose that such a computer gets infected by a 'beneficial' computer virus, which asks for permission before infecting any particular program. Then it is perfectly possible that a situation arises, when a particular program has to be executed for the first time after the virus has appeared on the computer, and that this program has to urgently perform some task which is critical for the life of a patient. If at that time the virus interrupts the process with the request for permission to infect this program, then the caused delay (especially if there is no operator around to authorise or deny the request) could easily result in the death of the patient."
-UNQUOTE-
This statement is so absurd that I just have to comment. There is not a single hospital around that would connect such equipment to an open network, and even if there was, MGG does not ask permission, it checks to see if permission has been pre-arranged which is entirely different. Please, when evaluating something like this, be sure to disregard this kind of hearsay, after all, a court would dismiss that in a second. (And yes, I did actually ask a lawyer to verify what parts of Bontchev's claim were likely to be regarded as hearsay according to the law.) I know it's only an example, but if you can't think of a reasonable example then it follows that it's probably not a reasonable statement.
Conclusion.
Please remember that this is only my opinion. However, do not forget that Bontchev's opinion is only his opinion too, a fact that he neglected to mention through his arrogance. He is not a god, he does not lay down the law just because of his expertise in the field.... he merely voices his opinion. I have merely voiced mine and welcome any feedback on it.
Also, I have no plans to actually write MGG, as just this explanation of it's functioning sufficient to prove my point. MGG uses no features/techniques that couldn't be programmed easily in practice using techniques currently known. It is also possible to expand this virus to check a second line to get advanced instructions, such as what files to infect, how many to infect per run, whether or not to go memory resident etc. This means it can be expanded to be useful on a variety of systems, not just a small number.
- MidNyte [Ultimate Chaos Public Relations & Virus Research]
As always, I welcome ANY feedback, good or bad, as long as it is reasonable.
midnyte01@excite.com | www.ultimatechaos.org/midnyte | surf.to/midnyte