Viruses and the Internet
Last modified 3rd Feb 1997


Introduction

The Internet brings a new dimension to the virus problem. Before, viruses generally spread from system to system on physical media, often the floppy disk. This is a fundamentally slow way for viruses to spread; if they are bad at reproduction or they are too obvious, then they are unlikely to become widespread this way.

The Internet changes all this. No longer are viruses restricted to the slow, hand-to-hand infection hitherto the norm. The very ease with which information can be exchanged can be a problem.

Conventional viruses

Most of the danger on the Internet comes from old viruses exploiting new paths for transmission. There are basically two ways they can do this: innocent and malicious distribution.

Innocent virus distribution

Sharing software over the Net is simple and easy; a simple mouse click attaches a program to an email, and it is just as easy to detach and run it. People can place a useful program on their web pages almost as simply, and this can be downloaded by anyone anywhere. Any one of these programs could be infected.

What kinds of viruses could these practices spread? Purely boot sector viruses are out. Parasitic file viruses work well in this environment, although many (but no means all) users are cautious about obtaining programs from places they do not trust.

The viruses that really win in the Internet environment are the macro viruses. They are attached to data, not code, making them harder to avoid. An increasing number of documents on the Net are available as Word files, for example, with no alternative format.

The only solution here is to obtain viewer programs which read the data in the file but ignore the macros. Such programs are available for Word and Excel among others. Never open a file you do not trust with the application that created it.

Malicious virus distribution

Viruses may also be spread by malicious individuals, knowingly passing on infected programs. Virus authors and others find the Internet perfect for giving a new virus a start in life, by means of hundreds of unsuspecting Internet users; by infecting an attractive-looking file that then gets placed in a public download area, the virus can spread far in a short time.

As before, caution is your protection here. Although less common than innocent distribution, maliciously distributed viruses are more likely to be new, maybe even previously unknown. Do not download programs unless you completely trust the source, and do not view documents in the creating application - use a viewer.

Java

Java has been much in the news recently, and concern has been expressed over its security.

Java is supposed to run applets in an isolated environment from which they cannot escape. This requires a flawless, bug-free Java environment, which is unlikely to exist yet. Faults have already been found (and fixed), and more probably lurk undetected. Some of the discovered flaws have been serious, allowing the applet to escape completely and do everything a normal program could.

Can Java viruses exist, though? The answer appears to be a qualified `no'.

Java applets generally flow in one direction; from server to client, where they stop. Users do not generally give Java applets to their friends; instead, they tell them where to go and see them. Java applets do not get saved to local disk, except as web cache. They are not good candidates for infection; if an applet escaped from the cage Java is meant to keep it in, there would be no point in it trying to infect other applets, since they would never spread.

Harmful Java is likely to be in the form of Trojan horse applets instead; intentionally malicious pieces of code masquerading as innocent. Given the speed with which Sun Microsystems, Netscape and other Java vendors have fixed security problems once they have been discovered, any such applet is unlikely to work for long.

Cookies

Cookies have also been the subject of a number of uninformed scares lately. In reality, the only problem with them is a privacy issue; they cannot do any damage to your system. Cookies are a system in newer Web browsers enabling sites to remember you, and keep track of your visits. Some people do not want them to do this, and prefer the greater anonymity they used to have. This is the only real problem with cookies.

Email viruses

There have been a number of scare stories about email viruses in recent years. These have become widespread, with many people taking them seriously. All of them are untrue. While viruses can be carried in email messages in the form of attachments, these are only dangerous if detached and run (or in the case of macro viruses, viewed using the creating application).

Electronic mail messages themselves cannot become infected by viruses, with current email technology. Reading the text portion of an email is always safe. Extracting and viewing attachments may not be.

Conclusion

In conclusion, viruses on the Internet are, by and large, old problems in new clothes. The largest problems are the ease with which infected programs or documents can be found and run, and how quickly a new virus can spread in this environment. So far, though, no viruses are `internet-aware'; only their authors are.