The 25th Anniversary of the Virus

Writing in Science (subscription required), Richard Ford and Eugene Spafford discuss the 25th anniversary of the computer virus.

Don Reisinger notes that depending on what you count as a virus, it may actually be the 30th anniversary of the virus. I think it's fair to say that it's the 25th anniversary of viruses on PCs and leave it at that. For some virus history, be sure to check out VirusList's history of malicious programs. Click through to the years (like the early 80s) to see the details. Also, Wikipedia has a timeline of notable viruses and worms.

The first PC virus was written by a 9th grader named Rich Skrenta. Interestingly, Rich recently stepped down as CEO of Topix.net. In an interview with Security Focus, Rich gave the details of why he invented a virus:

"I had always been mechanically curious, taking apart tube radios and telephones and wiring up O gauge Lionel train sets when I was young. When I got an Apple II in the 7th grade, I was in heaven. I had been playing jokes on schoolmates by altering copies of pirated games to self-destruct after a number of plays. I'd give out a new game, they'd get hooked, but then the game would stop working with a snickering comment from me on the screen (9th grade humor at work here)".

Soon, classmates were getting wary of letting Skrenta near their disks. He needed a way to alter their floppies to contain his "booby traps" without physically being able to get his hands on them. "I hit on the idea to leave a residue in the operating system of the school's Apple II. The next user who came by, if they didn't do a clean reboot with their own disk, could then be touched by the code I left behind. I realized that a self-propagating program could be written, but rather than blowing up quickly, to the extent that it laid low it could spread beyond the first person to others as well. I coded up Elk Cloner and gave it a good start in life by infecting everyone's disks I could get my hands on."

Of course, if Rick hadn't done it, someone else would have. Since the early 80's viruses have become more sophisticated--and more sinister. Viruses are how botnets are created and secrets are stolen. Millions of dollars are spent every year combating them.

And fighting viruses isn't easy. I sometimes get asked a question something like: "When will someone write a program that detects viruses perfectly?" The answer is "never," unfortunately. Ford and Spafford talk about this in the Science paper: "Building a computer program that can tell with absolute certainty whether any other program contains a virus is equivalent to a famous computer science conundrum called the 'halting problem.'" Simply (and somewhat imprecisely) stated, the halting problem says that it's impossible to write a program that can look at other programs and determine whether or not they will halt or run forever. Alan Turing proved this in 1931. (Here's a good discussion of the halting problem if you want to know more.)

Given the impossibility of detecting viruses with certainty, the best we can do are watch lists and heuristics. Not a comforting thought as computers become more and more important to our modern society.