Computer Virus

A computer virus is a type of malware that attaches to another program (like a document), which can replicate and spread after a person first runs it on their system. For instance, you could receive an email with a malicious attachment, open the file unknowingly, and then the computer virus runs on your computer. Viruses are harmful and can destroy data, slow down system resources, and log keystrokes.

Cybercriminals aren’t creating new viruses all the time, instead they focus their efforts on more sophisticated and lucrative threats. When people talk about “getting a virus” on their computer, they usually mean some form of malware—it could be a virus, computer worm, Trojan, ransomware or some other harmful thing. Viruses and malware continue to evolve, and often cybercriminals use the type that gives them the best return at that particular time. 

History of computer Viruses

One of the most recognized terms in the world of cyber security is computer virus. Like any dangerous biological virus brings alarm to a scientist, the term computer virus brings fear to the administrators or users of any computer system. Viruses are never a pleasure. So where did viruses come from? Where and when did they start? How did they grow to become as menacing as they are today?

1940-1966: The Birth of Replicating Automata

Replicating Automata is a mechanism that has the ability of self-multiplication. Its birth came from mathematical and intellectual curiosity and not from malicious intent. This thought was initiated in the 1940s and subsequently published in a 1966 paper by mathematician John von Neumann. In this paper, he documented the possibilities of developing a piece of code that could copy itself, infect its host just like a biological virus, and cause any number of threats to the host system.

1971: The Creeper Program

In 1971, Bob Thomas of BBN created the very first virus, the Creeper Program. It was the first actual test of the Replicating Automata concept to see whether it was possible. He was successful and it worked. On each new host it infiltrated, it replicated itself, infected the hard drive, and tried to remove itself from its previous host.

1974: The Rabbit Virus

In 1974, the Rabbit Virus was developed. This time malicious intent was ingrained in its code. The virus replicated itself within its host and caused system disruptions that adversely affected overall system performance. This continued until complete system failure or crash was achieved.

1975: The First Trojan

In 1975, John Walker, a computer programmer, created the first Trojan. A Trojan is a computer virus that cannot replicate itself but instead, propagates itself by attaching to user programs, files, or games that are transmitted or exchanged. It is then executed primarily through end-user activity.

Around this time, there were a number of popular games called Animal Games. These games used a set of questions to decipher what animal a user was thinking of. John Walker created a version of this game that became very popular among his friends and colleagues.

With no internet and smart devices at that time, it was distributed using magnetic tapes. Walker used this avenue to distribute the Pervade virus embedded in the game. Once the virus was installed on the host, it proceeded to snoop around and copy itself to all the directories on the existing host’s file system. Although this was done without the host’s knowledge or permission, its effects were not destructive.

1986: The Brain Boot Virus

In 1986, there was a computer store in Pakistan run by two brothers: Basit and Amjad Farooq. In their mounting frustration from people illegally copying their software, they developed a piece of malicious code called the Brain Boot Virus which would alter the boot sector of any floppy disk used to copy their software. This became known as the first PC virus, due to the increased development and use of the personal computer at that time.

Design

Parts

A computer virus generally contains three parts: the infection mechanism, which finds and infects new files, the trigger, which determines when to activate the payload, and the payload, which is the malicious code to execute. Infection mechanism Also called the infection vector, this is how the virus spreads. Some viruses have a search routine, which locate and infect files on disk. 

Payload The payload is the body of the virus that executes the malicious activity. Examples of malicious activities include damaging files, theft of confidential information or spying on the infected system. Payload activity is sometimes noticeable as it can cause the system to slow down or “freeze”. Sometimes payloads are non-destructive and their main purpose is to spread a message to as many people as possible. This is called a virus hoax.

Phases

Virus phases is the life cycle of the computer virus, described by using an analogy to biology. This life cycle can be divided into four phases: Dormant phase The virus program is idle during this stage. The virus program has managed to access the target user’s computer or software, but during this stage, the virus does not take any action. The virus will eventually be activated by the “trigger” which states which event will execute the virus.

Not all viruses have this stage. Propagation phase The virus starts propagating, which is multiplying and replicating itself. The virus places a copy of itself into other programs or into certain system areas on the disk. The copy may not be identical to the propagating version; viruses often “morph” or change to evade detection by IT professionals and anti-virus software.

Each infected program will now contain a clone of the virus, which will itself enter a propagation phase. Triggering phase A dormant virus moves into this phase when it is activated, and will now perform the function for which it was intended. The triggering phase can be caused by a variety of system events, including a count of the number of times that this copy of the virus has made copies of itself. 

The trigger may occur when an employee is terminated from their employment or after a set period of time has elapsed, in order to reduce suspicion. Execution phase This is the actual work of the virus, where the “payload” will be released. It can be destructive such as deleting files on disk, crashing the system, or corrupting files or relatively harmless such as popping up humorous or political messages on screen

Detection

To avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the DOS platform, make sure that the “last modified” date of a host file stays the same when the file is infected by the virus. This approach does not fool antivirus software, however, especially those which maintain and date cyclic redundancy checks on file changes. 

A Virus may also hide its presence using a rootkit by not showing itself on the list of system processes or by disguising itself within a trusted process. In the 2010s, as computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defending a computer against viruses may demand that a file system migrate towards detailed and explicit permission for every kind of file access.

Read request intercepts

While some kinds of antivirus software employ various techniques to counter stealth mechanisms, once the infection occurs any recourse to “clean” the system is unreliable. In Microsoft Windows operating systems, the NTFS file system is proprietary. This leaves antivirus software little alternative but to send a “read” request to Windows files that handle such requests.

Some viruses trick antivirus software by intercepting its requests to the operating system. A virus can hide by intercepting the request to read the infected file, handling the request itself, and returning an uninfected version of the file to the antivirus software.

The interception can occur by code injection of the actual operating system files that would handle the read request. Thus, an antivirus software attempting to detect the virus will either not be permitted to read the infected file, or, the “read” request will be served with the uninfected version of the same file.

The only reliable method to avoid “stealth” viruses is to boot from a medium that is known to be “clear”. Security software can then be used to check the dormant operating system files. Most security software relies on virus signatures, or they employ heuristics. 

Security software may also use a database of file “hashes” for Windows OS files, so the security software can identify altered files, and request Windows installation media to replace them with authentic versions. In older versions of Windows, file cryptographic hash functions of Windows OS files stored in Windows—to allow file integrity/authenticity to be checked—could be overwritten so that the System File Checker would report that altered system files are authentic, so using file hashes to scan for altered files would not always guarantee finding an infection.

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. Different antivirus programs will employ different search methods when identifying viruses. If a virus scanner finds such a pattern in a file, it will perform other checks to make sure that it has found the virus, and not merely a coincidental sequence in an innocent file, before it notifies the user that the file is infected. The user can then delete, or (in some cases) “clean” or “heal” the infected file.

Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.

One method of evading signature detection is to use simple encryption to encipher (encode) the body of the virus, leaving only the encryption module and a static cryptographic key in cleartext which does not change from one infection to the next. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code.

If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible.

Since these would be symmetric keys, stored on the infected host, it is entirely possible to decrypt the final virus, but this is probably not required, since self-modifying code is such a rarity that finding some may be reason enough for virus scanners to at least “flag” the file as suspicious. 

An old but compact way will be the use of arithmetic operation like addition or subtraction and the use of logical conditions such as XORing where each byte in a virus is with a constant so that the exclusive-or operation had only to be repeated for decryption. It is suspicious for a code to modify itself, so the code to do the encryption/decryption may be part of the signature in many virus definitions. 

A simpler older approach did not use a key, where the encryption consisted only of operations with no parameters, like incrementing and decrementing, bitwise rotation, arithmetic negation, and logical NOT Some viruses, called polymorphic viruses, will employ a means of encryption inside an executable in which the virus is encrypted under certain events, such as the virus scanner being disabled for updates or the computer being rebooted. This is called crypto virology.

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses, however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using “signatures”. 

Antivirus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called “mutating engine” or “mutation engine”) somewhere in its encrypted body. See polymorphic code for technical detail on how such engines operate.

Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus.

The advantage of using such slow polymorphic code is that it makes it more difficult for antivirus professionals and investigators to obtain representative samples of the virus, because “bait” files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that utilize this technique are said to be in metamorphic code. To enable metamorphism, a “metamorphic engine” is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14,000 lines of assembly language code, 90% of which is part of the metamorphic engine.

Effects

Damage is due to causing system failure, corrupting data, wasting computer resources, increasing maintenance costs or stealing personal information. Even though no antivirus software can uncover all computer viruses (especially new ones), computer security researchers are actively searching for new ways to enable antivirus solutions to more effectively detect emerging viruses, before they become widely distributed.

A power virus is a computer program that executes specific machine code to reach the maximum CPU power dissipation (thermal energy output for the central processing units). Computer cooling apparatus are designed to dissipate power up to the thermal design power, rather than maximum power, and a power virus could cause the system to overheat if it does not have logic to stop the processor. This may cause permanent physical damage.

Power viruses can be malicious, but are often suites of test software used for integration testing and thermal testing of computer components during the design phase of a product, or for product benchmarking.

Stability test applications are similar programs which have the same effect as power viruses (high CPU usage) but stay under the user’s control. They are used for testing CPUs, for example, when overclocking. Spinlock in a poorly written program may cause similar symptoms, if it lasts sufficiently long.

Different micro-architectures typically require different machine code to hit their maximum power. Examples of such machine code do not appear to be distributed in CPU reference materials.

Malware

The term “virus” is also misused by extension to refer to other types of malware. “Malware” encompasses computer viruses along with many other forms of malicious software, such as computer “worms”, ransomware, spyware, adware, trojan horses, keyloggers, rootkits, bootkits, malicious Browser Helper Object (BHOs), and other malicious software. The majority of active malware threats are trojan horse programs or computer worms rather than computer viruses.

The term computer virus, coined by Fred Cohen in 1985, is a misnomer. Viruses often perform some type of harmful activity on infected host computers, such as acquisition of hard disk space or central processing unit (CPU) time, accessing and stealing private information (e.g., credit card numbers, debit card numbers, phone numbers, names, email addresses, passwords, bank information, house addresses, etc.), corrupting data, displaying political, humorous or threatening messages on the user’s screen, spamming their e-mail contacts, logging their keystrokes, or even rendering the computer useless.

However, not all viruses carry a destructive “payload” and attempt to hide themselves—the defining characteristic of viruses is that they are self-replicating computer programs that modify other software without user consent by injecting themselves into the said programs, similar to a biological virus which replicates within living cells.

The Difference Between Malware and a Virus

Attack Type

Again, malware is an overarching category of attack. It includes subcategories such as ransomware, keyloggers, trojans, worms, spyware and, of course, viruses.

While there are many types of viruses, all of them share the ability to spread through self-replication.

Method of Infection

Typically, malware attacks are initiated through phishing or social engineering techniques, as well as corrupt attachments or downloads.

Most often, viruses are spread via web application, software and email; they can also be transmitted through infected websites, content downloads and corrupt storage devices.

Attack Operations

Malware works in different ways, but most start by ensuring a means of persistent access to a system so adversaries can slip into the network any time they like. Once inside, the malware takes control of the system with the purpose of communicating back to its original sender. The information it communicates may include sensitive data, intellectual property, captured keystrokes or images from a device’s camera, among other items.

Viruses, on the other hand, are usually dormant until the victim activates the attack, either through opening an infected application, downloading a corrupt file or clicking an infected link. Once activated, the virus may complete any number of tasks that it was designed to do, including deleting files, encrypting data, taking over system functions or disabling security settings.

Attack Outcomes

The outcome of a malware attack depends on the type of attack. In some cases, like ransomware attacks, the goal of the cybercriminal is to receive payment in return for system restoration. In others, like distributed denial of service (DDOS) attacks, the hacker may have no purpose other than to disrupt operations.

Though viruses vary in terms of sophistication, the attacker’s goal is generally to damage the user’s device or the larger network. For organizations, the virus may result in disrupted operations and may cost significant sums to restore the system, but the attacker typically does not profit off the activity directly unless the virus is part of a broader malware attack, such as a ransomware scheme.

The Future of Computer Viruses

For more than 60 years, computer viruses have been part of collective human consciousness, however what was once simply cyber vandalism has turned quickly to cybercrime. Worms, Trojans and viruses are evolving. Hackers are motivated and clever, always willing push the boundaries of connection and code to devise new infection methods. The future of cybercrime seems to involve more PoS (point of sale) hacks, and, perhaps, the recent Moker remote access Trojan is a good example of what’s to come. This newly-discovered malware is hard to detect, difficult to remove and bypasses all known defenses. Nothing is certain—change is the lifeblood of both attack and defense.