The Fascinating History of Computer Viruses | Part One

Computer viruses have a long and fascinating history. Let's dive into some of the details of their evolution and major milestones:

 

Creeper Virus (1971): The Creeper virus, created by Bob Thomas, was one of the earliest computer viruses. It infected the ARPANET, an early version of the Internet, and displayed the message, "I'm the creeper, catch me if you can!"

The Creeper virus is one of the earliest computer viruses ever created. It was developed by Bob Thomas in the early 1970s and targeted the ARPANET, an early precursor to the modern internet. While the Creeper virus is relatively simple compared to modern-day viruses, it laid the foundation for future malware and set the stage for the development of more sophisticated threats.

 

Below are the detailed explanations of the Creeper virus:

 

a) Inception and Functionality:

   The Creeper virus was created as an experimental self-replicating program. It was designed to infect Digital Equipment Corporation's (DEC) PDP-10 mainframe computers running the TENEX operating system. The primary goal of Creeper was to spread through the ARPANET, a network of computers connected via early internet protocols.

 

b) Infection Process:

   Creeper spread by exploiting a flaw in the TENEX operating system. It utilized the ARPANET to find other vulnerable systems and gain access to them. Once the virus infected a target system, it installed itself and started executing its malicious code.

 

c) Behavior and Propagation:

   After infecting a system, Creeper displayed a message on the infected computer's terminal that said, "I'M THE CREEPER : CATCH ME IF YOU CAN." The virus then attempted to transfer itself to other vulnerable systems on the network by using the ARPANET.

 

d) Reaper Program:

   The Creeper virus was unique in that it was accompanied by another program called the "Reaper." The Reaper was developed as a countermeasure to the Creeper virus. Its purpose was to locate infected systems, remove the Creeper virus, and stop its spread. The Reaper essentially acted as an early antivirus program, making it one of the first instances of malware fighting malware.

 

e) Legacy and Impact:

   The Creeper virus is significant because it marked one of the earliest instances of self-replicating malware. It highlighted the potential dangers of networked computing and the need for security measures to protect against such threats. The Creeper virus also paved the way for the development of more advanced viruses and led to the evolution of cybersecurity practices and technologies.

 

f) Evolution and Modern Countermeasures:

   Over the years, viruses and other forms of malware have become significantly more sophisticated and widespread. To combat these threats, the cybersecurity industry has developed advanced antivirus software, firewalls, intrusion detection systems, and other security measures. These technologies aim to detect and neutralize viruses, including self-replicating ones like Creeper, to protect computer systems and networks from harm.

 

It's important to note that the Creeper virus was not designed with malicious intent but rather as an experiment to explore the possibilities of self-replicating programs. Nonetheless, it laid the foundation for the development of more destructive and harmful malware in the future, highlighting the importance of cybersecurity in today's interconnected world.

 

Elk Cloner (1982): Elk Cloner, developed by Richard Skrenta, is considered the first personal computer virus. It infected Apple II systems via floppy disks and spread by attaching itself to the operating system.

Elk Cloner is one of the earliest known computer viruses to affect personal computers. It was designed to infect Apple II computers, which were popular at the time. Elk Cloner is significant because it marked a shift in the way computer viruses were created and spread.

 

Elk Cloner was written as a prank by Skrenta, who was a high school student at the time. The virus was distributed on a floppy disk, which was a common method of sharing software and data on personal computers during that era. The virus targeted the Apple DOS operating system, which was the standard operating system for Apple II computers.

 

When a computer booted from an infected floppy disk containing Elk Cloner, the virus would install itself into the computer's memory. It would then modify the DOS system so that every time the computer was booted from an uninfected disk, Elk Cloner would be loaded into memory.

 

Elk Cloner's main payload was the display of a humorous poem or rhyme, which would be displayed on the screen after a certain number of disk accesses. The poem varied depending on the version of Elk Cloner, but a common example is as follows:

 

Elk Cloner: The program with a personality

It will get on all your disks

It will infiltrate your chips

Yes, it's Cloner!

It will stick to you like glue

It will modify RAM too

Send in the Cloner!

 

The appearance of the poem was intended to surprise and amuse the computer user, but it also served as an indication that their computer was infected with the virus.

 

Elk Cloner had a relatively low rate of spreading compared to modern viruses. It would primarily spread through shared floppy disks, as users would unknowingly copy the virus onto their own disks when transferring files between computers. However, due to its novelty and the relative lack of awareness about computer viruses at the time, Elk Cloner managed to infect a significant number of computers within Skrenta's high school and beyond.

 

The discovery of Elk Cloner led to increased awareness about computer viruses and the need for antivirus measures. It demonstrated the potential for malicious software to spread and cause disruptions, even on early personal computer systems. As a result, it played a role in shaping the development of antivirus software and the field of computer security in general.

 

It's worth noting that Elk Cloner was not a destructive virus like some later examples. It didn't cause permanent damage to computer systems or steal personal information. Instead, it was more of a nuisance and a proof-of-concept that showed how computer viruses could be created and spread.

 

Brain (1986):  Brain, created by two Pakistani brothers, Basit, and Amjad Farooq Alvi, is one of the earliest MS-DOS viruses. It spread through infected floppy disks and displayed a message claiming the virus was not harmful.

The Brain virus, also known as Brain boot sector virus or Pakistani Brain, is one of the earliest computer viruses that targeted personal computers. It was created in 1986 by two Pakistani brothers, Basit Farooq Alvi and Amjad Farooq Alvi, who owned a computer store in Lahore, Pakistan. The Brain virus is notable for being the first known computer virus to infect the IBM PC platform.

 

Here is a detailed explanation of the Brain virus:

 

a) Infection Method:

The Brain virus infected the boot sector of floppy disks. At that time, floppy disks were commonly used for data storage and software distribution. The virus spread primarily through the exchange of infected floppy disks between computers. When an infected diskette was inserted into a computer, the virus would copy itself to the boot sector of the disk and modify the disk's partition table to make itself active during the boot process.

 

b) Payload:

The primary purpose of the Brain virus was not to cause harm or destroy data but to protect software developed by the Alvi brothers. They used the virus as a copyright protection mechanism. When an infected disk was booted, the virus would display a message, indicating that the software was the property of "Brain Computer Services" and contact information, including the brothers' address and phone number.

 

c) Propagation:

As people exchanged infected disks, the virus gradually spread across different regions and countries. Initially, it was mostly limited to the local area around Lahore, Pakistan. However, as people shared infected disks internationally, the virus gained more attention and started spreading globally. It eventually reached Europe, the United States, and other parts of the world.

 

d) Detection and Impact:

Since the Brain virus was one of the first of its kind, antivirus software did not exist at that time. Therefore, there was no immediate defense against it. As the virus became more widespread, computer users began to notice its effects, such as slow boot times, unusual messages, or modified partition tables. However, the virus itself did not cause significant damage to data or files on infected systems.

 

e) Legacy and Influence:

The Brain virus played a significant role in raising awareness about computer security and the potential risks associated with computer viruses. Its emergence led to the development of antivirus software and the establishment of cybersecurity measures to combat future threats. The Brain virus demonstrated that computers could be vulnerable to malicious software, leading to a greater emphasis on protecting computer systems.

 

It is worth noting that the Brain virus is considered a relatively benign virus compared to modern-day malware. Its primary purpose was to protect copyrighted software rather than causing harm or stealing sensitive information. However, its impact on the computer industry and the subsequent development of antivirus solutions made it a landmark case in the history of computer viruses.

 

Morris Worm (1988): The Morris Worm, created by Robert Tappan Morris, was one of the first worms to infect the Internet. It exploited vulnerabilities in UNIX systems and caused significant disruption, leading to the development of early computer security measures.

 

The Morris Worm, also known as the Great Worm or Internet Worm, was one of the earliest and most notorious computer worms in history. It was created by Robert Tappan Morris, a graduate student at Cornell University, and was released on November 2, 1988. The Morris Worm gained significant attention as it was one of the first large-scale attacks on the early internet, causing widespread disruption.

 

Here are the details of the Morris Worm:

 

a) Infection Method:

   The Morris Worm targeted UNIX-based systems, which were prevalent at that time. It exploited multiple vulnerabilities in the system, including a flaw in the sendmail program, a widely used mail transfer agent. The worm utilized a combination of techniques like exploiting buffer overflow vulnerabilities, weak passwords, and the trusted hosts feature to gain unauthorized access to target systems.

 

b) Propagation:

   Once inside a system, the Morris Worm sought to propagate itself to other vulnerable systems connected to the internet. It employed multiple spreading techniques, including guessing weak passwords, exploiting known vulnerabilities, and utilizing a bug in the fingerd daemon. The worm would connect to a target system, gain unauthorized access, and copy itself to the compromised system, thus infecting it and starting the propagation cycle again.

 

c) Self-Replication Mechanism:

   The Morris Worm was a self-replicating program. Each infected system would spawn multiple copies of the worm and distribute them to other vulnerable systems. However, Morris attempted to control the spread of the worm by implementing a mechanism to limit infections on each target system. It was designed to avoid excessive replication, but a flaw in the implementation caused the worm to spread more aggressively than intended.

 

d) Impact:

   The Morris Worm had a significant impact on the early Internet. It infected thousands of systems, including many of the major universities and research institutions connected to the ARPANET (predecessor of the internet). The rapid replication and high resource utilization of the worm led to system slowdowns, crashes, and widespread disruption of network services. Many organizations had to disconnect their systems from the network to contain the spread and clean up infected machines, causing considerable downtime and financial losses.

 

e) Detection and Cleanup:

   As the Morris Worm began to wreak havoc, system administrators and researchers quickly responded to contain and study the worm. They analyzed its behavior, identified its propagation methods, and developed techniques to detect and remove the infection. Several patches and updates were released to fix the vulnerabilities exploited by the worm, reducing the risk of reinfection.

 

f) Legal Consequences:

   The Morris Worm had unintended consequences for its creator, Robert Tappan Morris. While he claimed that the worm was meant to be a harmless experiment to measure the size of the internet, its widespread impact and disruption led to legal action. Morris became the first person convicted under the Computer Fraud and Abuse Act in the United States. He was sentenced to three years of probation, community service, and fined.

 

The Morris Worm was a seminal event in the history of computer security. It highlighted the need for robust security practices, vulnerability patching, and user awareness to prevent and mitigate the impact of malware attacks. The lessons learned from this incident helped shape the development of security protocols and practices that are still in use today.

 

Michelangelo (1991): Michelangelo was a notorious boot sector virus that received extensive media attention. It was designed to activate on March 6th, the birthday of the famous artist Michelangelo. The virus infected the boot sectors of hard drives and had the potential to overwrite critical data.

The Michelangelo virus, also known as the Michelangelo Birthday Virus, was a computer virus that gained significant attention in 1991. It was named after the renowned Italian artist Michelangelo, whose birthday falls on March 6th. The virus was designed to activate and cause damage on this particular date.

 

Here are the details about the Michelangelo virus:

 

a) Discovery: The Michelangelo virus was first discovered in Australia in early 1991. The virus was originally created in Europe by a hacker named Ralf Burger.

 

b) Method of infection: The Michelangelo virus-infected computers through infected floppy disks. At that time, floppy disks were a common means of data transfer and storage.

 

c) Trigger date: The Michelangelo virus was programmed to activate on March 6th, which coincides with Michelangelo's birthday. On this date, the virus would execute its payload, causing damage to the infected computer.

 

d. Payload: When the virus became active, it would overwrite critical parts of the computer's hard disk, specifically the first sectors where the boot sector and partition table are located. This would render the system unbootable and cause significant data loss.

 

e) Spread: The Michelangelo virus spread through infected floppy disks. When an infected disk was inserted into a computer, the virus would copy itself onto the hard disk. If that computer's hard disk was subsequently used to create or copy files onto another floppy disk, the virus would spread to that disk as well.

 

f) Stealthy behavior: The Michelangelo virus employed stealthy techniques to avoid detection. It hid itself in unused portions of infected disks and in memory, making it difficult to detect using traditional antivirus software.

 

g) Antivirus response: The discovery of the Michelangelo virus created a significant panic in the computer industry due to its potential to cause widespread damage. Antivirus companies released special tools and updates to detect and remove the virus. The media coverage surrounding the virus also contributed to the sense of alarm.

 

h) Impact: The Michelangelo virus gained widespread media attention, leading to concerns and fear among computer users. Although it did not cause the catastrophic damage that was initially anticipated, it did infect a substantial number of computers worldwide. The exact number of infections is difficult to determine, but estimates range from tens of thousands to hundreds of thousands.

 

i) Prevention and removal: To prevent infection by the Michelangelo virus, users were advised to regularly update their antivirus software and exercise caution when handling unknown or suspicious floppy disks. To remove the virus, dedicated antivirus tools were developed to detect and clean infected systems.

 

j) Legacy: The Michelangelo virus serves as a prominent example of the media's influence on public perception and panic regarding computer viruses. It highlighted the need for improved security measures, including regular backups, reliable antivirus software, and user education on safe computing practices.

 

It's important to note that the Michelangelo virus was relatively short-lived, and its impact diminished over time. However, its notoriety has persisted, and it remains a significant event in the history of computer viruses.

**To be continued in Part-2