Copy Link
Add to Bookmark
Report
Alive Issue 1
/~~~~~~\ *********** ***********
~\( * * )/~ *********** ***********
( \___/ ) *** *** ***
\______/ *********** *** *** *** *******
@/ \@ *** *** *** *** *** ***
*** *** *** *** *** ***********
*** *** *** *** *** *********** |\__/|
******** *** ***** / \
******** *** *** ~\( 0 0 )/~
*** ( /---\ )
*** \______/
*** @/ \@
***
==============================================================
April - July, 1994. Volume I, Issue 1
==============================================================
CONTENTS:
1. "Alive" Is Alive Again! - Editor's Word
2. In the Trap of the Language
3. Puzzle - Continued (2)
4. The Legend - Fred Cohen
... Interview
... Article Review - Trends in Computer Virus Research
5. The Mystery - Mark Ludwig
... Interview
... It Conquered the World : A Fiction Excerpt from Mark
Ludwig's "CVAL&E" for Your Enjoyment
6. The Reality - Vesselin Bontchev
... Interview
... Dozen Reasons Why a "Good" Virus Is a Bad Idea
.............................Vesselin Bontchev
... An Example of Beneficial Virus
.............................Vesselin Bontchev
7. The Grand Debate about Beneficial Viruses and Artificial Life
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
% ALIVE, Copyright 1994. By Suzana Stojakovic-Celustka %
% This magazine may be archived and reproduced without charge %
% throughout Cyberspace under the condition that it is left %
% in its entirety. Send submissions, comments, etc. to %
% celust@cslab.felk.cvut.cz and subscription requests to %
% mxserver@ubik.demon.co.uk %
% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****
"ALIVE" IS ALIVE AGAIN! - EDITOR'S WORD
=======================================
Dear Readers!
For those who already lost every hope that "Alive" will be alive ever again
here are the good news. The first real (non experimental) issue of "Alive"
is right in front of your eyes. Apologies and thanks to all of you who were
patient till now.
The reasons of delay are various. As it usually happens real life interferes
with the best intentions. Sincerely, it is not so easy to bring to the world
new number when one person is editor, technical editor, graphic designer,
journalist, critic, student, etc...Anyway there are signs that such a
situation will improve in some time, so no more complainings. I hope you will
like this number and am expecting any and all comments and contributions.
About this issue:
-----------------
The first article "In the Trap of the Language" is my attempt to find out how
to make a good definition of a computer virus. I have to confess that I
didn't expect that this problem would bring me so far in philosophy. Somehow,
I am still not sure that exact solution exists and probably this topic will
have a continuation.
The second article is one more step to find the solution of Puzzle presented
in the last number. With a little help of Fred Cohen, here is the first try
to define environment in which is suspected to have something "alive".
I was very glad to be a host to three guests in this number : Fred Cohen,
Mark Ludwig and Vesselin Bontchev. They are speaking about themselves and
their work exclusively for "Alive". If you thought that you knew everything
about any of these persons, maybe you were wrong. Read the interviews and
might be that you will find something new.
Respecting Fred Cohen's wish to not reproduce any of his published articles
or texts in electronic form, in this number you can read only review of his
article "Trends in Computer Virus Research". There is also an excerpt from
Mark Ludwig's new book "Computer Viruses, Artificial Life and Evolution",
reprinted from "Crypt Newsletter" No 22 with permission. Vesselin Bontchev
made an extension of his "Dosen Reasons Why a "Good" Virus Is a Bad Idea"
(which appeared originally on Virus-L some time ago) exclusively for "Alive".
The Reasons are pretty convincing, but there is also his Example of
Beneficial Virus presented in this number. It is actually an excerpt from a
longer Mr Bontchev's recent posting to Virus-L.
With these guests the Grand Debate about Beneficial Viruses and Artificial
Life starts from this number in "Alive". If you think that you have something
to say about this theme, please send your contributions. You don't have to
be an expert or a "good" guy/girl. As long as contributions have a form
according to "Alive" guidelines, they will be deeply appreciated.
About contributions and subscriptions:
--------------------------------------
Preferred form of contributions are short articles or previews. Comments on
contributions will be deeply appreciated, but will be published only if they
have a convenient form. This is -not- a place for polemics or blames, so
please don't send your comments if you have nothing constructive to say. The
preferred form of code examples is pseudo-code. The code of existing viruses
which somebody could consider beneficial will not be published here. Send
your contributions and comments to celust@cslab.felk.cvut.cz
**************************************************************************
WARNING!! During the vacation time, i.e. 20th July - 1th September, please
send your contributions and comments to celustka@sun.felk.cvut.cz
**************************************************************************
Subscriptions requests should be sent to mxserver@ubik.demon.co.uk
Where can you find "Alive":
---------------------------
The number of hosts where you can find "Alive" increased since last number.
The magazine is available for anonymous ftp from following sites:
1. ftp.informatik.uni-hamburg.de in /pub/virus/texts/alive
(by courtesy of Vesselin Bontchev, Virus Test Center, University of Hamburg,
Germany)
2. ftp.demon.co.uk in /pub/antivirus/journal/alive
(by courtesy of Anthony Naggs, UK)
3. ftp.elte.hu in /pub/virnews
(by courtesy of Toth J. Szabolcs, Eotvos Lorand University, Hungary)
4. ftp.u.washington.edu in public/Alive
(by courtesy of Jeffrey E. Hulten, University of Washington, USA)
Gophers:
saturn.felk.cvut.cz
(by courtesy of administrative personnel of Computer Department, Czech
Technical University, Prague, Czech Republic)
ursus.bke.hu
(by courtesy of Toth J. Szabolcs, Eotvos Lorand University, Hungary)
Other places:
Slovak Antivirus Center BBS +42 7 2048 232 ZyXEL 1496+ 19.200 Bd NonStop
(by courtesy of Peter Hubinsky, Slovak Antivirus Center, Bratislava,
Slovakia)
Software Library of University of St. Gallen - the requests may be sent to
luca.sambucci@ntgate.unisg.ch
(by courtesy of Luca Sambucci, University of St. Gallen, Switzerland)
Any offer from other sites will be appreciated.
Acknowledgements:
-----------------
I wish to thank to Fred Cohen, Mark Ludwig and Vesselin Bontchev for their
appearance and contributions in this number.
Also thanks to Jeffrey E. Hulten (USA), Philip Fites (Canada) and Vladimir
Vrabec (Czech Republic) for their suggestions how to improve the quality of
"Alive". Hopefully, there will be PostScript and Hypertext (WWW) versions of
"Alive" in near future.
There are no language corrections in this number, but I would like to thank
to Martin Tharp (USA) for corrections he made in the last number.
About editor:
-------------
The editor is currently a Ph.D student on Computer Department, Faculty of
Electrical Engineering, Czech Technical University in Prague. Is working on
her Ph.D thesis and hoping that "Alive" will bring a lot of useful material
and a lot of fun.
So, dear readers, enjoy the reading and make your copy of "Alive" really
alive: SPREAD IT WIDELY!
****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****
Some say that life's an illusion
Who knows what's false or what's true...
...With all of its glories and all of its faults
It seems life is a bittersweet waltz...
- "Bittersweet Waltz" -
****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****>>>>****<<<<****
IN THE TRAP OF THE LANGUAGE
===========================
There is a problem which bothered me since the results of Contest for the
Best Virus Definition were published. It seemed that plain language was not
suitable to define computer virus properly. Well, the problem of good
definition of whatever is not anything new.
1. GOOD REPRESENTATIONS
Looking for the recipe how to make good definitions I found some books. The
first one is "Artificial Intelligence" by Patrick Henry Winston [5]. There
are few words there about good representations:
"...In general, a representation is a set of conventions about how to
describe a class of things. A description makes a use of the conventions of
a representation to describe some particular thing.
Finding the appropriate representation is a major part of problem solving.
Consider, for example, the following children's puzzle:
The Farmer, Fox, Goose and Grain:
A farmer wants to move himself, a silver fox, a fat goose, and some tasty
grain across a river. Unfortunately, his boat is so tiny he can take only
one of his possessions across on any trip. Worse yet, an unattended fox
will eat a goose, and an unattended goose will eat grain, so the farmer
must not leave the fox alone with the goose or the goose alone with the
grain. What is he to do?
Described in English, the problem takes a few minutes to solve because you
have to separate important constraints from irrelevant details. English is
not a good representation.
Described more appropriately, however, the problem takes no time at all, for
everyone can draw a line from the start to finish in figure 1. instantly. Yet
drawing that line solves the problem because each boxed picture denotes a
safe arrangement of the farmer and his possessions on the banks of the river,
and each connection between pictures denotes a legal crossing. The drawing
is a good description because the allowed situations and legal crossings are
clearly defined and there are no irrelevant details.
-------- --------
| Grain | | Farmer |
| ====== |-->| Goose |
| Farmer | | Grain |
| Fox |<--| ====== |
| Goose | | Fox |
|________| |________|
^ | ^ |
| V | V
-------- -------- -------- -------- -------- --------
| Farmer | | Fox | | Farmer | | Goose | | Farmer | | ====== |
| Fox |-->| Grain |-->| Fox | | ====== |-->| Goose |-->| Farmer |
| Goose | | ====== | | Grain | | Farmer | | ====== | | Fox |
| Grain |<--| Farmer |<--| ====== | | Fox |<--| Fox |<--| Goose |
| ====== | | Goose | | Goose | | Grain | | Grain | | Grain |
|________| |________| |________| |________| |________| |________|
^ | ^ |
| V | V
-------- --------
| Fox | | Farmer |
| ====== |-->| Fox |
| Farmer | | Goose |
| Goose |<--| ====== |
| Grain | | Grain |
|________| |________|
Figure 1. ( ====== denotes a river)
The representation principle:
Once a problem is described using an appropriate representation, the problem
is almost solved..."
Reading this, one could say: "Oh, I knew that. What is so special? If I can
describe problem properly then solution is not so far. But, I should know
something about the problem first.."
2. THE KNOWLEDGE AND THE LANGUAGE
Yes, here we come. What is the knowledge at all? Another interesting book
"The Tao of Physics" by Fritjof Capra [2] says:
"...Rational knowledge is derived from the experience we have in objects and
events in our everyday environment. It belongs to the realm of the intellect
whose function is to discriminate, divide, compare, measure and categorize.
In this way, a world of intellectual distinctions is created; of opposites
which can only exist in relation to each other.
Abstraction is a crucial feature of this knowledge, because in order to
compare and to classify the immense variety of shapes, structures and
phenomena around us we cannot take all their features into account, but have
to select a few significant ones. Thus we construct an intellectual map of
reality in which things are reduced to their general outlines. Rational
knowledge is thus a system of abstract concepts and symbols, characterized
by linear, sequential structure which is typical of our thinking and
speaking. In most languages this linear structure is made explicit by the use
of alphabets which serve to communicate experience and thought in long line
of letters..."
Here comes the question again: how much is the plain language suitable to
describe natural world if it is an abstraction itself? Reading the same book
further:
"...The natural world on the other hand, is one of infinite varieties and
complexities, a multidimensional world which contains no straight lines or
completely regular shapes, where things do not happen in sequences, but all
together...It is clear that our abstract system of conceptual thinking can
never describe or understand this reality completely. In thinking about the
world we are faced with the same kind of problem as the cartographer who
tries to cover the curved face of the Earth with a sequence of plane maps.
We can only expect an approximate representation of reality from such a
procedure, and all rational knowledge is therefore necessarily limited...
To quote the semanticist Alfred Korzybski: 'The map is not the territory'...
...For most of us it is very difficult to be constantly aware of the
limitations and of the relativity of conceptual knowledge. Because our
representation of reality is so much easier to grasp than reality itself, we
tend to confuse the two and to take our concepts and symbols for reality..."
Oh well, it is clearer now (or maybe not), but what to do? Especially in
science where we need unambiguous descriptions. Ibidem:
"...The inaccuracy and ambiguity of our language is essential for poets who
work largely with its subconscious layers and associations. Science, on the
other hand, aims for clear definitions and unambiguous connections, and
therefore it abstracts language further by limiting the meaning of its words
and by standardizing its structure, in accordance with the rules of logic.
The ultimate abstraction takes place in mathematics where words are replaced
by symbols and where the operations of connecting the symbols are rigorously
defined. In this way, scientists can condense information into one equation,
i.e. into one single line of symbols, for which they would need several pages
of ordinary writing..."
So, it seems that mathematics is a proper language for the science. Is it
really? Continuing:
"...The view that mathematics is nothing but an extremely abstracted and
compressed language does not go unchallenged. Many mathematicians, in fact,
believe that mathematics is not just a language to describe nature, but is
inherent in nature itself. The originator of this belief was Pythagoras who
made the famous statement 'All things are numbers' and developed a very
special kind of mathematical mysticism. Phytagorean philosophy thus
introduced logical reasoning into the domain of religion...
...The scientific method of abstraction is very efficient and powerful, but
we have to pay a price for it. As we define our system of concepts more
precisely, as we streamline it and make the connections more and more
rigorous, it becomes increasingly detached from the real world. Using again
Korzybski's analogy of the map, we could say that ordinary language is a map
which due to its intrinsic inaccuracy, has a certain flexibility so that it
can follow the curved shape of the territory to some degree. As we make it
more rigorous, this flexibility gradually disappears, and with the language
of mathematics we have reached a point where the links with reality are so
tenuous that the relation of the symbols to our sensory experience is no
longer evident. This is why we have to supplement our mathematical models and
theories with verbal interpretations, again using concepts which can be
understood intuitively, but which are slightly ambiguous and inaccurate..."
It looks like a magic circle: real world - language - mathematics - language
- real world. Where is the reality?
"...It is important to realize the difference between the mathematical models
and their verbal counterparts. The former are rigorous and consistent as far
as their internal structure is concerned, but their symbols are not related
to our experience. The verbal models, on the other hand, use concepts which
can be understood intuitively, but which are slightly ambiguous and
inaccurate..."
3. WHERE WE ARE?
Taking this trip through the theory we are coming back to the initial
question: is natural language appropriate tool to define a computer virus?
There is no doubt that computer viruses belong to the real world. One can try
to define a computer virus using natural language only. As results of Contest
for the Best Virus Definition and many bitter discussions on Virus-L show,
such definitions are still very inaccurate. Even worse, everybody can define
a computer virus on his or her own way which leads to confusion. Few
mathematical definitions while more accurate are not widely understandable...
The one of most known mathematical definitions of computer virus was given
by Fred Cohen. Here are few words from him about this subject:
-----------------------------------------------------------------------------
A: Can the use of mathematics avoid ambiguity of plain language in definition
of computer virus?
FC:
I translate - Can the use of a precise and well defined language avoid
ambiguity of plain language?...Mathematics is a subclass of the more general
class of languages. All mathematics is linguisticly defined, therefore
language, if used precisely, can be as accurate as mathematics. The real
problem is that mathematics says a lot of things more concisely than language
because it is essentially a set of macros. For linguistic definitions to work
for regular people, they have to be short enough to remember and accurate
enough to apply. Hence my very short linguistic definition:
- A life form (substitute virus if desired) is an information structure that
reproduces in a particular environment. -
-----------------------------------------------------------------------------
4. THE END IS NEW BEGINNING
Well, I could summarize now what I have learnt about how to make a good
definition:
1. The first step is to check what is our knowledge about the problem. It is
also a first level of abstraction, i.e. we cannot take all features of
observed phenomenon into account, but have to select a few significant ones.
This process is common in everyday life. One evokes a "mental model" about
some concept. What will such a "mental model" show depends on information one
has collected about the subject till that moment. Such an information is
usually different for every individual depending on his or her experience,
education, source of information, interest, etc. In the case of computer
viruses the knowledge will include the information about computers,
programming, possibly biological viruses, etc.
The problem with "mental models" is that probably no two persons with the
same "model" exist. Also exchange of "mental models" is not usual way of
communication today.
2. The second step is to find a representation for a "mental model", so one
could share it with other people. It is the further level of abstraction,
i.e. choice of a set of conventions about how to describe a class of things.
The most common tool one will use for description is natural language. It
means one will describe a "mental model" using words which are sequences of
letters from some alphabet. In fact, one is constructing a "natural language
model" of phenomenon. To represent computer virus by English language the
words used could be: "reproduction", "infection", "program", etc.
The problem with natural language is that there does not exist universal
language which all people would understand (that problem is impressively
demonstrated in the story of the Tower of Babylon [3]). Furthermore, even in
the limits of one language, it can often happen that the same words will have
different meanings for different people ("There are many different languages
in the world, yet none of them is without meaning." - 1 Corinthians 14.10).
It is what we call ambiguity and inaccuracy of natural language.
3. The science and technique need unambiguous descriptions. For that reason
it is necessary to abstract the language further. Such an extremely
abstracted and compressed language is mathematics. This language is more
accurate and precise than natural language. It is also universal for the
people who understand it.
The problem with mathematics is that it is not a language which is commonly
used for communication in everyday life. Mathematical models will be
understood by particular groups of people only.
4. To ease understanding of mathematical models to wider audience, they
should be accompanied with verbal interpretations which will explain symbols
used. The graphic representation of mathematical models is also useful. As
it was shown in the example at the beginning of this text, drawings are
pretty convenient descriptions in some cases.
The problem here arises when one separates verbal or graphic interpretation
from mathematical definition. It may cause the similar confusion as stated
in point two.
The above steps show different levels of abstraction (or modelling) one
should pass to obtain an accurate definition. Each level has its own inherent
problems. The accuracy required depends, in the last instance, on the
environment where definition will be applied. In the case of computer viruses
the most of the people will be satisfied with definition in natural language.
It has to be stressed again that such a definition will be inaccurate due to
ambiguity of natural language. The good technical definition of computer
virus should be the mathematical one because of its accuracy and consistence.
It should be also accompanied with verbal and graphical interpretations for
better understanding.
Although above text does not give a good definition of computer virus
immediately, it answers to some questions. Namely, it explains why the
results of the Contest in technical categories were so poor. Simply, because
mathematical and verbal parts were separated from each other in the
guidelines of the Contest for the Best Virus Definition. It also explains the
very good results in poetical category. The ambiguity of natural language was
not an obstacle there, just the opposite, it was an advantage. Greater
freedom in wording gave interesting results.
Talking again about technical definitions, there are new questions which
bother me now. The natural language and mathematics follow different logic
in their structure. The formal mathematical logic is monotone, i.e. if
formula is provable in some theory T it is also provable in every theory T',
where T is subset of T'. It means that the more initial axioms exist, the
more new statements is possible to prove. It does not always work in real
life. There are many universal statements in real life which have numerous
implicit suppositions which are not possible to include initially. For
example, from supposition that every bird flies, we can conclude that certain
bird named Quido can also fly. Later we find out that Quido is a penguin and
penguins do not fly. In that moment our system of reasoning should fall
apart, because this fact is obviously controversial. Nevertheless, such a
type of inconsistency is not an obstacle in everyday life. The natural
language covers this inconsistency better. It can be said that natural
language follows non-monotone logic. So, having a mathematical definition
which is accompanied by verbal counterpart it is still questionable how they
will match each other.
There is also the question how the final model or "picture" corresponds to
reality, i.e. how to prove that it is true. That problem is not new. Ludwig
Wittgenstein says in his Tractatus Logico-Philosophicus [6] :
" 2.223
To recognize if picture is true or false, we should compare it with reality.
(Um zu erkennen, ob das Bild wahr oder falsch ist, muessen wir es mit der
Wirklichkeit vergleichen.)
2.224
From picture itself it is not possible to recognize if it is true or false.
(Aus dem Bild allein ist nicht zu erkennen, ob es wahr oder falsch ist.)
2.225
An a priori true picture does not exist.
(Ein a priori wahres Bild gibt es nicht.)
3
Logical picture of fact is thought.
(Das logische Bild der Tatsache ist der Gedanke.) "
It is not so easy to answer the question of the truth. If we recall of
Korzybski's analogy of the map, the main question remains: How to find the
map which will cover the territory on the best way?
5. REFERENCES
1. Anzenbacher A., Introduction to Philosophy, SPNP, 1990. (in Czech)
2. Capra F., The Tao of Physics, Shambhala Publications Inc., 1975.
3. Good News Bible, The Bible Societies, 1990.
4. Marik V., Stepankova O., Lazansky J., et all, Artificial Intelligence I,
Academia Praha, 1993.
(in Czech)
5. Winston P.H., Artificial intelligence, Third edition, Addison - Wesley
Publishing Company, 1992.
6. Wittgenstein L., Tractatus Logico-Philosophicus, Oikoymenh, Prague, 1993.
(in Czech with original German text)
7. E-mail conversation with Fred Cohen
***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&
The truth is like a tiger, but with many horns;
like a cow, but without a tail.
- Zenrinkushu saying -
***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&---&***&
PUZZLE - CONTINUED (2)
======================
In the last issue of "Alive" I was wondering if Misra's algorithm for
regenerating token in logical ring could be considered as a sign of "life".
I got later some instructions from Fred Cohen how to solve this puzzle. One
should try to find a solution in two steps:
1. Define environment
2. Check if observed object reproduces in given environment.
Well, I will try to give now more information about environment and entities
considered.
Distributed systems:
--------------------
The environment in general is a distributed system. Distributed systems are
characterized by there being no global state visible to an observer at any
given instant. There is no common memory. There has to be a communication
system which enables sharing of information.
Computer networks have provided the first example of a distributed software
and hardware structure. The entities comprising the system are the sites at
which the computers are located and the communication system that enables
these sites to exchange messages.
Once the idea of a distributed system is introduced it becomes necessary to
specify its components, that is, the distributed algorithms. Whatever the
architecture of physical distributed system is, there is a need for
distributed algorithms which usually provide the basic functions that are
essential to all information systems, e.g. mutual exclusion, detecting
termination, etc.
Distributed algorithms:
-----------------------
1. Basics:
A distributed algorithm has been defined as a set of processes which, by
exchanging messages, co-operate to achieve a common end - performing some
desired function or providing some required service.
A distributed algorithm has two basic elements:
a) The processes that receive, manipulate, transform and output data.
b) The links along which these data flow and which form a network having both
structural and dynamic properties.
2. Concepts and techniques:
Whatever the design and construction methodology is employed, distributed
algorithms make use of the standard techniques associated with networks, such
as using the acknowledgement of receipt of a message to check that it has
been sent, broadcasting values to a group of processes and so on.
a) Diffusing computations
The processes can be linked by their communication paths in any manner
whatsoever, but one process is special in that initially it can only issue
messages. Further, and initially again, only this process can issue messages,
and subsequently any other process can issue a message only if it has
received one. It is the principle of spanning tree of the graph representing
the processes and their links.
b) Circulating token
The "token" here is a privilege or priority that is made to circulate around
the set of processes connected in a ring structure. This technique is used
particularly by algorithms for termination and mutual exclusion.
c) Time stamping
This mechanism makes it possible to label the events in a consistent manner
in relation to the interactions between the processes, that is, the issue and
receipt of messages: in terms of time as defined by the logical clocks, an
issue will always precede the corresponding receipt. This is particularly
used for algorithms that enter into distributed systems, such as those for
mutual exclusion and detection of mutual blocking.
3. Communication + ordering = control
By its very definition, a distributed algorithm is based on communication of
messages. In very many cases this communication can take place according to
particular topology - logical ring, tree structure - and with the use of
particular technique - circulating token, diffusing computation. Thus there
is relation of appropriateness between the structures of the topology and of
the communication control.
Summary:
--------
Environment considered in this puzzle is a distributed system. In such a
system distributed algorithms are used to provide the basic functions.
Distributed algorithms consist of separate processes that communicate with
one another by exchange of messages. The Misra's algorithm, presented in the
last number, showed the method for detecting the loss of a token (a special
message which the processes hand from one to the other in the logical ring)
and regeneration of token if it is lost. The question was if it was a sign
of life in given environment. The environment is more explained now. The next
step should be to show if basic entities, i.e. processes and tokens
(messages) can reproduce in such an environment.
References:
-----------
1. Janacek J., Distributed systems, 1993., Vydavatelstvi CVUT, (in Czech)
2. Raynal M., Distributed Algorithms and Protocols, 1988., John Wiley & Sons
3. E-mail conversation with Fred Cohen
^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!
It moves. It moves not.
It is far, and It is near.
It is within all this,
And It is outside of all this.
- Upanishads -
^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!^&*!
THE LEGEND - FRED COHEN
=======================
There are very few people dealing with computer viruses who have never heard
the name Fred Cohen. He is the person who first brought computer viruses to
scientific community. Here are some well known formal information:
In 1983, Fred Cohen performed and described the first experiments with
computer viruses. He gave the definition of computer virus in his paper
"Computer Viruses - Theory and Experiments", originally appearing in IFIPsec
84. To quote this paper:
"We define a computer "virus" as a program that can "infect" other programs
by modifying them to include a possibly evolved copy of itself."
Dr Cohen is best known for his pioneering work on computer viruses, the
invention of high integrity operating system mechanisms now in widespread
use, and automation of protection management functions. He regularly provides
consulting services for top management worldwide. During the past 10 years
of his research work, Fred Cohen wrote over 60 professional publications and
11 books. He is also a widely sought speaker, averaging over 12 invited talks
per year. Dr Cohen's current interests are in the areas of high integrity
distributed computing, office automation, information warfare, information
theory, artificial life and social aspects of computing.....
The Fred Cohen's formal biography is much, much longer, so let's leave it for
some other time. Some less formal information Fred Cohen gave himself,
speaking exclusively for "Alive" :
A: Why did you get interested in computer viruses?
FC:
When the idea came to me, it was incredibly interesting and I followed up.
The most interesting thing is the implication about life in general.
When I first started to do experiments and report on the results, I was
greeted with quite a bit of hateful commentary. At one point, I was even
called on the carpet of one of the Professors and accused of breaking into
computers at another university. I was innocent, but treated as if guilty.
That experience has helped me through the various other times I have been
falsely accused of breaking into computers.
Somewhere during that period, an old saying one printed on a wall at
Carnegie Tech by Alan Perlis came back to me:
Problems worthy of attack,
Prove their worth by fighting back.
A: What could you say about your work which is not so commonly known?
FC:
By now, I have published almost everything that has come up. The only real
disappointments relate to my inability to find any paying work related to
computer viruses. Lots of people have offered me work if I will say things
that aren't true, or endorse a product that I think is not very good. People
want the use of my name, but not the results of my effort and analysis. A
good example is the controversy surrounding benevolent viruses. I have been
black balled by many members of computer security community because I refuse
to renounce what I feel to be the truth. Among the leaders of the black
balling are academics who I think should be fighting for academic freedom and
the proliferation of new ideas, but it turns out they can get more research
grants by speaking out against new ideas than by giving them a fair airing.
It should be no big surprise - after all, as recently as 1988, I had an NSF
grant proposal rejected by poor reviews from academics who claimed that there
was no such thing as a computer virus and that viruses could not work in
systems with memory protection. Obviously, they never bothered to read any
of the 50 or so papers I have written on the subject.
A: What problems did you have in presentation of your work?
FC:
Only a few years ago, I was called a heathen by the computing community
including many professors at universities. The reason was that I supported
the notion of benevolent viruses. They had a public effort to black ball me
from research grants and other work, and it was almost unopposed. It got
quite lonely at times, but I persevered, and now I am only loathed and hated
by a small majority of the computing community.
In the fall of 1992, I was vocally and electronically vilified for publishing
the results on the effectiveness of built-in protection in Unix and Novell
networks against viruses and specifying the proper protection settings for
these environments. A few months later, Novell agreed with me, and they are
now changing some things about their protection scheme. Then, I was scheduled
to present an updated version of the paper at the DPMA conference in New
York, but they censored my benevolent virus paper, and had another speaker
present a paper about Novell Netware protection that was just plain wrong,
led Novel administrators to use inadequate protection, and got reprinted in
a national magazine.
I guess I was wrong - you never get used to it - but you have to decide if
you want to tell the truth as you see it or be popular - it is unlikely that
you will ever get both until well after you are dead. I have made a personal
choice that has doomed me to financial ruin over the last seven years or so,
but despite the financial impact on me and my family, I have tried to keep
on.
I have told you some of the problems I have encountered, and there are many
more of them, but let's keep to the positive aspects for now.
A: Why people still do not understand what do you mean when talking about
computer viruses?
FC:
There are at least two or three answers to that. The first one is that few
people recognize that viruses are really only part of a pair - the life form
and its environment. The life form is not alive except in an environment,
and yet for linguistic ease, we speak of viruses as if they were independent.
The second one is that simple explanations are commonly used to avoid having
to talk about the great breadth of issues involved in this field. It's a lot
easier to sell fear when you can claim all Indians are evil than when you
have to explain the difference between a Shawnee and a Mohawk. Another reason
is that most people aren't very interested in mathematics or being very
precise in what they do. Why bother to fully understand when you don't have
to. That's my view, but who knows what is really in other peoples' minds.
A: What is your concept of beneficial virus?
FC:
All technology (in my experience) is a two edged sword. We tend to see one
edge or the other, but both exist. When we explore both sides, we get a
deeper understanding. A benevolent virus is simply a virus that is used for
good purposes, but then this is a matter of context. For example, even an
extremely malicious virus used against an enemy could be perceived as
beneficial. Good and bad are relative. Most of the viruses I discuss as
benevolent are in fact reproducing symbol sequences without any known
malicious side effects. For example, the maintenance viruses that automate
systems administration functions are only doing what people would otherwise
have to do manually. They save extra labour by automatically distributing
themselves, etc. but otherwise, that are just the same as any other program.
A: Why did you get interested in artificial life?
FC:
I am interested in life because I am alive and want human life to continue,
to grow and evolve, and to advance and survive - both for myself and for my
children. The word artificial is really only a side effect of peoples' egos
requiring a special name for things they create. My interest is in deeper
understanding, and thus I examine the issues of life from an informational
standpoint and abstract out the specifics of whether the environment is
biological, electromagnetic, or what have you. I am an information scientist
by degree, training, and interest. As such, the study of information (a.k.a.
symbolic representations in whatever form) is one of my passions.
A: Why did you write "It's alive!"?
FC:
I enjoy writing, and I had done a significant amount of work on this subject
that I thought might be of interest to others. I was also somewhat
disappointed by the presentation of artificial life as it is given by the
growing mainstream of the field, and wanted a venue in which I could express
contrary and novel ideas without the growing set of conservative researchers
trying to stop me. When I talk about this topic, I am talking about real
living creatures, not things that mimic real living creatures. I am talking
about foundations for the understanding of life in the general sense, an
expansion of biology into the general informational domain, drawing parallels
between our biosphere and the infosphere, understanding the implications of
the changes in our environment through information systems before we
experiment on our children, understanding life forms in a different way,
understanding the implications of our emerging technologies and ways of
thinking about things, and other stuff like that.
In my book, I don't just talk about computers, but about the concepts of God,
evolution, the generation and creation of life, death and why it must exist
and why we need it to survive, the joint life forms we are now creating,
diseases of the joint life forms, models of biological life and our
willingness to commit memocide. I try to bring the richness of the world
together in my writing so that the outbreak of Ebola Zaire can be related to
the Jerusalem virus in a sensible way, and we can see the implications of our
actions.
As you can see, I have a passion for this subject, and if I continue at this
pace, you will have another book to review.
A: Why people are willing to reject the concept of beneficial viruses or
artificial life in general?
FC:
I don't care to speculate further on peoples' motives at this time, but as
a general guide, we might consider that people have emotions and that their
motives are often complex and poorly understood. I have had people tell me
that I am paving a road to hell with my good intentions, but I cannot tell
which of us is really doing that because I am not omniscient. I just walk the
path that seems right to me and try to understand the implications before I
make big decisions.
A: Do you think that there is anything unethical in claims that beneficial
viruses exist?
FC:
I think it is unethical to claim that there are NO benevolent viruses when
we all know that they do exist and have seen published examples. The ethical
questions in any research come from the analogy to the two edged sword
described above. I feel we have a responsibility to present both sides of
the issue, to consider the implications of our work and how it will impact
others, and to consider these issues deeply and carefully before proceeding.
To me, it is very strange that people complain about my publishing results
on benevolent viruses. After all, I got a lot of complaints in the 1980s
about publishing results on malicious viruses, including over 40 papers in
that period on protection against viruses. My conclusion is that the people
complaining about the ethical issues are more often than not, expressing
their frustration that somebody else thought of an interesting new line of
research and published the results despite its somewhat negative impact on
their research. Every once in a while, there may be an ethical issue worth
bringing up, but it is patently ridiculous to claim that it is unethical to
publish results of research into useful applications of computer viruses.
But then, people also claim we should not publish results on useful
applications of nuclear physics because there are nuclear weapons.
\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|
Take care of the means and the ends will take care of themselves.
- Mahatma Gandhi -
\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|/\|
Article Review:
---------------
TRENDS IN COMPUTER VIRUS RESEARCH
=================================
by Dr Frederick B. Cohen
In this paper (published in 1991.) Fred Cohen discusses current trends in
computer virus research. The article is an excellent reading for those who
want to get a short insight in entire Fred Cohen's work.
The text can be roughly divided in two parts. In the first part the author
gives a quick review of history of malicious viruses and defensive methods
against that type of computer viruses. The second part deals with benevolent
viruses and the design of useful viruses in practice. The article is closed
by discussing future research topics.
Malicious Viruses and Defense
-----------------------------
This part begins with a short insight to the history of malicious viruses'
attacks. The term is referred mostly to the population of IBM PC/DOS viruses
which started to appear in large numbers since 1987. The author call those
viruses - "real-world viruses".
In the further text the preview of defense methods against malicious viruses
is given. The vulnerabilities and advantages of several well known ideas are
discussed. It is stated that all built-in self-test techniques are vulnerable
to a generic attack, i.e. when the virus activates before program being
attacked and forges the operating environment so that altered information
seems to be unaltered to the protection system. According to the author the
most effective protection against malicious computer viruses is defense-in-
depth. In this approach many approaches are combined, so if one technique
fails, redundant techniques provide added coverage. The combined use of virus
monitors (scanners), integrity shells, access controls, virus traps, on-line
backups, SnapShots ("SnapShoting" of system memory at bootup and performing
a complete replacement of the system state with the known state from a
previous bootstrap), BootLocks (providing low-level remapping of disk areas
to prevent bootstraping mechanisms other than the BootLock mechanism from
gaining logical access to the DOS disk) and ad-hoc techniques should provide
reliable protection against operation, infection, evasion and damage by known
and unknown viruses. Disadvantage of such an approach is space/time
consumption when realized entirely in software. It is pointed out that
performance of defense system can be greatly enhanced through hardware based
implementations.
Benevolent viruses and further research
---------------------------------------
In the second part the author introduces the concept of benevolent virus. He
explains that computer viruses are some of the fastest distributed programs.
They distribute freely, easily and evenly throughout a computing environment.
The hardest problem in parallel processing is efficient uniform distribution
of computing between computers working together on the same problem. With
computer viruses the solution of this problem is easier because of their
ability to replicate and spread. It is, however, important to know that the
problem of controlling virus growth must be addressed before widespread use
of viruses in existing computer networks.
To avoid confusion, the author gives his famous definition of computer virus
from the paper "Computer Viruses - Theory and Experiments" (published 1984.):
"We define a computer 'virus' as a program that can 'infect' other programs
by modifying them to include a possibly evolved copy of itself."
There is also description of worm:
"...so-called "worm" programs would install segments on computers which were
not in use, performing "segments" of the parallel processing problem being
solved..."
The author's formal definition of computer virus (not presented in this
article) for mathematical reasons encompasses all self-replicating programs
and programs that evolve and move through a system or network, thus putting
many of the worm programs under the formal description of computer virus.
The short history of theoretical and experimental work on self-reproducing
programs is given. The two examples of useful computer viruses are presented.
One example is The Viral Bill Collector. It is a distributed program which
allows to the user to avoid a large centralized bureaucracy which controls
and directs all activities, by distributing all functions to the individual
bill collectors. The computing environment "births" and "kill" collectors
according to the current requirements.
The second example is Maintenance Virus. To reduce manual system
administration, maintenance viruses are implemented. They replicate
themselves in limited numbers, seek out known imperfections and repair them.
The author points out that "birth/death" processes are central to the problem
of designing viruses that do not run amok, as well as to the evolution of
viral system over time.
Some other future improvements of useful viruses as random variation and
selective survival are discussed. It is stated that in the same way as we can
generate computer program from specifications, we can generate evolutionary
systems from specifications, and assure to reasonable degree that they will
act within predefined boundaries. The author regretfully notices that viruses
have gotten a bad name, partly because there are so many malicious and
unauthorized viruses operating in the world. He offers as possible solution
of this problem the "Computer Virus Contest" which rules prohibit the use of
viruses that have been released into uncontrolled environments, viruses
placed in systems without explicit permission of the owner and viruses
without practical mechanisms to control their spread.
The author concludes that "just as biological viruses can cause disease in
humans, computer viruses can cause disease in computer systems, but in the
same sense, the benefits of biological research on the quality of life is
indisputable, and the benefits of computer virus research may same day pay
off in the quality of our information systems, and by extension, our well
being."
Further reading:
----------------
I would recommend this article for the start to those who want to get
acquainted with Fred Cohen's work. The next step could be the book "A Short
Course on Computer Viruses" where the same themes are presented in more
details. According to personal wishes, one can continue either going further
with the theory by reading Fred Cohen's Ph.D thesis or some of his articles
with formal definition of computer virus, or to find some practical solutions
of viral and security problems in some of numerous Fred Cohen's articles with
that subjects. Personally, I am waiting impatiently to read the newest book
"It's Alive!".
^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^
The man who fights for his ideals
is the man who is alive!
- Miguel de Cervantes -
^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^&&&^^^
THE MYSTERY - MARK LUDWIG
=========================
Reading the following text from the article published in Crypt Newsletter No
22, I got curious. Yes, I have heard the name Mark Ludwig earlier, but it
always had some negative connotation. This article was somewhat different...
[ IN THE READING ROOM: "COMPUTER VIRUSES, ARTIFICIAL LIFE AND EVOLUTION"
BLASTS EVOLUTIONARY SCIENCE WITH THEORETICAL PHYSICAL METHODS
Just after Christmas, on December 27th, Addison-Wesley France was served with
a temporary legal notice prohibiting the distribution of its recently
published French language edition of Mark Ludwig's "Little Black Book of
Computer Viruses, Volume 1." Entitled "Naissance d'un Virus" or "Birth of a
Virus," the French edition was selling for about $50 cash money. The company
is also distributing a disk containing copies of Ludwig's TIMID, INTRUDER,
KILROY and STEALTH viruses separately for a few dollars more.
However, before the ink was dry on the paper a French judge dismissed the
complaint, said Ludwig between laughs during a recent interview. Addison
-Wesley France, he said, subsequently worked the fuss into good publicity,
enhancing demand for "Naissance d'un Virus."
Almost simultaneously, Ludwig has published through his American Eagle
corporation, its follow-up: "Computer Viruses, Artificial Life and
Evolution," which will come as a great surprise to anyone expecting "The
Little Black Book of Computer Viruses, Part II."
For those absent for the history, "The Little Black Book of Computer
Viruses," upon publication, was almost uniformly denounced - by the orthodox
computer press - as the work of someone who must surely be a dangerous
sociopath.
Most magazines refused to review or mention it, under the working assumption
that to even speak about viruses for an extended length - without selling
anti-virus software - only hastens the digital disintegration of the world.
Ludwig found himself engaged in a continued battle for advertising for his
book, losing contracts without notice while the same publications continued
to stuff their pages with spreads for cosmological volumes of pornography.
This has always been a curious, but consistent, hypocrisy.... ]
...Later in the same text there were few words about the author...
[...Not surprisingly, the controversy has kept sales of "The Little Black
Book" brisk since its initial printing and financed the expansion of American
Eagle.
Which brings us, finally, to "Computer Viruses, Artificial Life and
Evolution," a book which takes a hard scientific look at life and the theory
of evolution, and only incidentally contains working viruses.
To grapple with the underlying philosophy behind "CVAL&E," its helpful to
know Ludwig was a physics major at Caltech in Pasadena, CA, at a time when
Nobel-laureate theoretical physicists Richard Feynman and Murray Gell-Mann
were in residence. The ruthlessness with which these scientists dealt with
softer disciplines not up to the task of thorough theoretical analysis
coupled with the academic meat-grinder that is Caltech's reputation, casts
its shadow on "CVAL&E."
Ludwig writes in the introduction:
". . . Once I was a scientist of scientists. Born in the age of Sputnik, and
raised in the home of a chemist, I was enthralled with science as a child.
If I wasn't dissolving pennies in acid, I was winding an electromagnet, or
playing with a power transistor, or . . . freezing ants with liquid propane.
When I went to MIT for college I finally got my chance to totally immerse
myself in my first love. I did rather well at it too, finishing my
undergraduate work in two years and going on to study elementary particle
physics under Nobel laureates at Caltech. Yet by the time I got my doctorate
the spell was forever broken . . . I saw less and less of the noble scientist
and more and more of the self-satisfied expert."...]
...Well, at this point I decided to contact Mark Ludwig and ask him some
questions. Here is he, answering exclusively for "Alive":
A: Why did you get interested in computer viruses?
ML:
I thought they were interesting as genetic, self-reproducing entities, and
I just wanted to learn something about them, as a scientist. What little I
could find out about artificial life seemed very much skewed toward the
evolutionary point of view, which is in my mind more philosophy than good
science. Since computers are universal simulating machines, I think one thing
AL [Artificial Life] researchers can get into is a sort of programmatic story
telling which has little to do with reality. I mean, of course you can design
something to evolve (Lamarkian or Darwinian) just because you have an
universal simulating machine. But does that have anything to do with real
life?
I saw viruses as a real-life phenomenon, rather than a laboratory construct.
Perhaps they are the only "life-form" apart from earth's carbon-based life
we will ever meet. Laboratory AL experiments tend to be contrived because
the researcher's intelligence inevitably enters in. Viruses, as a phenomenon,
are somewhat different. They're in the wild. What do they do there? Do they
evolve? Can they evolve? The whole question just seemed fascinating to me.
A: When did you start to deal with computer viruses and could you describe
shortly your work?
ML:
About 1988 or 1989. Given the above interest, the natural thing to do seemed
to be to get some viruses and learn about them. That proved to be a real
challenge though. Technical knowledge of this field was very hush-hush then.
I ended up solving the problem by setting up a BBS and announcing that I'd
send people $20 if they'd send me a virus. So I got a few that way. But I
realized it was going to be hard to discuss my scientific interests with
anyone if no one understood the technology behind viruses. Furthermore, I
did not believe that this silence was best for mankind in the long run. I
mean, here is this brand new technology -computers & information science-
and a brand new phenomenon -viruses- and all anybody wanted to do was to make
it go away. As a scientist, I was much more inclined to explore the
possibilities. Yet I knew I couldn't possibly do that alone if we're really
going to find out what uses these things might have, or what understanding
they might actually contribute to other scientific disciplines. Science
doesn't work like that now-a-days. The knowledge has to be more generally
available before anyone could even begin to think along these lines. So I set
out to make that knowledge accessible.
A: Why did you write "The Birth of a Virus" ?
ML:
"The Birth of a Virus" is the French edition of "The Little Black Book of
Computer Viruses." I plainly wrote it so that the average programmer could
learn the basics of how a virus operates. That was published in 1991. It is
not intended to be a compendium of all the tricks virus programmers use, or
anything like that. It is an introduction. The viruses discussed in the book
(4 of them) are pretty basic, but they get some of the basic techniques
across, and illuminate the issues which a virus must face to reproduce.
A: Why did you write "Computer Viruses, Artificial Life and Evolution"?
ML:
CVALE is a first stab at discussing my original interest in viruses. It
discusses questions like "Are viruses alive?" and digs into viral evolution,
comparing viruses to real-world organisms, etc. It's about more than just
viruses, though. It's about the whole Artificial Life movement, as well as
science and philosophy. Really, I think what I've seen in staring hard at
viruses might be very valuable in bringing about a revolution in evolutionary
biology. Using carbon-based organisms is a horrible way to study evolution.
They're too complex and we don't understand them well enough. The time frames
of evolution are too large. And deep philosophical questions rear their heads
all over the place. Inside the computer, most of these difficulties just
vanish. The one thing you have to be careful of is the universal nature of
the computer. What you don't want is to create some kind of science that will
always confirm itself. Looking at viruses can teach us how to impose some of
the checks and balances that science needs to be valid.
A: Do you think that your work is unethical or illegal?
ML:
Illegal? Some people tell me that it is in some parts of the world. Certainly
it is not illegal in the US.
Unethical? That is a more difficult question. I don't think so, but I'm open
to correction. I mean, I realize that by publishing viruses, somebody could
use that information to hurt somebody else. It's not my intention to empower
would-be criminals. At the same time, I think a lot of people can get hurt
because people who should have the technical expertise to deal with malicious
viruses don't have it and have a hard time getting it. The idea that you can
combat a human intelligence with a piece of software is ludicrous. Anybody
who just installs an anti-virus and sits back on his laurels is asking for
trouble. At least some virus writers are intelligent people. And the only way
to combat a human intelligence is with human intelligence. In other words,
you start with first hand knowledge of what viruses are and how they work.
Given that first hand knowledge, you can reasonably choose anti-virus
software to protect your systems, etc., but you don't just pick the program
based on some advertisement, or some review that purports to be unbiased,
albeit written by an a-v developer or by some peon at an advertiser-driven
magazine. Thus, I see my work as being potentially very beneficial in that
it brings education and light where darkness has been.
The only way I can see to answer the ethics question is to weigh the merits
and dismerits of what I'm doing. I've always taken the attitude that I'll
do this on a tentative basis, but if it proves out that people are taking
my stuff and wreaking havoc with it, I'd be the first one to condemn it.
Now, 3 years after the release of The Little Black Book, I think I can say
safely that people are not, for the most part, running out to destroy the
world with it. They are behaving responsibly.
We do not make it illegal to manufacture hammers or knives because people do,
occasionally, kill other people with those implements. We do not call the
knife manufacturer immoral or unethical. Killing someone or not with them
is the responsibility of the user, not the manufacturer.
I fail to see why viruses should be treated differently. The a-v community
argues that there is no such thing as a good virus, ergo there is no benefit
side to the equation, as in the case of a hammer. Even if they were right on
that point, though, it would not be logical to conclude, therefore, that
making information about viruses available is therefore also bad. Someone
who learns about viruses -who gets the first hand knowledge about them- is
going to be a whole lot better at facing a malicious virus running amok in
a network than somebody who simply sits back and lets somebody else, e.g. an
anti-virus company, do his job for him. The second person will in all
likelihood need expert
help to get rid of the virus. The first will be the
expert to begin with. Thus it seems reasonable to suggest that even if all
viruses were only evil (which I do not believe), it could still be very good
to make the knowledge of them available, because in so doing you are teaching
people how they work and giving them the expertise to fight them better. As
far as I can see, the benefits do outweigh the dangers here.
I think when considering the ethics of all of this, we have to realize that
the a-v community is trying to partake of a new ethic which, if carried to
its logical conclusions, will have a chilling effect on all innovation and
all human initiative. You see this new ethic throughout society. It damns
anything which could potentially be harmful before you even know whether it
will be beneficial or not. I don't care whether you're talking about a-v or
environmentalism or about the latest drive to socialize medicine in the US,
this mindset is behind it. The bottom line is an attempt to create a
risk-free socialist world controlled by a technical elite. Now, you can't
stop hammers with this approach, but you can sure stifle anything new,
because you can magnify the risks, and diminish the benefits, and people
don't have an intuitive feel for it.
The truth is that people who reason this way are trying to make gods out of
themselves. They are not content to let their opinions be opinions. Rather
they try to elevate them into moral truism. A lot of people in the west
still have a love-affair with socialism, so they buy into this risk-free
attitude without questioning it much. We shouldn't be deceived by such
propaganda though.
A: What problems did you have in presentation of your work?
ML:
Well, nobody wanted to print it. But it was not that big of a deal since I
already owned a publishing company which published other books for university
classes. I just had to decide whether we should get into this line or not.
I've had enough experiences in other fields of science to know that if you
want to do anything new you're going to meet resistance. I haven't run into
any problems I didn't expect from the start.
A: Why people are willing to reject the concept of beneficial viruses or
artificial life in general?
Most people don't reject the idea of a beneficial virus if you discuss it
with them intelligently. Rather, they become open to it rather quickly.
There's a certain amount of inertia you have to overcome to get people to
actually install a beneficial virus, though, because they've been brainwashed
into believing that virus = bad. Once you get past that, it's not a problem.
Now, obviously, I won't say the same of the anti-virus community. Here you
have a case of group-think where everyone just echoes everyone else's
opinion. It's kind of like an extreme political party. Breaking ranks will
get you ostracized. They are the ones who've been trying to brainwash people,
and they want to keep it up because they are pushing an agenda that puts them
in the driver's seat. They know full well that to make any concession in
their position is to open the floodgates. How will you ever pass legislation
against the free dissemination of virus-related information once you admit
that some of it might be beneficial? You won't. So they'll fight the idea of
a beneficial virus to their dying breath.
Artificial Life is a different matter, though. I think a lot of people reject
the concept in its strong form for religious or philosophical reasons.
Furthermore I think those reasons are completely valid. I mean, IF you accept
the idea that life is nothing more than atoms and physics, it makes sense to
define life functionally and then design something functionally equivalent
and call it life. However that IF is a big if. There are plenty of reasons
not to do that, both philosophical and purely scientific. Most of the people
doing AL work just leap right in like good positivists and sweep the deeper
questions under the rug. If AL is ever to garner widespread support, those
who study it are going to have to be more sensitive to the philosophical
issues. I tried to do that in my book, though I haven't gotten a whole lot
of feedback as to how well I succeeded.
A: Are there persons in virus/anti-virus field that you respect and why?
ML:
Technically there are quite a few people I respect. Writing viruses and
anti-viruses is kind of like a programmer's version of a grand master's
chess game. You need both a good deal of skill and a sense of the art of it
to play on either side.
Intellectually, I don't have very much respect for many of the people who've
made a name for themselves in a-v work. Many of them aren't thinking for
themselves anymore. They've made up their minds and they won't hear new
ideas. They're like politicians who are so committed to a movement that they
don't dare change, and they stagnate intellectually as a result.
There are a whole lot of people a step below the big names, though, who
are just good people trying to keep the computers in their companies clean
and what not. They aren't pushing an agenda - they're just trying to get
their job done. They're open minded and they will listen to new ideas.
I respect these people a lot, and it's my sincere desire to help them get
their job done. By making technical information about viruses available,
I'd like to believe that I'm doing that.
!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!
And God saw that it was good. And God blessed them,
saying 'Be fruitful and multiply'
-Genesis 1:21,22
(The dedication to Mark Ludwig's "Little Black Book about Computer Viruses")
!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!{**}!
IT CONQUERED THE WORLD: A FICTION EXCERPT FROM MARK LUDWIG'S "CVAL&E,"
=======================================================================
FOR YOUR ENJOYMENT
==================
[Warning: Sections of the following may seem morbid and unpleasant.]
Cast 50 years in the future . . .
"Atomic storage technology was developed and put to work in computers 40
years ago. Five years later the first notebook computers with 100 terabytes
of pico-second access, non-volatile storage became available for under $5000.
Of course, software lagged far behind hardware. For nearly 20 years, the
software giants battled it out developing operating systems to make effective
use of the storage technology. In fact, operating systems proliferated to
such an extent that real progress in programming gave way to brute
competition between operating systems. By and by, IBM came up with the
solution. Their OS/4 operating system was an incredible engineering feat.
About 1.2 terabytes of code, fully interactive speech recognition, touch and
vision interface, artificial reality feedback. But the clincher was the
artificial intelligence which allowed the operating system and applications
to adapt to both the individual user and the software developer. It was a
cinch to write very complex programs in this environment because of the
artificial intelligence, despite the fact that there were nearly 2 million
possible system calls. Shareware proliferated for it, and then commercial
programs that would boggle the mind of anyone just ten years earlier.
"By 2045, OS/4 was the _de facto_ standard. There weren't even any close
competitors. Nobody even had any interest in new operating systems, because
this one seemed to fit everyone's needs so well. It seemed to be the golden
age of computing, except for one thing. OS/4 had some anti-virus measures
built into it. They worked pretty well. However, a fairly simple but benign
virus appeared in this environment that those anti-virus measures couldn't
cope with. This virus was only about 2 megabytes in size, and since it was
benign, nobody cared much about it. However, at the time the United States
had become a tyranny whose evils had eclipsed even those of Stalin and
Hitler. Most intelligent people had fled the country long ago. The
government went on a crusade to find the author of the virus. They got their
man, and subjected him to functional re-engineering at the hands of
nano-robots. A horrible fate. This focused quite a bit of attention on the
virus and its alleged author. To defend this poor scapegoat, a team of
scientists got together and proved that just such a virus should evolve into
a useful clean-up utility if left alone.
"A couple weeks later IBM released a supplementary anti-virus utility to take
care of the problem. Even though the scientists said not to worry, a lot of
people wanted the virus out, and IBM saw this as a good way to make a moral
statement about virus writing that would make a number of governments happy.
This . . . was the beginning of the end, though. A typical case of the quick
fix. No one took the time to disassemble the virus. Nobody listened to the
team of scientists.
"Until that anti-virus utility was released, there was little evolutionary
pressure on the virus, and most of it caused evolution in beneficial ways.
The utility was quite adept at putting pressure on the virus to make it
malevolent, though. And the virus mutated with incredible ease . . . If that
were not enough, the artificial intelligence of the anti-virus only succeeded
in driving the viruses - which also used system AI resources - to become
smarter and more prolific. The anti-virus was made available on a Monday,
free of charge to the general public. By Wednesday, the whole world was in
chaos. Everything was shut down. Financial markets. Communications.
Hospitals. The works. Nobody went to work. People were dying . . ."
(c)opyright 1993 American Eagle Publishing. Used with permission.
&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**
The disciples asked the master:
- What will happen with you after your death?
- I will go to the hell.
- But, they think that you are very holy master!
- If I don't go to the hell, how can I help you?
- Zen text -
&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**&&**
[ The book review of "Computer Viruses, Artificial Life & Evolution" and "It
Conquered The World" originally appeared in the February 1994 issue of The
Crypt Newsletter. They are reprinted in "Alive" with permission of Crypt's
editor George Smith (Urnst Kouch). The Crypt Newsletter is a monthly
publication featuring science news, media reviews and comment of interest to
a computing audience. E-mail: ukouch@delphi.com ]
Editor's note:
--------------
The "underground" versions of The Crypt Newsletter contain source code of
some viruses. It is disputable if they are beneficial or not. The "clean"
versions (without virus code) are available on Compuserve.
~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~***~~~
THE REALITY - VESSELIN BONTCHEV
===============================
Many people know the name Vesselin Bontchev from discussions on Virus-L/
comp.virus. His formal biography says:
In 1988 Mr Bontchev became interested in computer viruses and soon afterwards
his freeware anti-virus programs were the most popular in Bulgaria. In 1990
he became the director of the Laboratory of Computer Virology at the
Bulgarian Academy of Sciences - a laboratory, created mainly due to his
efforts. Since 1991 he is working on his Ph.D. thesis in the Virus Test
Center at the University of Hamburg, Germany.
Since 1990 Mr Bontchev is the Bulgarian representative in IFIP's TC-11
(Computer Security). He is also a founding member of CARO (the Computer
Anti-virus Researchers' Organization), a founding member of VSI (the Virus
Security Institute), and a member of EICAR (the European Institute for
Computer Anti-virus research).
Mr Bontchev's main fields of interest include computer viruses, computer
security, integrity and data protection, encryption, number theory....etc.
Leaving formalities for a moment, Vesselin Bontchev speaks for "Alive"
exclusively:
A: Why did you get interested in computer viruses?
VB:
Initially - because they are interesting, of course. I mean, they are
challenging; doing something that is unusual and clever. Later I discovered
that my knowledge in this field can help many other people and this motivated
me additionally.
A: When did you start to deal with computer viruses and could you describe
shortly your work?
VB:
It all began in the Spring of 1988. At that time I was working on a voluntary
basis as a consultant for the only Bulgarian computer-related magazine -
"Komputar za vas" ("Computer for You"). I was asked to provide some help in
translating a German article (from the German magazine "CHIP", I believe)
about computer viruses. I didn't know German at all, but I knew a lot about
computers. The article was initially translated by a professional translator,
who knew German perfectly, but knew nothing about computers and the special
jargon used in this area. There was a lot of funny stuff in the draft
translation... But I digress.
In short, the article was about computer viruses. I read it, and the subject
captivated me at once. Knowing from personal experience that the quality of
the information obtained from such sources as popular magazines tends to be
rather low, I used the information system of the Bulgarian Central Institute
for Scientific and Technical Information to do a library search by keywords
and then to read all available serious journals that had some articles on
this subject. The most valuable source of information proved to be "Computers
& Security", and in particular the papers from Dr. Fred Cohen and Prof.
Harold Highland - two of the very few people that seemed to know what they
were talking about.
After reading all that was available to me at that time (not that much; there
weren't so many articles published on this subject at that time), I decided
that while an interesting mental exercise, computer viruses couldn't be that
dangerous, because every moderately competent computer techie should be able
to spot them at once. Also, it was obvious that all the hype in the popular
media was caused mostly by people who knew near to nothing on the subject.
Even the viruses that existed at that time didn't seem anything particularly
clever - I remember that when I read the description of Brain, I spent long
time wondering what the *other* part of the code could do, because it was
clear to me that anybody with some experience in assembly language
programming could fit the described functionality into less than one kilobyte
of code - so what were the other 2 Kb of the virus *doing*?
In short, I wrote an article for "Komputar za vas", explaining my view that
computer viruses can't be a real threat. What I have overlooked was that by
far not all computer users are technical experts who know by heart the
internals of their machines... Just a couple of days after my article was
published, two guys came at the editor's office of the magazine and proudly
announced that they have found a virus! It was what we are calling now
Vienna.648.Reboot.A, but nobody knew it at that time. The two guys had
already dealt with the infection in the company they were working for (they
were system programmers, after all) and demonstrated us how well their
custom-made disinfector works... disinfecting the only copy of the virus left
in their disposition. Of course, I wanted to examine "the beast" and to
understand how exactly it works and why. The problem was, it was already
gone! I visited the office in their company, and after a long and fruitless
search for an infected file, we finally found a piece of paper in the trash
bin, that contained the hex dump of an infected file... I got that piece of
paper and entered the code with DEBUG byte-by-byte. Then I disassembled it,
understood it, wrote my own disinfector (and even a vaccine) for it... This
is how it all began for me. My second case was Cascade, then Ping_Pong, then
the Bulgarian viruses began to appear (Old_Yankee, Yankee_Doodle), and then
came the Dark Avenger...
My work now? Well, I am working in the Virus Test Center at the University
of Hamburg, under the leadership of Prof. Klaus Brunnstein. I am in charge
of maintaining our virus collection. I am also analysing viruses, helping
people who are asking virus-related questions from all parts of the world,
writing my Ph.D. thesis, testing anti-virus products, and many other less
exciting things.
A: Why did you leave Bulgarian anti-virus scene and moved to Germany?
VB:
Because I was proposed the wonderful opportunity to live and work under
excellent working conditions in place with a very high reputation in the
computer anti-virus field - and also to get a Ph.D. there.
A: Are you familiar with present virus/anti-virus situation in Bulgaria?
VB:
It depends on your definition of "familiar". I have a pretty clear idea of
what is happening there, although I am not as much familiar with the
virus/anti-virus scene there as I used to be.
A: It is known that certain animosity existed between you and Bulgarian
virus writer known as Dark Avenger some time ago.
VB:
That is put very mildly, yes.
A: What do you think about him today?
VB:
The same bad things I've been always thinking about him. Sorry, but my
education does not allow me to list them here.
A: What is your general opinion about virus writers?
VB:
Most of them are just irresponsible juvenile people (I am tempted to say -
kids), who want to "establish" themselves and to impress their peers, by
doing things that they perfectly know are regarded as "bad" by the society,
but for which, as they also know very well, this same society is unlikely to
be able to punish them. They like so much to brag about their "exploits" and
"civil liberties", but it is actually the same old graffiti writing, only in
a more modern, electronical form. In short - vandals.
A: What do you think about beneficial viruses and artificial life? Why are
people willing to reject the concept of beneficial viruses and artificial
life in general?
VB:
I don't feel competent to comment about artificial life, because I am not
expert in this area. I don't believe that computer viruses are a form of
artificial life, however.
People don't like to even hear about the so-called "beneficial viruses"
mostly because the term "computer virus" is already loaded with negative
meaning in the public opinion - maybe incorrectly, just like the term
"hacker", but that's it how it is. I would suggest to anybody who is doing
serious and responsible research in the field of self-replicating code, to
use some other term, if they don't want to be misunderstood by the general
public. After all, what Dr. Cohen is understanding under the term "beneficial
virus" is *very* different from those nasty little programs that the general
public is acquainted with.
A: Do you think that is unethical to claim that computer viruses can be
beneficial and why?
VB:
Now, that's a difficult question... Well, it depends. It depends on what are
the motives of the person making the claim. Is he a legitimate scientist who
is trying to use an interesting phenomenon for something useful for the
humanity? Or is he just an irresponsible person who is looking for an excuse
for his asocial acts and is trying to masquerade them under the
scientifically-looking term "research"?
However, I think that even the legitimate researcher ought to emphasize that
he is talking about something completely different from the real computer
viruses known to the general public - in order not to be misunderstood. Also,
I think that he should clearly (and loudly) distinguish himself from the
virus writing crowd. Research - yes, but seriously done, in clear and
strictly controlled environment, by people who have the knowledge and
experience to conduct it. Just like the kind of research into biological
experiments.
A: You often mention "real viruses". What are they and how are they related
to the concept of "beneficial viruses" ?
VB:
I am convinced that what most people understand under the term "computer
virus" cannot be beneficial. When the average user hears the term "computer
virus", he almost certainly does not have a valid definition for it, but just
as certainly he has a pretty clear view of what the term is about. I call
this a "real computer virus". Real computer viruses are always bad.
My professional understanding of "real virus" is this:
"Something has entered my computer without my authorization and is
replicating there, potentially doing damage."
The accents are on (a) entered without authorization, (b) replicating -
i.e. modifying executable objects and wasting time and disk space, and (c)
maybe it is doing damage, maybe it is intentionally, maybe not intentionally.
The average user's understanding of "real virus" is probably:
"Something is here, I didn't allow it to be here. I've been told it can
spread like living being and that it can destroy my data/programs. I don't
like it."
Two years ago I asked the net to send me the arguments why they think a
"good" virus is a bad idea. I have collected dozen reasons. I do not claim
that computer viruses cannot be beneficial, but any virus that pretends
to have this property must not violate any of the 12 conditions.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Originality and the feeling of one's own
dignity are achieved only through work
and struggle.
- Dostoevsky -
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Vesselin Bontchev:
DOZEN REASONS WHY A "GOOD" VIRUS IS A BAD IDEA
==============================================
I. Technical points:
--------------------
1. Once released, one has no control on how the virus will spread; it may
reach an unknown system (or the one which could have even not existed at the
time the virus is created) and on which it might cause non-intentional
damage. Any virus that claims to be beneficial, must contain measures to
prevent this. For instance, if it infects a particular object, it must at
least keep a cryptographically strong checksum of this object, in order to
make sure that it does not infect anything else by mistake. And this is only
a simplistic example; in reality the precautions must be much more
elaborated.
A virus that claims to be beneficial should provide means to be controlled.
It should be possible to easily prevent the infection even of a system that
has never heard about the virus; it should be possible to remove the
infection easily from any infected system, without causing any harm; and it
should be possible to send a message to all instances of the virus to
terminate themselves, restoring the infected systems to their uninfected
state - or to update themselves. Such a message should propagate faster than
the virus itself. In some sense, those messages will be "viruses" for the
"computational environment" consisting of all existing copies of the virus,
just like the virus is a virus in the "normal" computational environment (the
one that the user uses). If such a solution is implemented, this is still
dangerous, although the danger is of a different kind. Suppose that a system
uses the beneficial virus and relies on it. Then a malicious attacker could
send a message to the virus to terminate itself, thus causing harm to the
system (a denial of service attack). Therefore, the message should be
cryptographically authenticated. In short, the virus should be able to
authentify itself to the system and the system should be able to authentify
itself to the virus.
The user of the beneficial virus should actively invite (e.g. install) the
virus on his/her system. It is not enough if the virus asks for permission,
because this forces the user to take some measures in order to keep their
system virus-free. By default (i.e. if no measures are taken), the virus
should not infect that system. Only if the virus finds some kind of
"invitation", it should infect the system. There must be a way to turn off
the prompting - the user must both be able to set the default action to "no,
don't infect" (by removing the invitation or not installing it in the first
place) and to "yes, keep infecting without asking". And again, cryptographic
means should be used to ensure that what the virus sees as invitation is
indeed one and not some kind of mistake.
No uncontrollable mutations of virus should happen, either of random (errors)
or deterministic (intentional changes) nature.
2. The anti-virus programs will have to distinguish between "good" and "bad"
viruses, which is essentially impossible. Also, the existence of useful
programs which modify other programs at will, will make the integrity
checkers essentially useless, because they will be able only to detect the
modification and not to determine that it has been caused by a "good" virus.
Therefore, a virus that claims to be beneficial, must not modify other
programs.
3. A virus will eat up disk space and time resources unnecessarily while it
spreads. The virus is a self-replicating resource eater. Therefore, a virus
that claims to be beneficial, should keep only one instance of itself per
infected machine and the costs of the time and other resources used by it
must be negligible, compared to the benefits it brings to the user.
4. A virus could contain bugs which might damage something or harm somebody.
Any program could be buggy, but the buggy virus is a self-spreading buggy
program which is out of control.
5. A virus will disable the few programs on the market which check themselves
for modifications and halt themselves if they have been changed. It is
important to repeat again that a virus that claims to be beneficial, *must
not modify* other programs.
Summary of technical points against "good" viruses:
-impossibility to control it or possibility to lose control over it
-uncertainty in discerning "good" from "bad" viruses
-resource wasting
-bugs which are harder to detect and easier to spread around
-modification of programs
The above points apply to any practical system of use today, i.e. the systems
which are based on von Neumann's architecture.
II. Ethical/legal points:
--------------------------------
6. It is unethical to modify somebody's data without his or her active
authorization. In several countries this is also illegal. The user of a
beneficial virus must actively invite the virus to infect his or her machine.
The virus must wait for an invitation, not bother the user with asking for
permission or sneaking in without one.
7. Modifying a program could mean that the owner of the program loses his or
her rights for technical support, ownership, or copyright. An example of such
a possibility could be the case reported recently to VTC - Hamburg. The
company refused technical support to somebody whose system was infected -
they insisted that their product is re-installed.
8. An attacker can use a "good" virus as a means of transportation to
penetrate a system. That is why a "good" virus must be able to authentify
itself to the system, and the system must be able to verify that it is
exactly what it claims to be. A person with malicious intents can furthermore
get a copy of the "good" virus and modify it to include something malicious.
Actually, an attacker could trojanize -any- program, but a "good" virus will
provide the attacker with means to transport his malicious code to a
virtually unlimited population of computer users. The possibility to
transport malicious code is one of the things that makes a virus "bad".
9. Declaring some viruses as "good" will just give an excuse to the crowd of
virus writers to claim that they are actually doing "research". Working with
potentially dangerous things - either poisonous substances or self -repli-
cating programs - should be left to people who have (a) the moral and ethical
stability and (b) the technical expertise to do it.
10. Anything useful that could be done by a virus, could also be done with
a normal, non-replicating program. Any virus that claims to be beneficial
must do something that either cannot be done by a non-viral program, or is
not done as effectively as with a viral one to avoid problems stated in
previous points.
The summary of ethical/legal points against "good" viruses:
-modification of data/programs without active authorization of user
-possibility to lose ownership rights on infected program
-possibility to modify a "good" virus with malicious code to transport such
a code further
-the question of responsibility of persons writing viruses
-the question of suitability of "good" viruses to perform a certain task
III. Psychological points:
--------------------------
11. A virus activity ruins the trust that the user has in his or her machine.
The impression that a virus steals user's control of the machine can cause
the user to lose his or her belief that she or he can control it. It may be
a source of permanent frustrations.
12. For most people the word "computer virus" is already loaded with negative
meaning. They will not accept a program called like that, even if it claims
to do something useful.
*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*
Those who are good, travel the road that avoids evil;
so watch where are you going - it may save your life.
- Proverbs 16.17 -
*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*^^^*
Vesselin Bontchev:
AN EXAMPLE OF BENEFICIAL VIRUS
==============================
...Here is an example of a software package that uses replication to some
extent and which is without doubt beneficial.
Consider a company that has about 1,000 PCs, all networked together in a LAN.
The company also takes the virus problem seriously, and insists that each and
every of those PCs must be running the latest version of the SuperDuper Scan,
before it is allowed to access the network. (Let's ignore for a moment
whether the decision to rely on a scanner for virus protection is wise or
not.) This is a very reasonable requirement, because scanners tend to get old
like nothing else, and a new virus could sneak in undetected by the obsolete
scanners and wreak havoc.
So, the person responsible for the network has imposed a requirement: no PC
that does not run the latest version of SuperDuper Scan is allowed to log in.
That's fine, but how do you achieve that? The simple answer is - by keeping
a copy of the (presumably resident) scanner on each of the PCs and regularly
updating them. Only problem is - how do you keep 1,000 PCs up-to-date? And
keeping them up-to-date with a product, a new version of which is released
every month? If you try to go to each PC (and they are probably in different
buildings and some are in obscure locations and used rarely) and update it
manually from a floppy - then one month will not be sufficient to update
them all - and before you have finished, you'll have to start all over again!
A real nightmare...
The obvious alternative is to keep one copy of the anti-virus package on the
server and update the PCs from there. (Of course, it is presumed that you
have a site license, but any company with 1,000 PCs that is using a
particular anti-virus product has also probably been careful enough to get
a site license.) However, if you go to each PC and manually download the new
version from the server, then the situation has not improved very much. One
option is to tell the users to do it regularly, and even set some sort of
automatic system that sends them automatic reminders each time the software
on the server is updated. However, users tend to be lazy and automatic
messages tend to be automatically ignored...
But there is an alternative! Design the anti-virus package like a network
virus (a worm actually). One segment of the worm constantly monitors the
logins. Each time a workstation attempts to login, that segment automatically
questions that station whether it is running the anti-virus product and which
version of it. If it turns out that a newer version is available, the segment
informs the user about this, and proposes to update the local version. If the
user refuses, then access to the network is denied. If the user accepts,
another segment of the worm fetches the relevant (updated) parts of the
package from the server, uploads them to the workstation, and reboots the
latter, in order to make sure that the changes will take effect. Of course,
the user is kept informed about this and user permission is requested each
time.
Now comes the best part. The "worm" - the set of programs that are
responsible for the automatic distribution of the software actually come as
part of it. They are part of the anti-virus software, and they are used to
copy parts of the anti-virus software accross the network, in an automated
way. That is, to some extent, the package is a virus (worm), because it is
able to replicate (parts of) itself.
Are there any ethical problems? I don't see any. The owner of the network has
the full right to decide what the policy of admitting workstations to log in
will be. The user has the alternative not to comply - and not to use the
network. Of course, in a well-implemented (read: secure) package, the
different parts of the virus will use cryptographic means to authentify each
other. That is, it will be impossible for the user to lie that "yeah, the
newest version of the software is already running", and it will be impossible
for a rogue program to lie "hi, I'm the automatic distribution service; lemme
"update" your anti-virus package". In most of the existing implementations
the packages do not go to such trouble, but in the future they probably will
- because this is the way to go. Of course, there will be some other goodies,
like making sure that the different "worms" of this kind do not conflict with
each other and so on, but this is not so important for this discussion.
In fact, it is extremely easy to implement a primitive version of what
I described above. A simple set of command lines inserted in the system login
script and a couple of external programs will do the job...
Editor's note:
--------------
This example of beneficial virus is taken from the Mr Bontchev's posting to
Virus-L/comp.virus which in its entirety appeared in Virus-L Digest Volume
7, Issue 48, 1 Jul 1994.
@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@
Has a dog Buddha-nature or not?
Mu!
- Zen koan -
@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@***@^^^@
THE GRAND DEBATE ABOUT BENEFICIAL VIRUSES AND ARTIFICIAL LIFE
=============================================================
In the previous articles, three more or less different viewpoints about
beneficial viruses and artificial life were presented. The topic is
undoubtedly interesting. Could computer viruses be beneficial? What is
artificial life? Are computer viruses the form of artificial life or not?
Is it ethical to play with such things?...etc...The questions are numerous.
The answers, opinions and approaches can vary widely - from the scientific
(and somewhat controversial) interests of Fred Cohen and Mark Ludwig,
pragmatic (and somewhat sceptical) approach of Vesselin Bontchev till vague
and possibly confused opinions of "average computer user" and spurious
intentions of anonymous virus writers today.
There is a lot of confusion in the computer virus/anti-virus society today.
Many things are not clear. For example, do we know what are we talking about
when talking about computer viruses and/or artificial life? Do we talk with
each other or it is a heap of monologues without anybody listening carefully?
Where are the limits between scientific research and criminal activity? What
is the science and what is marketing and media hype? Who can tell the
difference? Are there connections between research in artificial life and
hyper production of computer viruses (with possibly malicious purposes)
today?
I would like to put some order in the confusion. On the pages of "Alive"
everybody will have a right to give his or her opinion, regardless if he or
she is an anti-virus expert/producer/researcher or "average user" (whatever
it means) or virus writer. I would like to invite all to Grand Debate about
Beneficial Viruses and Artificial Life to present your opinions and eventual
work in computer virus and/or artificial life field. However, I prefer a
little calmer atmosphere than it is on some public forums, at least the
discussions without pointless personal attacks. In fact, it is the only rule
for the Grand Debate. Everything else is free. By this I announce officially
that Grand Debate about Beneficial Viruses and Artificial Life is opened.
The purpose of the Grand Debate is to give some answers, if possible. The
subject is complex and there is no unique answer. For example, Fred Cohen
said: "...viruses are only part of a pair - the life form and its
environment..." According to Mark Ludwig viruses are "...a real-life
phenomenon, rather than a laboratory construct..." and perhaps "...the only
'life-form' apart from earth carbon-based life we will ever meet..." Vesselin
Bontchev thinks that viruses are "...challenging, doing something which is
unusual and clever...", but he doesn't believe that "...computer viruses are
a form of artificial life..."
Talking about beneficial viruses Fred Cohen stated: "A benevolent virus is
simply a virus that is used for good purposes, but then this is a matter of
context...Good and bad are relative. Most of the viruses I discuss as
benevolent are in fact reproducing symbol sequences without any known
malicious effect..." Mark Ludwig thinks: "There's a certain amount of inertia
you have to overcome to get people to actually install a beneficial virus,
though, because they've been brainwashed into believing that virus = bad..."
Vesselin Bontchev says that "...what most people understand under the term
of 'computer virus' cannot be beneficial..." and that "...'real' computer
viruses are always bad..." Furthermore, he gives the definition of "real
virus" and average user's understanding of the term. At this point it seems
that the problem of good definition of computer virus is the most important
problem to solve.
What is artificial life? According to Fred Cohen there is no difference from
real life and "the word artificial is really only a side effect of people's
egos requiring a special name for things they create..." He is talking
"...about foundations for the understanding of life in the general sense, an
expansion of biology into the general informational domain, drawing parallels
between our biosphere and the infosphere, understanding the implications of
the changes in our environment through information systems before we
experiment on our children..."
Mark Ludwig said that "...staring hard at viruses might be very valuable in
bringing about a revolution in evolutionary biology. Using carbon-based
organisms is a horrible way to study evolution. They are too complex and we
don't understand them well enough. The time frames of evolution are too
large. And deep philosophical questions rear their heads all over the place.
Inside the computer, most of these difficulties just vanish..."
Although not talking about artificial life Vesselin Bontchev gives very good
points to think about in his "Dozen reasons..." When experimenting with
potentially dangerous things which have ability to reproduce and to modify
themselves the question of controllability of such "creatures" is very
important. "A virus that claims to be beneficial should provide means to be
controlled..." and "...the user of the beneficial virus should actively
invite (e.g. install) the virus on his/her system..."
The brief conclusions from these introductory discussions are:
a) a good definition of computer virus is needed
b) beneficial viruses are possible, but it is hard to change the negative
meaning which term "computer virus" already got in public
c) the research in computer viruses and artificial life can bring us to
better understanding of life in general
d) it is important to know how to control experiments and practical use of
self reproducing entities (with eventual possibility of modification of
themselves and their environment).
It seems that this is quite a lot for the beginning. I expect that in further
discussions more questions and problems will arise, before some answers
appear. After all it is all real life. Maybe, the computer viruses are in the
world to teach us something. Computer viruses are not only pointing to
vulnerabilities in today's information systems, but also in vulnerabilities
in human society. In the smaller extent everything can be seen here. I am not
sure that there is an exact answer to question why people want to hurt other
people or to destroy something. The destruction due to malicious computer
viruses is not really the same as destruction in war. The writers of
malicious computer viruses are not the killers. Anyway, they want to tell us
something. What is that we have to find out by ourselves. Maybe we will also
find the way to learn how to put the human dimension in our everyday life.
++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++
God made us plain and simple,
but we have made ourselves
very complicated.
- Ecclesiastes 7.29 -
++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++oooo++++
____________________________________________________
/ / | |
/ |\__/| / | THAT'S ALL FOLKS !! |
/~~~~~~\ / \ | NEW "ALIVE" IS COMING NEXT |
~\( * * )/~~\( 0 0 )/~ | HOST TO YOU SOON !! |
( O ) ( O ) |______________________________|
\______/ \______/
@/ \@ @/ \@
