Virus Hunters

| SPECIAL TO GCNIt has been 12 years since the first real Internet virus scare. On Nov. 2, 1988, Cornell University graduate student Robert Morris unleashed a 'worm' program that used e-mail protocols to propagate itself across the Internet.It was a sophisticated program, written in c, and its primary effect was to slow Internet e-mail to a crawl.The Morris worm was a mere sneeze compared with what the latest crop of malicious programs has done to computer systems worldwide in the last two years.First, there was Melissa. Then in May, a computer student at a vocational school in the Philippines unleashed a worm of his own. This time, the program was written in Visual Basic Script, disguised as an e-mail attachment, a love letter.And it did a lot more than just slow down Internet message delivery. It destroyed data on infected systems and brought countless corporate mail systems to their knees. Because of a lack of laws criminalizing computer vandalism, the suspected author of the Love Bug was never prosecuted. A series of copycat viruses, essentially modifications of the original ILOVEYOU worm code, continued to attack computer systems throughout the rest of the spring and summer.With the world increasingly linked by the Internet, and with tools making software development less difficult, the potential threats to computer security have grown exponentially over the last few years. And recently, the number of incidents of politically motivated Internet attacks has increased dramatically.There are two widely used methods of detecting malicious programs. One is recognizing a known virus' signature, or code pattern. The other is identifying malicious behavior by a program and isolating it.Signature-based scanning uses pattern recognition software to identify malicious code or files infected with a virus. The software examines the binary structure of a file and checks it against a database of the patterns of known threats. When the scan results in a match, the software can identify the problem file and isolate, repair or delete it.Signature scans work extremely well with known viruses but often can be easily circumvented by new threats. These programs are heavily dependent on frequent and timely updates from the software's manufacturer.Fortunately, most software packages that use signature scans support automated downloads from the Internet of updates to their databases. But in some cases, the software must be restarted after the updates are downloaded'not always an acceptable option if the protected system is a server.Symantec Corp. deals with this issue in its Norton AntiVirus Corporate Edition 7.5 by separating the scanning engine from the rest of the software architecture, allowing new definitions and software updates to be loaded without a restart.Behavior-based, or heuristic, scanning is a bit more complex. Rather than looking for specific known viruses or malicious applications, it watches for suspicious activity by a program, intercepting any application code that performs actions that could be damaging to the operating system. This can offer a high level of protection, but it can also be intrusive to system users.Also, some heuristic scans still depend on signature files to identify virus-like behavior with a specific threat, so they might not act against new threats that behave in ways the scans don't expect. This happened with ILOVEYOU, which many antivirus products did not immediately perceive to be a threat because it was a script-based attack and ran within a trusted application'Microsoft Outlook.Also essential to defending against viruses is the matter of where to catch them. Most virus protection programs traditionally have run on the desktop computer. This approach was fine when the main point of entry of viruses was through infected floppy disks, and it still offers a great deal of protection to individual users. But more layers of defense are required for an Internet-connected network.The first line of defense for most networks is at the entrance'the firewall or Internet mail gateway. Some firewall products can screen for malicious code in Simple Mail Transfer Protocol message packets before letting them on the network, preventing infection of systems from the outside.Firewall packet screening can be effective against already identified threats, as it is almost always dependent on pattern recognition. It also works well in blocking viruses and other threats coming in over nonmail protocols like File Transfer Protocol and Hypertext Transfer Protocol.Another type of interceptor, usually running on the mail relay server or on a groupware server, is a content filter. It can check for specific attachment types and quarantine them, preventing them from being delivered.Trend Micro's InterScan, for example, provides behavioral analysis and signature checking for not just SMTP but FTP and HTTP as well, to block both viruses and malicious Java and ActiveX Web components in Web pages before they even get on the network.Another effective point of defense is the organizational mail or groupware server; protecting this point can prevent infected files from entering from outside the organization or being propagated internally if brought in through other means.Some antivirus products integrate directly with groupware products such as Lotus Domino and Microsoft Exchange, screening attachments to mail messages.With large client installations, reporting is an essential part of catching attacks early. Reporting can help set up protection against new threats before they spread. Some products, such as Symantec's Norton and Network Associates' McAfee, offer a central console from which administrators can control how the product is deployed and check activity logs and other reports from client systems.But just as important as any virus protection product is applying rigorous administrative policies to networks and teaching users to apply a little common sense.By now, users should know the danger of opening an unknown file type. But every day, it seems another user double-clicks on yet another version of a script virus and launches yet another barrage.User education is very important to ensuring that the threat from viruses, malicious code and other attacks on system security are maintained at a level that can be managed by the safeguards put in place.XXXSPLITXXX-