Computer viruses can spread at warp speed across global networks and the internet, infecting your IT systems at the speed of light. Neil Campbell reports

Computer viruses are the bubonic plague of the information technology age. Spreading across global networks such as the Internet, they can cause havoc at the speed of light.

Viruses are becoming increasingly more dangerous, more intelligent and more difficult to track and trace. All this comes in an age where companies' reliance on information technology and software systems is increasing exponentially.

Electronic messaging and the Internet are now the benchmarks for communication within and between networked organisations. The worldwide dominance of Microsoft Windows means that countless organisations are potentially vulnerable to the same virus. Companies are becoming ever more vulnerable to attack, and the potential consequences of attack are becoming increasingly severe. The stakes are rising...

From disk to e-mail
Computer viruses were first carried on infected disks. Inserting the disk into the company's system would insert the virus as well. The need for physical transmission slowed down the rate of infection. Nowadays, with the explosion in use of e-mail and the Internet, viruses can be sent all over the world, instantaneously, and millions of copies can infect millions of systems.

The current virus `vogue' takes the form of e-mail attachments and macro programs - ideal transmission platforms for the spread of macro viruses.

Anti-viral defences continually improve. But so do the skills of the rogue programmer.

How viruses attack
A virus is simply a computer program - it contains instructions that tell your computer what to do. Viruses tell your computer to do something you don't want - or wouldn't want if you knew it was happenning. By definition, a virus must be able to self-replicate to spread. Viruses are therefore programmed to spread to other files on your computer and to other people's files through your network. The effects of viruses range from frustration through to destruction.

The two highest profile computer viruses are `ILOVEYOU' (May 2000) and `Melissa' (March 1999). Nothing like these two has has hit the general public for almost a year. But don't breathe a sigh of relief. You should be asking `what will it be in 2001?'

Coming your way
Research (by Message Labs) indicates that e-mail users are still alarmingly vulnerable to viruses designed to appeal to their curiosity.

  • 54 percent would open an e-mail entitled Great Joke
  • 50 percent would open Look at this
  • 46 percent would open Re. Message
  • 40 percent would open No title
  • & 39 percent would open Special offer.

    New viruses, or reincarnations of previous malicious strains, will continue to appear.

    Things can only get worse
    Five years ago, experts predicted that the chance of receiving a virus over a one-year period was about 1 in 1000. In the present day, chances have dropped to 1 in 10. The historical `boom' in computer viruses is well publicised.

    Year Viruses detected in e-mails
    1992 1,100
    1995 6,000
    1998 11,000
    2001? 40-60,000
    Source: US Dr Solomon's anti-virus company

    The number of viruses year-on-year is increasing at an alarming rate. Between six and 12 new viruses are appearing each day. `Only' 200 to 300 of the total number of viruses, however, are actively spreading.

    Why are the number of virus reports and incidences increasing at such a fast rate? The following factors go some way to explaining:

  • E-mail and the Internet offer the perfect medium for the spread of viruses
  • Fibre-optic telecommunications networks are now so advanced that electronic messages can circle the globe within minutes
  • More computers and laptops mean more targets and more inter-connections
  • Improved virus monitoring increases the number of viruses detected
  • Casual security and failure to update security procedures and products opens systems to risk
  • Flaws in operating systems can be easily compromised by an astute programmer.

    Experts are warning that, in the future, viruses - carried by e-mail - will infect networks on arrival into employees' mailboxes. This removes a fundamental step in the attack process - the user will not have to open the e-mail or launch an attachment to activate the virus. Furthermore, cluster viruses may enter your system and subsequently generate mini-viruses. These will deliver a `multi-pronged' attack on your system, shutting down anti-virus software.

    The newest, and potentially most dangerous, threat is from rogue Web pages. These infect the computer while the user surfs the Internet, oblivious to the impending problems.

    It may not be long before Linux systems, palmtops and mobile phones are targeted. Welcome to the 21st century.

    Actions you can take
    In reality, there is no `silver bullet' solution that will render your company virus-proof. Anti-virus companies are continually improving defences against present and future threats. But - some day - the next `I LOVE YOU' will strike, and anti-virus companies will be one step behind.

    There are, however, measures that you can adopt to build up your defences:

  • Install the latest anti-virus software
  • Disable macros in all applications
  • Download `patches' for software holes
  • Update anti-virus software, at the very least on a weekly basis, to avert the latest viruses
  • Educate employees on the telltale signs to look out for in risky incoming e-mails
  • Exercise caution whenever installing software or downloading files.

    I love you ...
    The speed and magnitude of ILOVEYOU (also known as `LoveLetter' & `LoveBug') superseded any electronic virus before it.

    The Symantec Anti-Virus Research Centre began receiving reports regarding the ILOVEYOU virus early morning of May 4, 2000 (GMT). The virus appeared to originate from the Philippines.

    ILOVEYOU is a macro virus for Word 97 and Word 2000 that utilises Microsoft Outlook (not Outlook Express) to send itself to many people, very quickly. As a result, it spread like a plague across business e-mail systems and the Internet alike, even causing chaos in `infallible' companies such as Microsoft and Intel.

    The statistics for the virus are impressive:

  • Suspected 55 million computers received the virus
  • 2.5 to 3million of these computers were infected
  • Damage estimates range from $5billion to $10 billion in lost data and man hours
  • Major corporations and establishments such as Microsoft, Intel, the Pentagon, CIA and British Parliament were all affected
  • May 8, 2000. Police identified and arrested Romel Lamores from Manila, an employee of China Bank, as the suspected author of the ILOVEYOU virus. They later dropped the case against the 27-year-old. The prosecutor said the National Bureau of Investigation could not produce the extra evidence ordered by a court to allow a case against the man to proceed under the Access Device Act.

    `ILOVEYOU' set for return?
    Experts are predicting the return of the `ILOVEYOU' on February 14th - Valentine's Day (after this supplement goes to Press).

    Users are particularly vulnerable to unusual e-mails on Valentine's Day. A survey from anti-virus vendor Message Labs warns that, despite the notoriety of ILOVEYOU, one in three business e-mail users across the UK would still open an email titled `I love you' on the 14th February.