Chaos Manor Benchmarks

By Jerry Pournelle

January 6, 2003

(Chaos Manor Benchmarks :  Page 1 of 1 )

Column 269 (Continued from the Previous Week)

Viruses, Worms, and Trojans, Oh My!

Periodically I get mail returned as undeliverable: Only it is mail I never sent. I'm used to it, and pay little attention. It's usually followed by mail from others who have had the same experience, and are frightened; and sometimes from people who have received mail purportedly from me—and which contained a virus. Note that in no case had I sent a virus, or indeed sent any mail to those people.

What's happening here is a new (well, it's not really new, but it seems more prevalent lately) kind of virus or Trojan or worm—the distinctions aren't really important here—that works this way: It invades a computer, usually because someone opened a mail attachment. They thought the attachment was from someone they knew. When they opened it, nothing happened, or they saw a harmless cartoon, and they may not have suspected that the mail didn't come from their friend at all—and that it contained a virus.

Once present, the virus goes to work. First, it seeks out any address books it can find. Some versions also look at the subject headers of legitimate email on the computer. Then the virus chooses a subject, either from its internal stores or from subjects already present in email on the infected computer; attaches a copy of itself plus the harmless cartoon; and mails or forwards a message, possibly one found in the infected system's mailbox, to a number of the addresses in the address book—but before it does that, it fakes the return address. Rather than use the return address of the infected machine, it uses one it found in its victim's address or contact files.

Thus if you and I are both in Joe Radiantsmile's data base, and Joe, being a PR guy and friendly to everyone, opens an infected mail attachment from someone he really wants to hear from—like John Dvorak—then Joe gets infected by the virus, which wasn't sent by Dvorak but instead came from a copy of the virus that infected another PR person's computer.

 Page 1 of 1