Viral Paranoia

Bugs by L.A. Weekly Art Dept.

BACK IN EARLY APRIL, WHEN THE MELISSA VIRUS WAS unleashing its alleged menace, George C. Smith reacted with a resounding yawn. The New York Times had declared on April 1 that "tens of thousands of computers worldwide" were infected with the virus which had "already cost millions of dollars in lost productivity." But to Smith, "the story of the virus was the virus." When I talked to him shortly after the story broke, he pointed out that "If you look at some of the news stories, you had corporate people reporting that they noticed a surge in e-mail, which they took as an indication that the virus was there. People are at work, and they've been sent the alarm, and they have access to message groups within the company. They hit 'forward to: all' and send their version of the Melissa story to everyone." Not surprisingly, those overloaded e-mail systems grind to a crawl. "There you have one example," says Smith, "of news of the virus being spread more efficiently than the virus itself."

Smith, 43, is a virus aficionado with a message for all of wired humankind: Relax! From his home in Pasadena, he publishes his online Crypt Newsletter (www.soci.niu.edu/~crypt/), which is devoted to skewering, among other techno myths, the idea that computer viruses lurk everywhere, itching to destroy your hard drive, your bank records, the military's nuclear launch codes -- anything that comes in contact with these insidious strips of software code. A former research chemist with a Ph.D. from Lehigh University, Smith split academia for the life of an ink-stained wretch (he wrote for the Allentown Morning Call in Pennsylvania), then went solo as a freelance media critic, with frequent contributions to The Wall Street Journal and Time's Netly News. To research his 1994 book, The Virus Creation Labs, he made his way into the secretive world of virus writers by becoming one himself, an activity he won't elaborate on, except to say that the "Crypt Newsletter at one time contained some virus source code." But in 1993, Smith gave an interview to the zine Gray Areas under his then nom de virus "Urnst Kouch," in which he copped to authoring several viruses with monikers like The Encroacher, Mimic and Diarrhea. Writing viruses, he said then, was not a tough assignment, with the plethora of virus source code lying around in cyberspace for the taking, waiting to be hacked. That was six years ago. Now it's even easier.

Smith has little in common with the high school and college-age virus writers he profiled in his book. A typical example is 16-year-old "Little Loc," a.k.a. "Priest," who offered source code for his Satan Bug to anyone interested, then sat back and watched in amazement as rumors circulated on CompuServe discussion groups (this was 1993) that Satan's diabolical author designed it specifically to attack government computers, and that the virus, indisputably, was the work of international terrorists. (Eventually, Satan did find its way into computers at the U.S. Secret Service, leading to the teenager's interrogation by government investigators -- and a job offer from a major computer security firm, where he was paid to devise cures for his own viruses.)

THE CRYPT NEWSLETTER HAS NOT PUBLISHED VIRUS source code for several years; these days, Smith devotes himself instead to inoculating his readers against media viruses. Because viruses are relatively simple to detect and spreading viruses is more difficult than the public generally believes, virus anxiety usually causes more "lost productivity" than viruses themselves. For example, last ã year a nasty, BIOS-chip-erasing virus known as CIH (sometimes called "Chernobyl" because it is timed to deliver its bombshell on the anniversary of the Chernobyl disaster) produced such media hysteria that, according to Smith, it caused a major aerospace firm to shut down for a day (or at least turn off its computers).

"Boeing's computer emergency response team issued a memo about CIH -- 'Alert G-8535-1998-04' -- ordering all 'employees to stop producing work on PCs for 24 hours.' Although free software to detect the virus had been made available earlier in the month, Boeing's team paradoxically forbade the use of it," he recounts.

Virus-detection software finds and eliminates most viruses, although Smith himself rarely bothers to use it, because viruses are most often planted in pirated software. Unless you're the type of person who downloads lots of illegal "warez" from fly-by-night Web sites, your chances of encountering a virus are slight. Contrary to popular delusion, viruses cannot be passed on via e-mail. They can be loaded into files attached to e-mail messages, but you must open the attachment to activate the virus. By trashing attachments from people you don't know, you've probably protected yourself.

Viruses with genuine "destructive payloads," such as CIH, do not spread widely for one obvious reason: Their payload makes them easy to spot. And viruses, by their nature, are buggy, rickety pieces of software. In most cases, they're self-defeating.

"There isn't any software written that doesn't have errors in it," Smith says. "Virus writers -- not being professional programmers for the most part -- tend to not take into account the kinds of things these viruses will encounter throughout the world, and they also tend to include their own mistakes. The vast majority of computer viruses are sufficiently obvious. Because of these two things, they cannot spread efficiently."