Inside the Mind of a Virus Writer

Who are they, and why do they do it?

Who writes viruses: social misfits with a grudge? Lanky boys in Iron Maiden t-shirts? Bond villains with computers bent on destroying society?

No. Forget your preconceptions, says Sarah Gordon, senior research fellow at the Symantec Antivirus Research Center.

"A hacker or a virus writer is just as likely to be the guy next door to you," she says, "or the kid at the checkout line bagging your groceries. She may very well be a 50-year-old female."

Although they come in many varieties, the majority of virus writers are college students. Even so, they are more normal than you might imagine. Gordon's interviewees have normal relationships with their friends, teachers, families and, yes, members of the opposite sex.

Why They Do It

"It's about the perception of the challenge," she says. "For an experienced programmer it's not difficult to write self-replicating programs but for a younger person it's a challenge." They get positive reinforcement from their friends, who are often misinformed by the media which portrays virus-writers as geniuses (albeit evil ones). In other words, they think it's cool.

Ironically, it's easy to write a virus. With the right tools, you could probably create one in a few minutes. "The skills you develop writing viruses don't help you become a programmer in anti-virus world," says Gordon. "Because I can put on a band-aid doesn't mean I should be a brain surgeon."

Gordon believes that virus writers simply aren't aware of the consequences of what they do. In their minds, once a virus is released into the wild, it is beyond their control and not their problem. Anyway, they think, people have anti-virus software so really they're doing us a favour by revealing vulnerabilities in the programmes we use.

"There's also a lot of depersonalisation and desensitisation with email and online communications," she argues. Virus writers simply don't see the pain they cause: the wasted hours, the lost work, the embarrassment and frustration.

Gordon sees the same attitude within businesses. People will write viruses or hack systems in a misguided and unauthorised attempt to test vulnerabilities. It's easy to download something from the internet and cause huge damage by running it on a live system.

Not only do you have to have an acceptable use policy and make sure employees know what it is but they have to be made aware of the consequences of not following it.

Unearthing the Antidote

It's the same story for society at large. Virus writing "isn't just a technical problem. It is legal, social, educational problem." Research shows that reducing the chances of success reduces the scope of the problem and the temptation to misbehave. Quite simply, a virus that doesn't spread like wildfire won't be reported in the papers. Correcting people's perception of how viruses are created and the damage they do will also have an impact.

And, of course, make sure you have up-to-date anti-virus software running on your computers.