Date: Tue, 18 Feb 92 15:36:33 EST
From: "garbled header" <eaten.by.our@program>
Subject: File 9--'Michelangelo' Scare (Washington Post abstract)
"'Michelangelo' Scare Stirs Fears About Computer Viruses"
Author: John Burgess
Source: Washington Post, Feb 17, 1992, p. A1
A new and unusually destructive type of computer "virus" -- a
software program that enters a computer surreptitiously and destroys
data there en masse -- has reignited concern over these electronic
saboteurs.
Security experts have dubbed the virus "Michelangelo," because after
entering a computer it lies dormant until March 6, the Italian
Renaissance artist's birthday. Then it springs to life and wipes out
data stored on the computer's memory disk.
In November, a copy of Michelangelo turned up at the Gaithersburg
offices of the National Institute of Standards and Technology, hiding
on the data disk of a computer that had been returned after being on
loan to another federal agency.
Using special software, institute technicians found the virus and
removed it after receiving a tip from the other agency. That agency
had found the virus on its computers and warned the institute to
make sure its computers hadn't been infected too.
Michelangelo got national attention last month after Leading Edge
Products Inc., a manufacturer of personal computers compatible with
those of International Business Machines Corp., confirmed that it had
shipped about 500 machines that contained the virus. The manufacturer
sent customers special software designed to neutralize it.
Because the triggering date lies in the future, no one is known to
have lost data due to the virus, which was created by an unknown
programmer and has spread from computer to computer through the
exchange of infected floppy disks.
But security experts, using special software that scans computer
disks to detect viruses, have been finding copies of Michelangelo
since last summer and removing them before they activate.
It remains unclear whether large numbers of computers contain
undetected copies of the virus, though estimates of millions of
machines have been published in the news media. Michelangelo affects
only IBM-compatible personal computers, but there are about 60
million of these in existence.
Past scares about viruses often have proven to be overblown. But due
to Michelangelo's unusually destructive nature, as well as the
potential presence of other viruses, some computer experts are
suggesting that personal computer users take no chances over getting
caught by a virus.
"When it hits, it's dramatic," said Lance Hoffman, a professor of
computer science at George Washington University.
Computer users can protect themselves by making additional electronic
copies of information they cannot afford to lose, by reducing the
exchange of floppy disks and the transmission of software over phone
lines, and by obtaining special software that detects viruses.
Viruses are a surprise byproduct of the computer age. Complex sets
of computer instructions, they are usually written by anonymous
programmers as pranks, or in the case of Michelangelo, in a deliberate
effort to destroy the information of people the programmer has never
met.
Fighting the virus writers is a coalition of software companies,
academics, researchers and users of personal computers. The two play
a constant cat-and-mouse game -- virus writers sometimes send their
creations to the experts as a challenge.
If an infected floppy disk is put into a computer, the virus orders
the machine to copy it onto any other disk that the computer
contains, generally without the operator knowing that this is taking
place. Or a virus may enter a computer when its operator receives
infected software programs from a computer "bulletin board" reached
by phone.
Many viruses are considered benign, doing little more than flashing
whimsical messages on the screen or playing a tune. But others, like
Michelangelo, are engineered to seek out stored data and destroy it,
sometimes on a specific date.
That can be devastating. Companies might lose all of their account
records, for instance, or an author using a home computer might lose
the entire manuscript of a novel.
To dissect Michelangelo and find out how it works, security experts
have deliberately introduced the virus into test computers and
advanced their internal clocks to March 6 to trigger the virus.
Michelangelo-infected machines that are not functioning on March 6
will not activate the virus, according to experts. By the same
token, the virus can be kept dormant by shifting the clock on the
machine so that it never reads March 6.
Computer experts agree that getting hit by a virus -- more than
1,000 types have been identified over the years -- can be devastating
as society progressively puts more and more reliance on computers.
But there is continuing debate as to how prevalent the programs really
are.
"I'm finding virus catastrophes everywhere," said Martin Tibor, a
data recovery consultant in San Rafael, Calif., whose repeated calls
to the media after the Leading Edge incident helped publicize
Michelangelo. "These things are replicating like crazy."
David Stang, director of research at the National Computer Security
Association, offers a more conservative assessment. While stressing
the danger of viruses, he puts the probability of a virus residing in
a given computer at a large company at about 1 in 1,000.
Michelangelo constitutes a tiny fraction of those viruses, he said.
The National Institute of Standards and Technology has 5,000 personal
computers and has detected about one to three viruses a month since
last summer.
In contrast, Total Control Inc., an Alexandria computer security
firm, said that about 70 percent of the 300 personal computers at one
unnamed federal agency have been found to have Michelangelo.
San Jose research firm Dataquest Inc. surveyed 600 large U.S.
companies late last year and found that 63 percent had found a virus
on at least one company computer. However, it noted that these
companies often operated hundreds of computers.
Antiviral software has created a thriving new niche for the personal
computer software industry. Such products can be purchased in
software stores or obtained for free or at a nominal cost through
on-line computer networks.
Antiviral software is not foolproof, however. "You can't write a
generic program that detects every virus, " said Hoffman, noting that
new strains are always appearing.
Some computer users suggest that the antiviral software companies
want to stoke fear to build a market for their products.
Consultant Tibor conceded that the calls he made to the media about
Michelangelo were in part motivated by hopes of bringing business his
way -- it in fact brought in only one client, he said. But his main
motivation, Tibor said, was to get the word out about a serious
computer danger.
"I see the victims of viruses all the time," he said. He calls viruses
"the digital equivalent of germ warfare."%
Downloaded From P-80 International Information Systems 304-744-2253
