LAS VEGAS- What kind of person would unleash a data-damaging virus onto the computers of complete strangers?
Just about anyone, according to Sarah Gordon, who profiles creators of cyber-epidemics for IBM's Thomas J. Watson Research Center.
"Who writes viruses?" Gordon asked a roomful of hackers and information protection specialists Wednesday at the Black Hat Briefings computer security conference at Las Vegas' garishly elegant Venetian hotel-casino.
"We all know it's evil, unethical, maladjusted teenagers with no social lives, absent parents, and too many Danzig CD's, right?"
Wrong.
According to Gordon's research, including a study of 80 active virus writers, most have normal social lives, get along just fine with family and friends, and generally mean no harm. "All these stereotypes really don't make it," she said.
The virus writers in Gordon's study range from teenagers to college students to professionally employed grown-ups. Most lose interest as they get older; adults who remain in the "virus underground" do tend to have a few social problems, said Gordon.
Otherwise, the only evident pattern she has found among virus writers is that they tend to be intelligent, educated, and male. Given the tools required for their trade, common sense also suggests that most probably live in households with middle-class or better incomes.
Female virus writers are few and far between -- so far Gordon has encountered only five.
Why would anyone want to create a program whose only purpose is to replicate itself and damage other people's data? Deliberately malicious virus scribes are rare, said Gordon. Most don't realize how easily their creations can spread and the harm they can cause.
She has received calls from students who have created viruses as a research project, only to see them accidentally infect their entire school's system.
"People write viruses to feel empowered," she said. Some say they are motivated by pure curiosity; others claim it's a kind of free speech; and some say it's just harmless fun that doesn't really affect anyone.
That might have been true 10 years ago, Gordon pointed out, but not in the Internet age, as the Melissa and explore.zip virus recently proved.
Some are trying to show software developers the flaws in their programs, in order to force them to create better products, said Gordon.
There are also political virus writers who write programs that merely display a key word such as Macedonia, their creators' names, or the name of a group on screen as a way of marking turf -- a kind of cyber-graffiti.
And then there are the cyber-Unabombers who spread viruses to demonstrate the downside of modern society's dependence on technology.
For more than a decade there have been computer bulletin boards where virus devotees could exchange programs. To make it even easier to build cyber-infections, there is now an abundance of sites where virus aficionados can chat, swap code, and even download virus kits.
"There's been a resurgence in the popularity of creating viruses recently," said Jeff Moss, organizer of the Black Hat Briefings. "It's been getting more media exposure, so more people are attracted to it."
That's bad news, he points out, in an era when networked computers -- to say nothing of the Internet -- mean that viruses can spread faster and further than ever before.
Still, there's no need for panic, according to Gordon. Though some 40,000 known viruses exist, only about 300 significantly impact users, she said, and most of those can be handled by good anti-virus software.
"Most people write viruses that will never affect you."
