and then hell froze over

anti-virus companies do not hire virus writers, if i've said it once i've said it a thousand times... oh sure, there was that one example where a company which wasn't even in the security industry (their main focus being graphics) hired benny (aka marek strihavka) to be the lead developer of their anti-virus software (which wasn't actually for public consumption at the time) because they felt he was reformed (even though he still makes viruses available on his webpage) and was then thoroughly denounced by multliple members of the av industry... then, of course, there's the case of sven jaschan who was hired by a security company - but again NOT an anti-virus company or even a company looking to make anti-virus software, so one could say that he doesn't count (especially since his hiring resulted in the company losing an av company it had hoped to partner with)...

it may seem like these violate the av companies don't hire virus writers rule but in reality these edge cases (neither company is technically an anti-virus company) actually reinforce the rule by virtue of what the av industry does in response...

so you can imagine, then, how far my jaw dropped when john sharp, founder of authentium, solicited applications from students who graduated from a virus writing curriculum:

Authentium to George Ledin's students: if you're interested in a job, we'll look at your resume. Based on your training, our assumption is that you're going to do a better job helping us detect and defeat malware than someone without this knowledge.

now, i realize one might argue that people who learned to write viruses in school don't have the same motives as those who write and release viruses (though it occurs to me that a virus writing curriculum would appeal to exactly the type of person who would write and release viruses so you may actually be dealing with a population whose bad apple content is higher than average) and the debate has been weighed in on by far more influential individuals than myself - but, with many companies refusing to hire such students just as they would virus writers, mr. sharp's words are unexpected to say the least... i wonder if he's shared his philosophy with helmuth freericks, who was listed as the vp of r&d at authentium when he signed the public letter against teaching virus writing that's being hosted by the anti-virus information exchange network...

things get more interesting than that, however... authentium's (formerly command software system's) command anti-virus used to license the f-prot scanning engine and given the identical naming produced by the two it seems like it still does... that engine is produced by frisk software international... frisk has made his feelings on the subject of virus writing curricula very clear, stating that it's ethically unacceptable, so it'll be interesting to see what if anything becomes of this if authentium really does hire students who've taken such courses...

what is a virus writer?

a virus writer is a person who writes/programs viruses, nothing more, nothing less...

while many virus writers do more than just write viruses, those other things are not technically part of being a virus writer - being a virus writer does not imply sharing viruses, spreading viruses, publishing viruses, or letting viruses escape... the act of writing a virus does not require or imply the communication of the virus with the rest of the world, and if the virus isn't communicated to the rest of the world it cannot be a problem - thus we shouldn't try to solve the supposed problem with totalitarian laws about what we can or cannot write on our own computers as it addresses the wrong problem...

people often forget/ignore/gloss over the distinction between virus writing and the related activities but i think martin overton said it best when he said "I don't give a flying fig that you write viruses (as long as you keep them to yourself)"...

back to index

anti-virus companies don't hire virus writers

this is an urban myth/conspiracy theory that pops up again and again... some people are convinced that the anti-virus industry hires virus writers, either to put their 'virus writing expertise' to good use stopping viruses, or to actually write viruses to keep the anti-virus industry in business...

it's absurd...

first of all, writing a virus isn't the slightest bit comparable to writing detection algorithms to find thousands of viruses... virus writing isn't actually all that difficult a task in and of itself, and it's made even easier by the existence of published code to do just about anything a new virus writer might want... in order to evade detection a virus need only have an implementation that is new in a sufficiently non-trivial way... anti-virus development, on the other hand, involves reverse engineering, code emulation, and a host of other skills that are really orthogonal to writing viruses... the average virus writer's skill set just isn't useful in anti-virus development...

second, under most versions of the conspiracy theory, hiring virus writers is supposed to be a clever move by the anti-virus companies but this cleverness doesn't hold up under scrutiny... why hire virus writers to write viruses when there are (provably) lots and lots of people willing and able to make viruses for free?... that would be the opposite of clever...

finally, any anti-virus company that hired a virus writer would be crucified by it's competitors in the court of public opinion... these are businesses, they are motivated by money and if they can get more money at the expense of one or more of their competitors they will... and it's not like you can keep something like this secret - disgruntled employees will leak the info, employees who switch companies will leak the info, etc... that's a risk no anti-virus company can afford...

just keep these things in mind next time you hear the silly conspiracy theory...

let's be part of the problem

DVForge - Virus Prize 2005
what the hell are these people thinking, offering to pay people to write viruses for the mac and spread them in the wild? like virus writers don't already have enough motivation to write and spread viruses - especially when it comes to being the first one for a new platform or the first one in the wild for a new platform... those sorts of things already make them (in)famous...

these folks have clearly had a break our ethical reality - you do not need a proof of concept virus to prove viruses can spread on the mac - mac OS X is basically a form of unix and the very first viruses that fred cohen wrote when doing his seminal work on viruses back in the '80s worked on unix systems... and they did work, they spread on production systems...

come on, folks - all general pupose computing platforms are susceptible to viruses... all of them... it's been proven - and i don't mean the way you prove things in court with evidence, because there will always be new platforms for which there is no evidence yet... i mean it's been proven on paper with logic - the only facilities a virus needs are those that are already present in the definition of general purpose computer...

these people are not solving any real problem by offering a reward to virus writers for writing yet more viruses (and you know damn well there are going to be a lot more viruses written than rewards handed out)... all they are doing is making virus spreading (because you do need to spread your virus so that it makes it's way onto the target systems naturally in order to get the reward) seem more legitimate by wrapping it up like it's some sort of good deed that puts a set of misconceptions by uninformed people to bed... the fact is that they are soliciting behaviour that is illegal under canadian laws (criminal mischief pertaining to data) as well as laws in a variety of other countries that have unauthorized-access-related legislation...

john mcafee reputedly paid for virus collections and thus became a pariah in the anti-virus industry for supplying virus writers with financial motivation to write viruses... these people here are supplying financial motivation to write & spread viruses and that absolutely contributes to the problem, rather than the solution... these people are not interested in the greater good, they're only interested in making a name for themselves and they don't care how much damage they cause in the process...

update 5:30pm: well, that was quick... seems a lot of people contacted the guy in charge and convinced him to stop the contest... hurray!... now let's move on...

legality of virus writing

someone at f-secure is clearly frustrated...

how many times have i seen someone say that virus writing should be illegal? i don't know, i've lost count it's been said so many times... i'm sure it probably seems entirely reasonable too... except wait, oh my goodness, it's not!...

huh? what am i talking about? i'm talking about the fact that enforcing such a law would be an unprecedented contravention of fundamental human rights...

let's face facts - abstracted from all other related activities, simply writing a virus is analogous to writing in a personal journal... it's a matter of freedom of thought and as such one of the most fundamental freedoms there is... it doesn't affect anyone until the writer tries to communicate his/her idea with others... if i write a virus and no one else ever sees it, have i contributed to the virus problem? if i utter a racial slur and no one's around to hear it, have i offended a minority group? no on both counts... what i do in the privacy of my own home or the privacy of my own computer should be of no concern to anyone else...

if you're going to outlaw something, outlaw something that actually causes a problem... outlaw spreading viruses, maybe even outlaw publishing viruses (see here for why full disclosure shouldn't be usable as a valid argument against such free speech limitations), but keep the thought police out of the picture...

that's important so i'll repeat it - outlawing virus writing would be a contravention of a person's freedom of thought, keep the thought police out of the picture...

vx'er crackdown

Police raided another virus writer
Benny, Ratter questioned

looks like law enforcement is starting to get more serious (and capable) about getting their hands on virus writers... i said this kind of thing was coming, years ago, but do the vx'ers listen to me? no...

well ok, maybe some of them did... but obviously not enough...

there should be billboards with pictures of stern looking cops and captions that read "write viruses? that's fine. let 'em out and you're mine."...

and i'm not even suggesting that the vx'ers referenced in those articles actually let anything out - but obviously someone has been doing so, and that endangers the whole 'scene'...