The Psychology of Virus Writers

securitas writes "BBC Technology reports on the psychology of virus writers and the work of security researcher Sarah Gordon, who has been studying this area for 20 years. ''The stereotype that virus writers are all young teenage boys with no social life, hiding in their basement is not accurate,' she said. In contrast, she said, most virus creators are typical for their age, are on good terms with friends and family and are often contributors to their local community.' The story is an interesting contrast to a previous BBC report about why people write viruses."

Comments

virus-con

[larry bagina]

As well as quizzing people online, Ms Gordon, who now works for security firm Symantec, became a regular at the conferences and conventions that virus writers attend and organise.

Do virus writers really go to virus conventions? I'd think you'd find people like Ms Gordon, undercover FBI, wannabe 133t teenagers, and maybe a couple former virus writers out of jail and trying to find admiration.

Re:virus-con

[Shisha]

The article in general didn't seem to be too Slashdot worthy, so to speak.

I mean, for the general public it might be big news that writing viruses, especially nowadays with MS Outlook everywhere, has become a challenge just about only for a few teenagers. The article didn't mention anything about even the possibility of someone writing viruses for some ill purpose e.g. creating spam drones, preparing for a DDoS attack or whatever.

In a typical psychologist style there were general statements like "viruses written by hackers are more complex". Who's a hacker? For me it's Linus and Alan Cox etc. not someone running "nmap" and waiting for a new exploit to be published. The point is there is no clear definition of a"hacker" and the statement becomes plain meaningless. What does "typical of their age mean"? Oh nevermind.

Btw. Also I'm not sure what she meant by "participating in the local community". Does that mean slashdot?

Re:virus-con

[Omestes]

Using the term hacker is not vague to the general public. The word has a very concrete meaning, to most people it means someone who does bad things with computers, i.e. use them to steal data, crack systems, mess up corporate and governmental websites, and such.

Sure, geeks and /.ers use the term to mean ubergeeks with a more egalitarian ethical system, but joe public does not understand this. They we either not around when the word hacker was used as a benevelant tag, nor are they as deep in the geek community and mystique.

So the use of the word geek does not make the article loose validity.

Slashdot?

[October_30th]

no social life, hiding in their basement is not accurate

How about running a similar investigation on /. folk?

Re:Slashdot?

[Davak]

Not to push your idea too far, but perhaps virus writing and slashdotting are somewhat related.

No, I'm not trolling...

Virus writers get a lot of attention and feedback regarding their work. They usually believe they are exposing some weakness or highlighting some security risk. They see their actions on the news and the internet.

Slashdot posting gives some similar stimuli. By posting an excellent message, the author receives moderation and more people start discussing the idea. Likewise, most slashdotters are posting to expose an idea or highlight something they think somebody else might appreciate.

Both activities give certain rewards. Just like trolling is a cheap (immoral?) way of getting good slashdot stimuli such as responses and emotion... virus writing is a cheap (immoral?) way of getting "rewarded" for programming.

I think the worship of Rand (Atlas Shrugged) is stupid... however, it serve to remind us that people do certain things for rewards--slashdot or virus writing included.

Davak

Stereotypes

[immel]

"The stereotype that virus writers are all young teenage boys with no social life, hiding in their basement is not accurate" It is quite normal for teenage boys with no social life(something they have no control over) to hide in their basement. I believe it was Linus Torvalds who said that we could alll breathe easier if all these poor people could just get some dates. (someone will probably redirect this to the NYT magazine interview)

Re:Stereotypes

[KillerHamster]

As reported in this Slashdot story, the interview is here (free reg, etc.)

The relevant question and response were:

We've been getting hit with a lot of viruses and worms lately. What's your idea for ending the attacks?

When you have people who hook up these machines that weren't designed for the Internet, and they don't even want to know about all the intricacies of network security, what can you expect? We get what we have now: a system that can be brought down by a teenager with too much time on his hands. Should we blame the teenager? Sure, we can point the finger at him and say, ''Bad boy!'' and slap him for it. Will that actually fix anything? No. The next geeky kid frustrated about not getting a date on Saturday night will come along and do the same thing without really understanding the consequences. So either we should make it a law that all geeks have dates -- I'd have supported such a law when I was a teenager -- or the blame is really on the companies who sell and install the systems that are quite that fragile.

Why people write viruses?

[heironymouscoward]

Because it's good business, when you're being paid by spammers to create huge networks of compliant computers.

The kids who learnt how to do this 5-10 years ago are now living off it. For the really good virus writers, it's become a career.

One word to sum up the psychology of virus writers

[Faust7]

"Mua ha ha."

Really, it's not that difficult...

[herrvinny]

For your average email virus, slap on a SMTP engine, a searcher to grab email addresses, and a semi-interesting email so people will run the program, and bam, you're got yourself an email virus, preying upon people's stupidity.

On the other hand, things that attack vulnerabilities such as buffer overruns, etc are harder because you actually have to do some research.

A question for /. lawyers and people who play one: virus writing is illegal, I know, but is writing a trojan illegal? And if it is, how do you define a trojan?

but what about the psychology of virus catchers?

[karuna]

I have never used antivirus program for the last 4 or 5 years and my computer has never be infected with a virus. Actually it is a mistery for me why people execute apparently infected file on their computers and then blame others for their stupidity.

I remember the times when viruses spread around with floppies. It got written into boot sector and loaded into memory when floppy was inserted into drive. Then antivirus programms were necessary. Nowadays, however, it is not a technical issue to write a virus but purely human engineering. Those virus writters have better understanding of average human psychology than I have and they know that average Joe will download untrusted file, or will run the attachment, regardless how suspicious it may look.

Why care about virus writers? They will always be arrond like those who draw grafiti on walls which is a nuisance but not something that any sane man would seriously believe to. Better educate people how to use their computers and whom to trust online.

Re:Hackers

[James Lewis]

Please get over this. I know that there are "white hat" "hackers" out there who want the meaning of hacker to be something different, but you lost that battle a LONG time ago. Ask anyone on the street these days, and they'll tell you a hacker is someone who maliciously breaks into people's computers. You can't change that, just come up with a different name to call yourself or live with the reaction most people will have when you tell them you are a hacker.

Two quick questions...

[sczimme]

Anyway, I'm gonna go hang out in the backyard of my white Protestant family's backyard and talk about golf while barbecuing.

1) Your backyard has a backyard? Cool!

2) Golf while barbecuing? Do you have a grill hitched to the back of the golf cart? 'Cause that would be neat, but the greenskeeper might get mad. Oh, you meant ((talk about golf) while barbecuing), not (talk about (golf while barbecuing)). Gotcha.

Bet you thought these would be at least somewhat relevant questions about stereotypes. In the words of Dark Helmet: "Fooled you!"

:-)