Date: Tue, 18 Feb 92 15:36:33 EST From: "garbled header" Subject: File 9--'Michelangelo' Scare (Washington Post abstract) "'Michelangelo' Scare Stirs Fears About Computer Viruses" Author: John Burgess Source: Washington Post, Feb 17, 1992, p. A1 A new and unusually destructive type of computer "virus" -- a software program that enters a computer surreptitiously and destroys data there en masse -- has reignited concern over these electronic saboteurs. Security experts have dubbed the virus "Michelangelo," because after entering a computer it lies dormant until March 6, the Italian Renaissance artist's birthday. Then it springs to life and wipes out data stored on the computer's memory disk. In November, a copy of Michelangelo turned up at the Gaithersburg offices of the National Institute of Standards and Technology, hiding on the data disk of a computer that had been returned after being on loan to another federal agency. Using special software, institute technicians found the virus and removed it after receiving a tip from the other agency. That agency had found the virus on its computers and warned the institute to make sure its computers hadn't been infected too. Michelangelo got national attention last month after Leading Edge Products Inc., a manufacturer of personal computers compatible with those of International Business Machines Corp., confirmed that it had shipped about 500 machines that contained the virus. The manufacturer sent customers special software designed to neutralize it. Because the triggering date lies in the future, no one is known to have lost data due to the virus, which was created by an unknown programmer and has spread from computer to computer through the exchange of infected floppy disks. But security experts, using special software that scans computer disks to detect viruses, have been finding copies of Michelangelo since last summer and removing them before they activate. It remains unclear whether large numbers of computers contain undetected copies of the virus, though estimates of millions of machines have been published in the news media. Michelangelo affects only IBM-compatible personal computers, but there are about 60 million of these in existence. Past scares about viruses often have proven to be overblown. But due to Michelangelo's unusually destructive nature, as well as the potential presence of other viruses, some computer experts are suggesting that personal computer users take no chances over getting caught by a virus. "When it hits, it's dramatic," said Lance Hoffman, a professor of computer science at George Washington University. Computer users can protect themselves by making additional electronic copies of information they cannot afford to lose, by reducing the exchange of floppy disks and the transmission of software over phone lines, and by obtaining special software that detects viruses. Viruses are a surprise byproduct of the computer age. Complex sets of computer instructions, they are usually written by anonymous programmers as pranks, or in the case of Michelangelo, in a deliberate effort to destroy the information of people the programmer has never met. Fighting the virus writers is a coalition of software companies, academics, researchers and users of personal computers. The two play a constant cat-and-mouse game -- virus writers sometimes send their creations to the experts as a challenge. If an infected floppy disk is put into a computer, the virus orders the machine to copy it onto any other disk that the computer contains, generally without the operator knowing that this is taking place. Or a virus may enter a computer when its operator receives infected software programs from a computer "bulletin board" reached by phone. Many viruses are considered benign, doing little more than flashing whimsical messages on the screen or playing a tune. But others, like Michelangelo, are engineered to seek out stored data and destroy it, sometimes on a specific date. That can be devastating. Companies might lose all of their account records, for instance, or an author using a home computer might lose the entire manuscript of a novel. To dissect Michelangelo and find out how it works, security experts have deliberately introduced the virus into test computers and advanced their internal clocks to March 6 to trigger the virus. Michelangelo-infected machines that are not functioning on March 6 will not activate the virus, according to experts. By the same token, the virus can be kept dormant by shifting the clock on the machine so that it never reads March 6. Computer experts agree that getting hit by a virus -- more than 1,000 types have been identified over the years -- can be devastating as society progressively puts more and more reliance on computers. But there is continuing debate as to how prevalent the programs really are. "I'm finding virus catastrophes everywhere," said Martin Tibor, a data recovery consultant in San Rafael, Calif., whose repeated calls to the media after the Leading Edge incident helped publicize Michelangelo. "These things are replicating like crazy." David Stang, director of research at the National Computer Security Association, offers a more conservative assessment. While stressing the danger of viruses, he puts the probability of a virus residing in a given computer at a large company at about 1 in 1,000. Michelangelo constitutes a tiny fraction of those viruses, he said. The National Institute of Standards and Technology has 5,000 personal computers and has detected about one to three viruses a month since last summer. In contrast, Total Control Inc., an Alexandria computer security firm, said that about 70 percent of the 300 personal computers at one unnamed federal agency have been found to have Michelangelo. San Jose research firm Dataquest Inc. surveyed 600 large U.S. companies late last year and found that 63 percent had found a virus on at least one company computer. However, it noted that these companies often operated hundreds of computers. Antiviral software has created a thriving new niche for the personal computer software industry. Such products can be purchased in software stores or obtained for free or at a nominal cost through on-line computer networks. Antiviral software is not foolproof, however. "You can't write a generic program that detects every virus, " said Hoffman, noting that new strains are always appearing. Some computer users suggest that the antiviral software companies want to stoke fear to build a market for their products. Consultant Tibor conceded that the calls he made to the media about Michelangelo were in part motivated by hopes of bringing business his way -- it in fact brought in only one client, he said. But his main motivation, Tibor said, was to get the word out about a serious computer danger. "I see the victims of viruses all the time," he said. He calls viruses "the digital equivalent of germ warfare."% Downloaded From P-80 International Information Systems 304-744-2253