Virus writers send Christmas gifts

LONDON: Christmas goodwill in cyberspace might not be as sincere as it seems, virus experts are warning. Malicious season's greetings look set to cause the latest computer bug scares, with the first two Christmas viruses already spreading fast.

"Music", which masquerades as a Christmas tune program, is a bug that can update and mutate itself by connecting to its creator's Web site. "Navidad", aimed at Spanish speakers, has swiftly become the second-most troublesome virus to clients of British-based anti-virus firm Sophos.

But Sophos technology expert Graham Cluley says the most damaging viruses may be the ones you never know you have. Whilst email-spammers can be a nuisance and hard-drive crashes can be neutralised by regular backing up, the subtlest viruses can spread rot through your work without you noticing for months or even forever. They are known as data diddlers.

One switches the places of a few numbers on a spreadsheet, another multiplies entries by 0.95, changing the data - perhaps a sales sheet or even a company's financial results - so slightly that no one notices. "The damage may not be noticed for months and if it's your company's annual results, for example, this could be highly embarrassing," Cluley told a recent news briefing.

Giving an outline of the dangers ahead, he said only one thing was certain - that the number of viruses would rise, and that writing new versions of existing ones was getting easier. A thousand new viruses are detected each month round the world - up from just 400 a year and a half ago.

"It is also getting easier to take an existing virus and mutate it. We've already seen some 60 versions of the Love Bug." Some viruses don't just forward themselves, but can forward the last document a user was working on - with the potential for huge embarrassment.

"The message isn't getting out that writing viruses is uncool," Cluley added, blaming this, in part, on the scarcity of convictions and heavy sentencing for computer crime. The author of this year's "Love Bug", the fastest-spreading virus the world has ever seen, avoided prosecution because the Philippines had not got around to adding adequate computer offences to its statute book.

And other skilled virus writers are still being hired by software companies - sending out an encouraging message to the virus writers of tomorrow. "I wouldn't be surprised if we see more viruses for mobile platforms," Cluley also said, but he stressed these may never become the huge problem some people are predicting. "Mobile phone viruses just can't exist right now as the phones are not powerful enough," he said.

Viruses are possible for portable computer systems but the only one seen so far was Phage, for the Palm operating system - and its creator sent it straight to the anti-virus companies, as if just to show he could do it and be the first. The growing use of encryption for emails is also likely to bring fresh headaches in the fight against viruses.

Anti-virus sweeps at company firewalls or on the Internet cannot cope with encryption, meaning that the only sure way to screen emails is before they are sent or after they arrive on the recipient's desktop or laptop PC. Keeping individual PCs updated with the latest sweeping software is far more labour intensive and prone to user error.

Love hurts

Despite Love Bug's fame, it was not the virus that caused the most trouble this year. That was the evil Kakworm, which spread itself around by email, just like the Love Bug, but, most sneakily, without even having to be opened by the user. "The Love Bug was like a shooting star, lots of light, sound and fury for a relatively short time. But Kakworm has been infecting people steadily for over a year," Cluley said.

Kakworm exploits a glitch in the Microsoft Outlook email programme for which a fix has been freely available for over a year - but most people do not know that. Anti-virus experts say the biggest weapon in the fight for clean computers is to educate PC users about security.

People now seem aware that Word documents can harbour hidden dangers and are increasingly suspicious of strange unsolicited emails, and should be aware of the new trick of the double extension. "LOVE-LETTER-FOR-YOU.TXT.vbs" was designed to look like a humble plain-text file - but the vbs (for visual basic script, a programming language) at the end was the often-overlooked warning sign that it hid a nasty surprise. To stay clean, it is also best to avoid online porn sites or newsgroups. Just by careless browsing one can pick up something nasty.

(C) Reuters Limited 2000.