Judging Good and Evil

Overview The use of " anti-virus " techniques in many modern worms recalls two stories: the " war " between virus writers and the possibility of a beneficial virus. This article examines both in light of recent events in the virus world. In early 2004, the release of Netsky began a rash of articles discussing " vigilante " coders trying to stop the spread of other worms. The war between Netsky's author and the Beagle and MyDoom writers garnered widespread public attention; even articles in non-security sources questioned the impact of this fight. The debate over using a computer virus to fight other viruses or to harden a system against potential attack has been around for decades 1. Although no virus has actually ever met an accepted definition of " beneficial, " many appear to have tried. Prior to Netsky, worms of all varieties (both real and theoretical) have been constructed to fit the role of " good virus. " All For One The concept of a beneficial virus has been discussed for years in the viral research arena 2. Historically, the debate has been framed by those that reject any self-replicating software that forces system changes as a legitimate aid and those that argue a " good " virus is theoretically possible. The latter group generally argues that past failures and a lack of tangible examples does not mean that the possibility of a good virus should be dismissed. This report begins with the general theory of a good virus and then looks at possible candidates that have been released. To properly discuss the topic, there has to be a common definition of what makes up a " virus, " or at the least, some of its characteristics need be agreed upon. For the purposes of this analysis, " virus " will simply mean any software that replicates and makes system changes (whether these changes are perceived as positive or negative). The viral payload will be used to help discern the intention of the program/author. There are intrinsic properties of viral code that make it dangerous for public release, no matter what the payload or intent. Even a tool that downloads and installs a single patch to every machine it is run on endangers applications or entire networks where fixes have