In 1986, there was one known computer virus. Today there are 50,000 and between 10 to 15 new ones are being discovered every day.
To battle this profusion of computer bugs, Cupertino-based Symantec Corp. founded the Symantec AntiVirus Research Center five years ago and placed the world headquarters of the division in Santa Monica.
SARC looks like a combination of NORAD and the computer section at Fry’s. Computers sit in rows, running every operating system imaginable.
This room is where the viruses get to play, according to SARC Director Vincent Weafer. All the famous ones were here once: Melissa, bubbleboy, Chernobyl.
A team of engineers and computer scientists watch the dynamics of the virus. They observe where it imbeds itself, how it impacts each kind of operating system, and how much damage it can do. Then, within minutes, based on the patterns of the thousands of other viruses they have fought, they find a cure.
It’s rather like the lesson learned by Keanu Reeves in “The Matrix” you have to become the virus in order to beat it.
Research organization Computer Economics estimates that $12.1 billion was spent worldwide in 1999 to fight computer viruses, and President Clinton just allocated an additional $280 million to fight cybercrime.
America wakes up
It was the Melissa virus, which spread itself by sending e-mails to the names in the user’s address book, that woke up corporate America to the potential damage that can be inflicted by computer terrorism.
“You’re seeing new positions at corporations, like the vice president of security,” said Elizabeth Magliana, vice president of product management for Symantec’s enterprise solutions division. “Before, people would want (virus updates) every six months. Melissa changed that paradigm. Now companies ask ‘How quickly can you get it to me?’ ”
The jump in the number of viruses can be attributed to several factors, Weafer said, starting with the prevalence of Microsoft Office in the workplace and the ease of Internet downloading that allows a novice to trigger a chain of events that could take down a network.
And with greater use of cable modems and digital subscriber lines in homes comes more risk. “With dial-up, you’re only susceptible as long as you’re connected,” Weafer said. “With always-on access, they can get to you at three in the morning.”
But many Internet users at home write off the potential for disaster all your files are backed up, so you’re in the clear, right?
Wrong, says Weafer.
If you’ve ever bought anything on the Internet, your credit card numbers are out there for a crafty-enough virus to weed out. Anyone who does online banking faces similar risks.
Companies that use Symantec products can isolate suspicious files and e-mail them to SARC for analysis. Potentially infected diskettes and CD-ROMs are also sent for a once-over. Weafer says that 80 percent of these files are infected with viruses they’ve seen before and can readily correct.
More advanced programs
For the remainder, SARC uses a procedure known as “Scan and Deliver.”
Antidotes are prepared by computers searching the virus database for solutions that have worked under similar conditions. A fix that works is created, and the patch to kill the virus is shipped back out to the users.
Weafer believes that expert programmers are getting into the game because the quality of the viruses that SARC now sees are more sophisticated. These people may be aided by organized networks, with names like Cult of the Dead Cow, where computer virus programmers share information and work out various versions of malicious creations.
The FBI has a division dedicated to combating computer crimes, and SARC helps the authorities whenever it discovers an electronic fingerprint that can help narrow down the whereabouts of a hacker.
Much like the infectious disease hotspots monitored by the Centers for Disease Control and Prevention, there are similar outbreak zones for computer viruses.
The areas now under watch by SARC include a cluster in Brazil and Argentina, he said, which send their viruses for dispersal to Japan, where laws governing cybercrime are lax. There are also intermittent outbreaks of hacker activity in Eastern Europe.
The sites around the globe are monitored by SARC outposts in Sydney, Tokyo and Leiden, The Netherlands. Information collected by these sources is transferred to Santa Monica, where a cure for the new virus can usually be found and distributed before it creates mass chaos.
