What is computer Virus? and its evolution in computer systems.

The Word “Virus” comes from Indo-European language family root Indian – Sanskrit viṣa, Avestan vīša, and Ancient Greek ἰός (iós), which all mean “poison”.

The English word “virus” also comes from the Latin vīrus, which also refers to poison.

In Biology, Virus is a microscopic infectious agent that replicate itself inside living cells of alive system.

Same way, in computer systems, Virus is a type of infectious software that, when executed, replicates itself inside computer system and has ability to modify systems OS or application programs by inserting its own code into those programs.

What virus can do to computer systems?

The below actions of a virus can severely disrupt normal computer operations, compromise sensitive information, and cause financial and reputational damage to individuals and organizations:

1. Unauthorized Access: Viruses can change code used for system authorization and create backdoor or it can take exploit system vulnerabilities to gain unauthorized access to infected system. This can allow attackers to control the system, it can cause Denial Of Service(DDoS) for system user.
2. Data corruption: Virus can modify, delete, or corrupt files and data stored on infected systems.
3. System Instability: Virus can affect systems normal operation, leading to system crash, freeze, or sudden system CPU & memory excessive consumption also called as resource drain results in performance degradation can make system unusable.
4. Spying and Surveillance: Some viruses are capable of monitoring and recording user activities, capturing keystrokes, screen recording, accessing webcam and microphone. Which can then use by threat actors for espionage(https://dictionary.cambridge.org/dictionary/english/espionage), identity theft or other nefarious(https://dictionary.cambridge.org/dictionary/english/nefarious) purpose.
5. Transmission: Viruses can spread in computer networks affecting each system though LANs, emails as an attachment, file transfers over different protocols(ftp), though removable media (HDD, SSD, Pen Drive), though internet by downloading malicious file or software and many more ways are there.

Evolution Of Viruses:

1949          – Theory of self-replicating programs by John Von Neuman.

1970-1971    – Creeper Virus (replicating) by Bob Thomas at BBN Technologies. Creeper gained access via the ARPANET and copied itself to the remote system where the message, “I’M THE CREEPER. CATCH ME IF YOU CAN!” was displayed.

1881-1982    –  Elk Cloner (first personal computer virus) by Richard Skrenta. It attached itself to the Apple DOS 3.3 operating system and spread via floppy disk. Infecting the personal computer and displaying a short poem beginning “Elk Cloner: The program with a personality.”

1986-1987   –   Brain (Boot Sector virus for MS_DOS) by Amjad Farooq Alvi and Basit Farooq Alvi in Lahore, Pakistan. First computer virus for the IBM Personal Computer (IBM PC) and compatibles. Brain affects the PC by moving real boot sector to another sector and marked as bad. And it was replacing the boot sector of floppy disk with the copy of virus.

1988         –   Festering Hate virus (for Apple OS) CyberAIDS are the names of the first two Apple ProDOS viruses, this virus were annoying but was not damaging the system. It was extremely destructive, spreading to all system files it could find on host computer and then destroying everything when it could no longer find any uninfected files.         

1989         –  Ghostball (First Threat) by Friðrik Skúlason. It was able to infect both executable .COM-files and boot sectors. It can place its code in boot sector and gets activated on execution of infected file. Once its activated it will search directories recursively for other uninfected .COM files to infect.

1991         – Michelangelo (First Malware) by Australian hackers. It attacks boot area of storage devices. This effect can make file into an unreadable form. Once the virus infects a computer, it remains dormant until a specific date March 6 of each year, to be exact. On March 6, any computer infected with Michelangelo has critical data on its boot disk overwritten, damaging the disk and rendering it unusable and the data nearly unrecoverable. It comes through USB drive, HDD drives, Floopy Disk.

1992          – WinVir (First For Microsoft Windows) by Masud Khafir, the Netherlands.

1996          – Bizatch/Boza virus (First for Windows95) by  Australian hackers which can encrypt files on compromised systems. It adds .boza extension to encrypted files.

1997         – Win32.Cabanas (memory-resident stealth virus) by virus-writing crew VLAD. It installs itself as part of the operating system when executed, after which it remains in RAM from the time the computer is booted up to when it is shut down.

2000       – ILOVEYOU worm by Filipino computer science student. It has infected 10 million PC’s after 5^th May 2000. It spreads through an email has message line “ILOVEYOU”, and attachment “LOVE-LETTER-FOR-YOU.TXT.vbs”. At first glance it looks like a text file to non-technical users, but it was Visual Basic script with extension .vbs, which was running a script by opening an attachment it affects system by overwriting random files.

2003     – SQL Slammer worm by David Litchfield. It has affected computer systems and networks by Denial-Of-Service(DDoS) attack. There was a bug ‘Buffer Overflow’ in SQL server and Desktop Engine Database products which was exploited by this virus.

2003-2007 – Fizzer virus (first money making) by F-secure. The Fizzer worm locates the Kazaa shared folder on an infected computer and copies itself there with random names. Any person who connects to an infected computer and executes files downloaded from its shared folder becomes infected with the worm.

2003-2007 – Code Red virus discovered by eEye Digital Security employees Marc Maiffret and Ryan Permeh. Code Red was a computer worm observed on the Internet on July 15, 2001. It attacked computers running Microsoft’s IIS web server CodeRed is a worm that caused possible billions of dollars of damage in the summer of 2001. It contains the text string “Hacked by Chinese!”, which is displayed on web pages that the worm defaces. July 19, 2001. On this day, the number of infected hosts reached 359,000.

2007           –  Zeus (First Trojan Malware) by Hamza Bendelladj. It was a malicious software that was used to steal financial data. It has become one of the most successful pieces of botnet software in world.

2008           – Conficker virus by Ukrainian citizens. It  was a computer worm targeted windows systems by using flaws in windows OS program. This worm was designed to get administrative access to system. It has infected millions of government, business and home computers.

2011             – Gameover Zues by Russian cybercriminal Evgeniy Bogachev. It was a malware installed through a link to website that download malware to user system, which was delivered through spam emails. It was used in bank frauds resulting damage of approx. $1000 millions of dollars loss to bank.

2012            – Flame by The United States and Israel. It’s a malware first discovered in 2012. It was able to spread to other system through LAN. And was able to record audio, screenshots, keyboard activity and network traffic. It’s able to record Skype conversations, also it’s able to turn infected systems to Bluetooth beacons.

2013             – Linux.Darlloz was discovered by Symantec. It has infected Linux Embedded systems. It has targeted different embedded systems including routers, security cameras, set-top boxes by exploiting a PHP vulnerability.

2014             – Regin (Tool for espionage and mass surveillance) by United States and United Kingdom. Regin was multi-staged backdoor Trojan, means it has number of components, each dependent on to others to perform attack. It was also known as Remote Access Trojan(RAT), able to capture credentials, monitor network traffic, take control of connected input devices, gather system metrics.

2015             – BASHLITE (First used for DDoS attack). It’s able to hold open TCP connections, send a random string of junk characters to a TCP or a UDP port, or repeatedly send TCP packets with specified flags. The malware connects to random IP addresses and attempts to login, with successful logins reported back to the command and control server. It was a client-server model for command and control.

2016             – MEMZ  was malware in the form of Trozan Horse, created by Leurak for youtuber dancooct1’s Viewer-Made malware series. It was able to create screen glitches.

2016    – Spyware/Pegasus developed and distributed by a private company. It’s a malicious software which enters victims computer, gather data from devices connected to system or over network and users, and sends it to third parties without user’s consent.

2017    – Kedi RAT is a Remote Access Trojan, capable of escaping security scanners, and communicates with its command & control server via Gmail. It was discovered by Sophos. It looks like a Citrix Utility, transfers data using Gmail.