Spreading viruses
Upwards of 60,000 viruses are at present coursing through our cyberstream. Assaults range from targeted guerilla attacks to indiscriminate carpet bombing intended to create as much electronic and psychological mayhem as possible. What motivates people to write viruses and why do people fall for their tricks?
Frank Farley, a former American Psychological Association president, calls hackers cyber-delinquents - people with a graffiti-artist mentality desperately seeking to show that they exist, and addicted to the cheap thrill of having some sort of power over other people's lives. But as the practice multiplies, 'poachers turned gamekeepers' (former hackers who work for manufacturers of anti-virus software and attend conferences organised by virus writers) are helping to flesh out this stereotype.
In order to understand more clearly what makes them tick, virus writers can be divided roughly into three camps. Nuisance-level viruses are generally written by smart, relatively privileged youngsters who eventually grow out of the habit. Their viruses are more an expression of technological and social experimentation, characteristic of their life stage, than because of any drive to do significant harm.
As one would expect among educated teenagers, they quickly lose interest when they come to recognise two things. First, that virus writing is regarded as child's play among the cyber-savvy, giving it a low 'street cred'. Second, the level of social daring involved is hard to control - the ramifications of nuisance viruses can sometimes have more serious effects than expected.
Life-stagers are therefore less threatening than the second category of virus writer: the protester. Protesters are people motivated by clearly delineated ideological, political, moral or religious beliefs. For them, writing a virus is an alternative mode of dissent or militancy. Sometimes their motivation can solidify or multiply support, like the Beijing and Spanish viruses that were written to broadcast and condemn the massacring of students, and telephone charges, respectively.
This category also includes fanatics who, some fear, may be moved to use viruses to disable essential facilities or to terrorise whole societies.
Finally, there are the hackers. They have neither the naivete of the life-stagers nor the ideological motivation of the protesters. They are closest to the stereotype: experienced, thrill-seeking, borderline criminals who take pleasure in flaunting mainstream standards of behaviour.
Some psychologists have tried to profile successful virus writers. For example, it has been proposed that the writer of the 'Loveletter' virus (which spread to tens of millions of internet users) simply tried to appeal to people like him - those who would jump at the slightest suggestion of being special. Such subject lines are particularly destructive because they hit the depressed or lonely, or otherwise psychologically vulnerable.
Why do end users continue to click where they should not? Because threats are increasingly sophisticated, blending novel and proven features of past viruses and worms. 'Klez', for example, used 'spoofing'. Instead of relying on an attractive subject line, the virus writer figured out a way to change the 'From' address of the infected message to a familiar address taken from the target machine's e-mail address book. Another trick is to make a message resemble an authentic warning about an impending threat. The prospect of viewing pornography is an eternal winner, too.
In the trade, such manipulations are called 'social engineering', and are an area of intense competition. We are all familiar with their 'weapons of influence', as social psychologist Robert Cialdini calls them, through exposure to advertising. There is the concept of authority that lowers our normal resistance. An offer of help makes it hard to believe the intent could be malicious. The chance to take action to avoid harm is universally compelling. And finally, fear accelerates the need for a reaction.
So the humble internet user is courted by an incredibly diverse group of punters, all seeking to exploit old vulnerabilities from fresh angles. Anti-virus software programmers struggle to keep up. But it is not software deficiencies that are most often exploited by virus writers. The weakest link is the individual's reluctance to use security software diligently. People buy and install it - but neglect to regularly update it. Thus, the virus writer scores another victory because the responsibility falls back on to the end user, who understandably resents the resources required to keep informed.
Jean Nicol is a psychologist specialising in issues of cultural identity and change in an era of globalisation
