Virus Outbreaks Thwart Computer Experts
By JOHN MARKOFF
Published: May 30, 1989
COMPUTER experts are exploring a variety of cures for the nation's epidemic of computer viruses, but they see no sure way to stop outbreaks that threaten all but the most isolated and elaborately protected systems.
Some experts say the threat is so acute it may force the nation to rethink its growing dependence on both large and small computers.
Infections by viruses, programs that can secretly spread between computers and alter or destroy data, have increased dramatically. For example, the software trade association Adapso reported in March that there were 30,000 virus infections in the last two months of 1988, as against 3,000 in the first two months of that year.
Software experts have devised a number of techniques to ward off, detect and destroy viruses. But they concede that almost all systems remain vulnerable. Further, efforts to make computer systems more secure inevitably reduce their flexibility and ease of use.
''From a technical perspective there is no silver bullet,'' said John B. Landry, an executive vice president of Cullinet Software Inc. and an Adapso executive.
The problem is worsened by the growing use of computers, electronic bulletin boards and public and private computer networks.
''In recent years a lot of people became infatuated with what they could do with computers,'' said Eugene H. Spafford, a Purdue University computer scientist who has been involved in fighting viruses. ''We have to pause and ask, 'Do we really want everybody in the country connected on a single computer network?' ''
Viruses can enter a computer system in several ways. For example, a disgruntled employee might introduce a virus that modifies programming language so that it alters or destroys data. Or users who copy software from electronic bulletin boards might unwittingly pick up a program whose author had imbedded a virus in it. Or someone with access to a computer's passwords might transmit a virus to a computer system over telephone lines.
Once inside the computer, a virus might erase all a user's data, cause a particular message to appear on computer screens, or duplicate itself, clogging the computer's memory. Researchers are most frightened by viruses that make minor modifications, like altering numbers in a spread sheet, thereby introducing errors that might never be noticed.
Researchers have taken several approaches to block virus entry or ''vaccinate'' computers so that users are notified when a virus is at work.
Also, many companies have drastically restricted employee access to computer systems or barred the use of borrowed or copied software. Others have broken up computer networks so that a virus cannot travel from system to system.
Some companies have designed elaborate password systems, abandoning passwords based on a user's name, Social Security number or other easily obtained data. In another form of protection, passwords automatically become invalid after a certain period of time. Private and Federal Surveillance
Some companies maintain their own security forces, which monitor computer systems to watch for viruses. For example, Clifford Stoll, an astronomer at Lawrence Berkeley Laboratory in California, was monitoring a group of computers there when he discovered that a West German computer hacker had entered the system through an international computer network.
Other companies have been established to perform such surveillance. And several Federal agencies have set up teams to look for loopholes in computer systems and respond quickly to virus attacks.
One of the most ambitious is the Computer Emergency Response Team Coordination Center, financed by a research arm of the Pentagon. The team operates a secure repository for computer security information, maintains a 24-hour telephone line and provides other services during computer emergencies. Team members also conduct research on computer security. The Department of Energy has a similar organization.
In the end, however, most experts acknowledge that no system is absolutely secure unless it is physically and electronically isolated from potential sources of infection.
Fears of virus contamination are already forcing corporate managers to change the way they use computers.
For example, employees of the accounting firm Coopers & Lybrand disconnected their Macintosh computers from the firm's advanced network after the network was struck several months ago by a virus. The virus, written by a disgruntled former employee of Electronic Data Systems Inc., was designed to enter computer systems and destroy software written by E.D.S. Transmitted by contaminated diskettes and computer networks, it spread widely among Macintosh users. New Laws Sought
Apple Computer Inc., which manufactures the Macintosh, issued software that can identify systems contaminated by the virus and destroy it. The company distributed it free and users passed it around through computer networks and electronic bulletin boards.
''The virus issue is very pernicious because of the way it changes the behavior of computer users,'' said David Braunschvig, the accounting firm's director of strategic management services.