Some thoughts on actual computer “viruses”

I remember those old viruses which used disk boot-sectors to infect other computers. They took months to spread worldwide, and some of them were very destructive. But they were generally well programmed (used a tiny amount of system resources) and used “legal” ways to reproduce themselves.

I say legal, because they moved within the rules imposed by the operating system and did not need “broken windows” or “unlocked doors” to survive and get into other systems.

Actually, viruses tend to use more and more known bugs to get into systems and reproduce themselves. They also use (or abuse of) user errors to infect new computers. This change seems not likely to be a consequence of improved operating system security, it has more to do with the massification of poorly tested and badly developed software.

Today's example is Microsoft SQL-Server 2000. It surely is a complete and very user-friendly database server, but that's only half of a software product. A software product should also include a secure design and not less testing as developing hours.

Another such software, coincidentally also from Microsoft, is Outlook. Lots of functionality packaged in one software, great ideas, that has to be said. But what about security? Millions of people worldwide use that software trusting that they are using a well-tested program. Sadly, they are wrong.

I've used an unknown E-Mail client that provides all e-mail functionalities of Outlook and more. When I receive one of those E-Mails with corrupt MIME headers and auto-executing attachments, I think in all those Outlook users that are in the CC: field because their PC's are being infected and I'm happy to be using my little PMMail.

Gik.-