|
|
|
The Ethics of Harm-
Welcome to my section on ethics. This is such a broad topic, but I wanted to touch on it as it applies to computers and those that use them. One of the things I find very wrong in the great, wonderful world of computers is that there are so many people that want nothing more from it than to use it as a means to harm others. By harm I'm talking about viruses, Trojans and other exploits designed to kill, cripple, invade, etc. the computers of others. I am a strong believer in ethics and doing what is right. I have a real problem with those that don't share the same view. Perhaps this is not right on my part? Maybe I am just trying to impose my morals on someone else? Well, ethically, I should try to get others to do the right thing, but I try to respect everyones opinion or view. Your right to do someone harm ends when you actually succeed in harming them.
"I was not aware that there could be any consequences. This virus was so badly written, I never imagined it would leave the town. It all depends on human stupidity, you know. It's not the computer's fault that viruses spread." -- Dark Avenger
-- Exerpt from "Inside the mind of Dark Avenger" by Sarah Gordon (used with permission)
Why did you come to this site? Was it to learn basics on how to be safer online or were you searching for exploits, viruses and Trojans? Many "security" oriented sites carry them so that there is free exchange of knowledge between the hackers / crackers and those that are supposed to stop them. Personally, I find fault with this. I feel that if you are truly trying to be a security professional, part of what you should be doing is NOT putting the very programs you are trying to stop, into the hands of someone not responsible enough to handle it and who may have ill-intentions in using it. One of the most true things I've witnessed yet is when someone comes to alt.comp.virus and asks for a virus or source code for a virus. Oftentimes the request carries the typical "I don't want to hurt anyone, I just want to learn about it and see what it does" The large majority of replies to the person will be along the lines of "If you can't find one by yourself on the Internet, then you sure as hell aren't responsible enough to handle it safely". Responsibility and accountability are not usually a part of the the virus writers world. It's a total disconnection from their actions and the eventual outcome of their creations.
One thing
to remember is that: Simply writing a virus is not a bad thing. Releasing
the virus is the bad thing. Writing a virus, for some, is a form of
learning and provides a way to test "proof of concept" ideas,
or the "can I do...?" There are those that write many viruses
that never make it "in the wild" (ITW).
Sarah Gordon - Don't you feel responsible if someone else uses one of your viruses to cause actual harm to a person's machine?
Dark Avenger - No. If they wanted to cause harm, they wouldn;t need my viruses. The could simply type "format c:" or something else that is much more effective.-- Exerpt from "Inside the mind of Dark Avenger" by Sarah Gordon (used with permission)
Part of any action you take includes an outcome. Whether its swinging a hammer to hit a nail or writing and releasing the next Melissa. Since many of the people that write or release viruses are young, many don't have the skills or education to actually write a virus themselves or make the decision as to whether they should. The thought of the end result is not considered. These irresponsible decisions can also be applied in real life through other means. As a law enforcement officer, I see kids perform actions with no thought of the outcome.
The use of "worm generators" or "kits" has spawned a whole new generation of virus "writers" that are capable of creating a .VBS script mass mailing worm by pushing a few buttons and selecting which "features" to implement. To add to this new found threat are various publications (Wired) that see fit to publish URL's and direct links to these kits. This allows anyone reading their magazine to become a "virus writer". Not only is this incredibly poor decisionmaking on the part of the publication, but its about as irresponsible as you can hope to get.
"First law of computer security: don't buy a computer. Second law: if you ever buy a computer, don't turn it on" -- Dark Avenger
-- Exerpt from "Inside the mind of Dark Avenger" by Sarah Gordon (used with permission).
Of course, many argue that the person seeking the exploit or virus source code has every right to that information as he is most typically, "learning", and who are we to stand in the way of education? The problem is though, oftentimes what he is seeking to educate himself in is not a good thing. Would you feel that education is important if they were learning to build a bomb that may be used against a school? What if you knew that what the person was seeking to learn would be used directly against you?
Another argument posed by the pro-exploit / virus community is "who is supposed to determine what information gets given out?" That is a very good question and one of the main purposes for having some sort of ethics when working with computers. When the Internet was designed, the dream was for it to be a place of no limitations or restrictions...free, fast and all encompassing. Abuse was inevitable. There would be no abuse if there weren't people making conscious decisions to do something they know is wrong. Who are these people?
"They are kids, most of whom seek fame (and achieve it easily with the help of a-v people). Most of them are not good at programming viruses at all." -- Dark Avenger (when asked about the latest crop of virus writers)
-- Exerpt from "Inside the mind of Dark Avenger" by Sarah Gordon (used with permission)
Those that create viruses and other forms of malicious software are as varied as the general cross section of the population. In short, the majority seem to be adolescent, male (girls make up a very small percentage of virus writers, but they are there) and with above average intelligence. These are very basic categories and it's recommended that you, the reader, follow the below links to learn more.
The following studies offer some excellent information :
The Generic Virus Writer by Sarah Gordon (1994)
The Generic Virus Writer 2 by Sarah Gordon (1996)
Virus Writers: Yesterday, Today and Tomorrow by Sarah Gordon
Where There's Smoke, There's Mirrors: The Truth about Trojan Horses on the Internet
All images and text are copyright 2000, 2001, 2002 by
Steve Sprague. No part of this site can be reproduced without my consent.