Is It Possible to Make a Computer Virus That Acts as an Anti-virus?Is It Possible for a Universally-Executable Virus to be Written in Binary?Computer that lasts for centuries?Would relatively primitive people really confuse technology with magic?Could a virus be genetically modified to target a specific human population?How viable would an analog computing revolution be?Symbiotic anti-virus animalWith current technology, genetically modified virus able to end mankindIs it plausible that a country developed steam engines before gunpowder?Virus within a virus: possible?Is It Possible for a Universally-Executable Virus to be Written in Binary?
What is the best way to teach JavaScript functions to middle schoolers?
What would be the effect(s) of this asteroid?
How can I create a n way Cartesian product of type lists in C++?
What to do if some panel members walk out while I'm being interviewed?
How to appropriately quit a "bad" unpaid internship?
When does one use an extra stave for piano music?
Identifying Wires behind Light Switch
How to correctly say Star Wars in Latin?
Can every manifold be turned into a Lie group?
Corridor seats on the TGV — why? Are seat reservations not always mandatory?
What is the moral difference between abortion and infanticide?
Why didn't classical music use drums?
Do they actually regularly send out people with space ships to spacewalk out and fix broken satellites?
How would sword design change if the aim was to cause as much immediate bleeding as possible?
Why can't I shoot with a fast shutter speed?
Even and Odd Numbers
Why was LEGO reluctant to use additional colours for regular bricks in former times?
What happens when a photon "dies"?
A story both SF and Fantasy where a character in a spacesuit has a phantom arm
What is the relative return point (i.e. the "space it left") of a creature banished by the Banishment spell?
How bad is 1. e4 c5 2. Nf3 d6 3. a3?
Affection vs. Affliction
Is one spouse responsible if other failed to file taxes
Resolution of potentiometer
Is It Possible to Make a Computer Virus That Acts as an Anti-virus?
Is It Possible for a Universally-Executable Virus to be Written in Binary?Computer that lasts for centuries?Would relatively primitive people really confuse technology with magic?Could a virus be genetically modified to target a specific human population?How viable would an analog computing revolution be?Symbiotic anti-virus animalWith current technology, genetically modified virus able to end mankindIs it plausible that a country developed steam engines before gunpowder?Virus within a virus: possible?Is It Possible for a Universally-Executable Virus to be Written in Binary?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
.everyonelovesstackoverflowposition:absolute;height:1px;width:1px;opacity:0;top:0;left:0;pointer-events:none;
$begingroup$
After receiving answers to this question, I now know that viruses cannot be written in machine code in such a way that they can universally infect all kinds of systems. Every machine has a unique set of instructions, and processes the zeroes and ones in a different way.
Knowing that, I have a follow-up question: Can a virus be made for a system in a way that acts like an anti-virus? In other words, this virus would infect computers and instead of causing damage, it would protect the computer from other viruses?
If the answer is yes it is possible, could this virus be sophisticated enough to automatically update its virus definitions? Perhaps an advanced deep learning algorithm allows this?
Upon trying to research this, I am able to get definitions of anti-virus and definitions of virus, but I haven't had any luck in gaining a good understanding of their possible interchangeability. I know that both of them are software-based, so I'm inclined to say this is possible.
Or would such a program be too large? (most viruses are very small in order to avoid detection, as well as attach themselves to emails or other programs)
UPDATE: For the sake of this question, the virus could be made using modern technology, or future technology with sophisticated artificial intelligence or advanced compression (to make the virus smaller).
science-based reality-check computers
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
$endgroup$
|
show 7 more comments
$begingroup$
After receiving answers to this question, I now know that viruses cannot be written in machine code in such a way that they can universally infect all kinds of systems. Every machine has a unique set of instructions, and processes the zeroes and ones in a different way.
Knowing that, I have a follow-up question: Can a virus be made for a system in a way that acts like an anti-virus? In other words, this virus would infect computers and instead of causing damage, it would protect the computer from other viruses?
If the answer is yes it is possible, could this virus be sophisticated enough to automatically update its virus definitions? Perhaps an advanced deep learning algorithm allows this?
Upon trying to research this, I am able to get definitions of anti-virus and definitions of virus, but I haven't had any luck in gaining a good understanding of their possible interchangeability. I know that both of them are software-based, so I'm inclined to say this is possible.
Or would such a program be too large? (most viruses are very small in order to avoid detection, as well as attach themselves to emails or other programs)
UPDATE: For the sake of this question, the virus could be made using modern technology, or future technology with sophisticated artificial intelligence or advanced compression (to make the virus smaller).
science-based reality-check computers
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
$endgroup$
2
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
20
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
31
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
11
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
3
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11
|
show 7 more comments
$begingroup$
After receiving answers to this question, I now know that viruses cannot be written in machine code in such a way that they can universally infect all kinds of systems. Every machine has a unique set of instructions, and processes the zeroes and ones in a different way.
Knowing that, I have a follow-up question: Can a virus be made for a system in a way that acts like an anti-virus? In other words, this virus would infect computers and instead of causing damage, it would protect the computer from other viruses?
If the answer is yes it is possible, could this virus be sophisticated enough to automatically update its virus definitions? Perhaps an advanced deep learning algorithm allows this?
Upon trying to research this, I am able to get definitions of anti-virus and definitions of virus, but I haven't had any luck in gaining a good understanding of their possible interchangeability. I know that both of them are software-based, so I'm inclined to say this is possible.
Or would such a program be too large? (most viruses are very small in order to avoid detection, as well as attach themselves to emails or other programs)
UPDATE: For the sake of this question, the virus could be made using modern technology, or future technology with sophisticated artificial intelligence or advanced compression (to make the virus smaller).
science-based reality-check computers
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
$endgroup$
After receiving answers to this question, I now know that viruses cannot be written in machine code in such a way that they can universally infect all kinds of systems. Every machine has a unique set of instructions, and processes the zeroes and ones in a different way.
Knowing that, I have a follow-up question: Can a virus be made for a system in a way that acts like an anti-virus? In other words, this virus would infect computers and instead of causing damage, it would protect the computer from other viruses?
If the answer is yes it is possible, could this virus be sophisticated enough to automatically update its virus definitions? Perhaps an advanced deep learning algorithm allows this?
Upon trying to research this, I am able to get definitions of anti-virus and definitions of virus, but I haven't had any luck in gaining a good understanding of their possible interchangeability. I know that both of them are software-based, so I'm inclined to say this is possible.
Or would such a program be too large? (most viruses are very small in order to avoid detection, as well as attach themselves to emails or other programs)
UPDATE: For the sake of this question, the virus could be made using modern technology, or future technology with sophisticated artificial intelligence or advanced compression (to make the virus smaller).
science-based reality-check computers
science-based reality-check computers
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
edited Oct 9 at 20:05
Renan
74.6k21 gold badges167 silver badges350 bronze badges
74.6k21 gold badges167 silver badges350 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
asked Oct 2 at 15:40
overlord - Reinstate Monicaoverlord - Reinstate Monica
5,76016 silver badges48 bronze badges
5,76016 silver badges48 bronze badges
2
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
20
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
31
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
11
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
3
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11
|
show 7 more comments
2
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
20
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
31
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
11
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
3
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11
2
2
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
20
20
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
31
31
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
11
11
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
3
3
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11
|
show 7 more comments
12 Answers
12
active
oldest
votes
$begingroup$
That has already happened.
The "2012 Internet Census" (known professionally as the Carna botnet) was a virus that infected ~400,000 consumer network hardware devices (like routers or modems) by using default passwords. The author of it eventually gained control over a meaningful percentage of devices in the world, and was able to see internet traffic patterns in realtime from billions of devices (at the time, only ~4 billion devices could be visible on the internet, due to technical limitations).
While doing this, the author says:
We noticed at this time that one of the machines already had an unknown binary in the /tmp directory that looked suspicious. A simple strings command used on that binary revealed contents like synflood, ackflood, etc., the usual abuse stuff one would find in malicious botnet binaries. We quickly discovered that this was a bot called Aidra, published only a few days before.
The Aidra botnet was a botnet created by an Italian hacker, who sold time on it for DDoS attacks (the kind of thing that takes down websites). Aidra is a classic case of a virus, in the sense that you're thinking. It infects devices, and uses them to do bad things.
The author of Carna goes on to say:
Since Aidra was clearly made for malicious actions and we could actually see their Internet scale deployment at that moment, we decided to let our bot [...do some technical things...]. This step was required to block Aidra from exploiting these machines for malicious activity.
Resulting in...
Within one day our binary was deployed to around one hundred thousand devices - enough for our research purposes. We believe Aidra gained a litte[sic] more than half of that amount. The weeks after our initial deployment we were able to build binaries for a few more platforms. We also probed telnet every 24 hours on every IP address. Since many devices restart every few days and needed to be reinstalled again, over time we gained machines that Aidra lost
This means, in a nutshell, that the author of the Carna botnet observed the malicious Aidra virus spreading, and decided to choke it out using his own botnet. A virus fighting a virus. Carna won, and Aidra had little impact on the world.
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
$endgroup$
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
add a comment
|
$begingroup$
Yes it's already happened
See Welchia Virus
The Welchia virus downloads itself via the same vulnerability that the Blaster virus used. It then deleted the Blaster virus if found and then installed the patch closing the hole down before spreading to new systems and finally deleting itself.
An antivirus virus.
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
$endgroup$
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
add a comment
|
$begingroup$
Yes
A virus is not a virus because it's doing bad things per-se, but because of how it is installed / replicates to other systems. Any computer virus can be modified in such a way where the actions it performs is to block other viruses from being installed or modified on the system. In fact, a virus could be used to simply install anti-virus software on the computers it infects.
Another way the virus could achieve protection is by simply revoking root / administrator permissions from any other programs or users except itself, effectively stopping any further software from being installed on the system.
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
$endgroup$
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
add a comment
|
$begingroup$
Real computer worms that close vulnerabilities
There are historical examples of self-spreading network viruses ("worms") that follow the pattern of:
- exploit a particular vulnerability;
- "fix" that vulnerability so that it's not exploitable anymore;
- (optionally) remove other popular malware that uses the same vulnerability and it's likely to be there.
One example like this is Welchia which is considered to be mostly benign (though with "side effects") as it removed the Blaster worm which was popular at the time and installed Microsoft patches; there are also other examples of "anti-worms".
In addition, there are commercial botnet systems that are designed to close down vulnerabilities and clean up the system of other malware (presumably owned/controlled by competitors) so they do remove some bad things (and protect from future infections) so as to have full access to the system resources for their malware. If I recall correctly, some variants of Mirai were doing this, but it's certainly not unique or novel nor that unusual.
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
$endgroup$
add a comment
|
$begingroup$
You could design a piece of software that works this way in PRINCIPLE, but in practice it would have some pretty significant limitations.
The primary problem is that antivirus software relies very heavily on being able to propagate defensive information on new threats and security flaws to the defended machines more rapidly than a threat can infect them. Most security flaws and viruses require some kind of social engineering component to get a human to do something, so that human rate of engagement can slow a virus' spread enough to allow time for the antivirus to analyse the new threat, develop a defense, and distribute it to all protected machines.
Therefore in order to provide a successful defense, your your antivirus-virus (henceforth referred to as AVV), needs to be able to communicate with all instances of itself wherever they are to share information. You can't rely on each instance of AVV learning just from what it's exposed to on that machine. You need EVERY instance of AVV sharing information, and that's a very tricky thing.
In order to successfully propagate, AVV needs to stay small. Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully. This means your antivirus functionality can't rely on definitions per se, because that requires a massive database of known threats. Therefore each instance can't maintain its own local information storage either. Your database of learned behavior therefore needs to be distributed across all the instances of AVV throughout.
You ALSO need a way for the instances of AVV to be able to understand the differences in environments in the machines they've infected and understand which other instances are sharing those environments so they can preferentially share information. E.g. AVV that infects Apple devices has different threats to defend against than those on Android devices, or Windows 10 versus Windows 8, or servers in older powerplants running on NT 4.0 or something gothic like that.
On top of all that, AVV is ALSO going to need to be able to at least partially disable any actual antivirus software that's ALREADY on the machine it's infecting. Having two sets of code trying to protect the same machine at the same time causes LOTS of problems. You may never have had to deal with the fallout from someone trying to use Norton and McAfee at the same time on the same computer, but I have, and it's not pretty.
The real problem is this though: In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on. This is, by and large, exactly what ALL viruses do and so, from the point of view of the user, your AVV is going to be as much of a problem as many of the more malicious viruses it's defending against. Sure, AVV is using those CPU cycles and gigabits of bandwidth to stop threats instead of sending Russian porno spam everywhere, but the result on the infected machine is often the same.
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
$endgroup$
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
|
show 3 more comments
$begingroup$
Yes.
A worm (which is a type of virus) spreads by exploiting a vulnerability replicating itself, but if that worm is also patching that vulnerability as it goes along, it isn't technically malicious (it can still have deleterious effects though, such as tying up bandwidth, etc...).
For example, in Linux, there have been worms which self-replicate and patch the vulnerability they exploit, preventing more nefarious worms from acting on the vulnerability, which would make them a kind of "white-hat" virus.
What makes a program a "virus" or "antivirus" depends on what its ultimate impacts on a system are. A virus spreads and damages infrastructure, an antivirus prevents this. Under a strict definition though, a virus is technically any self-replicating program. It is thus possible to have a self-replicating antivirus which provides immunity to a specific exploit (as in the self-replicating patch-worm example).
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
$endgroup$
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
|
show 3 more comments
$begingroup$
The first ever antivirus software (Reaper) was a virus! It was written in 1971 to catch the first ever worm, Creeper. The only way to fully eradicate Creeper was by installing Reaper on all connected PDP-10 mainframes. This was done by having Reaper automatically replicate itself on other machines.
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
$endgroup$
add a comment
|
$begingroup$
The short answer is yes.
A virus can do whatever it is programmed to do. If you want it to install itself as an anti-virus you can absolutely do that. If you want it to attempt to "infect" other hosts to act as an anti-virus you can use the usual exploits.
But why though? if your Anti-Virus Virus is so good at its job that you want to black-hat it to everyone, why wouldn't you make it an open source download instead. Why would you intentionally trigger already installed anti-malware trying to protect them? What do you gain?
Overall, it is possible. I just fail to see it being worth it.
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
$endgroup$
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
add a comment
|
$begingroup$
as @eigenvalue mentioned. Stuxnet was one of a kind virus, which was able to target specific windows machines. These specific machines were targeted because these machines were the machines of the Iranian scientists who were at the time working on Nuclear Reactor.
The special thing about this virus was that it was spread in the wild and if the machine was not who it was looking for it would just sit there idle. From all the machines in the world it was able to figure out which machine it had to be activated on.
In industries and nuclear plants special computers are used called PLC's which are programmed via ladder diagram. Its kind of a drag and drop builder used to program. The virus actually infected the scientist's machine which was connected to the PLC and then changed the ladder diagram and increase the spinning speed of nuclear reactors. Increasing the speed caused resonance which destroyed these reactors, and the virus achieved the desired goal.
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
$endgroup$
add a comment
|
$begingroup$
Knowing that, I have a follow-up question: Can a virus be made for a
system in a way that acts like an anti-virus? In other words, this
virus would infect computers and instead of causing damage, it would
protect the computer from other viruses?
Yes, once a program gets in it can do pretty much whatever it wants.
If the answer is yes it is possible, could this virus be sophisticated
enough to automatically update its virus definitions? Perhaps an
advanced deep learning algorithm allows this?
Yes, and its not even hard. The AI deep learning part is a bit harder, but still doable.
A lot of viruses spreading is due to users not updating their systems.
Just upload a list of software the computer contains and its version, and download and install the new versions. That and running windows update, apt-get update, zypper dup, or etc for your OS offers a lot of native protection if its ever even used.
After that implementing a firewall for the user, or re-configuring windows firewall would raise the bar even higher.
automatically sandbox know weak programs like web browsers and mail clients.
Download a list of bad IP's and bad behaviors ever day, and doing a black list would offer even more protection.
So the hacker uses a CDN (content distribution network), so you have a main distribution point from a website hosted on a cdn, and that pretty much all you need.
So the program would have a built-in list of IP or website address, and a preset list of files to download.
Said program would wget http://www.goodvirus.com/files.txt
wget http://www.goodvirus.com/blacklists.txt
The files.txt would contain a list of files and versions to download.
If the version is newer than what you have it download the new version.
Your biggest problem and where the AI comes in is problems like specter, melt down, and etc are way hard to detect. Also mitigate has issues, After a few weeks the security will have a patch you can just download and install reboot and your safe.
You have to ask yourself how far this virus is going to go.
An AI which detects, and implements its own solution is going to have to be way smarter. It will takes years to develop and prefect.
However, automated tools from companies already exist, google has sysbotz which throws things at the linux kernel until it breaks. Then said bot compiles a report, and sends it off to the kernel devs for them to fix. More and more of these automated testing platforms are being created and deployed.
More and more smarter testing routines are being developed and tested all the time.
The bigger problem is the difference between program and virus comes down to user consent. Sure your program forcefully propagates every where, but at the end of the day if your program does nothing bad people will willingly allow or install your virus on their computers. Then it's no longer a virus, but a program.
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
$endgroup$
add a comment
|
$begingroup$
Stuxnet has the code to remove itself after the given date in the future.
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
$endgroup$
add a comment
|
$begingroup$
A long time ago (2007), someone with a very acute case of the oedipal complex decided that the real problem with IT security was the weak link, i.e.: users. Which was probably the inspiration for this Dilbert strip (source):
So he created a program called Disk Knight that replicated over networks, and it completely disabled USB drives. No more infections from obnoxious relatives plugging their virus-ridden usb drives on your machine to send their work to your printer! YAY!
Only the dude became such a persona non grata that the internet gave him a damnatio memoriae punishment. The only thing left over of the whole story are passing mentions on Microsoft and Norton's pages about the functions of Disk Knight, and how its behavior was unacceptable. Other than that, mentions and mentions in forums on how to remove it, usually in languages other than English.
So you see, if you can write a program to defend the machines of the layspeople, you can protect them from viruses. But if you are not an expert and you don't know what you're doing, you may cause more harm than good. The proper way is still to make yourself a known force against malwares so as to build trust, and in that way you can cooperate with the community in the fight against evil. Fail to do so, and no matter how good your motives, you'll go down in history as a villain.
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
$endgroup$
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "579"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworldbuilding.stackexchange.com%2fquestions%2f157482%2fis-it-possible-to-make-a-computer-virus-that-acts-as-an-anti-virus%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
12 Answers
12
active
oldest
votes
12 Answers
12
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
That has already happened.
The "2012 Internet Census" (known professionally as the Carna botnet) was a virus that infected ~400,000 consumer network hardware devices (like routers or modems) by using default passwords. The author of it eventually gained control over a meaningful percentage of devices in the world, and was able to see internet traffic patterns in realtime from billions of devices (at the time, only ~4 billion devices could be visible on the internet, due to technical limitations).
While doing this, the author says:
We noticed at this time that one of the machines already had an unknown binary in the /tmp directory that looked suspicious. A simple strings command used on that binary revealed contents like synflood, ackflood, etc., the usual abuse stuff one would find in malicious botnet binaries. We quickly discovered that this was a bot called Aidra, published only a few days before.
The Aidra botnet was a botnet created by an Italian hacker, who sold time on it for DDoS attacks (the kind of thing that takes down websites). Aidra is a classic case of a virus, in the sense that you're thinking. It infects devices, and uses them to do bad things.
The author of Carna goes on to say:
Since Aidra was clearly made for malicious actions and we could actually see their Internet scale deployment at that moment, we decided to let our bot [...do some technical things...]. This step was required to block Aidra from exploiting these machines for malicious activity.
Resulting in...
Within one day our binary was deployed to around one hundred thousand devices - enough for our research purposes. We believe Aidra gained a litte[sic] more than half of that amount. The weeks after our initial deployment we were able to build binaries for a few more platforms. We also probed telnet every 24 hours on every IP address. Since many devices restart every few days and needed to be reinstalled again, over time we gained machines that Aidra lost
This means, in a nutshell, that the author of the Carna botnet observed the malicious Aidra virus spreading, and decided to choke it out using his own botnet. A virus fighting a virus. Carna won, and Aidra had little impact on the world.
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
$endgroup$
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
add a comment
|
$begingroup$
That has already happened.
The "2012 Internet Census" (known professionally as the Carna botnet) was a virus that infected ~400,000 consumer network hardware devices (like routers or modems) by using default passwords. The author of it eventually gained control over a meaningful percentage of devices in the world, and was able to see internet traffic patterns in realtime from billions of devices (at the time, only ~4 billion devices could be visible on the internet, due to technical limitations).
While doing this, the author says:
We noticed at this time that one of the machines already had an unknown binary in the /tmp directory that looked suspicious. A simple strings command used on that binary revealed contents like synflood, ackflood, etc., the usual abuse stuff one would find in malicious botnet binaries. We quickly discovered that this was a bot called Aidra, published only a few days before.
The Aidra botnet was a botnet created by an Italian hacker, who sold time on it for DDoS attacks (the kind of thing that takes down websites). Aidra is a classic case of a virus, in the sense that you're thinking. It infects devices, and uses them to do bad things.
The author of Carna goes on to say:
Since Aidra was clearly made for malicious actions and we could actually see their Internet scale deployment at that moment, we decided to let our bot [...do some technical things...]. This step was required to block Aidra from exploiting these machines for malicious activity.
Resulting in...
Within one day our binary was deployed to around one hundred thousand devices - enough for our research purposes. We believe Aidra gained a litte[sic] more than half of that amount. The weeks after our initial deployment we were able to build binaries for a few more platforms. We also probed telnet every 24 hours on every IP address. Since many devices restart every few days and needed to be reinstalled again, over time we gained machines that Aidra lost
This means, in a nutshell, that the author of the Carna botnet observed the malicious Aidra virus spreading, and decided to choke it out using his own botnet. A virus fighting a virus. Carna won, and Aidra had little impact on the world.
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
$endgroup$
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
add a comment
|
$begingroup$
That has already happened.
The "2012 Internet Census" (known professionally as the Carna botnet) was a virus that infected ~400,000 consumer network hardware devices (like routers or modems) by using default passwords. The author of it eventually gained control over a meaningful percentage of devices in the world, and was able to see internet traffic patterns in realtime from billions of devices (at the time, only ~4 billion devices could be visible on the internet, due to technical limitations).
While doing this, the author says:
We noticed at this time that one of the machines already had an unknown binary in the /tmp directory that looked suspicious. A simple strings command used on that binary revealed contents like synflood, ackflood, etc., the usual abuse stuff one would find in malicious botnet binaries. We quickly discovered that this was a bot called Aidra, published only a few days before.
The Aidra botnet was a botnet created by an Italian hacker, who sold time on it for DDoS attacks (the kind of thing that takes down websites). Aidra is a classic case of a virus, in the sense that you're thinking. It infects devices, and uses them to do bad things.
The author of Carna goes on to say:
Since Aidra was clearly made for malicious actions and we could actually see their Internet scale deployment at that moment, we decided to let our bot [...do some technical things...]. This step was required to block Aidra from exploiting these machines for malicious activity.
Resulting in...
Within one day our binary was deployed to around one hundred thousand devices - enough for our research purposes. We believe Aidra gained a litte[sic] more than half of that amount. The weeks after our initial deployment we were able to build binaries for a few more platforms. We also probed telnet every 24 hours on every IP address. Since many devices restart every few days and needed to be reinstalled again, over time we gained machines that Aidra lost
This means, in a nutshell, that the author of the Carna botnet observed the malicious Aidra virus spreading, and decided to choke it out using his own botnet. A virus fighting a virus. Carna won, and Aidra had little impact on the world.
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
$endgroup$
That has already happened.
The "2012 Internet Census" (known professionally as the Carna botnet) was a virus that infected ~400,000 consumer network hardware devices (like routers or modems) by using default passwords. The author of it eventually gained control over a meaningful percentage of devices in the world, and was able to see internet traffic patterns in realtime from billions of devices (at the time, only ~4 billion devices could be visible on the internet, due to technical limitations).
While doing this, the author says:
We noticed at this time that one of the machines already had an unknown binary in the /tmp directory that looked suspicious. A simple strings command used on that binary revealed contents like synflood, ackflood, etc., the usual abuse stuff one would find in malicious botnet binaries. We quickly discovered that this was a bot called Aidra, published only a few days before.
The Aidra botnet was a botnet created by an Italian hacker, who sold time on it for DDoS attacks (the kind of thing that takes down websites). Aidra is a classic case of a virus, in the sense that you're thinking. It infects devices, and uses them to do bad things.
The author of Carna goes on to say:
Since Aidra was clearly made for malicious actions and we could actually see their Internet scale deployment at that moment, we decided to let our bot [...do some technical things...]. This step was required to block Aidra from exploiting these machines for malicious activity.
Resulting in...
Within one day our binary was deployed to around one hundred thousand devices - enough for our research purposes. We believe Aidra gained a litte[sic] more than half of that amount. The weeks after our initial deployment we were able to build binaries for a few more platforms. We also probed telnet every 24 hours on every IP address. Since many devices restart every few days and needed to be reinstalled again, over time we gained machines that Aidra lost
This means, in a nutshell, that the author of the Carna botnet observed the malicious Aidra virus spreading, and decided to choke it out using his own botnet. A virus fighting a virus. Carna won, and Aidra had little impact on the world.
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
edited Oct 3 at 0:40
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
answered Oct 3 at 0:33
KneticKnetic
1,2445 silver badges11 bronze badges
1,2445 silver badges11 bronze badges
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
add a comment
|
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
7
7
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
$begingroup$
There was also a virus that did the rounds more recently that would install security updates on your system, change configs to fix a few known vulnerabilities, fix the vulnerability that allowed it to get in in the first place, and then delete itself. I'm trying to find an article on it, but Google isn't playing ball.
$endgroup$
– anaximander
Oct 3 at 13:52
9
9
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@anaximander are you referring to the Mirai botnet? Upon infection Mirai will identify "competing" malware and remove them from memory and block remote administration ports. It certainly did not have benign intentions, but it did demonstrate functionality that is typically affiliated with both virus and anti-virus software.
$endgroup$
– Patrick Roberts
Oct 3 at 18:27
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
$begingroup$
@PatrickRoberts Mirai was certainly the one that came to my mind. It's removal of competing botnet software was most definitely selfishly motivated. Low power devices such as IP webcams don't have much processing power, so having multiple botnets infecting it will a) be more likely have a noticable effect on the real use of the device and b) reduce the processing power availiable to the botnet. I forget which was the biggest competition at the time but it tried to do the same - Mirai "won" though.
$endgroup$
– Baldrickk
Oct 10 at 10:53
add a comment
|
$begingroup$
Yes it's already happened
See Welchia Virus
The Welchia virus downloads itself via the same vulnerability that the Blaster virus used. It then deleted the Blaster virus if found and then installed the patch closing the hole down before spreading to new systems and finally deleting itself.
An antivirus virus.
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
$endgroup$
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
add a comment
|
$begingroup$
Yes it's already happened
See Welchia Virus
The Welchia virus downloads itself via the same vulnerability that the Blaster virus used. It then deleted the Blaster virus if found and then installed the patch closing the hole down before spreading to new systems and finally deleting itself.
An antivirus virus.
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
$endgroup$
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
add a comment
|
$begingroup$
Yes it's already happened
See Welchia Virus
The Welchia virus downloads itself via the same vulnerability that the Blaster virus used. It then deleted the Blaster virus if found and then installed the patch closing the hole down before spreading to new systems and finally deleting itself.
An antivirus virus.
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
$endgroup$
Yes it's already happened
See Welchia Virus
The Welchia virus downloads itself via the same vulnerability that the Blaster virus used. It then deleted the Blaster virus if found and then installed the patch closing the hole down before spreading to new systems and finally deleting itself.
An antivirus virus.
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
answered Oct 3 at 0:40
ThorneThorne
28.3k6 gold badges44 silver badges89 bronze badges
28.3k6 gold badges44 silver badges89 bronze badges
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
add a comment
|
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
1
1
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
$begingroup$
I suggest give dates on this, as this is one of the earliest examples that I can think of
$endgroup$
– Neil Slater
Oct 9 at 15:14
add a comment
|
$begingroup$
Yes
A virus is not a virus because it's doing bad things per-se, but because of how it is installed / replicates to other systems. Any computer virus can be modified in such a way where the actions it performs is to block other viruses from being installed or modified on the system. In fact, a virus could be used to simply install anti-virus software on the computers it infects.
Another way the virus could achieve protection is by simply revoking root / administrator permissions from any other programs or users except itself, effectively stopping any further software from being installed on the system.
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
$endgroup$
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
add a comment
|
$begingroup$
Yes
A virus is not a virus because it's doing bad things per-se, but because of how it is installed / replicates to other systems. Any computer virus can be modified in such a way where the actions it performs is to block other viruses from being installed or modified on the system. In fact, a virus could be used to simply install anti-virus software on the computers it infects.
Another way the virus could achieve protection is by simply revoking root / administrator permissions from any other programs or users except itself, effectively stopping any further software from being installed on the system.
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
$endgroup$
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
add a comment
|
$begingroup$
Yes
A virus is not a virus because it's doing bad things per-se, but because of how it is installed / replicates to other systems. Any computer virus can be modified in such a way where the actions it performs is to block other viruses from being installed or modified on the system. In fact, a virus could be used to simply install anti-virus software on the computers it infects.
Another way the virus could achieve protection is by simply revoking root / administrator permissions from any other programs or users except itself, effectively stopping any further software from being installed on the system.
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
$endgroup$
Yes
A virus is not a virus because it's doing bad things per-se, but because of how it is installed / replicates to other systems. Any computer virus can be modified in such a way where the actions it performs is to block other viruses from being installed or modified on the system. In fact, a virus could be used to simply install anti-virus software on the computers it infects.
Another way the virus could achieve protection is by simply revoking root / administrator permissions from any other programs or users except itself, effectively stopping any further software from being installed on the system.
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
answered Oct 2 at 15:50
cegfaultcegfault
6,36013 silver badges33 bronze badges
6,36013 silver badges33 bronze badges
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
add a comment
|
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
1
1
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
$begingroup$
Unless of course, another Virus uses the same method it used to Obtain Root Privileges, then removes the Good viruses access and patches the method.
$endgroup$
– Shadowzee
Oct 3 at 0:38
add a comment
|
$begingroup$
Real computer worms that close vulnerabilities
There are historical examples of self-spreading network viruses ("worms") that follow the pattern of:
- exploit a particular vulnerability;
- "fix" that vulnerability so that it's not exploitable anymore;
- (optionally) remove other popular malware that uses the same vulnerability and it's likely to be there.
One example like this is Welchia which is considered to be mostly benign (though with "side effects") as it removed the Blaster worm which was popular at the time and installed Microsoft patches; there are also other examples of "anti-worms".
In addition, there are commercial botnet systems that are designed to close down vulnerabilities and clean up the system of other malware (presumably owned/controlled by competitors) so they do remove some bad things (and protect from future infections) so as to have full access to the system resources for their malware. If I recall correctly, some variants of Mirai were doing this, but it's certainly not unique or novel nor that unusual.
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
$endgroup$
add a comment
|
$begingroup$
Real computer worms that close vulnerabilities
There are historical examples of self-spreading network viruses ("worms") that follow the pattern of:
- exploit a particular vulnerability;
- "fix" that vulnerability so that it's not exploitable anymore;
- (optionally) remove other popular malware that uses the same vulnerability and it's likely to be there.
One example like this is Welchia which is considered to be mostly benign (though with "side effects") as it removed the Blaster worm which was popular at the time and installed Microsoft patches; there are also other examples of "anti-worms".
In addition, there are commercial botnet systems that are designed to close down vulnerabilities and clean up the system of other malware (presumably owned/controlled by competitors) so they do remove some bad things (and protect from future infections) so as to have full access to the system resources for their malware. If I recall correctly, some variants of Mirai were doing this, but it's certainly not unique or novel nor that unusual.
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
$endgroup$
add a comment
|
$begingroup$
Real computer worms that close vulnerabilities
There are historical examples of self-spreading network viruses ("worms") that follow the pattern of:
- exploit a particular vulnerability;
- "fix" that vulnerability so that it's not exploitable anymore;
- (optionally) remove other popular malware that uses the same vulnerability and it's likely to be there.
One example like this is Welchia which is considered to be mostly benign (though with "side effects") as it removed the Blaster worm which was popular at the time and installed Microsoft patches; there are also other examples of "anti-worms".
In addition, there are commercial botnet systems that are designed to close down vulnerabilities and clean up the system of other malware (presumably owned/controlled by competitors) so they do remove some bad things (and protect from future infections) so as to have full access to the system resources for their malware. If I recall correctly, some variants of Mirai were doing this, but it's certainly not unique or novel nor that unusual.
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
$endgroup$
Real computer worms that close vulnerabilities
There are historical examples of self-spreading network viruses ("worms") that follow the pattern of:
- exploit a particular vulnerability;
- "fix" that vulnerability so that it's not exploitable anymore;
- (optionally) remove other popular malware that uses the same vulnerability and it's likely to be there.
One example like this is Welchia which is considered to be mostly benign (though with "side effects") as it removed the Blaster worm which was popular at the time and installed Microsoft patches; there are also other examples of "anti-worms".
In addition, there are commercial botnet systems that are designed to close down vulnerabilities and clean up the system of other malware (presumably owned/controlled by competitors) so they do remove some bad things (and protect from future infections) so as to have full access to the system resources for their malware. If I recall correctly, some variants of Mirai were doing this, but it's certainly not unique or novel nor that unusual.
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
answered Oct 3 at 0:41
PeterisPeteris
6,1641 gold badge16 silver badges29 bronze badges
6,1641 gold badge16 silver badges29 bronze badges
add a comment
|
add a comment
|
$begingroup$
You could design a piece of software that works this way in PRINCIPLE, but in practice it would have some pretty significant limitations.
The primary problem is that antivirus software relies very heavily on being able to propagate defensive information on new threats and security flaws to the defended machines more rapidly than a threat can infect them. Most security flaws and viruses require some kind of social engineering component to get a human to do something, so that human rate of engagement can slow a virus' spread enough to allow time for the antivirus to analyse the new threat, develop a defense, and distribute it to all protected machines.
Therefore in order to provide a successful defense, your your antivirus-virus (henceforth referred to as AVV), needs to be able to communicate with all instances of itself wherever they are to share information. You can't rely on each instance of AVV learning just from what it's exposed to on that machine. You need EVERY instance of AVV sharing information, and that's a very tricky thing.
In order to successfully propagate, AVV needs to stay small. Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully. This means your antivirus functionality can't rely on definitions per se, because that requires a massive database of known threats. Therefore each instance can't maintain its own local information storage either. Your database of learned behavior therefore needs to be distributed across all the instances of AVV throughout.
You ALSO need a way for the instances of AVV to be able to understand the differences in environments in the machines they've infected and understand which other instances are sharing those environments so they can preferentially share information. E.g. AVV that infects Apple devices has different threats to defend against than those on Android devices, or Windows 10 versus Windows 8, or servers in older powerplants running on NT 4.0 or something gothic like that.
On top of all that, AVV is ALSO going to need to be able to at least partially disable any actual antivirus software that's ALREADY on the machine it's infecting. Having two sets of code trying to protect the same machine at the same time causes LOTS of problems. You may never have had to deal with the fallout from someone trying to use Norton and McAfee at the same time on the same computer, but I have, and it's not pretty.
The real problem is this though: In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on. This is, by and large, exactly what ALL viruses do and so, from the point of view of the user, your AVV is going to be as much of a problem as many of the more malicious viruses it's defending against. Sure, AVV is using those CPU cycles and gigabits of bandwidth to stop threats instead of sending Russian porno spam everywhere, but the result on the infected machine is often the same.
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
$endgroup$
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
|
show 3 more comments
$begingroup$
You could design a piece of software that works this way in PRINCIPLE, but in practice it would have some pretty significant limitations.
The primary problem is that antivirus software relies very heavily on being able to propagate defensive information on new threats and security flaws to the defended machines more rapidly than a threat can infect them. Most security flaws and viruses require some kind of social engineering component to get a human to do something, so that human rate of engagement can slow a virus' spread enough to allow time for the antivirus to analyse the new threat, develop a defense, and distribute it to all protected machines.
Therefore in order to provide a successful defense, your your antivirus-virus (henceforth referred to as AVV), needs to be able to communicate with all instances of itself wherever they are to share information. You can't rely on each instance of AVV learning just from what it's exposed to on that machine. You need EVERY instance of AVV sharing information, and that's a very tricky thing.
In order to successfully propagate, AVV needs to stay small. Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully. This means your antivirus functionality can't rely on definitions per se, because that requires a massive database of known threats. Therefore each instance can't maintain its own local information storage either. Your database of learned behavior therefore needs to be distributed across all the instances of AVV throughout.
You ALSO need a way for the instances of AVV to be able to understand the differences in environments in the machines they've infected and understand which other instances are sharing those environments so they can preferentially share information. E.g. AVV that infects Apple devices has different threats to defend against than those on Android devices, or Windows 10 versus Windows 8, or servers in older powerplants running on NT 4.0 or something gothic like that.
On top of all that, AVV is ALSO going to need to be able to at least partially disable any actual antivirus software that's ALREADY on the machine it's infecting. Having two sets of code trying to protect the same machine at the same time causes LOTS of problems. You may never have had to deal with the fallout from someone trying to use Norton and McAfee at the same time on the same computer, but I have, and it's not pretty.
The real problem is this though: In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on. This is, by and large, exactly what ALL viruses do and so, from the point of view of the user, your AVV is going to be as much of a problem as many of the more malicious viruses it's defending against. Sure, AVV is using those CPU cycles and gigabits of bandwidth to stop threats instead of sending Russian porno spam everywhere, but the result on the infected machine is often the same.
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
$endgroup$
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
|
show 3 more comments
$begingroup$
You could design a piece of software that works this way in PRINCIPLE, but in practice it would have some pretty significant limitations.
The primary problem is that antivirus software relies very heavily on being able to propagate defensive information on new threats and security flaws to the defended machines more rapidly than a threat can infect them. Most security flaws and viruses require some kind of social engineering component to get a human to do something, so that human rate of engagement can slow a virus' spread enough to allow time for the antivirus to analyse the new threat, develop a defense, and distribute it to all protected machines.
Therefore in order to provide a successful defense, your your antivirus-virus (henceforth referred to as AVV), needs to be able to communicate with all instances of itself wherever they are to share information. You can't rely on each instance of AVV learning just from what it's exposed to on that machine. You need EVERY instance of AVV sharing information, and that's a very tricky thing.
In order to successfully propagate, AVV needs to stay small. Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully. This means your antivirus functionality can't rely on definitions per se, because that requires a massive database of known threats. Therefore each instance can't maintain its own local information storage either. Your database of learned behavior therefore needs to be distributed across all the instances of AVV throughout.
You ALSO need a way for the instances of AVV to be able to understand the differences in environments in the machines they've infected and understand which other instances are sharing those environments so they can preferentially share information. E.g. AVV that infects Apple devices has different threats to defend against than those on Android devices, or Windows 10 versus Windows 8, or servers in older powerplants running on NT 4.0 or something gothic like that.
On top of all that, AVV is ALSO going to need to be able to at least partially disable any actual antivirus software that's ALREADY on the machine it's infecting. Having two sets of code trying to protect the same machine at the same time causes LOTS of problems. You may never have had to deal with the fallout from someone trying to use Norton and McAfee at the same time on the same computer, but I have, and it's not pretty.
The real problem is this though: In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on. This is, by and large, exactly what ALL viruses do and so, from the point of view of the user, your AVV is going to be as much of a problem as many of the more malicious viruses it's defending against. Sure, AVV is using those CPU cycles and gigabits of bandwidth to stop threats instead of sending Russian porno spam everywhere, but the result on the infected machine is often the same.
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
$endgroup$
You could design a piece of software that works this way in PRINCIPLE, but in practice it would have some pretty significant limitations.
The primary problem is that antivirus software relies very heavily on being able to propagate defensive information on new threats and security flaws to the defended machines more rapidly than a threat can infect them. Most security flaws and viruses require some kind of social engineering component to get a human to do something, so that human rate of engagement can slow a virus' spread enough to allow time for the antivirus to analyse the new threat, develop a defense, and distribute it to all protected machines.
Therefore in order to provide a successful defense, your your antivirus-virus (henceforth referred to as AVV), needs to be able to communicate with all instances of itself wherever they are to share information. You can't rely on each instance of AVV learning just from what it's exposed to on that machine. You need EVERY instance of AVV sharing information, and that's a very tricky thing.
In order to successfully propagate, AVV needs to stay small. Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully. This means your antivirus functionality can't rely on definitions per se, because that requires a massive database of known threats. Therefore each instance can't maintain its own local information storage either. Your database of learned behavior therefore needs to be distributed across all the instances of AVV throughout.
You ALSO need a way for the instances of AVV to be able to understand the differences in environments in the machines they've infected and understand which other instances are sharing those environments so they can preferentially share information. E.g. AVV that infects Apple devices has different threats to defend against than those on Android devices, or Windows 10 versus Windows 8, or servers in older powerplants running on NT 4.0 or something gothic like that.
On top of all that, AVV is ALSO going to need to be able to at least partially disable any actual antivirus software that's ALREADY on the machine it's infecting. Having two sets of code trying to protect the same machine at the same time causes LOTS of problems. You may never have had to deal with the fallout from someone trying to use Norton and McAfee at the same time on the same computer, but I have, and it's not pretty.
The real problem is this though: In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on. This is, by and large, exactly what ALL viruses do and so, from the point of view of the user, your AVV is going to be as much of a problem as many of the more malicious viruses it's defending against. Sure, AVV is using those CPU cycles and gigabits of bandwidth to stop threats instead of sending Russian porno spam everywhere, but the result on the infected machine is often the same.
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
answered Oct 2 at 15:59
Morris The CatMorris The Cat
13.7k1 gold badge37 silver badges61 bronze badges
13.7k1 gold badge37 silver badges61 bronze badges
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
|
show 3 more comments
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
$begingroup$
Very good answer. My story takes place in a futuristic society, so any lack of bandwidth limitations of this virus can be explained by better technology.
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:16
1
1
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
$begingroup$
Re "Most security flaws and viruses require some kind of social engineering component to get a human to do something", A virus needs human intervention to propagate by definition. It's called a worm if it doesn't.
$endgroup$
– ikegami
Oct 3 at 5:14
1
1
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
$begingroup$
Re "You need EVERY instance of AVV sharing information, and that's a very tricky thing.", This is pretty common in malware in general already.
$endgroup$
– ikegami
Oct 3 at 5:16
1
1
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
$begingroup$
Re "Huge pieces of code like a standard antivirus application are just too huge to infect machines successfully.", This isn't particularly relevant either. It's extremely common for malware to download modules.
$endgroup$
– ikegami
Oct 3 at 5:18
1
1
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
$begingroup$
Re "In order to do ANY of that stuff, AVV needs to use up a significant chunk of the processing power and bandwidth on every machine it's installed on.", In general, no. The use of those resources can be throttled. That said, anti-virus software specifically is quite expensive in terms of resources.
$endgroup$
– ikegami
Oct 3 at 5:20
|
show 3 more comments
$begingroup$
Yes.
A worm (which is a type of virus) spreads by exploiting a vulnerability replicating itself, but if that worm is also patching that vulnerability as it goes along, it isn't technically malicious (it can still have deleterious effects though, such as tying up bandwidth, etc...).
For example, in Linux, there have been worms which self-replicate and patch the vulnerability they exploit, preventing more nefarious worms from acting on the vulnerability, which would make them a kind of "white-hat" virus.
What makes a program a "virus" or "antivirus" depends on what its ultimate impacts on a system are. A virus spreads and damages infrastructure, an antivirus prevents this. Under a strict definition though, a virus is technically any self-replicating program. It is thus possible to have a self-replicating antivirus which provides immunity to a specific exploit (as in the self-replicating patch-worm example).
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
$endgroup$
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
|
show 3 more comments
$begingroup$
Yes.
A worm (which is a type of virus) spreads by exploiting a vulnerability replicating itself, but if that worm is also patching that vulnerability as it goes along, it isn't technically malicious (it can still have deleterious effects though, such as tying up bandwidth, etc...).
For example, in Linux, there have been worms which self-replicate and patch the vulnerability they exploit, preventing more nefarious worms from acting on the vulnerability, which would make them a kind of "white-hat" virus.
What makes a program a "virus" or "antivirus" depends on what its ultimate impacts on a system are. A virus spreads and damages infrastructure, an antivirus prevents this. Under a strict definition though, a virus is technically any self-replicating program. It is thus possible to have a self-replicating antivirus which provides immunity to a specific exploit (as in the self-replicating patch-worm example).
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
$endgroup$
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
|
show 3 more comments
$begingroup$
Yes.
A worm (which is a type of virus) spreads by exploiting a vulnerability replicating itself, but if that worm is also patching that vulnerability as it goes along, it isn't technically malicious (it can still have deleterious effects though, such as tying up bandwidth, etc...).
For example, in Linux, there have been worms which self-replicate and patch the vulnerability they exploit, preventing more nefarious worms from acting on the vulnerability, which would make them a kind of "white-hat" virus.
What makes a program a "virus" or "antivirus" depends on what its ultimate impacts on a system are. A virus spreads and damages infrastructure, an antivirus prevents this. Under a strict definition though, a virus is technically any self-replicating program. It is thus possible to have a self-replicating antivirus which provides immunity to a specific exploit (as in the self-replicating patch-worm example).
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
$endgroup$
Yes.
A worm (which is a type of virus) spreads by exploiting a vulnerability replicating itself, but if that worm is also patching that vulnerability as it goes along, it isn't technically malicious (it can still have deleterious effects though, such as tying up bandwidth, etc...).
For example, in Linux, there have been worms which self-replicate and patch the vulnerability they exploit, preventing more nefarious worms from acting on the vulnerability, which would make them a kind of "white-hat" virus.
What makes a program a "virus" or "antivirus" depends on what its ultimate impacts on a system are. A virus spreads and damages infrastructure, an antivirus prevents this. Under a strict definition though, a virus is technically any self-replicating program. It is thus possible to have a self-replicating antivirus which provides immunity to a specific exploit (as in the self-replicating patch-worm example).
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
edited Oct 2 at 16:51
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
answered Oct 2 at 15:58
stixstix
3,2997 silver badges19 bronze badges
3,2997 silver badges19 bronze badges
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
|
show 3 more comments
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
3
3
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
$begingroup$
a worm is a type of malware. a virus is a type of malware. they are 2 different entities. any type of malware IS technically malicious. A virus by definition is never "white hat". and the difference between virus and anti-virus is not determined by ultimate impact. immunity in regards to computer security is impossible.
$endgroup$
– IT Alex
Oct 2 at 16:04
1
1
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
$begingroup$
en.wikipedia.org/wiki/…. A computer virus is any self-replicating program. It is always considered malware because it does so without the consent of the user, not because they always do harm. Viruses are never considered whitehat though. Self-propagating programs that "do good" are considered greyhat, and are in some cases still illegal.
$endgroup$
– Nosajimiki - Reinstate Monica
Oct 2 at 16:40
2
2
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
$begingroup$
1/2 @ITAlex Your comment is one of semantics and ultimately pedantic. The OP wants to know if it is possible for a virus to behave as an antivirus and I have provided a real world example of such a case. If the definition of a virus is "any self-replicating program," then a computer worm meets that definition. Immunity in regards to a specific exploit is always possible, we do it every day with patches. As far as whether a virus is always malware or not, if the user knows that the virus self replicates and is OK with that, then they are consenting and it by definition can't be malware.
$endgroup$
– stix
Oct 2 at 16:48
1
1
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
$begingroup$
2/2 A user might want the immunity that the virus provides, and thus they would consent to it infecting their system, in which case it isn't malware.
$endgroup$
– stix
Oct 2 at 16:49
2
2
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
$begingroup$
@stix Your assumptions are wrong on a lot of very important levels. Computer security lives and breathes by those differences. If the user was intentionally consenting it wouldn't be a virus. It would be installing anti-virus software like any other.
$endgroup$
– IT Alex
Oct 2 at 20:25
|
show 3 more comments
$begingroup$
The first ever antivirus software (Reaper) was a virus! It was written in 1971 to catch the first ever worm, Creeper. The only way to fully eradicate Creeper was by installing Reaper on all connected PDP-10 mainframes. This was done by having Reaper automatically replicate itself on other machines.
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
$endgroup$
add a comment
|
$begingroup$
The first ever antivirus software (Reaper) was a virus! It was written in 1971 to catch the first ever worm, Creeper. The only way to fully eradicate Creeper was by installing Reaper on all connected PDP-10 mainframes. This was done by having Reaper automatically replicate itself on other machines.
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
$endgroup$
add a comment
|
$begingroup$
The first ever antivirus software (Reaper) was a virus! It was written in 1971 to catch the first ever worm, Creeper. The only way to fully eradicate Creeper was by installing Reaper on all connected PDP-10 mainframes. This was done by having Reaper automatically replicate itself on other machines.
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
$endgroup$
The first ever antivirus software (Reaper) was a virus! It was written in 1971 to catch the first ever worm, Creeper. The only way to fully eradicate Creeper was by installing Reaper on all connected PDP-10 mainframes. This was done by having Reaper automatically replicate itself on other machines.
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
answered Oct 4 at 11:52
AaganrmuAaganrmu
1713 bronze badges
1713 bronze badges
add a comment
|
add a comment
|
$begingroup$
The short answer is yes.
A virus can do whatever it is programmed to do. If you want it to install itself as an anti-virus you can absolutely do that. If you want it to attempt to "infect" other hosts to act as an anti-virus you can use the usual exploits.
But why though? if your Anti-Virus Virus is so good at its job that you want to black-hat it to everyone, why wouldn't you make it an open source download instead. Why would you intentionally trigger already installed anti-malware trying to protect them? What do you gain?
Overall, it is possible. I just fail to see it being worth it.
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
$endgroup$
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
add a comment
|
$begingroup$
The short answer is yes.
A virus can do whatever it is programmed to do. If you want it to install itself as an anti-virus you can absolutely do that. If you want it to attempt to "infect" other hosts to act as an anti-virus you can use the usual exploits.
But why though? if your Anti-Virus Virus is so good at its job that you want to black-hat it to everyone, why wouldn't you make it an open source download instead. Why would you intentionally trigger already installed anti-malware trying to protect them? What do you gain?
Overall, it is possible. I just fail to see it being worth it.
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
$endgroup$
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
add a comment
|
$begingroup$
The short answer is yes.
A virus can do whatever it is programmed to do. If you want it to install itself as an anti-virus you can absolutely do that. If you want it to attempt to "infect" other hosts to act as an anti-virus you can use the usual exploits.
But why though? if your Anti-Virus Virus is so good at its job that you want to black-hat it to everyone, why wouldn't you make it an open source download instead. Why would you intentionally trigger already installed anti-malware trying to protect them? What do you gain?
Overall, it is possible. I just fail to see it being worth it.
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
$endgroup$
The short answer is yes.
A virus can do whatever it is programmed to do. If you want it to install itself as an anti-virus you can absolutely do that. If you want it to attempt to "infect" other hosts to act as an anti-virus you can use the usual exploits.
But why though? if your Anti-Virus Virus is so good at its job that you want to black-hat it to everyone, why wouldn't you make it an open source download instead. Why would you intentionally trigger already installed anti-malware trying to protect them? What do you gain?
Overall, it is possible. I just fail to see it being worth it.
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
answered Oct 2 at 15:49
IT AlexIT Alex
1,9713 silver badges15 bronze badges
1,9713 silver badges15 bronze badges
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
add a comment
|
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
1
1
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
$begingroup$
ah, you beat me to it by a few seconds!
$endgroup$
– cegfault
Oct 2 at 15:50
3
3
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
You might have an overwhelming desire to protect those less aware of computer security issues, Perhaps to provide ‘herd immunity’ against worms or botnets that typically target the less computer savvy. If they have up to date malware protection then it’s OK your antiviral worm is ineffective. If not then you just did them a ‘favour’.
$endgroup$
– Joe Bloggs
Oct 2 at 15:57
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
$begingroup$
@IT_Alex In my story, somebody made such a program and it effectively rendered anti-virus software as obsolete because threats became virtually nonexistent. (with some exceptions here and there)
$endgroup$
– overlord - Reinstate Monica
Oct 2 at 16:09
add a comment
|
$begingroup$
as @eigenvalue mentioned. Stuxnet was one of a kind virus, which was able to target specific windows machines. These specific machines were targeted because these machines were the machines of the Iranian scientists who were at the time working on Nuclear Reactor.
The special thing about this virus was that it was spread in the wild and if the machine was not who it was looking for it would just sit there idle. From all the machines in the world it was able to figure out which machine it had to be activated on.
In industries and nuclear plants special computers are used called PLC's which are programmed via ladder diagram. Its kind of a drag and drop builder used to program. The virus actually infected the scientist's machine which was connected to the PLC and then changed the ladder diagram and increase the spinning speed of nuclear reactors. Increasing the speed caused resonance which destroyed these reactors, and the virus achieved the desired goal.
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
$endgroup$
add a comment
|
$begingroup$
as @eigenvalue mentioned. Stuxnet was one of a kind virus, which was able to target specific windows machines. These specific machines were targeted because these machines were the machines of the Iranian scientists who were at the time working on Nuclear Reactor.
The special thing about this virus was that it was spread in the wild and if the machine was not who it was looking for it would just sit there idle. From all the machines in the world it was able to figure out which machine it had to be activated on.
In industries and nuclear plants special computers are used called PLC's which are programmed via ladder diagram. Its kind of a drag and drop builder used to program. The virus actually infected the scientist's machine which was connected to the PLC and then changed the ladder diagram and increase the spinning speed of nuclear reactors. Increasing the speed caused resonance which destroyed these reactors, and the virus achieved the desired goal.
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
$endgroup$
add a comment
|
$begingroup$
as @eigenvalue mentioned. Stuxnet was one of a kind virus, which was able to target specific windows machines. These specific machines were targeted because these machines were the machines of the Iranian scientists who were at the time working on Nuclear Reactor.
The special thing about this virus was that it was spread in the wild and if the machine was not who it was looking for it would just sit there idle. From all the machines in the world it was able to figure out which machine it had to be activated on.
In industries and nuclear plants special computers are used called PLC's which are programmed via ladder diagram. Its kind of a drag and drop builder used to program. The virus actually infected the scientist's machine which was connected to the PLC and then changed the ladder diagram and increase the spinning speed of nuclear reactors. Increasing the speed caused resonance which destroyed these reactors, and the virus achieved the desired goal.
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
$endgroup$
as @eigenvalue mentioned. Stuxnet was one of a kind virus, which was able to target specific windows machines. These specific machines were targeted because these machines were the machines of the Iranian scientists who were at the time working on Nuclear Reactor.
The special thing about this virus was that it was spread in the wild and if the machine was not who it was looking for it would just sit there idle. From all the machines in the world it was able to figure out which machine it had to be activated on.
In industries and nuclear plants special computers are used called PLC's which are programmed via ladder diagram. Its kind of a drag and drop builder used to program. The virus actually infected the scientist's machine which was connected to the PLC and then changed the ladder diagram and increase the spinning speed of nuclear reactors. Increasing the speed caused resonance which destroyed these reactors, and the virus achieved the desired goal.
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
answered Oct 9 at 15:07
omer Farooqomer Farooq
1312 bronze badges
1312 bronze badges
add a comment
|
add a comment
|
$begingroup$
Knowing that, I have a follow-up question: Can a virus be made for a
system in a way that acts like an anti-virus? In other words, this
virus would infect computers and instead of causing damage, it would
protect the computer from other viruses?
Yes, once a program gets in it can do pretty much whatever it wants.
If the answer is yes it is possible, could this virus be sophisticated
enough to automatically update its virus definitions? Perhaps an
advanced deep learning algorithm allows this?
Yes, and its not even hard. The AI deep learning part is a bit harder, but still doable.
A lot of viruses spreading is due to users not updating their systems.
Just upload a list of software the computer contains and its version, and download and install the new versions. That and running windows update, apt-get update, zypper dup, or etc for your OS offers a lot of native protection if its ever even used.
After that implementing a firewall for the user, or re-configuring windows firewall would raise the bar even higher.
automatically sandbox know weak programs like web browsers and mail clients.
Download a list of bad IP's and bad behaviors ever day, and doing a black list would offer even more protection.
So the hacker uses a CDN (content distribution network), so you have a main distribution point from a website hosted on a cdn, and that pretty much all you need.
So the program would have a built-in list of IP or website address, and a preset list of files to download.
Said program would wget http://www.goodvirus.com/files.txt
wget http://www.goodvirus.com/blacklists.txt
The files.txt would contain a list of files and versions to download.
If the version is newer than what you have it download the new version.
Your biggest problem and where the AI comes in is problems like specter, melt down, and etc are way hard to detect. Also mitigate has issues, After a few weeks the security will have a patch you can just download and install reboot and your safe.
You have to ask yourself how far this virus is going to go.
An AI which detects, and implements its own solution is going to have to be way smarter. It will takes years to develop and prefect.
However, automated tools from companies already exist, google has sysbotz which throws things at the linux kernel until it breaks. Then said bot compiles a report, and sends it off to the kernel devs for them to fix. More and more of these automated testing platforms are being created and deployed.
More and more smarter testing routines are being developed and tested all the time.
The bigger problem is the difference between program and virus comes down to user consent. Sure your program forcefully propagates every where, but at the end of the day if your program does nothing bad people will willingly allow or install your virus on their computers. Then it's no longer a virus, but a program.
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
$endgroup$
add a comment
|
$begingroup$
Knowing that, I have a follow-up question: Can a virus be made for a
system in a way that acts like an anti-virus? In other words, this
virus would infect computers and instead of causing damage, it would
protect the computer from other viruses?
Yes, once a program gets in it can do pretty much whatever it wants.
If the answer is yes it is possible, could this virus be sophisticated
enough to automatically update its virus definitions? Perhaps an
advanced deep learning algorithm allows this?
Yes, and its not even hard. The AI deep learning part is a bit harder, but still doable.
A lot of viruses spreading is due to users not updating their systems.
Just upload a list of software the computer contains and its version, and download and install the new versions. That and running windows update, apt-get update, zypper dup, or etc for your OS offers a lot of native protection if its ever even used.
After that implementing a firewall for the user, or re-configuring windows firewall would raise the bar even higher.
automatically sandbox know weak programs like web browsers and mail clients.
Download a list of bad IP's and bad behaviors ever day, and doing a black list would offer even more protection.
So the hacker uses a CDN (content distribution network), so you have a main distribution point from a website hosted on a cdn, and that pretty much all you need.
So the program would have a built-in list of IP or website address, and a preset list of files to download.
Said program would wget http://www.goodvirus.com/files.txt
wget http://www.goodvirus.com/blacklists.txt
The files.txt would contain a list of files and versions to download.
If the version is newer than what you have it download the new version.
Your biggest problem and where the AI comes in is problems like specter, melt down, and etc are way hard to detect. Also mitigate has issues, After a few weeks the security will have a patch you can just download and install reboot and your safe.
You have to ask yourself how far this virus is going to go.
An AI which detects, and implements its own solution is going to have to be way smarter. It will takes years to develop and prefect.
However, automated tools from companies already exist, google has sysbotz which throws things at the linux kernel until it breaks. Then said bot compiles a report, and sends it off to the kernel devs for them to fix. More and more of these automated testing platforms are being created and deployed.
More and more smarter testing routines are being developed and tested all the time.
The bigger problem is the difference between program and virus comes down to user consent. Sure your program forcefully propagates every where, but at the end of the day if your program does nothing bad people will willingly allow or install your virus on their computers. Then it's no longer a virus, but a program.
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
$endgroup$
add a comment
|
$begingroup$
Knowing that, I have a follow-up question: Can a virus be made for a
system in a way that acts like an anti-virus? In other words, this
virus would infect computers and instead of causing damage, it would
protect the computer from other viruses?
Yes, once a program gets in it can do pretty much whatever it wants.
If the answer is yes it is possible, could this virus be sophisticated
enough to automatically update its virus definitions? Perhaps an
advanced deep learning algorithm allows this?
Yes, and its not even hard. The AI deep learning part is a bit harder, but still doable.
A lot of viruses spreading is due to users not updating their systems.
Just upload a list of software the computer contains and its version, and download and install the new versions. That and running windows update, apt-get update, zypper dup, or etc for your OS offers a lot of native protection if its ever even used.
After that implementing a firewall for the user, or re-configuring windows firewall would raise the bar even higher.
automatically sandbox know weak programs like web browsers and mail clients.
Download a list of bad IP's and bad behaviors ever day, and doing a black list would offer even more protection.
So the hacker uses a CDN (content distribution network), so you have a main distribution point from a website hosted on a cdn, and that pretty much all you need.
So the program would have a built-in list of IP or website address, and a preset list of files to download.
Said program would wget http://www.goodvirus.com/files.txt
wget http://www.goodvirus.com/blacklists.txt
The files.txt would contain a list of files and versions to download.
If the version is newer than what you have it download the new version.
Your biggest problem and where the AI comes in is problems like specter, melt down, and etc are way hard to detect. Also mitigate has issues, After a few weeks the security will have a patch you can just download and install reboot and your safe.
You have to ask yourself how far this virus is going to go.
An AI which detects, and implements its own solution is going to have to be way smarter. It will takes years to develop and prefect.
However, automated tools from companies already exist, google has sysbotz which throws things at the linux kernel until it breaks. Then said bot compiles a report, and sends it off to the kernel devs for them to fix. More and more of these automated testing platforms are being created and deployed.
More and more smarter testing routines are being developed and tested all the time.
The bigger problem is the difference between program and virus comes down to user consent. Sure your program forcefully propagates every where, but at the end of the day if your program does nothing bad people will willingly allow or install your virus on their computers. Then it's no longer a virus, but a program.
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
$endgroup$
Knowing that, I have a follow-up question: Can a virus be made for a
system in a way that acts like an anti-virus? In other words, this
virus would infect computers and instead of causing damage, it would
protect the computer from other viruses?
Yes, once a program gets in it can do pretty much whatever it wants.
If the answer is yes it is possible, could this virus be sophisticated
enough to automatically update its virus definitions? Perhaps an
advanced deep learning algorithm allows this?
Yes, and its not even hard. The AI deep learning part is a bit harder, but still doable.
A lot of viruses spreading is due to users not updating their systems.
Just upload a list of software the computer contains and its version, and download and install the new versions. That and running windows update, apt-get update, zypper dup, or etc for your OS offers a lot of native protection if its ever even used.
After that implementing a firewall for the user, or re-configuring windows firewall would raise the bar even higher.
automatically sandbox know weak programs like web browsers and mail clients.
Download a list of bad IP's and bad behaviors ever day, and doing a black list would offer even more protection.
So the hacker uses a CDN (content distribution network), so you have a main distribution point from a website hosted on a cdn, and that pretty much all you need.
So the program would have a built-in list of IP or website address, and a preset list of files to download.
Said program would wget http://www.goodvirus.com/files.txt
wget http://www.goodvirus.com/blacklists.txt
The files.txt would contain a list of files and versions to download.
If the version is newer than what you have it download the new version.
Your biggest problem and where the AI comes in is problems like specter, melt down, and etc are way hard to detect. Also mitigate has issues, After a few weeks the security will have a patch you can just download and install reboot and your safe.
You have to ask yourself how far this virus is going to go.
An AI which detects, and implements its own solution is going to have to be way smarter. It will takes years to develop and prefect.
However, automated tools from companies already exist, google has sysbotz which throws things at the linux kernel until it breaks. Then said bot compiles a report, and sends it off to the kernel devs for them to fix. More and more of these automated testing platforms are being created and deployed.
More and more smarter testing routines are being developed and tested all the time.
The bigger problem is the difference between program and virus comes down to user consent. Sure your program forcefully propagates every where, but at the end of the day if your program does nothing bad people will willingly allow or install your virus on their computers. Then it's no longer a virus, but a program.
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
answered Oct 4 at 4:06
cybernardcybernard
2,3024 silver badges6 bronze badges
2,3024 silver badges6 bronze badges
add a comment
|
add a comment
|
$begingroup$
Stuxnet has the code to remove itself after the given date in the future.
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
$endgroup$
add a comment
|
$begingroup$
Stuxnet has the code to remove itself after the given date in the future.
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
$endgroup$
add a comment
|
$begingroup$
Stuxnet has the code to remove itself after the given date in the future.
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
$endgroup$
Stuxnet has the code to remove itself after the given date in the future.
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
answered Oct 4 at 7:52
eigenvalueeigenvalue
1,1635 silver badges9 bronze badges
1,1635 silver badges9 bronze badges
add a comment
|
add a comment
|
$begingroup$
A long time ago (2007), someone with a very acute case of the oedipal complex decided that the real problem with IT security was the weak link, i.e.: users. Which was probably the inspiration for this Dilbert strip (source):
So he created a program called Disk Knight that replicated over networks, and it completely disabled USB drives. No more infections from obnoxious relatives plugging their virus-ridden usb drives on your machine to send their work to your printer! YAY!
Only the dude became such a persona non grata that the internet gave him a damnatio memoriae punishment. The only thing left over of the whole story are passing mentions on Microsoft and Norton's pages about the functions of Disk Knight, and how its behavior was unacceptable. Other than that, mentions and mentions in forums on how to remove it, usually in languages other than English.
So you see, if you can write a program to defend the machines of the layspeople, you can protect them from viruses. But if you are not an expert and you don't know what you're doing, you may cause more harm than good. The proper way is still to make yourself a known force against malwares so as to build trust, and in that way you can cooperate with the community in the fight against evil. Fail to do so, and no matter how good your motives, you'll go down in history as a villain.
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
$endgroup$
add a comment
|
$begingroup$
A long time ago (2007), someone with a very acute case of the oedipal complex decided that the real problem with IT security was the weak link, i.e.: users. Which was probably the inspiration for this Dilbert strip (source):
So he created a program called Disk Knight that replicated over networks, and it completely disabled USB drives. No more infections from obnoxious relatives plugging their virus-ridden usb drives on your machine to send their work to your printer! YAY!
Only the dude became such a persona non grata that the internet gave him a damnatio memoriae punishment. The only thing left over of the whole story are passing mentions on Microsoft and Norton's pages about the functions of Disk Knight, and how its behavior was unacceptable. Other than that, mentions and mentions in forums on how to remove it, usually in languages other than English.
So you see, if you can write a program to defend the machines of the layspeople, you can protect them from viruses. But if you are not an expert and you don't know what you're doing, you may cause more harm than good. The proper way is still to make yourself a known force against malwares so as to build trust, and in that way you can cooperate with the community in the fight against evil. Fail to do so, and no matter how good your motives, you'll go down in history as a villain.
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
$endgroup$
add a comment
|
$begingroup$
A long time ago (2007), someone with a very acute case of the oedipal complex decided that the real problem with IT security was the weak link, i.e.: users. Which was probably the inspiration for this Dilbert strip (source):
So he created a program called Disk Knight that replicated over networks, and it completely disabled USB drives. No more infections from obnoxious relatives plugging their virus-ridden usb drives on your machine to send their work to your printer! YAY!
Only the dude became such a persona non grata that the internet gave him a damnatio memoriae punishment. The only thing left over of the whole story are passing mentions on Microsoft and Norton's pages about the functions of Disk Knight, and how its behavior was unacceptable. Other than that, mentions and mentions in forums on how to remove it, usually in languages other than English.
So you see, if you can write a program to defend the machines of the layspeople, you can protect them from viruses. But if you are not an expert and you don't know what you're doing, you may cause more harm than good. The proper way is still to make yourself a known force against malwares so as to build trust, and in that way you can cooperate with the community in the fight against evil. Fail to do so, and no matter how good your motives, you'll go down in history as a villain.
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
$endgroup$
A long time ago (2007), someone with a very acute case of the oedipal complex decided that the real problem with IT security was the weak link, i.e.: users. Which was probably the inspiration for this Dilbert strip (source):
So he created a program called Disk Knight that replicated over networks, and it completely disabled USB drives. No more infections from obnoxious relatives plugging their virus-ridden usb drives on your machine to send their work to your printer! YAY!
Only the dude became such a persona non grata that the internet gave him a damnatio memoriae punishment. The only thing left over of the whole story are passing mentions on Microsoft and Norton's pages about the functions of Disk Knight, and how its behavior was unacceptable. Other than that, mentions and mentions in forums on how to remove it, usually in languages other than English.
So you see, if you can write a program to defend the machines of the layspeople, you can protect them from viruses. But if you are not an expert and you don't know what you're doing, you may cause more harm than good. The proper way is still to make yourself a known force against malwares so as to build trust, and in that way you can cooperate with the community in the fight against evil. Fail to do so, and no matter how good your motives, you'll go down in history as a villain.
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
answered Oct 9 at 18:38
RenanRenan
74.6k21 gold badges167 silver badges350 bronze badges
74.6k21 gold badges167 silver badges350 bronze badges
add a comment
|
add a comment
|
Thanks for contributing an answer to Worldbuilding Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fworldbuilding.stackexchange.com%2fquestions%2f157482%2fis-it-possible-to-make-a-computer-virus-that-acts-as-an-anti-virus%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
$begingroup$
When you say "automatically update its virus definitions", do you mean the way a legitimate anti-virus would (by contacting some central server for new details) or by coming up with its own definitions on the fly?
$endgroup$
– Cadence
Oct 2 at 15:56
20
$begingroup$
The only difference between a "virus", a "worm" and an "application" is how they get installed on a system. Whether they are good or evil is not part of the technical definition, and good and evil are not absolute categories anyway -- it all depends on the point of view.
$endgroup$
– AlexP
Oct 2 at 16:16
31
$begingroup$
in 2019, I think every virus scanner qualifies for this. They all install in weird ways, slow your system, are difficult to uninstall, and cause more problems then they solve.
$endgroup$
– Trevor
Oct 2 at 16:34
11
$begingroup$
It's been done. More
$endgroup$
– ikegami
Oct 3 at 5:24
3
$begingroup$
I thought this question was going to be about biological viruses, and the answer again is yes. OT, but ... It happens naturally. A virus strain that is much less deadly but more infectious out-competes a deadly strain sharing some antigens. It doesn't put people in bed so immediately so they walk around spreading the less deadly strain for longer. When people go on to recover from the less deadly strain they are then immune to both because of the shared antigens.
$endgroup$
– nigel222
Oct 3 at 9:11