Computer viruses: the origins

In this post I am going to talk to you about computer viruses from a different angle: I am going to tell you the story of their origins.

The story begins shortly after the Second World War. John Louis Von Neumann, a mathematician considered today one of the fathers of modern computing, presents a paper at a conference in Pasadena in 1948, entitled « theory of automata organisation« .

This paper is followed by a series of lectures he gives in 1948 on « theory and organization of complex automata« .

The man to whom we owe the idea of programs stored in memory that can be modified, rather than faster programs fixed in hardware components, now raises the possibility of one program taking control of another.

In it he also develops the concepts of self-production of programs, making him, despite himself, the founding father of the theories of computer virology.

In June 1959 the magazine « Scientific American » publishes an article on self-replicating mechanisms written by L.S Penrose, entitled « Self reproducing machines« .

The magazine's contents page presents it as an account of simple constructed units that assemble into larger units, which in turn make copies of themselves from other simple units.

The process reveals the same mechanisms of self-reproduction as those found in biological organisms.

In August 1961 three young programmers at the famous Bell Laboratories at ATT, Robert Thomas Morris, Douglas McIlroy and Victor Vyssotsky, develop a game called Darwin that is played on an IBM 7090 mainframe. The game is made up of a program (Umpire) together with a section of the computer's memory called the arena, into which two or more programs, written by the players, are loaded.

The programs are written in IBM 7090 machine language on punched cards…

Each program can call a number of functions provided by Umpire, in order to occupy other locations in the arena, kill enemy programs, and fill all the free memory with copies of themselves.

The game can end after a predefined length of time, or when only a single program remains alive. The player who wrote the last surviving program is declared the winner.

These programs, the fighters that face each other in an arena, notably inspired the film Tron, in which a programmer is projected, by means of a dematerialization system, into the heart of a computer system.

The game does not last, however: Robert Thomas Morris develops a fighter consisting of 44 instructions, capable of adapting its strategy and protecting itself, which nobody can beat any more. As a result, nobody develops any more opponents and the game is abandoned. Following Darwin's abandonment, between 1961 and 1970, the true ancestor of viruses is born: Core War.

Also called the programmers' game, and like Darwin, which inspired it, Core War pits at least two programs against each other. Each aims to destroy the opposing program or programs and occupy all available memory by proliferating.

The arena now sits inside the memory space of a virtual machine called Mars, where the attacker does not know where the opponent's various segments are located and must, as in a game of Battleship, find and destroy the opponent.

The language used to create the fighters in Core War is called RedCode: be careful not to confuse it with the malware « CodeRed »: it infected hundreds of thousands of machines around the world in just a few hours.

RedCode, then, is a language close to assembly, though with a simplified instruction set.

It runs inside a virtual machine called Mars for Memory Array Redcode Simulator. There are several versions of the RedCode language, in which the number of instructions can vary; but in every case it remains very close to assembly language.

Despite the use of this language with its reduced instruction set, Core War incorporates, from its inception, most of the viral and antiviral mechanisms known today: replication, protection, polymorphism, destruction, repair, stealth, code injection, stopping a process, and even signature recognition, still so dear today to most of our antivirus products.

The winner is whoever has the most active copies of their program at the end of the game.

If there is no time limit, whoever destroys the opposing program is declared the winner. Core War is still played today, with worldwide competitions still taking place.

At the same time, in 1971, Bob Thomas creates Creeper, an experimental program that runs on a DEC PDP-10 Mainframe equipped with the TENEX operating system, with the distinctive ability to copy itself to a remote system, all on its own. In practice it is the first Worm, or « computer worm », another type of malicious code often wrongly confused with viruses.

We have just seen how, over nearly ten years, the mechanisms that prefigured viruses appeared, but it will still be more than ten years before the first virus appears…

So what can we say about that first virus? Numerous sources on the internet and elsewhere cite « Brain » as the first virus in history. Developed in 1986 by two Pakistani brothers, the Alvi brothers, it infected only 5 1/4-inch floppy disks and did not attack hard disks.

During the infection, « Brain » installed itself in the floppy disk's boot sector, then changed its volume name to (C) BRAIN

Although Brain is the first virus to appear on the IBM-PC, it is not the first computer virus on record. Credit for that goes to Rich Skrenta: an American student then aged 15, who in 1982 creates « Elk Cloner » on the Apple II.

Elk Cloner sent a poem explaining how it replicated itself. Rich is said to have infected his friends' computers by offering them infected pirated games.

In 1983, Frédéric Cohen first uses the term virus to define a program that can infect other programs. It was his professor, Leonard Adleman, who is said to have suggested it to him.

Cohen will demonstrate a « virus-like » on a VAX11/750 at Lehigh University.

From there, everything accelerates: Vienna, Stoned, Ping Pong, Cascade, Jerusalem, SCA, Byte Bandit. The first polymorphic viruses of the « Chameleon » type arrive in 1990, followed, in 1992, by Michelangelo, which infects 6 million computers, while three years later the first macro virus, « Concept », appears, going after Microsoft Word documents.

2 June 1998 still brings back terrifying memories for many IT professionals: their first encounter with CIH, a destructive virus also called Chernobyl, capable of flashing the bios of your motherboard and rendering your computer unusable…

The following years will be dominated by computer worms such as Mélissa, Happy99 and IloveYou. The press will seize on them, wrongly labelling them all “viruses”… And that is where this post ends, at the end of the prehistory of viruses. They have long since entered the history we know today.

In video form? Follow the white rabbit: https://www.youtube.com/watch?v=lCHsIZceyVU

Christophe Casalegno
​You can follow me on: Twitter | Facebook | Linkedin | Telegram | Youtube