COMPUTER VIRUSES: Remember 10 to 20 years ago
when we were all scared of getting a computer virus? We would pay for antivirus protection
from companies like McAfee and Norton just so that we wouldn’t get a “Trojan Virus”. But,
somehow, despite all our efforts, getting a virus was often an inevitability. And then,
we’d have to boot our computers into safe mode, delete recently downloaded files,
run virus scans, and hope and pray that the computer will actually
boot up the next time and that no data was corrupted or lost. But, nowadays,
the thought of a computer virus destroying our computer rarely crosses our mind. In fact,
many of us have completely stopped purchasing external anti virus protection, yet our computer
experience is better than ever and we don’t even have to deal with those slow virus scans. So,
did computer viruses just get erradicated like Polio or Small Pox? But wait, that can’t be true
because we still hear about data breaches and hacks all the time. So, clearly, computers still
have a bunch of vulnerabilities. But then, what happened to consumer computer viruses?
HISTORY OF VIRUSES:
Before we answer why viruses are no longer a big threat for most us, we have to understand how
viruses work in the first place. Computer viruses have been around for a long time with the first
one called “Creeper” dating back to 1971. The mechanics of the virus were extremely simple.
Once the virus was placed inside a local hard drive, it would just keep replicating itself until
the given computer ran out of space and became inoperational. At this point, the virus would
taunt the user with the message “I'M THE CREEPER. CATCH ME IF YOU CAN!” Fortunately, the Creeper
wasn’t hard to catch because it came along with an antidote called Reaper. This is because Creeper
wasn’t actually designed with malicious intent. It was simply supposed to demonstrate basic computer
vulnerabilities and how these shortfalls could be addressed. But, the days of benign experimental
viruses didn’t last long. As soon as computers became generally available, a new subset of
people called “Hackers” started trying to reverse engineer code and we started seeing much more
deadly viruses. This included the first real world virus called “Brain” in 1986. Unlike Creeper,
Brain didn’t just aim to waste your hard drive space. Brain was trying to corrupt your computer,
and it did this by latching onto your boot disk. From there, Brain would move your real boot sector
to another location and mark it as “bad”. In the meantime, it would overwrite your real boot
sector with the virus making it impossible to boot the computer. The next prominent computer virus,
“Michelangelo” appeared in 1991 and worked in a very similar fashion but with a unique twist.
Instead of corrupting the computer as soon as Michelangelo made contact, Michelangelo would
wait until March 6th of every year. This way, no one would really know how much the virus had
spread. And then suddenly, on March 6th, the virus would overwrite the first 100 sectors with zeros
and everyone would be screwed over at the same time. This strategy was especially effective as
the virus would end up infecting 20,000 computers. But, the next virus was so much bigger that
Michelangelo would look like a school project. Speaking of school projects, this next virus,
CIH, was developed by a university student and launched in 1998. The motive? Well,
the university student wanted to put overconfident software engineers in their place. And I think
it’s safe to say that that goal was destroyed. Once CIH made it to a user’s computer, it would
overwrite the hard drive, the boot sector, and even the bios. Similar to Michelangelo,
CIH was designed to remain dormant for 1 month before starting its rampage, but when the virus
was triggered, it was absolutely deadly. CIH would end up infecting a whopping 60 million
computers and causing $1 billion worth of damage. For the first time, computer viruses weren’t just
a nuisance. They were an actual international threat, and this threat would only get bigger
with the internet. Up until now, the main culprit spreading viruses were shared floppy drives, but
let’s just say the internet was much more viral. The first prominent internet virus came in 1999
and was called Melissa. Melissa was distributed through email and once you received Melissa,
it would automatically be sent to 50 of your contacts. Fortunately, Melissa wasn’t malicious,
some would even call it a social service as Melissa was simply distributing passwords to adult
websites. But, it’s successor “iloveyou” in 2000 wasn’t nearly as kind. On the surface, iloveyou
was a simple text file that was spread through email. But, behind the scenes, it was actually a
Visual Basic Script or a VBS that could overwrite office, image, and audio files. And thanks to the
virality of the internet, it would spread to 50 million computers in less than 10 days. This
marked the beginning of the peak computer virus era. But, within the next 10 to 15 years, this
fear would disappear as if it never existed in the first place. So, what in the world happened?
ERADICATION:
Well, as you saw with all those viruses, there’s only two ways that they can spread: shared storage
devices and the internet. The first medium was naturally eliminated thanks to the internet. Now
that people could email each other, there was less of a need to share floppy disks or USB sticks. If
you were gonna use an external storage device, it was more than likely just for personal use. So,
the storage device medium kind of died out on it’s own, but the internet medium was much harder
to address. A lot of this process simply consisted of small improvements to security over a long time
period. But there was a pinpointable event that leaped forward internet security and that was the
ditching of Internet Explorer. Back in 2004, the market share of Internet Explorer peaked at 95%.
Most of you probably remember IE as the slow, buggy, crappy browser, but it was much worse
than just that as it also had serious security vulnerabilities. You see, IE didn’t just allow
for the execution of Javascript which is the standard for websites. IE also allowed for the
execution of VB scripts which gave the browser access to the computer. This probably sounds
like a stupid idea, but there was reason for it. Ideally, this would allow websites to accomplish
much more advanced tasks as they had access to the computer. But, this also meant that they can
accomplish much more nefarious tasks, and that’s exactly what happened. Microsoft didn’t really do
much about this other than putting out a tutorial on how to disable VBScript execution. But,
let’s be honest, this was not something that the average user was ever going to do. Something that
the average user did do though was ditch Internet Explorer and move to Chrome. And unlike Microsoft,
Google didn’t support VBScript which made these viruses virtually useless. By this point, the
storage device medium and the direct from browser medium were effectively cut off which left us with
just the downloading medium. The eradication of this medium came down to multiple factors
starting with constant updates. Before 2010, there was really no such thing as regular updates. You
got a version of Windows when you bought your PC, and you would have this version up until
you got another PC. But, moving into the 2010s, constant over the air updates became a thing. And
while these updates somehow always happened at the worst times possible, they did wonders for
computer security. Viruses no longer had years on end to keep exploiting the same bugs and glitches.
As soon as a virus was discovered, companies were able to patch it and send out an update. We should
also mention that companies started taking cybersecurity much more seriously. Between
2010 and 2018 alone, cybersecurity spending rocketed from $27.4 billion to $66 billion.
These companies built out entire cybersecurity departments filled with extraordinarily talented
and well paid engineers. At Microsoft, for example, security analysts are paid $272K on
average. Speaking of compensation, companies also starting disuading hackers by straight
up bribing them. Google for instance, offers $1 million if you can hack Chrome. Similarly,
Apple is offering a million and a half if you can hack the iPhone. And these companies end up paying
out several people every single year, and in return, they’re able to prevent exploits that may
have harmed hundreds of millions of users. In the meantime, users have also gotten much more tech
savvy when it comes to protecting their devices. We should also mention that our internet usage has
also become much more focused. While we all spend more time than ever on the internet, virtually all
of our usage has to do with reputable companies and brands like Google, Facebook, Microsoft,
Apple, Amazon, etc. So, the chances we’re even exposed to a virus is significantly lower than 10
to 20 years ago. And when you put all of these factors together, you get the virus free era.
SHIFTING MOTIVES: None of this is to say that computer viruses
are completely gone though. The number of bad actors and threats are actually larger than ever.
And one of the main reasons that we don’t see viruses affect us is because bad actors no longer
target everyday users. Back in the day, the only incentive of creating a virus was to make a splash
in the tech scene and/or expose vulnerabilities. But, nowadays, hacking is a lot more profitable,
and I’m not talking about selling your hacks to big names companies. I’m talking about
using exploits to steal loads of data and operate international cyber crime rings that do everything
from creating fake IDs to credit card fraud. And this makes perfect sense. Let’s say you found
a data exploit in Windows after years of work. Would you rather try to spread this virus amongst
everyday users and display some corny gotcha message or would you rather target an institution.
I mean the answer is obvious. Stealing the data of 100 million users from T-Mobile is infinitely more
valuable than corrupting random people’s PCs. This information is literally worth billions.
Given that you’ll have to sell it through dark avenues, you’ll probably have to accept a deep
discount and sell it for hundreds of millions, but that’s still 100 times what Google is willing
to pay you for that exploit. Also, even if you were going for everyday people, the goal would
not be to screw up their machine. In fact, the goal would be exact opposite as you wouldn’t
want the user to even notice. Ideally, the virus should be able to collect data permanently and
not inhibit any functionality whatsoever. If you do this at scale, you can have constant streams
of data from tens of millions if not hundreds of millions of people. And thanks to cryptocurrency,
hackers are able to transact insane amounts of money with ease. This one hacker, for example,
claims that he’s owns $7 billion worth of Bitcoin making him the 369th richest person in
the world. So, while viruses no longer affect us directly, they’re very much still a major threat.
THE STATE OF VIRUSES:
In the end, we all remember computer viruses as a symbol of computers throughout the 2000s. Thanks
to much safer browsers, constant updates, large security departments, and much more savvy users,
traditional computer viruses have become a thing of the past. This isn’t to say that
cybersecurity threats have been completely eliminated altogether. Rather, they’ve simply
shifted in their form and their motive. Viruses, today, don’t aim to slow down your computer or
corrupt it. They aim to steal your data and sell it for millions. And judging by the constant data
leaks that we see on a regular basis, it looks like there’s still a long way to go. But hey,
at least we don’t have to deal with Trojan viruses and safe mode anymore. When was the last time you
had a computer virus? Comment that down below. Also, drop a like if you’re glad that we’re past
traditional viruses. And of course, consider checking out our discord community to suggest
future video ideas and consider subscribing to see more questions logically answered.