A thing of threads and patches

LIKE their biological counterparts, computer viruses are locked in an evolutionary arms race. These programs, whose crucial characteristic is that they reproduce by copying themselves onto new machines, began as a curiosity in the early 1980s. Now, however, they—and other, similar, types of malicious software—support a multibillion-dollar industry in which those who use them to steal information and subvert computers struggle with those who devise and sell digital protection. With so much at stake, malware, as it is known, gets ever sneakier, while the programs designed to detect it must get cleverer and cleverer just to keep up.

A paper presented to a conference in Bellevue, Washington, earlier this month describes—for the enlightenment of the white hats in this arms race—an innovation that may make viruses still sneakier. Its authors, Vishwath Mohan and Kevin Hamlen of the University of Texas at Dallas, call their program “Frankenstein”, after the fictional scientist who (at least, in film versions of the story) stitched together his monster out of body parts scavenged from graveyards and slaughterhouses.

The digital version of Frankenstein works by scanning innocuous programs—word processors, say, or the calculator that is part of Microsoft’s Windows operating system—for small chunks of code dubbed “gadgets”. Such snippets encode handfuls of the most basic operations that computers perform: loading a number into memory, for instance, and then adding two numbers together. Harvest enough of these, and arrange them in the right order, and it is possible to knock together a piece of software that can perform any task you like.

Frankenstein starts with a “semantic blueprint”: an abstract description of what the program is designed to do. It then sifts through all the gadgets on its host machine until it has put together the required list of instructions. In their paper, Mr Mohan and Dr Hamlen demonstrate the feasibility of this by having their program construct two simple algorithms—not full-blown viruses, but the sorts of things that a virus author might find useful—using only gadgets harvested from Explorer, the file browser included with Windows.

Besides being technically neat, this gadget-based approach has advantages for malware writers. As with natural language, it is possible to write “sentences” in computer code that, although different in composition, convey the same meaning. There is, in other words, more than one way to write a program. Since Frankenstein is designed to generate its algorithms from a different set of gadgets each time it infects a new machine, the resulting program will look different from any other version that has gone before it. Each variant of the program will, however, behave in precisely the same way.

Protean programs like this are not, in themselves, a new idea. Virus writers have used similar obfuscation techniques since the early 1990s. So-called polymorphic viruses employ encryption to scramble themselves. If a new key is used every time the program replicates, each generation of the resulting gibberish can be made to look different from its predecessor. But antivirus scanners have adapted. Modern ones look for the small chunk of code necessary to decrypt the virus, which is harder to tinker with. Scrambled computer code also exhibits telltales that can be detected by statistical analysis. Dr Hamlen offers the analogy of a bank robber with an unlimited supply of ski masks. The robber may look different each time he holds up a bank, but that hardly matters; hanging around a bank in a ski mask is always going to be suspicious.

The authors hope that Frankenstein’s methods will hinder such detection strategies. Because the program is not encrypted, statistical methods will report nothing amiss. And the fact that its progeny are composed of bits and pieces from legitimate programs will help to fool scanners that rely on heuristics—rules of thumb designed to spot dodgy behaviour. One potential weakness might be the semantic blueprint, which has to remain unchanged between generations. But, says Dr Hamlen, because the blueprint is not itself computer code—merely a description of what the generated code needs to do—it can be safely hidden from defensive programs with traditional encryption.

Who might be interested in such a thing? Malware writers and antivirus firms are two obvious audiences. But Wei Ming Khoo, a security researcher at Cambridge University who is not affiliated with the paper’s authors, reckons that Frankenstein’s reliance on code harvested from pre-installed software may slow its ability to spread between computers. That would lessen its appeal for cybercriminals.

Mr Khoo does, on the other hand, think the new approach would be good for precisely aimed, short-lived attacks. In this context it is, perhaps, no surprise that the work was paid for in part by America’s air force and that the authors note delicately that their program might come in useful for “active defence”—or, as one of Britain’s rugby coaches once put it, “getting your retaliations in first”. The world of cyber-warfare, always a murky place, may thus be about to get murkier still.

Correction: This article originally stated that Kevin Hamlen and Vishwath Mohan were at the University of Texas. They are in fact at the University of Texas at Dallas, which is a different institution. Our apologies to both. This was corrected at on August 24th