Naturally they still had to look at the actual code that made up the cores of the viruses, but the visualizations gave them a better way of tracking how the virus actually worked.
Like now, for instance.
Behind a thick Plexiglas wall was the virus test chamber, itself an analog representation of data transfer between computers. An old-fashioned punch-card printer sat at one end of a long conveyer belt. At the other end was a scanning array and punch-card reader along with a large diagram of a computer that looked like an ant farm.
Everything was a brilliant white, like some scientific version of heaven. Cameras and magnifying lenses surrounded the apparatus to make it easier to watch the process from start to finish. A long section of the Plexiglas wall had been built to make a huge lens that brought sections of the conveyer belt up several levels of magnification.
Jay walked over to the punch-card printer and sat at a terminal. He tapped a few buttons and the printer began to spit cards. What he’d actually done was to upload an e-mail that had been infected with the new blanker virus going around. High-end security software had caught it, but the virus had slid past standard virus-checker stuff, and he wanted to find out why.
He moved to a magnifying glass in front of the printer, one half of which was cut away like a “how it works” kind of drawing, and took a look. There, near the punch card being printed, was a small insect shape. He flipped a larger lens down over the area he was watching and took a better look.
The bug was fairly large. Pale, almost clear, without color, it was segmented into three main sections. It had six legs and six pincer arms, with one pair of each per section. The head was surprisingly small, with tiny feathered antennae, and it had large eyes.
As he watched, the middle thorax — if it could be called that, there being three of them — went completely transparent, and he could see through it.
Clever. The author of this little bug had come up with a new invisibility routine, a don’t-look-at-me-I’m-not-here bit of misdirection that made viral data less noticeable.
As Jay watched, the bug worked its way toward a small pile of punch cards.
The first batch of cards dropped down from the printer onto the belt, which inched itself forward just enough so that the next batch of cards wouldn’t hit the first, and then stopped. The bug didn’t go yet, though.
It waited for the second set of cards — which actually represented a packet of data — to begin stacking up. Then it reached between the second and third sections and did something to detach the last set of arms and pinchers. That segment moved toward the cards, went transparent, and began cutting at them with its claws. When it had made enough room, it burrowed in and pulled a section of torn card back to cover itself. The bundle of cards dropped onto the conveyer belt a few seconds later, and packet number three began printing.
Fascinated, Jay watched as the bug split itself apart again several packets later and the second segment burrowed into another stack of cards. The very next stack got the last third of the bug.
Impressive. A trinary virus — and, if he was right, one coded to ride different packets.
The last stack of cards dropped onto the conveyer belt, and then the belt sped up, taking the cards toward the scanner at the other end of the test chamber.
The cards were VR representations of packets of information: the e-mail he’d forwarded broken down and sent in little bunches. The way it worked was the first packet had a list saying how many packets were coming, kind of like a cover sheet for a fax. The last packet had a little tag saying, “The end.” The packets in between contained the actual e-mail itself.
The computer or server getting the data would watch for all the packets and confirm delivery of each one before forwarding on to the next link in the chain. If there were any errors, the problem packet would be re-sent.
Early virus writers had taken advantage of the fact that each packet was a set size. That meant that if your message was, say, ten point two packets long, eleven packets would still be sent. The point oh eight unused space would usually be filled with zeroes, and that was where the virus would hitch a ride.
The virus checkers had gotten wise to this, though, and started carefully checking the size of messages against the number of characters sent.
So the innovative virus writers had gone one better, and had their creations cut out sections of legitimate data in the middle of the stream and hide there.
This would change the size of the packet, of course, which would throw an error, but that wouldn’t set off any alarms. Errors in transmission were pretty common. Line noise, bad connections, time-outs, there were many, many legitimate reasons why errors occurred. The receiving computer would simply flag the error, the entire stream would get sent again, and the recipient would get their data unaware of the hitchhiker that had come along.
This had led to binary viruses, where the virus would split into two innocuous-looking sections that didn’t do anything until they were reassembled at the other end of the chain.
This was the first time he’d ever seen a trinary, however. In addition, the way the bug had not spaced the packets it was riding evenly led him to think it was randomly selecting them, which would make it tough to get a handle on.
At the other end of the test chamber, Jay watched the packets slide past the scanning array, which was actually a standard, off-the-shelf virus detector. He wanted to see how this bug got past them, after all. Putting one of his own cutting-edge programs there and squashing the bug with it wouldn’t tell him anything.
He was disappointed, though. The bug didn’t do anything special to defeat the security program. The off-the-shelf killware wasn’t designed to detect trinary bugs, and so it didn’t.
Jay saw the virus-bug reassemble itself, and then proceed to a large clear sheet of glass that represented the video subsystem of the computer setup. Once there, it sprayed the glass with some kind of ink, blacking it out. If he had been in the real world, he would have just seen his computer screen blank out.
Jay ran the test several times to confirm that the virus was indeed randomly selecting packets to leap onto, his thoughts turning over the same question.
Why?
Why would someone go through so much trouble to develop a virus that couldn’t be defeated by modern checkers, just to make someone’s screen go blank? It seemed like a lot of work for not much gain. Somebody that smart could be making good money programming.
Maybe they were, of course. Though that still begged the question of, Why bother?
As he watched the bug on the third test, something else occurred to him. There was something familiar about the way it moved, the shape of the antennae.
He walked toward the most current bug case on the wall of the lab and started looking. He glanced at hundreds of recent viruses, red, green, big, small, all kinds of them.
There.
It was the filler, the really recent one that had made the rounds a few days before, the virus that had been eating up hard-drive space.
He took a closer look, pulling it carefully from its cage.
The antennae were identical to those of the blanker he was running in the test chamber. He turned the bug over, and saw it shimmer: another invisibility routine.
Hmm.
Jay got a live sample of the filler and took it to the test chamber. After a few runs, he was satisfied that whoever had made the filler had also made the blanker. An analysis of the written code showed portions that were exactly the same. This, plus the fact that the bugs had been released only three days apart, told him that they’d probably been developed at around the same time.