A report in the Daily Yomiuri suggests that the Japanese government have commissioned Fujitsu Ltd to create a “defensive virus” and that after 3 years of work and a budget of $2.3 million, the project is nearing completion.
Technical details in the article are necessarily thin on the ground but it appears that the “cyberweapon” is designed to “springboard” from one compromised computer to another, tracing back to the original source of the attack and shutting down malicious processes en route.
Whilst I can see the attractiveness of the principle and have some sympathy for the thinly veiled claims in the article that “everyone else is doing it”, the concept of the “good” computer virus has been the subject of debate for many years and it has never gained widespread support.
Even a “good” virus or worm must execute on a machine without the permission of the owner of that machine. If that “good” virus has the objective of terminating malicious processes and/or patching security holes then, by definition it must modify or delete critical processes, memory content or files. If its design is to spread autonomously then system owners will have no opportunity to test whether its supposedly altruistic activities will have any negative impact on a running system. It will also consume bandwidth, disk space, memory and processor cycles, all adding to the load, just as a malicious worm does effectively creating a Denial of Service condition.
The “good” virus may also be hindered by effective security software, many of the actions it will be carrying out, such as modifying system components and terminating process, will be precisely those which are designed to be recognised and stopped by security programs.
Finally it really wouldn’t take much effort for criminal groups to take these white-hat tools and modify them for more malicious use, blurring the line even more between the “good” and the bad and putting professional grade carrier mechanisms in the hands of criminals.
The Japanese government seem less than coordinated right now on the actual use such a technology would be put to, the article reports them as saying that they are “not considering outside applications for the program as it was developed for more defensive uses, such as identifying which terminal within the Self-Defense Forces was initially targeted in a cyber-attack“. This is hardly surprising, as the creation of malware is currently a violation of Japan’s criminal code.
You have to wonder though, even in that limited scenario, wouldn’t such an automated “sprinkler system” pose a huge risk of destroying valuable forensic evidence in the case of a breach? Wouldn’t effective real-time monitoring of computers and networks, reporting to a centralised SIEM console provide as much intelligence in a less inherently risky way?
Post Script:
In 2004 Cyrus Peikari made a seemingly good case for Fighting Fire with Fire, but I feel that the medical analogy breaks down completely under close examination. In the digital case we are talking about releasing a self-replicating virus into the wild, whereas in the medical case we talk about manual and controlled introduction of an attenuated virus on an individual (and voluntary) basis.
Trend Micro blogs/ articles For more