The Internet, Application Vulnerabilities and Viruses: A Deadly Combination

One thing that can be said about virus writers is that they are not short of ingenuity when it comes to finding ways of spreading their infectious creations. The enormous increase in the use of the Internet, especially for exchanging files and documents, has made their work a good deal easier. Although e-mail is undoubtedly where the most risk lies, there are a number of other channels through which the Internet can be exploited for spreading malicious code.

– E-mail is the main virus entry point and the fastest. E-mails bear the risk of not just carrying infected files but attaching messages with infected text as well.

– A virus can use Internet Relay Chat to send itself out, or to send infected files to all those connected to the same channel as the user with the infected machine.

– Web pages. All web pages on the Internet are a combination of text and graphic files. As ActiveX controls or Java Applets are often used to cause and spread virus infection, web pages containing these programs increase the chances of infection to a user.

– Transferring files through File Transfer Protocol (FTP) allows files to be copied to and from computers around the world via the Internet. FTP is one of the most frequently used methods for downloading infected files from the Internet.

– Chat forums and newsgroups can also be used for sending e-mails with attached documents and therefore, viruses. If the machine of any one person in a newsgroup is infected, the infected message can be sent out to all other members of the group without the sender’s knowledge.

The problem becomes even more serious when the virus in question is designed to exploit an operating system or application vulnerability. Over the last year and a half, some of the most serious computer virus epidemics were caused by this type of malicious code. Badtrans.B, Nimda and Klez.I all exploited a vulnerability in Microsoft Internet Explorer to run when the e-mail message carrying it was viewed in the preview pane. Similarly, Code Red used a flaw in Microsoft Internet Information Server to run on infected computers.

All users should take basic security measures including using a reliable antivirus and exercising caution when browsing the Internet or sending and receiving e-mails. It is also advisable to keep up-to-date on the latest security news from software developers, as these often contain vital information on vulnerabilities, workarounds and patches. Users can subscribe to e-bulletins dealing with IT security issues.