Who Creates Computer Viruses?

Computer viruses are written by a variety of perpetrators. Historically they have been brilliant teenage kids or desperate people in search of attention. They are typically male and in their teens or early 20s. However, David L. Smith, author of the famous Melissa virus, was 30 when the FBI caught up with him.

Still, I like how Jack Sebbag, a vice president at the antivirus software companyMcAfee, characterizes virus writers: "They're 14-year-old kids who can't get a date, but have incredible talent and are looking for a challenge to bring (millions of) computers down just to get a little notoriety."

And some, as it turns out, are looking for work. In one variant of the MyDoom worm, there was a message to the antivirus software industry that said, "We [sic] searching 4 work in AV industry."

It's an ill-conceived strategy, of course. No one in the antivirus industry will go near them. Graham Cluley, senior technology consultant for Sophos, an antivirus company, said in a posting to the company website, "It's hard to tell if the creators of these new versions of the MyDoom worm are being serious, but there is no way that anybody in the anti-virus industry would touch them with a bargepole," adding, "It's very simpleif you write a virus, we will never ever employ you. Not only is it unethical to write malicious code, but it raises issues as to whether you could ever be trusted to develop the software which protects millions of users around the world from attack every day."

Nowadays, virus writers don't need much programming savvy to write a decent virus. They just modify existing viruses creating what are called variants. Theprogramming code is widely available on the Internet. Virus writers, hiding behind pseudonyms, even meet anonymously in chatrooms and swap tips, tricks, andbragging rights.

Ultimately, most motivations behind virus writing these days are financial. The virus turns your computer into a zombie, which is a computer that can be remotely controlled by a hacker or virus writer to do malicious tasks such as send spam or to attack another computer by sending a flood of data at it across the Internet in what are called distributed denial of service (DDoS) attacks.

Spam makes money for the virus writer by distributing massive volumes of junk email. DDoS attacks work via extortion. A wealthy corporation receives an email that demands a lump sum payment in return for protection. If the demand isn't paid, the perpetrator remotely commands all the zombies to attack and crash the company's server. Gambling web sites are often targets of these schemes. 

[Absolute Beginner's Guide To: Security, Spam, Spyware & Viruses, Andy Walker 2005]