Thursday, September 04, 2008

Viruses in Spa-a-a-a-a-ce

I think computer viruses should count as life. I think it says something about human nature that the only form of life we have created so far is purely destructive. We've created life in our own image. ~ Stephen Hawking

There was general consternation the other day when it was announced that there was a computer virus on a laptop aboard the International Space Station. People were shocked--SHOCKED, I say--that such a thing should have occurred.

Lemme tell you a little story about the Federal Government and viruses.

Back in the mid-1990's, I was a contractor working for an Army Reserve unit. Viruses were already pretty big stuff, although many were ill-designed and did very little. Enough of them were nasty enough, though, that anti-virus software was considered to be a pretty standard piece of software to have on hand.

The Feds were a little late to realize this.

One virus in particular, Form, got the nickname "the Government virus" because you could readily find it on military and civilian government employee computers. We had put antivirus software into place on the servers which caught infections as they got onto the file system, but no one would spring to install the software on all systems.

One day, a group of non-comms and officers showed up for a promotions meeting, the purpose of which, I guess, was to discuss potential promotions (I'm a life long civilian; I don't know about this stuff). I got a panicky call, asking me to come to the meeting room with an antivirus floppy disk (programs were still small enough to fit on a floppy). The way they shared data was to pass floppy disks to one another to copy to each individual laptop. As it turned out, virtually every laptop was already infected with something; by passing the floppies around, most of the laptops now had four or five viruses.

It took a couple of hours for two of us to clean up seven laptops. Miraculously, no data was lost, although recovering some of it took a mixture of skill, luck, and magic.

So, I'm not at all surprised that a laptop on the ISS should have a virus. In fact, I suspect that infected laptops have been on more than one mission. It's just that this time, they detected it.

Of course, there's a big brouhaha over how such a thing might have happened. Well, here's two ways for you. One, the laptop was connected to the Internet, either at the station or on Earth prior to going to the ISS, and someone went a-browsing where they maybe shouldn't have been a-browsing. Two, someone carried a USB flash drive up with data or software, stuck it into the laptop and infected it.

The sad truth is that it is very easy to get infected.

Of course, NASA people were quick to point out that they have Norton Anti-Virus installed. They also pointed out that it was updated on August 22. Translation: It wasn't up to date. I'm not going to throw stones at Symantec, who is responsible for the Norton product, because there's no telling the last time anyone on the ISS actually updated their antivirus definitions. Typically, these are updated by antivirus vendors daily, sometimes several times a day. An antivirus product that hasn't been updated for a week isn't going to protect anything.

Once upon a time, NASA wouldn't have been worried about viruses because they ran Unix. There are attacks for Unix systems, but they're fewer of them, and the normally require action from the user to actually get installed. Unfortunately, NASA decided Microsoft Windows was the way to go, which opened them up to attacks from every quarter, including apparently legitmate web sites that have been compromised by malware artists. One of these days, if NASA doesn't get to providing adequate protection to their systems, a damaging worm is going to get loose on their computers.

Somehow the mental image of all those big displays at Mission Control displaying Blue Screens of Death is not a comforting thought.

No comments: