Security optimize

The convergence of biological and computer viruses

The difference between a biological virus and a computer virus is blurring. Learn how a researcher infected himself with a computer virus.

A few years ago, I worked on a series about computer malware. I wish I could say the articles were a hit because of my herculean effort, but I can't. That honor goes to the incredible member discussions -- particularly the ones discussing similarities between malware propagation and how we humans spread our maladies.

Another article I've written that garnered much the same interest looked at how computer scientists were able to enhance digital communications by replicating neural networks discovered strangely enough in fruit flies. Lead scientist, Dr. Ziv Bar-Joseph:

Biological systems address many challenges presented by computer networking. For instance, biological processes are often distributed, as are communication systems used by computers. Thus, I believe, solutions for many computer-network problems can be based on what we learn from biological systems.

Is there convergence?

My interest in this subject may not be as lofty as Mr. Einstein and his desire to explain the entire universe using one equation. But, I'm starting to see signs that the convergence between biology and digital electronics is impacting computer security. Something I do consider important. So, when I stumbled across a web page asking, Could you become infected with a Computer Virus, I had to check it out.

After watching the TEDxTalk associated with the webpage, I was somewhat disappointed. The title is technically correct, but not what I had envisioned -- or so I thought. The talk starts out with Dr. Mark Gasson, senior research fellow at University of Reading, explaining how he inserted a RFID chip under the skin between his thumb and first finger.

Next, Dr. Gasson discussed several useful functions he programmed into the RFID device:

  • Allow the implanted person to gain access to secure buildings.
  • Allow devices like mobile phones to work only if the RFID tag is in close proximity.
  • The implant stores information that could be useful in emergencies.

Infect the RFID implant

Here's where the talk got interesting. After the RFID implant was in place, Dr. Gasson was able to infect it with a virus. And more importantly, infect (replicate the virus) other devices:

We did two experiments: one with the computer system securing building access using smart card or RFID devices. We infected that computer with a virus. The computer was able to transfer the virus to the implant when I tried to gain access.

In the second experiment, we purposefully infected the implant itself. When the building's access system read the tag, the virus was transferred and corrupted the computer system. At that point any other device (typically RFID smart cards rather than implants) trying to access the system was potentially at risk from the virus.

Is it an official virus?

Now the million-dollar question: can a human become infected with a computer virus? I looked at more definitions of virus than I care to admit. And, the only requirement common to all the definitions; a virus needs to be self-replicating in a host. This definition is one of the more interesting ones I found:

The concept of a virus as an organism challenges the way we define life. Viruses do not respire, nor do they display irritability; they do not move, nor do they grow. However, they do most certainly reproduce, and may adapt to new hosts.

So, if we consider replication a mandatory requirement, is it official?

More ammunition

I'd like to continue the discussion about convergence between computer viruses and biological viruses by introducing "An Attacker's Day into Human Virology," A research paper by Axelle Apvrille and Guillaume Lovet, researchers for Fortinet, that looks at traits common to both biological and computer viruses.

Medical terminology alert: I suspect, like me, most IT-types squeaked by with only the required biology classes at university. Just beware the first several pages of the paper are like this:

Additionally, macrophages release special proteins -- cytokines -- that activate Natural Killer lymphocytes.

Thankfully, Axelle and Guillaume returned to familiar terminology when they started comparing the two "not that different" types of viruses:

  • Brute force attack: This is one case where the biological virus is nastier. According to the research team, the whole idea is for the virus colony to overwhelm the immune system. Computer viruses are more selective with the main consideration being how to infect more hosts.
  • Polymorphism: Biological viruses are polymorphic because of error-prone replication. As I understand, during replication, duplicating genetic information is not always successful -- creating a different virus strain that is not immediately recognizable by the immune system. HIV is a good example. Conficker is a polymorphic computer virus.
  • Attack the AV engine: HIV is a good example of this as well. It directly attacks the immune system -- the body's AV engine. There are numerous computer viruses capable of terminating antivirus programs -- for example, W32/Sality.
  • Vulnerable hosts: Biological viruses do not attack at random. They target specific cells that are vulnerable to that particular virus's payload. Computer viruses are slightly different. Depending on their design they can either attack at random, hoping to find a vulnerable file or specifically check to see if the host is vulnerable before attacking.
  • Time bombs: Most biological viruses need to reach critical mass before they become effective. There are some famous computer viruses like Michelangelo and CodeRed programmed to activate their payload at a specific time and date.
  • Auto re-infect: The researchers mentioned HIV more than any other biological virus. That must mirror its effectiveness. HIV is insidious with its ability to keep the host infected or automatically re-infect it. The bank-account stealing virus Zeus, also insidious, employs constant updating so the infected host computer remains under the control of the attackers.

What if?

The next topic discussed by the researchers is a bit unnerving:

Fortunately, biological viruses are not advanced enough to implement packing, encryption, virtual machine detection, or anti-debugging tricks. Geneticists should probably pray that future biological viruses won't evolve from the genomes of cyber-criminals or medicine will have even more difficulties in identifying and stopping viruses.

Here's more:

We are quite lucky that biological viruses do not intentionally play a game of cat and mouse with medical doctors. Just imagine what this would translate to: sick people being redirected to a hair stylist instead of a medical doctor (URL redirection), viruses saying hello when you watch them with a microscope, or viruses refusing to replicate under culture (foiling reverse engineering).

Quite a concept -- computer viruses are more evolved than their biological counterparts.

Final thoughts

What Dr. Gasson has accomplished brings up several interesting questions:

  • Will the term virus require redefining, taking into account the biological-digital convergence?
  • What does Dr. Gasson proving that implanted devices can be infected mean to the medical field?
  • Mobile phones are close to being a necessity, meaning those without mobile phones are at a disadvantage. Will the same apply to implantable technology?

What say you?

About

Information is my field...Writing is my passion...Coupling the two is my mission.

40 comments
rwniebuhr
rwniebuhr

It might also be useful to look at computer viruses as parasites. There are many examples in nature of parasites altering their hosts' behaviour in ways that are dangerous to the host but beneficial to the parasite. Toxoplasma gondii, for example, causes foolhardy behaviour in rodents in order to get back to its preferred host, a cat; this can manifest as reckless behaviour in humans. Excerpt from a Wired post: In a stunning example of population-level evolution, a newly discovered parasite makes its ant hosts turn red and swollen, like berries. Berry-loving birds then eat the ants, and spread the parasite in their droppings..... infected ants not only look appetizing, but become sluggish and hold their abdomens high in the air, making them easy targets for birds that would normally avoid them. ...An earlier post....described a parasite that in sufficient numbers makes fish float close to the surface, similarly turning them into prey for birds who spread the parasites in their poop. These sorts of adaptations really boggle my mind, because evolution is clearly operating at a group rather than individual level: a single parasite has no effect on its host, but put enough in one place and they benefit. It’s enough to make you wonder what group-level characteristics are produced by human interaction???.

Michael Kassner
Michael Kassner

You quoted this in your article, "Just imagine what this would translate to: sick people being redirected to a hair stylist instead of a medical doctor (URL redirection)" This actually happens in the animal kingdom. Toxoplasmi gondii, a parasite that infects cats, mice, rats and humans, redirects mice and rats to cats to be eaten by them to finish it's replication cycle. "T. gondii infections have the ability to change the behavior of rats and mice, making them drawn to, rather than fearful of, the scent of cats. This effect is advantageous to the parasite, which will be able to sexually reproduce if its host is eaten by a cat. The infection is widespread in the brain, with more cysts targeting the parts of the brain corresponding to fear. The widespread nature of the infection causes many previously unnoticed symptoms in the rats." -- http://en.wikipedia.org/wiki/Toxoplasma_gondii I believe there is a similar thing among insects. No definitive word on the topic for humans for physical agents, but one could make a pretty good case for cultural meme viruses and trojans.

plut0nash
plut0nash

I'm sure many of us reading this have played games like Deus Ex (all 3), System Shock and other futuristic games where things like modifications, implants and genetic modifications are pretty pivotal to the happenings of the world. Now let's look at what is happening to us. A little over 20 years ago someone using a PC for something other than playing solitaire and working would be considered a geek / nerd / whatever. Maybe that timeframe is wrong, but you know what I mean. Now fastforward to today. Tablets and smartphones are overtaking PC sales, and using a tablet for menial tasks like email or browsing are far more convenient than what they were thanks to intuitive touch interfaces and convergence from all sorts of areas (web integration is one - I'm sure there are many that can be named.). Added to this, an Ipad is something sought after by even the most tech-stupid people. It just makes things simpler to do. I saw my mother in law talking to her aunt in Australia via Facebook on an Ipad. THAT is a big change. Now personally, I find touch interfaces irritating because of the level of attention they demand from me. Now if mobility and integration are the names to consider let's see where this can go. To go back to my first statement: Let me be honest here and say that implants are scary and the moral grayareas surrounding this concept are plain daunting for a person like me who chooses to switch off my PC and drive in a car with a plain FM / AM radio. However, there are people who will want to augment better eyesight with an implant in the future. I see others wanting not to wear eyeglasses or contact lenses and wanting to see better and further due to the wear on their eyes, or genetic problems. I see arthritis being sidelined for many with implants on the joints. I see paraplegics (spelling?) performing more and more tasks that they may have never been able to do before. Furthermore to this, what about brains directly interfacing with wifi / neural networks to perceive more detail than before? http://thebeautifulbrain.com/2011/06/the-neuroscience-of-tetris/ That should tell you that the brain already has capacity to adapt as it is fed with information and stimulation from the senses and nervous system. This is both exciting and frightening. Boundaries are bound to be crossed here. Anyway, off topic ramblings aside. The future is looking interesting to say the least :) Think that Deus Ex and System Shock are too sci-fi? I think that 200 years ago digital wristwatches weren't envisioned by most, and that having wikipedia overshadowing our university / college text books in terms of level of detail and availability where 20 years ago this never would have happened. Our kids and their successors are in for a very, very fascinating future indeed.

Chashew
Chashew

Great work Micheal, now how can I convert your article into a source post that can be understood by norms? JK ...but your so right when it comes to adaptive virus builds, and I believe the real identification for life is they need only reproduce to be classed as life forms. At any rate lets ask one question and be done with it, "Can AV apps possibly keep up with ever changing Malware ?". I try my best to help my online friends to keep their machines running and also stop the spread of baddies through social infections. But I cannot predict what their online activities might be or where they may go...right ? So if they manage to find a high end virus that spreads through either associative or addresses like some do what if anything can truly stop that junk? Chicken Soup??

Charles Bundy
Charles Bundy

it was possible to hack a protein synthesizer and insert arbitrary sequences (e.g. Ebola) Infecting an RFID chip embedded in the hand strikes me as equivalent to infecting their cell phone. It really doesn't have much convergence unless the device is physiologically tied to the organism. Implant doesn't count unless it has a biological effect. An example of this might be a pace maker. Infect something like that and you have a digital virus converging with the biological realm of effect-on-host.

pyusko
pyusko

Call it a di-bi virus. Or even shorter still, di-bi-vi. (Combining digital-biological-virus)

Slayer_
Slayer_

Many are cross platform, many of the most deadly are in fact bird flu's. So far a computer virus can't both infect Windows and a coke vending machine.

gscratchtr
gscratchtr

I read this: "computer viruses are more evolved than their biological counterparts" Isn't it the case that computer viruses are really creations (rather than 'naturally evolved' biological entities), so any "evolution" is actually the result of direct design? Or, if we believe in 'Intelligent Design', does that exclude biological viruses?

jond4u
jond4u

Good article Michael, But stealthy maladies abound, though perhaps not as viral infections. If you substitute Psychiatrist for Hair Stylist in the example above, I have seen one or two examples, and some people would say that Lyme Disease can masquerade as a whole host of other problems. So while that malady is bacteriological, I imagine there are already biological viruses which induce symptoms that mimic something else - and so fall in the category indicated. Or perhaps I just have a hard time believing that humans are cranking out computer viruses that outdo what is seen in nature. But maybe computer viruses really are more virulent. Pretty scary stuff, either way. Jonathan

spearson@8herons.com
spearson@8herons.com

Creating an uncontrollable sex drive (aka sex addiction) would be an interesting way for a hitherto unknown parasite to reproduce and spread via human reproduction.

Charles Bundy
Charles Bundy

doesn't intentionally redirect, it just alters brain chemistry.

mariuspretorius
mariuspretorius

on the awful possibilities of using biological viruses to surreptitiously and willfully infect populations in a form of biological warfare. What if terrorists learn from today's hackers but instead of using computer viruses start using biological viruses. It is probably already happening - but what if it gets done on a larger scale. Anybody with information on that field? But perhaps I'm going off topic.

Michael Kassner
Michael Kassner

This was the Proof of Concept that implanted devices, even as simple as an RFID, can be infected. Also, playing the devil's advocate, a virus is an implanted foreign body, which both are. The replication requirement is a bit of a stretch though.

dwordja
dwordja

Hmmm. This is a step beyond Independence Day's virus delivery to the mother ship. Yes, ahead there surely will be implanted terrorists (or patriots) who will look to deliver digital-biological viruses one-on-one surreptitiously to the computers of specific vehicles or whole transportation systems. To hack medical devices. To attack quality control systems in such as water treatment plants, pharmaceuticals production, and various manufacturing industries. And to corrupt critical "failsafe" systems at places like nuclear plants and defense bases. I laughed too soon when I read the suggestion of a virus under a microscope saying Hello. God help us!

hanekwj
hanekwj

Be carefull to classify organic matter in differing "Platform" catagories. All animals including humans are all biological and we have DNA, amino acids etc. the only difference between humans and animals are brain function. Thus all living animals are the same platform. Software on the other hand are specifically engineered to be defferent and therefore there is a seperation of "Platform"

hanekwj
hanekwj

The semantics behind the word “evolution” has changed so much that it has become a fire sale word: Someone in IT may say: Computers evolve; no they are developed or designed or technological advancements were made. A musician may say: My music has evolved over the years; no it has matured. In most cases there are hundreds of words that better describe something than the word evolution and that is where I relate it to a fire sale as that single word cheapens language. I have excluded the word evolution from my vocabulary and use it only to address the word itself or the concepts of biological, chemical, stellar, macro evolution etc. (I do not believe in any of the aforementioned evolutions) I don’t think anyone who believes in a Creator God, intelligent designer, or simply enjoys the English language should make use of the word evolution in everyday life.

Michael Kassner
Michael Kassner

The one comment that caught my attention was if a biological virus was encrypted. That would be scary.

Charles Bundy
Charles Bundy

which said sorry for the confusion, I was replying to [hanekwj]... It popped up, then disappeared. I then couldn't post anything so decided to update the original and it promptly got sucked into a black hole after hitting save. :)

Michael Kassner
Michael Kassner

If read where a dirty bomb was considered for this, if they are able to have the biological payload withstand the explosion.

Charles Bundy
Charles Bundy

And being a biologist my answer is no. You could super-glue a cell phone to your skin and it would serve the same [i]proof-of-concept[/i] wouldn't it? :)

Michael Kassner
Michael Kassner

They don't make science-fiction movies like that any more.

Slayer_
Slayer_

Those buttons you push for the drinks look a lot like Metro tiles...

Michael Kassner
Michael Kassner

As a wordsmith, I cherish words and their power. I never cease to be amazed at how many heated disputes can be quieted by asking each party to step back and first agree to define what they are arguing about.

Charles Bundy
Charles Bundy

dictates the need for error correction. Digital or biological require proofreading, but errors are tolerated on the biological side if the error can be transcribed into the gene.

Michael Kassner
Michael Kassner

Is that the same as error-prone replication? I am not a biologist, so I do not want to assume anything.

Michael Kassner
Michael Kassner

Can you define or explain the difference between error correction and error-prone replication. Or are they even related?

hanekwj
hanekwj

"but the biological emphasis is on reproduction over error correction of genes aka Evolution." As a biologist you should know the next one: Is it not true that in DNA we find polymerase (enzymes) that is exactly focused on error correction and therefore DNA itself has ANTI-EVOLUTION, error correcting properties?

Charles Bundy
Charles Bundy

doesn't strike me as having been written by biologists. I will say that for their notion of convergence to work the digital ecosphere would have to incorporate mutability. Right now the name of the game is to minimize error and get the same bits out as were put in, yes? Genotypic expression has error correcting systems, but the biological emphasis is on reproduction over error correction of genes aka [i]Evolution[/i]. Digital systems are not designed to support evolution processes. Even GA’s require a predefined fitness function. Thus it’s still a no-go on convergence wrt reproduction and survival being dictated by environmental pressure. Makes for an interesting read tho! :)

Michael Kassner
Michael Kassner

I'm glad you mentioned that you are a biologist. As the one reporting, I try to leave my opinions out of the mix and report what experts are saying. It really boils down to what definition of virus is agreed upon. I was trying to hint at that in the article. Did you read the paper by Axelle? There is a significant chunk of the paper that discusses convergence. I'd love to learn what you thought of it.

mariuspretorius
mariuspretorius

I had a nice chuckle when I read this comment. I haven't made up my mind concerning Metro, but I enjoyed your wittiness.

hanekwj
hanekwj

from the comment "interesting" It was clear that the mention of the word "evolution" caused ambiguity in the piece because it was used to describe something that cannot evolve (automatic (please note the difference between automatic and automated) it has to BE changed, in the case of computer viruses by human hand, or by built in morphological code(automated), built in by human hand. Hence no evolution for computer viruses. The world evolution has to ALWAYS be clearly defined when used or be replaced with a more appropriate word. In school they taught you if you are going to use an abbreviation multiple times you write it out the first time and put the abbreviation in brackets and then later on use the abbreviation: The Central Processing Unit (CPU) is at the???. CPU??????.. CPU???. So with evolution simply because the word has SO MANY MEANINGS PS. I am not shouting, I just wanted to put some emphasis on a few word

Michael Kassner
Michael Kassner

I thank you. I have been writing a long time and have yet to have one of my articles go in that direction.

Charles Bundy
Charles Bundy

is that I don't know how to respond to [hanekwj] so as not to start a heated discussion. :(