While theories on self-replicating automatas were developed by mathematician Von Neumann in the early 50s, the first real computer virus – “Creeper” – was released “in lab” in 1971 by an employee of a company working on building ARPANET, the Internet’s ancestor, and is thus celebrating it’s 40th birthday this year.

The last four decades have seen the number of viruses, worms, bot nets and other malware instances boom – from 1,300 in 1990, to 50,000 in 2000, to over 200 million in 2010.

They involved from simple academic proof of concepts into geek pranks and now into full fledged cyber-criminal tools: By 2005, the virus scene had been monetized, and virtually all viruses were developed with the sole purpose of making money via more or less complex business models.

Example: The original “Creeper” looked for a machine on the network, transferred to it, displayed the message “I’m the creeper, catch me if you can!” and started over, thereby hoping from system to system – a pure proof of concept, just to show that “it can be done”.

Over the years, infamous milestones in malware development were set by variants such as “Jerusalem” (1987), “Michelangelo” (1992), “Melissa” (1999), “I love you” (2000), “Code Red” (2001) and “Sasser” (2004), all of which have – despite the cutesy names and interesting stories behind them – racked up increasing and considerable monetary damage world wide.

MyTob (2005) marked the turning point and the entry in the area of Botnets and organized cybercrime. It was one of the first worms to combine the features of a Bot (the infamous “Zombies”, controlled by a remote “Botmaster”) and a mass-mailer. Business models designed to “monetize” the many botnets appeared (some of which will count more than 20 million machines): installation of spyware, diffusion of spam, illegal content hosting, interception of banking credentials, blackmail, etc. The revenue generated from these new botnets quickly reached several billion dollars per year; a figure that is growing today.

Today, things are being taken up another notch – say hi to full fledged Cyber War. Case in point: “Stuxnet” (2010), to which – according to most threat researchers today – only governments have the necessary resources to design and implement a virus of such complexity.
To spread, Stuxnet exploited several critical vulnerabilities in Windows, which, until then, were unknown, including one guaranteeing its execution when inserting an infected USB key into the target system, even if a systems autorun capabilities were disabled. From the infected system, “Stuxnet” was then able to spread into an internal network, until it reached its target: A supervisory control and data acquisition (SCADA) and human-machine interface (HMI) system: WinCC as well as the Distributed Control System SIMATIC PCS 7, both manufactured by Siemens.
In this particular instance, Stuxnet knew the weak point with a specific controller – perhaps a cooling system – and most likely intended to destroy or neutralize the industrial system. This marks the first (known) time that the target of a virus is the destruction of an industrial system (in this specific instance, according to research, very probably a nuclear power plant in Iran).