What Does a Computer Virus Look Like?

What does a computer virus look like, really?

No one really know for sure. But a partnership between security services provider MessageLabs and artist Alex Dragulescu has provided one answer.

SLIDESHOW (9)

Slideshow | All Shots

Dragulescu, a Romanian-born artist who first made his name by designing so-called so-called "spam plants," moved on to modeling viruses, worms, and phishing attempts late last year, at the behest of MessageLabs. With the spam, Draglescu took actual spam emails, stripped them down to their basic text, header, and URL information, and looked for relationships that he could exploit artistically using his own algorithms. The idea was to create something more aesthetically pleasing.

For MessageLabs, what Dragulescu saw as art the company saw as a more useful tool. To develop antivirus signatures, both Draglescu and MessageLabs' security researches have to break malware code down to understand it: where it attacks, what it writes or copies, and where it sends any stolen information. The company approached the artist and asked him to apply his craft to some of the more prevalent malware.

"What we thought was so interesting is that the security industry for more than 10 years has taken the same approach with threats, such as malware or spyware, that we intercept on a daily basis," said Paul Wood, a senior analyst at MessageLabs.

What Dragulescu came up with mimics the biological appearance of a virus, but is interpreted through the artists' rules: a virus is green, spam is reddish, phishing emails are blue, a Trojan is pink, spyware is purple, and a blue-green object is simply a malicious link. Other characteristics, such as the tendrils of the virus, are determined by attributes such as the number of connections it makes, Wood said.

Rather than give Draglescu actual copies of working code, MessageLabs gave him "vaccinated," or dead copies that had been pulled apart into machine language that could be analyzed without destroying Draglescu's computers. The actual process of analyzing the code and rendering it into artistic form can take hours, Wood said.

Initially, some of the MessageLabs team was skeptical of Draglescu's talents; theoretically, a poseur could simply take a few random seeds, generate some fractal art, and label it a virus. What convinced them was an odd pairing of malware: unbeknownst to Draglescu, he was asked to process an email laden with the Netsky virus that itself ad been infected by Parite, a polymorphic virus that infects .EXE and .SCR files. The result was a weird amalgam of code. Run through Draglescu's computers, however, the code transformed into an image that clearly contained elements of two different objects.

"When they saw these things coming up, they became surprised and excited about the whole idea," Wood said.

What MessageLabs is hoping for, Wood said, is that the images themselves will offer some ideas for new logic patterns the company's analysts themselves can use to look for new zero-day malware. "It helps to bring it to life," Wood said. "Whether we can go down that route or not certainly remains to be seen."

MessageLabs intends to continue the process as new malware is encountered. Unfortunately, for right now the process can't be completed in real-time; Draglescu still needs an hour or two to render the images, and he needs disassembled code to do so.

But, while sinister and beautiful, Draglescu's images so not represent mindless, tiny organisms simply trying to survive, Wood added. Instead, they represent engineering and malicious intent by criminals. "It's important not to lose sight of that," Wood said.