Computer virus vs biological virus, similarities?

When was the ana­logy between bio­lo­gic­al and com­puter vir­uses made?

Jean-Yves Mari­on: The use of the word “com­puter vir­us” comes from Leonard Adle­man, a com­puter sci­ence pro­fess­or and molecu­lar bio­lo­gist renowned for his work on DNA com­put­ing (com­pu­ta­tion using DNA sequences). He was one of the developers of the RSA encryp­tion algorithm. In 1983, one of his PhD stu­dents, Fred Cohen, developed a new type of inform­at­ic threat. He designed a pro­gram grant­ing him the access rights and data of unknow­ing users who down­loaded it. As such, Adle­man named this type of pro­gram “a vir­us”. The ana­logy between com­puters and bio­logy was pop­u­lar at the time, people spoke of arti­fi­cial intel­li­gence, neur­al net­works, etc.

Can we also apply this ana­logy to the means of fight­ing viruses?

There are pos­sible com­par­is­ons. The concept of lock­down, for example, is par­tic­u­larly applic­able to net­works. A fire­wall and fron­tend serv­ers – a demil­it­ar­ised zone (DMZ) – isol­ate the rest of the net­work to pro­tect it as much as pos­sible. It’s almost like put­ting on masks so we don’t get infected! 

How­ever, if bio­logy and com­puter sci­ence show sim­il­ar­it­ies in the reas­on­ing or ana­lys­is of a situ­ation, this is not the case when it comes to defence. From a bio­lo­gic­al point of view, the human immune sys­tem is a fant­ast­ic machine. It knows how to defend itself against vir­uses, bac­teria, aggres­sions, etc. It even knows how to “update” itself by tak­ing into con­sid­er­a­tion pre­vi­ous attacks. Our digit­al sys­tems are light years away from this ingenu­ity and efficiency. 

We would greatly bene­fit from a bet­ter under­stand­ing of our immune sys­tem to see if some ele­ments could be trans­posed in anti­vir­us soft­ware. The mech­an­isms of liv­ing beings are far more com­plex and soph­ist­ic­ated. A cyber­at­tack is only designed by one or sev­er­al humans. It is there­fore pos­sible for oth­er indi­vidu­als to under­stand and coun­ter­act this attack. Admit­tedly, cyber­at­tacks claim vic­tims, but we can defend ourselves. Where­as in the case of the Cov­id-19 pan­dem­ic… it is much harder!

Does this mean that we could pro­tect ourselves against a cyberpandemic? 

Sev­er­al answers. First, a world­wide cyber­pan­dem­ic has been announced for ages: “everything will stop, there will be no more cars, energy, etc.” But it remains to be seen! We are far from the chaos por­trayed in dis­aster movies. At the same time, the num­ber of cyber­at­tacks increases and make vic­tims every day. When a com­pany is attacked by a ransom­ware, it leads to import­ant human and eco­nom­ic con­sequences. Finally, we have already been sub­ject to sev­er­al attacks res­ult­ing in import­ant per­man­ent dam­age. For example, Wan­naC­ry or Not­Petya were respons­ible for bil­lions of fin­an­cial losses around the world.

Addi­tion­ally, vir­uses evolve, mutate and con­ceal them­selves bet­ter and bet­ter. Some even include many vari­ations. Let us take for example the bank­ing Tro­jan called Emotet. It appeared in 2014 and since then, its form, sig­na­ture or beha­viour have changed over time. It is cur­rently one of the most wide­spread vir­uses. We sub­mit­ted a par­tic­u­lar sample of Emotet to 63 anti­vir­uses on Google’s Virus­Total web­site. Only 7 of them detec­ted this malware…

Not to men­tion the bil­lions of con­nec­ted objects in our homes and our cit­ies which can be attacked, diver­ted from their inten­ded use. So yes, a cyber­pan­dem­ic is pos­sible, but it would not take the same form as a bio­lo­gic­al pandemic.

What do you fear the most?

I think that the true pan­dem­ic today is dis­in­form­a­tion. Much like a dis­ease pan­dem­ic, it is vir­al. Intel­li­gent lan­guage or image pro­cessing tools are now so soph­ist­ic­ated that they make it pos­sible to cre­ate “deep­fakes”, fake but entirely cred­ible videos which can make some­body say any­thing. It is pos­sible to pro­duce false “likes”, fake chat­bots, to widely spread false inform­a­tion, attack elect­or­al systems…