Is It Possible for a Universally-Executable Virus to be Written in Binary?

Question

In my world, there was a man that wrote a virus in binary code - which in turn infects every computer-based system in the world, as long as it is connected to the internet.

Is this even possible? Please be as detailed as you can, telling me why or why not it is possible.

---

Edit: assume that my world has technology just like today. What I'm asking is: even though it might be nearly impossible, is it possible to write a virus that can infect different hardware indiscriminately without needing to write a specialized virus for each kind of system?

My assumption was that because it was written in machine code with zeroes and ones, the only way to fight this virus would be to write another program that is an antivirus in machine code with zeroes and ones.

Answer 1

It would not be possible, because different CPU architectures have their own machine languages. Just because they all use binary doesn't mean they all have the same vocabulary or grammar. Think about it like this; just because someone who can read English will understand the sentence "The quick brown fox jumped over the lazy dog." doesn't mean someone who only knows French will understand it. Sure, the alphabet is the same, but the vocab and grammar aren't. Processors are the same way. A load instruction looks different on an x86 processor than it does on a MIPS processor.

Answer 2

Absolutely, but the question is why?

All program code eventually becomes binary machine code. Writing in binary to begin with would just be an exercise in masochism.

Here's how programming generally works:

1. The programmer writes code in a human-readable language, such as C++, Python, or Java, just to name a few.
2. A computer program called a compiler takes this human-readable language, parses it, and turns it into machine code. This machine code is specific to the computer architecture executing it. Alternatively, instead of machine code, the code can be compiled into assembly. Assembly is, more or less, human readable machine code (it's slightly more complex than that).
3. This optional assembly step is then converted into binary machine code.

The program's machine code is already in binary, and is generally known as a "binary executable." This binary code is highly specific to the CPU running it. Technically you can skip steps 1-3 and write the binary code directly, but this isn't very useful to do and just makes things harder for you as the programmer. Sometimes patches are done this way if you don't have the original source code and you want to "hack" an existing binary program, but you generally don't just go directly to binary.

Another issue is, since the closer you get to binary, the more machine-specific your program, it doesn't make as much sense to write a program (in your case, a virus) in binary, as it wouldn't be able to infect "every computer-based system" in the world. How many architectures a program can run on is known as portability, and in general the higher level language you use, the more portable your program.

For example, Java is meant to be very highly portable, however the way it accomplishes this is a bit of a cheat: It creates "virtual machines" that are implemented on the target hardware. This way, your java program can run on any machine that has a java virtual machine program on it.

Unfortunately, these virtual machines also tend to be relatively good security layers, in that they create a sort of "sandbox" for the programs they run. It's not impossible to escape this sandbox, and indeed a lot of security research goes into checking virtual machines for these types of escape exploits, but in general, the idea of writing a virus that can infect any machine connected to the internet is essentially reserved for fantasy. In fact, a large amount of time and money is spent just making programs that can run relatively painlessly across several architectures or operating systems. Life would be a lot easier if it were possible to simply write a program that can magically run anywhere.

Python, on the other hand, is "interpreted." This means that Python code itself [usually] isn't compiled into machine code, and instead is run through a program called an interpreter. This interpreter, as the name suggests, interprets the instructions in the Python program for the architecture running it. Interpreted languages tend to be slower due to this intermediate translation step, and, just like with Java, you have the problem of needing a new interpreter for each architecture you want to run your python script on.

This doesn't rule out scenarios involving artificial intelligence, however, as it is certainly conceivable to write an AI that is able to study all of the computer architectures it encounters and determine how best to port itself to the new architecture. In this case, the AI would almost certainly write binary code (or some kind of very low level intermediate language of its own design) in order to port itself to the new architecture.

So it makes more sense for your villain not to write his/her program in binary code, but instead to write a program that itself writes code, specifically binary code for any architecture it encounters.

Such a program would need to be very complex, as it would have to first find uninfected computers on the internet, probe them for vulnerabilities, and learn the architecture they're running in order to reformat itself to run on their architecture. Based on the definitions just given, it's clear such a program would, by necessity, be a learning algorithm, and such a program would also grow in size as it finds and infects new architectures and operating systems.

Answer 3

It's plausible. At least good enough for a sci-fi.

The answers and comments here already address why this is "impossible" by citing fundamental differences between computer architectures which would prevent the same binary code from being understood by different processors.

However, as it's usually the case in computer science, a lot of imagination and effort can take you a long way. In this paper the authors provide a mechanism for generating binary code that would run (and actually do the same thing, but the behaviors can also differ) on three very-different CPU architectures: x86, ARM and MIPS.

In short the idea boils down to: write normally a program that does what you want for each of the architectures. Then preppend a specially crafted series of bytes that would cause architecture X to jump to the beginning of the program written for X and all other architectures to ignore them (or do something that has irrelevant effects). After this section, do the same for architecture Y etc. for every one of them.

Whether such a thing is possible for all architectures currently in existence is probably an open question (personally, I know of no work that shows the opposite).

Answer 4

First just to be clear, binary and assembly is kind of the same. It's 1s and 0s, that give instructions to the cpu which in turns manipulates memory and other hardware of the machine. Assembly is just words, so you don't need to remember what 1101 means.

The problem is, the lower down you write the code, the harder it is to infect more systems, not easier. I mean in theory we could imagine some god level virus that could do it, but this virus would need to be aware of every hardware and software ever made.

Today when we write code, it's in a high level language. This code is then sometimes run just in time(java-script), or compiled into a mid level language (c#, Java). Then at run time these are turned to assembly/binary.

So let's say we talk about C#. When it is code it could be compiled for windows, for a mac, android, or apple. Once it's compiled though that flexibility is lost. Now if you made a DLL it will only run under windows.

Now when this code is run, it becomes assembly and binary moving memory around and calling cpu instructions. This is managed by the OS layer and drivers, letting you not worry if Intel or AMD made the cpu for this computer.

When you start with code in assembly, you have coded for a specific CPU. It is almost impossible for it to run on anything except the specific target. This is what programming in the 70s was like, and everyone was so happy to get C, where it could compile to multiple architectures.

So because of this if your virus was not god level or magical, and could not write itself a new version for any cpu it discovered, simple copies of it would not work on 99% of all computers.

Answer 5

No.

Different processors have different architectures and instruction sets. Binary code that runs in one architecture will usually be meaningless to others.

This is the reason why software meant to run in different architectures (like Android, GNU/Linux) have different binaries for every target architecture.

Other software that runs on top of a system or virtual machine (think Java) is more likely to run in many different devices, but less likely to be as damaging. For example, you can target the file system with Java and it should work in all major operating systems, but each system is likely to have their different, distinct vulnerabilities. You wouldn't find a common one.

Since you likely won't be able to target the tastier stuff in the file system universally, you may wish to try and crash machines by having them calculate PI to the last digit. Or make a profit by mining bitcoin. Or create a botnet. You might cause some slowdown on millions of computers, but it won't be universal.

If you want to do some real damage, the closest thing to universality nowadays is Javascript. Everybody browses the internet through their devices and most web developers nowadays are paid to get the job done with a focus on time to deliver, not quality or security. A vast number of sites reuse libraries from npm. Those libraries tend to form dependency hells, which is when the relationships between libraries get more promiscuous and entangled than middle age royalty family trees. So when a popular library has a security fault, every site who uses that library directly or indirectly is compromised, and may compromise some systems that access those sites. You may wish to think of that.

Or, for kicks, make a library that becomes very popular, then unpublish it. This happened in 2016 and caused chaos on thousands of projects. Good times...

But even if you manage to do that, still your damage won't be anywhere close to universal.

Answer 6

No

While many of the answers support a YES, I do not believe it would be possible. The thing is computers have progressed leaps and security has also progressed with this.

The first Hurdle your virus needs, is to get onto the target computer. This is hard. Almost every coporation will have basic security defenses in place that you will need to bypass. A firewall is the most fundamental one. Basically a Firewall will detect your incoming packet, make sure its wanted and then pass it onto a computer. This means if you target the wrong port or wrong IP address it will bounce back. With newer Firewalls, they will actively block all connections which were not made inside the firewall, scan the packets for viruses, executables and unknown files, confirm the IP address is real, etc, etc.

The next hurdle is getting your virus to be run on the computer. Unfortunately, just because a computer has received the packet, doesn't mean it will be run. And it also doesn't mean it will be run with ADMINISTRATOR Privliges. In this scenario, you will need to take advantage of a vulnerability to bypass the permissions system an operating system uses. This is where you run into huge issues. Every single operating system has a different set of vulnerabilities and your virus, coded in binary, will need to be able to attack each and every single one in a SMART way. Why SMART? because computers run Anti-Virus applications which will detect unusual activies and snuff your virus before it has a chance to do anything. So your binary coded virus will need to be able to address vulerabilties in:

• Win XP
• Win 7
• Win 8
• Win 8.1
• Win 10
• Linux
• Ubuntu
• Mac OS

This isn't a complete list, and if you expand the technical details, each subversion, update, feature pack, security update will Patch and introduce different vulnerabilities, so you would need to account for all of this just to ensure you could hit EVERY computer thats internet connected.

The final computer based hurdle is the hardware. You see, computers run on a range of different hardware which will process instructions differently. Your Windows machine and Linux machine might be similar, but that Server sitting in the AWS Cloud, running on IBM or Cisco hardware is a different beast.

Now we face our true final hurdle... Actually having someone write this all in Binary. You see, people don't usually code in binary and even less people will write complete applications with a Web Interface, a bunch of attacks on vulnerabilities in binary, and the ability to address different Operating systems and Hardware in Binary. Your talking about multiple specialist professions with 1000's of pages of documentation. Binary applications are also notoriously difficult to code in (specially direclty) and your application would need to be huge to ensure it can hit 100% of internet connected computers. (If you just wanted to say target, Microsoft XP, it would be much more believable and I believe similar scenarios have occursed in real life).

Answer 7

Yes

In fact there are visuses that do pass from one instruction set to another. The most famous was the ones designed to attack Iranian centrifuges. They passed from one computer to another through a variety of infection methods (USB, network), then found the controllers for centrifuges (fpgas if I remmeber right) and infected them. Now it acted different on different systems, but that is because it was designed to do so; the goal was to break the centrifuges, and spread on the conventional computers.

It being "in binary" is noise; all computer files are binary. You can interpret a file in various ways, but they are still binary. You can write a word doc file "in binary". Now, doing so without the help of tools is hard, but you said possible.

The first step is to discard the idea that a program is a specific executable. A program is a bunch of steps. The virus I imagine would run different executables on different architectures. Once it had infected a system, it would transfer a payload of how to infect other systems with different architectures.

The general way worms spread today is by probing systems to infect, fingerprinting what that system is running, then attempting remote penetration exploits that could work on the target architecture. Once they have some penetration, they fingerprint the system from the inside (more detail) and use exploits to upgrade their access (if needed), often patch the exploits they used to get in (they don't want to share), and either spread more or "call home" for instructions (join a hive).

More architectures just means more effort on the part of the worm maker. Worm makers are lazy; they just want a bunch of systems. So they find the lowest hanging fruit (common, low security systems that have what they want).

In the case of the crackers that wanted to attack the centrifuges, the centrifuges where isolated from the internet. So they had to create a package that could handle more than one target; one to spread as a worm, and one to damage as a payload.

---

Note, however, that the program being written "in binary" does not require that defeating it uses the same strategy. Something written "in binary" is like saying something is "hand crafted". If you have a hand crafted gun, a mass-manufactured suit of body armor can stop its bullets, and a mass-manufactured metal detector will get set off by it.

How you create something does not change what it is. All computer storage in this day and age is binary -- 0s and 1s -- so every executable, web page, script and document is "binary". They where almost all written using tools, because we have amazing tools to create files on a computer; compilers, text editors, IDEs, HTML editing suites, Typescript transpilers, office suites.

Someone manually fiddling bits (writing in binary; and how manual? Presumably he's using a tool) isn't producing anything fundamentally different than someone using tools to do the same.

Answer 8

Yes, it would.

I would consider the limitation to be the memory of the human writing the code. One of the smallest possible virusses is the Mini virus (see http://virus.wikidot.com/mini), which is only 13 bytes.

That's a mere 100 bits, which even a human could remember - and, arguably, piece together.

Now that's not a particularly effective virus nowadays, but given enough unpatched targets ( anyone still on XP in the year 2019?? ), it could have significant impact.

Now imagine a world where, for some reason, no-one has considered computer security at all. Say, a network built by scientists.

In such a scenario, the first to exploit this naivety might be able to infect "all the computers in the world".

I would suspect, though, the number of computers at that point should be rather small, as they spread, virusses would ( and have ) become more common place, as would countermeasures - making infecting all computers hard, let alone by a human typing in bytes...