4
$\begingroup$

In my world, there was a man that wrote a virus in binary code - which in turn infects every computer-based system in the world, as long as it is connected to the internet.

Is this even possible? Please be as detailed as you can, telling me why or why not it is possible.


Edit: assume that my world has technology just like today. What I'm asking is: even though it might be nearly impossible, is it possible to write a virus that can infect different hardware indiscriminately without needing to write a specialized virus for each kind of system?

My assumption was that because it was written in machine code with zeroes and ones, the only way to fight this virus would be to write another program that is an antivirus in machine code with zeroes and ones.

$\endgroup$
  • 3
    $\begingroup$ Computer viruses are just types of programs, and all computer programs are ultimately translated into machine code to be executed by the CPU, machine code is in binary. $\endgroup$ – Hypnosifl Sep 23 at 21:24
  • 20
    $\begingroup$ You could write it in binary but it wouldn't magically work on every computer-based system just because it was in binary. If your real question is whether binary code has some sort of universality property, the answer is no. $\endgroup$ – benrg Sep 23 at 21:29
  • 1
    $\begingroup$ @benrg, and I'm reminded that what we call Arabic numerals are what are used in non-Arabic countries. In Arabic countries different symbols are used. E.g. the digit "٦" represents six, not seven. Eastern Arabic numerals - Wikipedia $\endgroup$ – Ray Butterworth Sep 24 at 0:15
  • 2
    $\begingroup$ @jdunlop edited the question so "possible for a virus" was changed to "possible for a universally-executable virus"--overlord, can you comment on whether this accurately reflects the intent of your question? You did say that it "infects every computer-based system" but you didn't specify whether that's because in this science-fiction setting all computers happened to share the same machine language, or the virus was designed with a specific set of machine languages in mind, or because the virus will somehow work on all possible machine languages. $\endgroup$ – Hypnosifl Sep 24 at 0:59
  • 1
    $\begingroup$ Sorry, @overlord, but the edit actually made this question substantially more wrong. I can laboriously write an encryption program in assembly or machine code, and then write the decryption program in C#. The mechanism by which one enters instructions into a computer does not in any way limit how counter-instructions can be written. $\endgroup$ – jdunlop Sep 24 at 18:55
29
$\begingroup$

It would not be possible, because different CPU architectures have their own machine languages. Just because they all use binary doesn't mean they all have the same vocabulary or grammar. Think about it like this; just because someone who can read English will understand the sentence "The quick brown fox jumped over the lazy dog." doesn't mean someone who only knows French will understand it. Sure, the alphabet is the same, but the vocab and grammar aren't. Processors are the same way. A load instruction looks different on an x86 processor than it does on a MIPS processor.

$\endgroup$
  • 4
    $\begingroup$ This is the only correct answer so far. $\endgroup$ – Renan Sep 24 at 1:00
  • 11
    $\begingroup$ Even beyond the instruction set there are little things like endianness which mean that two different machines can't even agree on what a number looks like. $\endgroup$ – Starfish Prime Sep 24 at 8:48
  • 1
    $\begingroup$ I agree with your answer generally, but given enough knowhow, it is possible to write a virus that can infect everything known. The virus would have to have many 'packages' that it can dump on to the system once it knows the system it is trying to spread to. Each iteration carries a MIPS version and an x86 version. Stupidest case it can complete the x86 injection. If that fails, it attempts the MIPS injection, etc, until one sticks and reports back success. Then it loads on the other packages so that it can continue to spread to different machines. $\endgroup$ – Aetherfox Oct 3 at 13:25
  • 2
    $\begingroup$ @Aetherfox That's not a solution. How does it even start? I mean, the first line of code must be written for some specific architecture; what happens if the target happens to use something else? The first line never runs, and now it never dumps any of those packages. $\endgroup$ – Ryan_L Oct 3 at 15:43
  • 2
    $\begingroup$ @DrMcCleod I know that paper. That's a non-solution. Check section 6.3 page 10. "Note that the Figure shows a complete ELF file generated from our PI generator. In order to run on each architecture, we changed the one-byte ELF header of a CPUtype field to the appropriate value." So, not the same binary for every architecture. $\endgroup$ – Renan Oct 4 at 14:55
6
$\begingroup$

Absolutely, but the question is why?

All program code eventually becomes binary machine code. Writing in binary to begin with would just be an exercise in masochism.

Here's how programming generally works:

  1. The programmer writes code in a human-readable language, such as C++, Python, or Java, just to name a few.
  2. A computer program called a compiler takes this human-readable language, parses it, and turns it into machine code. This machine code is specific to the computer architecture executing it. Alternatively, instead of machine code, the code can be compiled into assembly. Assembly is, more or less, human readable machine code (it's slightly more complex than that).
  3. This optional assembly step is then converted into binary machine code.

The program's machine code is already in binary, and is generally known as a "binary executable." This binary code is highly specific to the CPU running it. Technically you can skip steps 1-3 and write the binary code directly, but this isn't very useful to do and just makes things harder for you as the programmer. Sometimes patches are done this way if you don't have the original source code and you want to "hack" an existing binary program, but you generally don't just go directly to binary.

Another issue is, since the closer you get to binary, the more machine-specific your program, it doesn't make as much sense to write a program (in your case, a virus) in binary, as it wouldn't be able to infect "every computer-based system" in the world. How many architectures a program can run on is known as portability, and in general the higher level language you use, the more portable your program.

For example, Java is meant to be very highly portable, however the way it accomplishes this is a bit of a cheat: It creates "virtual machines" that are implemented on the target hardware. This way, your java program can run on any machine that has a java virtual machine program on it.

Unfortunately, these virtual machines also tend to be relatively good security layers, in that they create a sort of "sandbox" for the programs they run. It's not impossible to escape this sandbox, and indeed a lot of security research goes into checking virtual machines for these types of escape exploits, but in general, the idea of writing a virus that can infect any machine connected to the internet is essentially reserved for fantasy. In fact, a large amount of time and money is spent just making programs that can run relatively painlessly across several architectures or operating systems. Life would be a lot easier if it were possible to simply write a program that can magically run anywhere.

Python, on the other hand, is "interpreted." This means that Python code itself [usually] isn't compiled into machine code, and instead is run through a program called an interpreter. This interpreter, as the name suggests, interprets the instructions in the Python program for the architecture running it. Interpreted languages tend to be slower due to this intermediate translation step, and, just like with Java, you have the problem of needing a new interpreter for each architecture you want to run your python script on.

This doesn't rule out scenarios involving artificial intelligence, however, as it is certainly conceivable to write an AI that is able to study all of the computer architectures it encounters and determine how best to port itself to the new architecture. In this case, the AI would almost certainly write binary code (or some kind of very low level intermediate language of its own design) in order to port itself to the new architecture.

So it makes more sense for your villain not to write his/her program in binary code, but instead to write a program that itself writes code, specifically binary code for any architecture it encounters.

Such a program would need to be very complex, as it would have to first find uninfected computers on the internet, probe them for vulnerabilities, and learn the architecture they're running in order to reformat itself to run on their architecture. Based on the definitions just given, it's clear such a program would, by necessity, be a learning algorithm, and such a program would also grow in size as it finds and infects new architectures and operating systems.

$\endgroup$
  • 1
    $\begingroup$ "Find uninfected computers on the internet": all right, possible and easy. "Probe them for vulnerabilities:" all right, possible, but the results may be extremely dissappointing. "And learn the architecture they're running:" ughhh, how on Earth could this be done, even conceptually? The entire point of the inter-computer communication protocols is to abstract the differences of architecture and operating system. $\endgroup$ – AlexP Sep 24 at 2:51
  • $\begingroup$ @AlexP It's possible if the system is totally vulnerable. If the target router is improperly configured, you can get administrator access to the network. From here, you may be able to change their DNS settings and feed them a fake site the next time they use the web. You use this fake site to install your malware, and hope their browser and anti-virus is as bad as their router. This is a wildly unlikely scenario, like one-in-a-million or less, so I don't think it counts for a "universal virus". But it might work on a handful of machines around the world. $\endgroup$ – Ryan_L Sep 24 at 3:26
  • $\begingroup$ @AlexP Data fuzzing. In most cases computer architectures will be similar, so start by trying a few known architectures and see what breaks. Feed it a stream of bytes, see what happens. Want to know endianness? Feed it a large number in little-endian, see if it comes back little-endian or if it winds up swapped. Want to know if it can execute your code? Exploit one of the vulnerabilities with a test program, see if that test returns success. It's difficult, but not impossible. Humans reverse engineer things all the time, so an AI virus could definitely do it too. $\endgroup$ – stix Sep 24 at 14:56
4
$\begingroup$

First just to be clear, binary and assembly is kind of the same. It's 1s and 0s, that give instructions to the cpu which in turns manipulates memory and other hardware of the machine. Assembly is just words, so you don't need to remember what 1101 means.

The problem is, the lower down you write the code, the harder it is to infect more systems, not easier. I mean in theory we could imagine some god level virus that could do it, but this virus would need to be aware of every hardware and software ever made.

Today when we write code, it's in a high level language. This code is then sometimes run just in time(java-script), or compiled into a mid level language (c#, Java). Then at run time these are turned to assembly/binary.

So let's say we talk about C#. When it is code it could be compiled for windows, for a mac, android, or apple. Once it's compiled though that flexibility is lost. Now if you made a DLL it will only run under windows.

Now when this code is run, it becomes assembly and binary moving memory around and calling cpu instructions. This is managed by the OS layer and drivers, letting you not worry if Intel or AMD made the cpu for this computer.

When you start with code in assembly, you have coded for a specific CPU. It is almost impossible for it to run on anything except the specific target. This is what programming in the 70s was like, and everyone was so happy to get C, where it could compile to multiple architectures.

So because of this if your virus was not god level or magical, and could not write itself a new version for any cpu it discovered, simple copies of it would not work on 99% of all computers.

$\endgroup$
  • 1
    $\begingroup$ No, binary and assembly are not the same (not even kind of). You can compare "binary" to "written on paper", it's completely orthogonal to almost anything people are interested in, including assembly. $\endgroup$ – Jasper Oct 4 at 8:54
  • $\begingroup$ @Jasper Let me try to explain this. The difference between assembly and other programming languages is that instead of writing an abstract language every command is a specific instruction to the CPU. Also every command to the cpu is a specific set of binary. Therefore assembly directly converts to binary 1 to 1 in no ambiguous way. More importantly h binary can be converted back to assembly $\endgroup$ – Andrey Oct 4 at 13:50
  • 1
    $\begingroup$ I'm a software developer and I do know about all this, I was actually saying that I disagree with what you are saying. For example, you cannot convert assembly to binary. Binary is a way you can represent machine code. (There is a conversion between assembly and machine code, which you might be talking about.) Binary is also a way you can represent numbers. Binary is also a way to represent text (using an encoding like ascii). Binary is not like assembly because it is the way we store information (just like written on paper" is a way to store information). $\endgroup$ – Jasper Oct 6 at 12:15
4
$\begingroup$

It's plausible. At least good enough for a sci-fi.

The answers and comments here already address why this is "impossible" by citing fundamental differences between computer architectures which would prevent the same binary code from being understood by different processors.

However, as it's usually the case in computer science, a lot of imagination and effort can take you a long way. In this paper the authors provide a mechanism for generating binary code that would run (and actually do the same thing, but the behaviors can also differ) on three very-different CPU architectures: x86, ARM and MIPS.

In short the idea boils down to: write normally a program that does what you want for each of the architectures. Then preppend a specially crafted series of bytes that would cause architecture X to jump to the beginning of the program written for X and all other architectures to ignore them (or do something that has irrelevant effects). After this section, do the same for architecture Y etc. for every one of them.

Picture from paper

Whether such a thing is possible for all architectures currently in existence is probably an open question (personally, I know of no work that shows the opposite).

$\endgroup$
  • $\begingroup$ +1 for answering the question and providing a real world example. $\endgroup$ – DrMcCleod Oct 4 at 14:39
  • $\begingroup$ I know that paper. That's a non-solution. Check section 6.3, page 10. "Note that the Figure shows a complete ELF file generated from our PI generator. In order to run on each architecture, we changed the one-byte ELF header of a CPUtype field to the appropriate value." So, not the same binary for every architecture. Also it behaves differently on each architecture. $\endgroup$ – Renan Oct 9 at 18:13
  • $\begingroup$ @Renan That's irrelevant. If OP is interested in the same file running everywhere, then the answer is trivially "no" because not all OSs support the same executable formats. Notice how OP's question doesn't mention that, only the more generic "code". $\endgroup$ – potestasity Oct 10 at 13:55
0
$\begingroup$

No

While many of the answers support a YES, I do not believe it would be possible. The thing is computers have progressed leaps and security has also progressed with this.

The first Hurdle your virus needs, is to get onto the target computer. This is hard. Almost every coporation will have basic security defenses in place that you will need to bypass. A firewall is the most fundamental one. Basically a Firewall will detect your incoming packet, make sure its wanted and then pass it onto a computer. This means if you target the wrong port or wrong IP address it will bounce back. With newer Firewalls, they will actively block all connections which were not made inside the firewall, scan the packets for viruses, executables and unknown files, confirm the IP address is real, etc, etc.

The next hurdle is getting your virus to be run on the computer. Unfortunately, just because a computer has received the packet, doesn't mean it will be run. And it also doesn't mean it will be run with ADMINISTRATOR Privliges. In this scenario, you will need to take advantage of a vulnerability to bypass the permissions system an operating system uses. This is where you run into huge issues. Every single operating system has a different set of vulnerabilities and your virus, coded in binary, will need to be able to attack each and every single one in a SMART way. Why SMART? because computers run Anti-Virus applications which will detect unusual activies and snuff your virus before it has a chance to do anything. So your binary coded virus will need to be able to address vulerabilties in:

  • Win XP
  • Win 7
  • Win 8
  • Win 8.1
  • Win 10
  • Linux
  • Ubuntu
  • Mac OS

This isn't a complete list, and if you expand the technical details, each subversion, update, feature pack, security update will Patch and introduce different vulnerabilities, so you would need to account for all of this just to ensure you could hit EVERY computer thats internet connected.

The final computer based hurdle is the hardware. You see, computers run on a range of different hardware which will process instructions differently. Your Windows machine and Linux machine might be similar, but that Server sitting in the AWS Cloud, running on IBM or Cisco hardware is a different beast.

Now we face our true final hurdle... Actually having someone write this all in Binary. You see, people don't usually code in binary and even less people will write complete applications with a Web Interface, a bunch of attacks on vulnerabilities in binary, and the ability to address different Operating systems and Hardware in Binary. Your talking about multiple specialist professions with 1000's of pages of documentation. Binary applications are also notoriously difficult to code in (specially direclty) and your application would need to be huge to ensure it can hit 100% of internet connected computers. (If you just wanted to say target, Microsoft XP, it would be much more believable and I believe similar scenarios have occursed in real life).

$\endgroup$
0
$\begingroup$

No.

Different processors have different architectures and instruction sets. Binary code that runs in one architecture will usually be meaningless to others.

This is the reason why software meant to run in different architectures (like Android, GNU/Linux) have different binaries for every target architecture.

Other software that runs on top of a system or virtual machine (think Java) is more likely to run in many different devices, but less likely to be as damaging. For example, you can target the file system with Java and it should work in all major operating systems, but each system is likely to have their different, distinct vulnerabilities. You wouldn't find a common one.

Since you likely won't be able to target the tastier stuff in the file system universally, you may wish to try and crash machines by having them calculate PI to the last digit. Or make a profit by mining bitcoin. Or create a botnet. You might cause some slowdown on millions of computers, but it won't be universal.

If you want to do some real damage, the closest thing to universality nowadays is Javascript. Everybody browses the internet through their devices and most web developers nowadays are paid to get the job done with a focus on time to deliver, not quality or security. A vast number of sites reuse libraries from npm. Those libraries tend to form dependency hells, which is when the relationships between libraries get more promiscuous and entangled than middle age royalty family trees. So when a popular library has a security fault, every site who uses that library directly or indirectly is compromised, and may compromise some systems that access those sites. You may wish to think of that.

Or, for kicks, make a library that becomes very popular, then unpublish it. This happened in 2016 and caused chaos on thousands of projects. Good times...

But even if you manage to do that, still your damage won't be anywhere close to universal.

$\endgroup$
0
$\begingroup$

Yes

In fact there are visuses that do pass from one instruction set to another. The most famous was the ones designed to attack Iranian centrifuges. They passed from one computer to another through a variety of infection methods (USB, network), then found the controllers for centrifuges (fpgas if I remmeber right) and infected them. Now it acted different on different systems, but that is because it was designed to do so; the goal was to break the centrifuges, and spread on the conventional computers.

It being "in binary" is noise; all computer files are binary. You can interpret a file in various ways, but they are still binary. You can write a word doc file "in binary". Now, doing so without the help of tools is hard, but you said possible.

The first step is to discard the idea that a program is a specific executable. A program is a bunch of steps. The virus I imagine would run different executables on different architectures. Once it had infected a system, it would transfer a payload of how to infect other systems with different architectures.

The general way worms spread today is by probing systems to infect, fingerprinting what that system is running, then attempting remote penetration exploits that could work on the target architecture. Once they have some penetration, they fingerprint the system from the inside (more detail) and use exploits to upgrade their access (if needed), often patch the exploits they used to get in (they don't want to share), and either spread more or "call home" for instructions (join a hive).

More architectures just means more effort on the part of the worm maker. Worm makers are lazy; they just want a bunch of systems. So they find the lowest hanging fruit (common, low security systems that have what they want).

In the case of the crackers that wanted to attack the centrifuges, the centrifuges where isolated from the internet. So they had to create a package that could handle more than one target; one to spread as a worm, and one to damage as a payload.


Note, however, that the program being written "in binary" does not require that defeating it uses the same strategy. Something written "in binary" is like saying something is "hand crafted". If you have a hand crafted gun, a mass-manufactured suit of body armor can stop its bullets, and a mass-manufactured metal detector will get set off by it.

How you create something does not change what it is. All computer storage in this day and age is binary -- 0s and 1s -- so every executable, web page, script and document is "binary". They where almost all written using tools, because we have amazing tools to create files on a computer; compilers, text editors, IDEs, HTML editing suites, Typescript transpilers, office suites.

Someone manually fiddling bits (writing in binary; and how manual? Presumably he's using a tool) isn't producing anything fundamentally different than someone using tools to do the same.

$\endgroup$
-2
$\begingroup$

Yes, it would.

I would consider the limitation to be the memory of the human writing the code. One of the smallest possible virusses is the Mini virus (see http://virus.wikidot.com/mini), which is only 13 bytes.

That's a mere 100 bits, which even a human could remember - and, arguably, piece together.

Now that's not a particularly effective virus nowadays, but given enough unpatched targets ( anyone still on XP in the year 2019?? ), it could have significant impact.

Now imagine a world where, for some reason, no-one has considered computer security at all. Say, a network built by scientists.

In such a scenario, the first to exploit this naivety might be able to infect "all the computers in the world".

I would suspect, though, the number of computers at that point should be rather small, as they spread, virusses would ( and have ) become more common place, as would countermeasures - making infecting all computers hard, let alone by a human typing in bytes...

$\endgroup$
  • 1
    $\begingroup$ You really threw scientists under the bus as computer security failures when there are senior managers at IBM who use "123456" as their password and authors who use "trustno1"? $\endgroup$ – Dubukay Sep 23 at 22:02
  • $\begingroup$ Have you ever seen code produced by scientists? $\endgroup$ – bytepusher Sep 23 at 22:09
  • 1
    $\begingroup$ I'm going to assume you don't mean computer scientists. You know, those folks who built them from scratch? $\endgroup$ – Dubukay Sep 23 at 22:13
  • $\begingroup$ Look, I said "say, scientists". Because: they write code, they are interested in networking computers, and, unlike for example the military, would not be too interested in security, making this a feasible scenario. If you come up with a good scenario why and how a bunch of managers develop a computer network, go ahead and write your own answer. $\endgroup$ – bytepusher Sep 23 at 22:19
  • 2
    $\begingroup$ Tim Berners-Lee was a scientist (as were most of the other people using ARPANET) who is credited as creating the WWW. So I would call a "world where a network is built by scientists" to be this world. $\endgroup$ – LinkBerest Sep 25 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.