Fred Cohen

Background

Fred Cohen was born in 1956. He earned a B.S. in electrical engineering from Carnegie-Mellon University in 1977 and a master's degree from the University of Pittsburgh in 1980. He went on to doctoral study at the University of Southern California, where he completed a Ph.D. in 1986 with a dissertation on computer viruses supervised in the orbit of the cryptographer Leonard Adleman, one of the co-inventors of the RSA cryptosystem.

Self-replicating programs were not a new idea when Cohen arrived at USC. Theoretical work on self-reproducing automata dated back to John von Neumann, and experimental self-propagating code such as the Xerox PARC worm programs had already been built. What had not been done was to define the phenomenon formally, prove results about it, and test it against real multi-user systems under controlled conditions.

The 1983 experiments

According to Cohen's own account in his 1984 paper, the first virus was conceived on 3 November 1983 as an experiment to be presented at a weekly seminar on computer security at USC. Cohen introduced the concept in that seminar, and the name virus for the class of programs was, by his account, suggested by Leonard Adleman. After roughly eight hours of work on a heavily loaded VAX 11/750 running Unix, a working virus was ready. Permission was obtained within a week, five experiments were performed, and the virus was demonstrated to the seminar on 10 November 1983.

The infection was implanted in vd, a program that displayed Unix file structures graphically, and announced to users through the system bulletin board. Cohen reported that in each of the five attacks all system rights were granted to the attacker in under an hour; the fastest takeover took under five minutes and the average under thirty. Individual infections completed in under half a second, so users noticed no delay. All infections were performed manually, traces were built in so the code could not spread undetected, no damage was done beyond reporting, and files were disinfected afterwards.

The reception was not entirely welcoming. Cohen wrote that once the results were announced, administrators decided no further computer security experiments would be permitted on their system, a ban that also blocked planned work on virus-tracking traces and password augmentation. Prototype attacks were nevertheless developed for Tops-20, VM/370 and VMS systems to show the technique was not specific to Unix.

Formal theory

Cohen's contribution was as much mathematical as experimental. His paper "Computer Viruses – Theory and Experiments", presented in 1984 and republished in the journal Computers & Security in 1987 (volume 6, issue 1, pages 22–35), gave a formal definition of a virus as a program that can infect other programs by modifying them to include a possibly evolved copy of itself. From that definition he derived undecidability results, showing by reduction to the halting problem that no single algorithm can perfectly detect all possible viruses. That result underpins the practical reality that antivirus products rely on signatures, heuristics and behavioural monitoring rather than on a general decision procedure.

He also described the compression virus, a benign construction that shrinks the programs it infects rather than damaging them, which he used to argue that virus behaviour is not inherently malicious and that the security problem is one of uncontrolled information flow and transitive trust rather than of hostile intent alone.

Later work

Through the late 1980s and 1990s Cohen published extensively in Computers & Security on defences rather than attacks, including papers on the implications of computer viruses and methods of defense (1988), models of practical defenses against computer viruses (1989), a cost analysis of typical computer viruses and defenses (1991), defense-in-depth against computer viruses (1992), and a formal definition of computer worms (1992). He also worked on integrity protection, cryptographic checksums and partially ordered protection models for information networks.

In the late 1990s he became an early advocate of deception as a defensive technique, releasing the Deception Toolkit, software that presents attackers with responses simulating vulnerable services in order to waste their time and reveal their probing. He later led a research team at Sandia National Laboratories and founded its College Cyber Defenders program, a precursor to the federal CyberCorps scholarship effort, and worked as a consultant, expert witness and industry analyst through Fred Cohen & Associates and Management Analytics. He states that he received the international Information Technology Award in 1989 for work on integrity protection and the Techno-Security Industry Professional of the Year award in 2002.

Significance

Cohen's work fixed the vocabulary and the theoretical frame for an entire sub-discipline. Before 1983 self-replicating code was a curiosity discussed in scattered papers and science fiction; after his experiments and their formalisation, the computer virus was a defined object with proven properties and measurable behaviour. The undecidability result in particular set the permanent boundary conditions for the antivirus industry that emerged a few years later, and his insistence on controlled, consented experimentation with disinfection afterwards became an early reference point for research ethics in offensive security work.

Timeline

• 1956Born in the United States.
• 1977Earned a B.S. in electrical engineering from Carnegie-Mellon University.
• 1980Earned a master's degree from the University of Pittsburgh.
• 1983-11-03Conceived the first virus as an experiment for a weekly computer security seminar at USC; Leonard Adleman suggested the name virus.
• 1983-11-10Demonstrated the working virus to the USC security seminar after five authorised experiments on a VAX 11/750 running Unix.
• 1984Published Computer Viruses - Theory and Experiments, giving the first formal definition of a computer virus.
• 1986Completed a Ph.D. at the University of Southern California.
• 1987Computer viruses: Theory and experiments appeared in Computers & Security 6(1), pages 22-35, including the result that perfect virus detection is undecidable.
• 1988Published On the implications of computer viruses and methods of defense in Computers & Security 7(2).
• 1989Published Models of practical defenses against computer viruses; states he received the international Information Technology Award for work on integrity protection.
• 1992Published A formal definition of computer worms and some related results in Computers & Security 11(7).
• 1998Released the Deception Toolkit, software that simulates vulnerable services to detect and delay attackers.
• 2002Named Techno-Security Industry Professional of the Year.