A University Professor’s ‘Startling’ Experiments Began It All
Fred Cohen remembers his first computer virus like other men remember their first girlfriend. There was that mixture of both passion and torment.
He was a 27-year-old doctoral candidate at the University of Southern California when he decided to write his thesis on computer viruses five years ago.
“But we thought perhaps this was a will-o’-the-wisp,” recalled Irvin Reed, a USC professor of electrical engineering and computer science who was one of Cohen’s advisers. “And we demanded that he develop it for a PC computer.”
On Nov. 3, 1983, Cohen created the first computer virus in a controlled experiment.
And then he became terrified.
“The experiments were so startling that I wanted to do more,” said Cohen, now an assistant professor of electrical and computer engineering at the University of Cincinnati.
‘You Get Real Afraid’
“But what happens to most people who do this experiment, and it happened to me, too, is that as soon as you try one, all of a sudden you get real afraid to try another.”
A year later, he went public with his research, which showed that it was possible to write a computer virus--and not very difficult to do at that. “There’s no question in terms of scientific literature that I’m the first person to publish on it,” Cohen said.
“As a cynic might say, the first one to publish on it or to capitalize on it?” remarked Terry Gray, a former UCLA faculty member who studied viruses. “But actually, the community owes quite a bit to Fred for focusing on this problem and bringing it to people’s attention.”
The Oakridge, Tenn.-born son of two nuclear physicists, Cohen began using computers at age 13. By the time he was ready to enter college, he was already a “genius computer hacker,” according to colleagues.
After receiving a B.S. in electrical engineering from Carnegie-Mellon University in 1977, and an M.S. in information science from the University of Pittsburgh in 1981, Cohen arrived at USC to work on his Ph.D. He became intrigued by the theoretical work on computer viruses by USC’s Leonard Adelman, a professor in electrical engineering and computer science.
“You might say the father of the computer virus is Leonard Adelman, and Fred Cohen was his most earnest disciple,” Reed said.
Cohen’s virus program stunned the department faculty. “It worked. It was for real,” Reed said. “It actually multiplied and gobbled up all the memory space of the computer.”
Said Cohen: “I was aware of the ramifications, so I was extremely careful (to construct a virus) to be traceable and to be sure it didn’t spread outside the system I was on.”
Immediately, Cohen became alarmed about the potential threat to computer security. “He didn’t even want to tell us all the things he thought he could do with it,” Reed said. “He was worried about people actually using them.”
Cohen publicly sounded the alarm about the viruses at two conferences on computer security in 1984. And in his doctoral thesis, he drew the following conclusion: “Viral attacks appear to be easy to develop in a very short time. They can be designed to leave few if any traces in most current systems, are effective against modern security policies for multilevel usage, and require only minimal expertise to implement.
“Their potential threat is severe.”
However, other computer experts were slow to respond. “It was something most people scoffed at because it was primarily theoretical,” noted Harold Highland, editor in chief of Computers & Security, an official journal of the International Federation for Information Processing. “People felt if they were going to spend time and effort on something, let it be on something that’s real.”
After receiving his Ph.D. from USC in 1986, Cohen went to teach at Lehigh University in Bethlehem, Pa.--ironically, the site of a computer viral outbreak shortly after he departed for the University of Cincinnati.
Probably no one is more aware of the science-fiction nature of the computer virus than Cohen. In fact, he wrote a novel about it “that was terrible,” he confessed.
“The basic story was that the United States pays this guy to put a computer virus into the Soviet computers. Then the Soviets take him to the Soviet Union and try to beat it out of him. When he gets back to the U.S., he finds the Americans aren’t good to him either. So he puts it in the U.S. system and eventually takes over the world.”
