Traces of Worms May 1990

I recently read an article in "Byte" about the next generation of the Inmos Transputer, which describes a technique for switching data packets around a network of nodes, known as "Wormhole Routing". In this method, the packet contains a header which specifies the destination address, and a trailer which indicates the end of the packet. This is fairly standard for any packet switching system, but the method of switching the packet is the aspect which attracts the "wormhole" description. At a routing node, the header is stripped off and read, and the onward routing is set up before the rest of the packet arrives. The contents of the packet are then routed through to the next node, until the trailer is detected. The routing path is then closed up, leaving as it were, no trace of the packet or the path it took. This is said to be suggestive of the way a worm burrows through the soil without leaving an open path behind it.

I was struck be the simile, and started musing on aspects of other general systems in which the players also exhibit the trait of removing their own traces. I had also been reading William Gibson's excellent Sci Fi book "Neuromancer": an example of a genre which has been tagged "cyber punk". In this work, set in the moderately distant future, some of the characters visit a pseudo "cyberspace" world known as the matrix, using computer like devices to tap in to it. The world of the matrix contains abstract constructs, and valuable data bases which are protected by various screens.

If you think this scenario is far fetched, you should be aware that there are several ongoing efforts to construct what is known as "virtual reality". Computer graphics have advanced so far in the last few years that computer constructed pictures can be amazingly life like. Now, with a variety of sensing devices such as goggles and gloves, a person can enter a computer constructed world, view it as he walks around it, and be visible to external observers, or to other computer controlled "visitors". So far, the visitors cannot actually feel the objects in the pseudo world, but they are working on it.

In Neuromancer, the matrix is plagued by "cowboys" who attempt to cut through the protection mechanisms, and one of the key attributes of the successful cowboy is to be able to cover up his traces, so that it looks as if he has never been there.

This trick, of course, was well known to the cowboys of the wild west when they were being tracked by the baddies - I'm sure we all remember scenes of the hunted removing hoof prints with branches, and wading up streams to confuse the pursuers. Even before the cowboys, animals as cunning as the fox were using similar doubling back tricks to shake off their hungry predators. This is an example of the rule which says that for every technique developed by intelligent man, evolution has beaten him to it.

We do not need to look to the future for computer Worms and Viruses, some of which already attempt to cover up their traces by renaming (parts of) themselves to look like harmless well known system programs. Other tricks employed by computer viruses include attaching themselves to the end of a normal program file so that they are invisible to casual inspection, and deleting any residues of their activities.

The human immune system can also be fooled by "real" viruses which mask their own identity in a variety of ways. For instance, the HIV virus (in common with other retroviruses) manages to lurk undetected by the immune system by integrating viral DNA into the host cell DNA. The original viral RNA is destroyed in the process of being transferred into DNA - once again, the traces are removed. Actually, this is simplifying a very complex subject. Cells infected by HIV exhibit an envelope protein called gp120 which should signal them to be attacked by the immune system. There are several possible reasons why this is not effective. Perhaps the cloud of sugar molecules surrounding gp120 screens it from attack, maybe it has "decoy" elements within it, or ongoing mutations confuse the immune system. Another possibility is that gp120 which leaks from infected cells attaches itself to healthy cells and so causes an auto-immune reaction. This is a fine example of "problem inversion" - if you are marked down for attack, don't try and remove the mark, just make sure everyone else is marked as well.

The world of espionage provides numerous examples of the lengths people will go to in order to cover up their traces - in "Spycatcher" Peter Wright details how much effort was expended in gluing back together a one-time code pad so that it looked as though it had not been tampered with. The traces of the original glue were chemically analysed so that a glue with similar colour and smell could be synthesised and used to bind together the carefully separated pages.

It has to be said that there is often something suspicious about any agent that spends much time and cost (in the general sense) in covering his traces - what has he got to hide? And indeed, the criminal fraternity are also well versed in the art of subterfuge, particularly that character often portrayed in fiction and Television - the con man. The clinching ploy in "The Sting" was, not only to relieve the victim of a large sum of money, but to do so in such a way that he believed it was impossible to strike back. This is a more subtle form of the mechanism I am talking about, here the traces are not actually removed, or even camouflaged, but "protected" in some sense, so that anyone attempting to follow the traces is prevented or inhibited from doing so.

Another example of the criminal tendency to cover traces is in the case of financial fraud. Here a variety of tricks are used with subterfuge accounts and transactions, but perhaps the cleverest is the way in which multiple holding companies are set up to create a chain of financial transfers, often in several different countries. Once again the pursued is making use of the natural environment to hide his traces - here the difficulty of tracing transactions across international borders is part of the financial environment that is being utilised.

Where there is attack, there is also defence, and lo and behold both of these activities feature strongly in wartime and in peace time defence systems. Electronic defence systems evolved a method of telling the good guys from the baddies by sending messages which trigger auto responding call signs from the "home team". This mechanism was immediately subject to trickery by the baddies pretending to be goodies by imitating their call signs.

This example is again a slightly different mechanism, this is disguise, where an agent of some kind pretends to be other than he is. Camouflage is a similar mechanism, where the agent attempts to completely hide himself by some form of cloaking or screening method, rather than just removing his traces. Of course, all these techniques are often used together, and Nature has long been a user of both camouflage and disguise, the examples being almost too well known and numerous to mention. The stick insect is a perfect example of the cloaking type, where the animal is hidden amongst the background. A nice form of disguise is used by several insects and snakes which copy the "danger" signals of poisonous varieties - bright colours, banded black and yellow, to pretend to be dangerous when in fact they are harmless.

All of which brings us back to the worm, which after all is harmless - isn't it ?