What were the incentives behind WinWord.Concept computer virus?

Question

I've just read this passage on the October 1995 issue of Virus Bulletin:

WinWord.Concept

The WinWord.Concept virus reported in last month’s Virus Bulletin has been found on at least one CD-ROM. Shortly after the journal’s September edition went to print, VB acquired a CD entitled Snap-On Tools for the Windows NT Professional from a UK company called ServerWare. The CD contains documents infected with WinWord.Concept.

It was shipped at the end of September to more than five and a half thousand Windows NT users. The infected documents on the CD-ROM are: custom~1.50\c1prod2.doc, html\netman.doc, intergra\intergra.doc, serverwr\ashwin.doc, serverwr\octopus.doc, serverwr\octposit.doc and serverwr\winport.doc.

Considering all the incentives available to cybercriminals today, I understand people putting some effort to infect computers. But why would someone send thousand of physical CD-ROMs with a virus back in 1995? Especially a virus which does nothing at all.

This also brings some sub-questions:

1. Around 1995, was it common for viruses to be spread by shipping CD-ROMs to victims?
2. Wouldn't it be too expensive? Apart from the cost of the blank CDs and shipping, I guess the recorder would be a very expensive piece of equipment back then.

Answer 1

I mean no offense to OP, but the question is an anachronism for two reasons that are likely not obvious to typical computer users today:

1. Prior to ubiquitous wide-area networking of personal computers, removable media was the main way that viruses spread site-to-site. LAN's were becoming commonplace in 1995, but most did not stretch beyond the building.
2. Viruses were mainly spread innocently by users sharing infected files (generally, on removable media) with other trusted individuals, not by malicious actors exploiting a centralized trusted server, like today.

Because this was a common occurrence in 1995, reading that passage at the time would not invoke surprise. You'd simply assume that the CD-ROM publisher was a victim themselves, and unknowingly spread the infected media.

If this virus had been well-known, and easily detected by virus scans at the time, then you could say the CD-ROM publisher did a poor job of vetting their product- perhaps, even accuse them of negligence. However, I'd suspect this was not the case. A well-known virus would be quickly detected by some of the users, and the vendor alerted to it, thus minimizing the impact.

Answer 2

Adding to the existing answer, I remember reading about the circumstances at the time. No anti-virus software looked for Word macro viruses at that point, and the creators of the CD believed they'd done due diligence before sending it out.

Once macro viruses became known, anti-virus software was rapidly upgraded to cope with them, In late 1995, I helped my manager's manager clean an infection off his machine. Dr Solomon's Anti-Virus was racing through his documents cleaning them up, when he noticed that it was dealing with encrypted documents and claiming to clean them. I raised it with Dr Solomon's support, and got the response:

"That was Word 95? The encryption isn't much good. We just brute-force it, and that doesn't slow things down noticeably."

Answer 3

The important part to know about Concept is that it was a self-replicating virus:

When an infected document is opened, Concept [...] copies its macros to the template [NORMAL.DOT]. [...] Once NORMAL.DOT has been infected, any file created using "Save As" will be infected with the virus.

So once a user opens an infected document, any document they create will also contain the virus. Which is why legitimate organizations accidentally send out the virus on CD (as described in Brians answer).

As for incentives to create the virus: There were no financial or similar incentives. As the name suggests, it's just a proof of concept to show that it can be done.

As the author notes in their payload:

That's enough to prove my point

Though the fact that it was a "noisy" virus (showing an alert box) might suggest that it was created to draw attention to the issue of macro viruses, so that relevant parties can start protecting against actually harmful ones.

Answer 4

I believe the motive was just to show it could be done. The following is all just by memory from news coverage at the time: There was a text string in the code somewhere saying something like "That should be enough to make the point." It was done by an individual, who did not keep his identity a secret (but I don't recall his name or anything). He just put it on some hard drives and it spread from there, eventually (as others have said) contaminating ServerWare's software.

A good source for this would be the New York Times from that era, but it would require some searching.

Answer 5

Hacking and hackers used to have different definitions. It used to be about breaking technological boundaries, gaining computer science, and doing ever-increasingly impressive feats, sometimes destructive for the sake of being destructive. Hackers in the 1980's and 1990's were generally not interested in credit card numbers or stealing money, but rather clout and "freeing" information ("data theft"). Just check out all the movies from the 90s, like Hackers and Takedown. Remember the stories of phreaking and other "victimless" crimes (corporations were often not considered "victims"). Hacking wasn't usually done for personal financial gain, just clout.

Historically, viruses would infect the boot sectors of floppy drives so it could further infect more systems if the floppy was left in the drive on bootup. They would spread over insecure network protocols to prove that those protocols were insecure. They would use system libraries and installed programs to demonstrate vulnerabilities in Flash, JPEG, or other file formats. The fact that the virus ended up on CDs was probably completely unintentional. Even as late as a few years ago, the Blue Pill hypervisor virus proved it was possible to make a virus that could hide underneath the OS, making it effectively impossible to remove while it was running.

So, to understand why this virus did "nothing," all you have to do is put yourself in the mindset of a 1990's era hacker. You had all this technology in front of you. You had no idea how it worked, but you wanted to know. You'd try all kinds of scientific experiments. Some of those experiments would have unintended side effects. For example, a virus that "accidentally" infected an insecure computer that was responsible for storing the data to be used on a CD. The purpose wasn't harm, or theft, but simply curiosity. This virus did exactly what it set out to do: prove that a system was insecure. That's not "nothing."

Nobody would have sent out CDs that just had a virus on them with nothing else. That wouldn't be how a hacker would operate. They would, however, infect a data server so that a virus could be spread to other systems, just to prove that it could be done. Many such viruses were about demonstrating vulnerabilities, and thanks to those viruses, we have robust antivirus software, many advancements in computer security at the hardware level, even to the point of encrypting an OS in memory so the hypervisor cannot read the memory, and so on. If it were not for these viruses, cybercriminals would have had a much easier time over the past few decades than they have.