Than Digital Dirt: Preserving Malware in Archives, Museums, and Libraries
Total Page：16
File Type：pdf, Size：1020Kb
More Than Digital Dirt: Preserving Malware in Archives, Museums, and Libraries by Jonathan Farbowitz A thesis submitted in partial fulfillment of the requirements for the degree of Master of Arts Moving Image Archiving and Preservation Program Department of Cinema Studies New York University May 2016 1 Table of Contents Chapter 1: Why Collect Malware? 2 Chapter 2: A Brief History of Malware 29 Chapter 3: A Series of Inaccurate Analogies 54 Chapter 4: A Gap in Institutional Practice 60 Chapter 5: Malware Preservation Strategies and Challenges 73 Chapter 6: Metadata for Malware 100 Chapter 7: Proof of Concept — Providing Access to Malware 109 Chapter 8: Risk Assessment Considerations for Storage and Access 119 Chapter 9: Further Questions and Research 130 Acknowledgements 135 Sources Consulted 136 2 Chapter 1: Why Collect Malware?1 Computer viruses are almost as old as personal computers themselves, and their evolution was only hastened by the birth of the internet. Within each code is a story about its author, about the time it was written, and about the state of computing when it wrought havoc upon our hard drives. —Attila Nagy, “14 Infamous Computer Virus Snippets That Trace a History of Havoc” I want to talk about the problem of ensuring that this new medium will have a history, one that future scholars can write about critically. —Henry Lowood, “Shall We Play a Game” This project discusses a multitude of concerns and challenges in the collection, preservation, and exhibition of malware and malware-infected digital artefacts for historical and cultural study. Malware is much more than a curiosity or an annoyance to be dispensed with and this thesis will reveal many of the narratives that malware presents in the history of computing and the internet. Despite (or perhaps because of) its ubiquity online and on individual computers, malware has been largely ignored as a potential collection item within libraries, archives, and museums. Critically, this thesis seeks to develop a more nuanced discussion about how cultural heritage institutions should regard malware. These institutions must understand how malware infections affect their workflows for processing born-digital artefacts like hard drives and floppy disks. In addition, some cultural heritage institutions ought to view malware as a potential collection item. While Henry Lowood’s statement above refers to the preservation of video games, along similar lines, I want to ensure that the medium of malware “will have a history.” 1 Portions of this thesis have been adapted from my previous paper, Preserving Malware: A Case Study of the WANK Worm. 3 This work serves as a preliminary blueprint for future research and analysis, and should not be taken as conclusive on the topics of malware collecting or best practices for malware preservation. My research focuses predominantly on computer worms and viruses; however, I will discuss other kinds of malware, including backdoors, ransomware, and spyware where relevant. A cultural heritage institution intentionally collecting and preserving malware could provide immense benefits to scholars in the humanities and sciences as well as the public at large. However, in my research, I have not yet encountered a cultural heritage institution in the United States that is committed to systematically collecting and preserving a historical sample of viruses, worms, or any other kind of malware. Computer and technology museums range from not collecting any malware at all, to just beginning to address the idea.2 Through their exhibitions and collections, technology museums and other institutions that host exhibits on the history of computing tend to present a narrative of linear progress in the development of software and other digital technologies. These narratives often lionize individuals, software companies, or hardware manufacturers. However, these institutions could present the full spectrum of how technology is used and exploited by people throughout the world, particularly in ways unintended by hardware or software companies—they could make 2 Chris Avram, “Re: Research on Malware,” March 2, 2015. While the Computer History Museum in Mountain View, California has several editions of antivirus software in its collection, the only born-digital malware artefact listed in its public catalog is an original disk that contains the source code for the Morris Worm (1988). However, the museum has books as well as video documentation of lectures related to malware. Among the few cultural heritage institutions that hold items related to malware, The Museum of Modern Art has a copy of the Newton “Virus,” created by the Troika art collective, in its architecture and design collection. However, Newton is somewhat of a “hoax virus.” It takes a screenshot of a user’s desktop in order to mimic the desktop icons falling, but has no other effects and does not replicate like a virus. 4 room for exploring uses of computing considered deviant or antisocial, or where anonymous individuals or groups are responsible, such as malware programming. Computer security and antivirus companies as well as governmental organizations save malware, but these collections have not been widely accessible and likely do not have the kind of curation and attention to the needs of humanities and social science researchers that cultural heritage institutions could provide. Accessing these collections can also be challenging. Computer security companies and governments also have no mandate for the long-term preservation of these collections or to collect related contextual or ancillary materials (for example, articles about malware, websites that discuss it, screen captures, and video walkthroughs of infections) that would allow researchers to explore the cultural, sociological, and political intricacies of malware development and infection. Defining Malware This section will place the term “malware” in its proper context and define the key characteristics of several kinds of malware: computer viruses, worms, and spyware. The word “malware” is a portmanteau of the words “malicious” and “software” and is generically defined as “any software used to disrupt