Which of the following programming languages is least prone to the insertion of malicious code

Macro Viruses Many common software applications implement some sort of scripting functionality to assist with the automation of repetitive tasks. These functionalities often use simple, yet powerful, programming languages like Visual Basic for Applications VBA. Although macros do indeed offer great productivity-enhancing opportunities to computer users, they also expose systems to yet another avenue of infection—macro viruses. Macro viruses first appeared on the scene in the mid-1990s, utilizing crude technologies to infect documents created in the popular Microsoft Word environment. Although they were rel- atively unsophisticated, these viruses spread rapidly because the antivirus community didn’t anticipate them and, therefore, antivirus applications didn’t provide any defense against them. Macro viruses quickly became more and more commonplace, and vendors rushed to modify their antivirus platforms to scan application documents for malicious macros. In 1999, the Mel- issa virus spread through the use of a Word document that exploited a security vulnerability in Microsoft Outlook to replicate. The infamous I Love You virus quickly followed on its heels, exploiting similar vulnerabilities in early 2000. Macro viruses proliferate because of the ease of writing code in the scripting languages such as VBA utilized by modern productivity applications. Although the vast majority of macro viruses infect documents created by applications belonging to the Microsoft Office suite including Word, Excel, PowerPoint, Access, and Out- look, users of other applications are not immune. Viruses exist that infect Lotus, AmiPro, WordPerfect, and more. Platforms Just as most macro viruses infect systems running the popular Microsoft Office suite of appli- cations, most computer viruses are designed to disrupt activity on systems running versions of the world’s most popular operating system—Microsoft Windows. It’s estimated that less than one percent of the viruses in the wild today are designed to impact other operating systems, such as Unix and MacOS. This may be the result of two influencing factors. First, there really is no “Unix” operating system. Rather, there is a series of many similar operating systems that implement the same functions in a similar fashion and that are indepen- dently designed by a large number of developers. Large-scale corporate efforts, like Sun’s Solaris and SCO Unix, compete with the myriad of freely available versions of the Linux operating sys- tem developed by the public at large. The sheer number of Unix versions and the fact that they are developed on entirely different kernels the core code of an operating system make it diffi- cult to write a virus that would impact a large portion of Unix systems. Second, according to a National Computer Security Association NCSA Virus Prevalence Study, 80 percent of all viruses are macro viruses, all but a slim percentage of which target Microsoft Office applications. There simply isn’t a software package for non-Windows plat- forms that is anywhere near as prevalent as Office is among PC users, making it difficult to develop effective macro viruses for non-Windows platforms. That said, Macintosh and Unix users should not rest on their laurels. The fact that there are only a few viruses out there that pose a risk to their system does not mean that one of those viruses couldn’t affect their system at any moment. Anyone responsible for the security of a computer system should implement adequate antivirus mechanisms to ensure the continued safety of their resources. Antivirus Mechanisms Almost every desktop computer in service today runs some sort of antivirus software package. Popular desktop titles include McAfee VirusScan and Norton AntiVirus, but there are a pleth- ora of other products on the market today offering protection for anything from a single system to an entire enterprise, as well as packages designed to protect against specific common types of virus invasion vectors, such as inbound e-mail. The vast majority of these packages utilize a method known as signature-based detection to identify potential virus infections on a system. Essentially, an antivirus package maintains an extremely large database that contains the telltale characteristics of all known viruses. Depend- ing upon the antivirus package and configuration settings, it scans storage media periodically, checking for any files that contain data matching those criteria. If any are detected, the antivirus package takes one of the following actions: If the software can eradicate the virus, it disinfects the affected files and restores the machine to a safe condition. If the software recognizes the virus but doesn’t know how to disinfect the files, it may quar- antine the files until the user or an administrator can examine them manually. If security settingspolicies do not provide for quarantine or the files exceed a predefined danger threshold, the antivirus package may delete the infected files in an attempt to pre- serve system integrity. When using a signature-based antivirus package, it’s essential to remember that the package is only as effective as the virus definition file it’s based upon. If you don’t frequently update your virus definitions usually requiring an annual subscription fee, your antivirus software will not be able to detect newly created viruses. With thousands of viruses appearing on the Internet each year, an outdated definition file will quickly render your defenses ineffective. Most of the modern antivirus software products are able to detect, remove, and clean a sys- tem for a wide variety of types of malicious code. In other words, antivirus solutions are rarely limited to just viruses. These tools are often able to provide protection against worms, Trojan horses, logic bombs, and various other forms of e-mail or Web-borne code. In the event that you suspect new malicious code is sweeping the Internet, your best course of action is to contact your antivirus software vendor to inquire about your state of protection against the new threat. Dont wait until the next scheduled or automated signature dictionary update. Furthermore, never accept the word of any third party about protection status offered by an antivirus solu- tion. Always contact the vendor directly. Most responsible antivirus vendors will send alerts to their customers as soon as new, substantial threats are identified, so be sure to register for such notifications as well.