How do computer virus writers test their viruses?

Question

This is my curiosity based question, neither I am a virus writer nor trying to learn how to be, I just can't imagine these people destroy dozens of computers for each virus as per my understanding software is software - it needs to be tested.

Answer 1

it needs to be tested

Does it? If you release a virus into the wild and it does not infect anyone you could say that is a form of testing in production. Gives enough feedback to see if you are on the right track, not? Testing in production is not always a bad thing, estimate your risks. Can you monitor the behaviour of the application continuously and adapt?

How do computer virus writers test their viruses?

Let imagine you are virus writer for a government agency. How would testing the software be different then any other form of software testing? You have expected behaviour which you need to validate, just like with any other piece of software. Second you would want some form of risk analyses. Chance it can be tracked back to its creator, Chance it would be found fast, Does it pass regular anti-virus protection, etc... leading to test and mitigation actions.

Simulation

Depending on your target you might need to simulate its environment. I guess you could setup a couple of virtual or physical machines to simulate the network you would like to penetrate. E.g. testing a StuxNet targeting specific components in nuclear-power-plants is different then generating e-mail zombies. Still to test it you would likely need to have a simulation environment. Just like a testing/staging environment, just a little bit more complex in some cases.