Copy Link
Add to Bookmark
Report
Crypt newsletter 12
ÜÜÜ ÜÜÜÜÜÜÜÜ ÜÜÜ ÜÜÜÜÜÜ ÜÜ ÜÜ ÜÜÜ ÜÜÜÜÜ ÜÜÜÜÜÜÜ ÜÜÜÜÜ
Û±±Û Û±±±±±±±Û Û±±Û Û±±±±±Û Û±±Û Û±±Û Û±±Û Û±±±±Û Û±±±±±±Û Û±±±±Û
Û±±Û ßßßßßßßß Û±±Û ßßßßÛ±±Û Û±±Û Û±±Û Û±±Û ßßßÛ±±Û ßßßÛ±±Û ßßßßß
Û±±Û Û±±Û ÜÜÜÜÛ±±Û Û±±Û Û±±Û Û±±Û ÜÜÜÛ±±Û Û±±Û
Û±±Û Û±±Û Û±±±±±Û ßß Û±±Û Û±±Û Û±±±±Û Û±±Û
Û±±Û Û±±Û ßßßßÛ±±Û Û±±Û Û±±Û ßßßßß Û±±Û
Û±±Û ÜÜÜÜÜÜÜÜ Û±±Û Û±±Û Û±±Û Û±±Û Û±±Û
Û±±Û Û±±±±±±±Û Û±±Û Û±±Û Û±±Û Û±±Û Û±±Û
ßßß ßßßßßßßß ßßß ßß ßß ßßß ßß
NEWSLETTER NUMBER 12
**********************************************************************
Another festive, info-glutted, tongue-in-cheek training manual
provided solely for the entertainment of the virus programmer,
security specialist, casual home/business user or PC hobbyist
interested in the particulars - technical or otherwise - of
cybernetic data replication and/or mutilation. Jargon free, too.
EDITED BY URNST KOUCH, January - February 1993
CRYPT INFOSYSTEMS BBS - 215.868.1823
**********************************************************************
TOP QUOTE: "We live in cheap and twisted times."
--Hunter S. Thompson, "Songs of The Doomed,"
1990.
-------------------------------------------------------------------
IN THIS ISSUE: NEWS . . . Anti-anti-virus virus's revisited:
the LOCKJAW series, quick analysis of the SANDRA virus . . . IN
THE READING ROOM: critique of various articles; review of
MONDO 2000 annual; VIRUS: The comic book! . . . return to
MICHELANGELO virus: an appraisal of the media's mishandling of the
March 1992 affair and software vendor collusion . . . sophisticated,
but warped, humor . . . and the usual potpourri of material.
**********************************************************************
********************************************************************
MICHELANGELO HYPE REVISITED: A SKEPTIC'S VIEW
********************************************************************
Just about a year ago the media exploded with weird stories of
impending catastrophe at the hands of a mysterious computer program.
Thrown a newsprint and TV body-block by techno-impaired editors and
reporters lacking even the sense to pour piss from a boot, the world
reeled. But the sky refused to fall and in the best tradition of
"calendar" journalism, the Crypt Newsletter has received permission
to reprint a critique of the events surrounding March 6, 1992.
"THE LITTLE VIRUS THAT DIDN'T: The press couldn't get enough
of Michelangelo. But did it fall prey or save the day?"
Republished from the Washington Journalism Review, May 1992.
The great Michelangelo computer virus scare of 1992 has proved to be
another classic example of Chicken Little journalism -- or the
Reporters Who Cried Wolf, depending on your tast in fairy tales.
At first glance, the story was a sexy one. The virus had an
instantly recognizable name. It was attached to a specific date --
March 6 --an attractive hook for editors with a penchant for calendar
Page 1
journalism. It was simple: On the birthday of its namesake, the virus
would destroy data within the computers it had infiltrated through
infected disks. And it boasted big numbers: By one estimate, as many
as 5 million IBM and IBM-compatible computers worldwide were going
to be victims of Michelangelo, a relatively small computer code written
and unleashed by an anonymous, devious programmer.
Newspapers around the country ran headlines warning of imminent
disaster. "Thousands of PC's could crash Friday," said USA Today.
"Deadly Virus Set to Wreak Havoc Tomorrow," said the Washington Post.
"Paint It Scary," said the Los Angeles Times.
Weeks after M-day, many antiviral software vendors and some reporters
still insist the coverage prevented thousands of computers from
losing data. John Schneidawind of USA Today says "everyone's PC's
would have crashed" had the media not paid much attention to
Michelangelo.
The San Jose Mercury News credited the publicity with saving the day.
One widely quoted antiviral vendor, John McAfee of McAfee Associates,
says the press deserves a medal.
In reality, many of the predictions were suspect. Those making them,
often computer security product vendors or closely related industry
associations, usually stood to profit from the widespread coverage.
And many reporters bit hard.
One vendor who played a key role was McAfee, one of the nation's
leading antiviral software manufacturers and founder and chairman
of the nonprofit Computer Virus Industry Association (CVIA). It was
McAfee who told many reporters that as many as 5 million computers
were at risk. He says he made the projection based on a study
that the virus had infected 15 percent of computers at 600 sites.
Both Reuters and the Associated Press sent the figure around the world.
McAfee says he didn't present it the way it was reported. "I told
reporters all along that estimates ranged from 50,000 to 5 million,"
he says. "I said, '50,000 to 5 million, take your pick,' and they
did."
But researcher Charles Rutstein of the International Computer
Security Association (ICSA), a for profit consulting group,
says even 50,000 was an exaggeration. Also widely quoted,
Rutstein says he told reporters early on to expect no more than
10,000 computers infected worldwide. (There are more than 35 million
computers in the United States alone, according to some estimates.)
"Five million is just ridiculous, but the press believed it because
they had no reason not to," Rutstein says now. "McAfee seems
credible." (McAfee responds that the ICSA and other critics are
"fringe groups.")
While many articles failed to disclose or merely mentioned in passing
that McAfee's antiviral software has sold more than 7 million copies
of its Viruscan and expects revenues of more than $20 million this year,
McAfee scoffs at the idea that he or other vendors hyped the threat
to generate sales. "I never contacted a single reporter, I never sent
out a press release, I never wrote any articles," he says. "I was just
sitting here doing my job and people started calling." He maintains
that the coverage of Michelangelo cost him money. "It was the
worst thing for our business, short-term," he says. "We offer
shareware [where users are trusted to pay], so we got tons of calls
from non-paying customers.
Page 2
"Before the media starts to crucify the antivirus community," he
continues, "they should look in the mirror and see how much [of the
coverage] came from their desire to make it a good story." But
he adds quickly, "Not that I'm a press-basher."
Schneidawind's and AP's efforts after March 6 to track Michelangelo
found only a few thousand afflicted computers worldwide, including
2,400 erroneously reported to be at the New Jersey Institute of
Technology. The institute actually had only 400 computers infected
with any virus; few had Michelangelo. A Philadelphia Inquirer
reporter got it wrong, says institute spokeman Paul Hassen, and it
spread quickly. "That was the first time I've been that close to
a feeding frenzy," he says. Perhaps the most embarrassed news
organization was CNN, which on March 6 staked out McAfee's offices
in Santa Clara, California, waiting for a doomsday that never
came.
Soon after the clock struck midnight on March 6, may reporters
seemed to suspect they'd been had. The Los Angeles Times, which
had quoted McAfee's 5 million figure on March 4, carried a
Reuters story three days later that reported the "Black Death"
had turned out to be little more than "a common cold."
AP downgraded its "mugger hiding in the closet" to a mere "electronic
prank."
AP Deputy Business Editor Rick Gladstone says the wire service
quickly downplayed the story after its initial reports and included
comments from the ICSA's Rutstein, who said the threat from the
virus had been exaggerated. "Our big oversight was to quote
McAfee's 5 million figure in the beginning of the coverage but we
backed off that," Gladstone says, adding that his staff "felt
somewhat vindicated" when relatively few computers were affected on
March 6. "Some of us in the press were suckered," he says.
Schneidawind doesn't feel he was. "We went into this with our
eyes open," he says. But on March 9, in an article entitled
"Computer virus more fright than might" (the subhead was a
more confident "Michelangelo kept at bay by early detection"),
the USA Today reporter chronicled his frustrations tracking the
virus. He reported that he had asked Rutstein and McAfee, again
identified as the CVIA chairman, to provide a working sample
of Michelangelo. Both declined. "It'd be like giving him a
biological virus because he wanted to play with it," McAfee says.
McAfee was also "reluctant to divulge the names of companies
struck by the virus" according to Reuters.
McAfee now estimates that only 10,000 systems were stricken
worldwide on March 6, a number he says he derived by counting the
number of calls he received from victims and guessing that they
estimated 5 percent of the total. But he insists the numbers
aren't as important as "the scope of the problem," which, he says
the press largely ignored. "For the first time, you had large
well-respected companies shipping the virus with their new computers
and software. How did it filter into secure environments like
that?"
Schneidawind agrees. "The estimates may have been overblown,
but no one new for sure until the 6th," he says. "Consider the
BCCI scandal, where everyone faulted the press for not being there.
I'd rather err on the side of caution."
Page 3
Schneidawind didn't seem to do that in a sidebar to his March 9 article
in which he listed other computer pests poised to strike in March.
Supplied by yet another antiviral software vendor, the list did not
reveal that most of the bugs were either variants of the same
root virus -- known as "Jerusalem" -- or rare species found only
in eastern Europe. Like many others the story did not make clear
that every week of the year is filled with trigger dates for
numerous viruses. (Or that user mistakes destroy more data than
viruses do.) More importantly, only a handful of some
1,000 worldwide viruses are common enough that a user may
occasionally encounter one. Of those, most only display silly
messages or compel the computer to play a tune.
On March 6, Michael Rogers and Bob Cohn of Newsweek offered a post
mortem to Michelangelo that warned readers to "beware the next round
of computer viruses," including the Maltese Amoeba and "the scariest
new virus . . . the Mutation Engine." What they and others such as
Ted Koppel of ABC's Nightline and John Fried and Michael Rozansky
of the Philadelphia Inquirer failed to say was that the Maltese Amoeba
had only been active in Ireland. Moreover, the Mutation Engine isn't
a virus at all, but a user-friendly encryption tool that virus-writers
use to disguise their creations.
To their credit, neither The New York Times nor The Wall Street Journal
gave much credence to Michelangelo. John Markoff of the Times in
particular provided restrained, intelligent coverage that virtually
ignored McAfee and other antivirus vendors. And The Journal's Walter
Mossberg wrote a "Personal Technology" column that realistically
appraised the viral threat as minimal.
Unfortunately, the hype over Michelangelo could cause wary journalists
to ignore more prevalent destructive viruses that could occur in
the future. It will cause more of the rogue programs to be
circulated, if only because their creators love the
attention. For some soul, the coverage given to
Michelangelo must have provided quite an adrenalin rush. It certainly
did for the press.
---------------------------------------------------------------------
As for a look back a year later:
1. Whatever happened to the Maltese Amoeba? The answer:
Who cares?
2. Where is the sound of PC's crashing in 1993 to the tune
of the "scariest new virus . . . the Mutation Engine"?
*****************************************************************
MODEL ANTI-VIRUS AUTHOR LEGISLATION PRESSED INTO THE
HANDS OF THE CRYPT NEWSLETTER: PETER TIPPETT HAS
COMPANY NAME ATTACHED TO RISIBLE DRIVEL
*****************************************************************
Recently we've had the time to look over a back issue of
Virus News and Reviews which contained some "model"
legislation designed for the express purpose of combating
computer viruses. Devised by Peter Tippett of Certus International,
the document makes clear that it was written to impress people
ignorant of computers in even the most general sense. It
propagates the idiotic notion that writing viruses is some kind
of specialized skill, or "art" as Tippett puts it, and by
Page 4
regulating individuals expert in the "art," the computer virus
problem can be solved.
For example, an excerpt from Tippett's "model" in Virus News
and Reviews (July 1992):
"A computer virus may only be created or modified, but never sold,
distributed, or allowed to be distributed, for bonafide research
purposes, and then only under the following circumstances:
"1. The virus is created for a legitimate, localized research
purpose;
"2. Strict provisions are made to always contain the virus within
the expressed domain of its author/researcher and to not allow the
virus to replicate or otherwise move to any media or computing
system outside of the author's/researcher's direct control;
"3. At least five days before any computer virus is created or
modified under this sub-part, the intent to create or modify a
computer virus must be publicly announced by its intended author in
at least three publicly available publications, each with a
circulation of at least 100,000. The announcement will contain at
least:
1) the name, company, title, address and telephone number of the
responsible party,
2) the name, company, title, address and telephone number of the
computer virus author, if different than the responsible party,
3) the address and location of the intended research,
4) the start date and intended finish date of the intended
research, and
5) the expressed intent to create or modify a computer virus.
"4. The research or study virus, or virus modification must contain
within its own code, and in a form that survives replication to all
progeny of the parent virus, the name of the responsible party and
other information sufficient for anyone of average skill in the art
to reliably discover."
Point 1 calls for the formation of a judging group which will appraise
virus research as worthy of license. To this day, no such group
exists in any field of scientific (professional or non-professional)
endeavor, at least not in the way envisioned by Tippett's model
legislation. The closest things to this are government research and
granting agencies like the National Science Foundation. But,
while the NSF doesn't have to grant money for research it
feels inexpert or uninteresting, it has no power to make it taboo.
(It can create an environment where certain avenues of research
are seen as "unfundable." This can be crippling in some fields,
but not in this case where just about anyone with a couple
PC's, a modem and a real desire to work can set up shop.)
Tippett's legislation would be a first in this regard. We think this
is a laughable assumption that shows a typical businessman's lack of
knowledge about how the critical pursuit of information
proceeds in any field. (In an aside: Tippett's writing brings
to mind Robert X. Cringely's assessment of Lotus Development's
Jim Manzi as an American businessman who shuns PC's, hates using
them and considers researchers and technical people "dickheads.")
Page 5
In Point 3, Tippett requires publication notice for virus creation.
This is an unenforceable bureaucratic requirement which would be
unlikely to be taken seriously even by people working in a
"legitimized" environment.
As for Point 4: Many virus authors and researchers already put plenty
of identification in their creations. This hasn't changed anything
nor does it prevent people from erasing or altering such identification
at whim. This point serves no obvious purpose and, in our opinion,
is legally meaningless.
The remainder of Tippett's "model" is similarly uninformed as to the
reality of virus construction and distribution, embarrassing when
one considers that he's published in Virus News and Review. But
perhaps this is intentional, since the facts are difficult to
adequately describe in a mere one-page letter. As a "paper" or
proposal in any college course worth its salt, Tippetts' submission
would gain a solid F. But for congressional legitimacy, if that's
its aim, excellence is not a requirement. Maybe Peter Tippett
is a lot smarter than we think.
**********************************************************************
IN THE READING ROOM: VIRUS - THE COMIC BOOK!
********************************************************************
It had to happen. There have been sci-fi and techno-thrillers
about viruses, so WHY NOT a comic book?
You'd expect this to be strange, but so what! Aren't a lot of
comics? Why should "Virus," published by Dark Horse, be
an exception?
But first, a little background. Dark Horse has made its name
by peddling an endless flood of titles devoted to squeezing
the last drop of greenish ichor from movies like "Alien" and
"Predator." That philosophy ensures just about anything it
prints is a big hit, selling out immediately in the kinds of comic
stores run by tubercular, ex-artfags with an intense dislike
for patrons who don't reserve at least ten new titles each
month.
You'd imagine, then, that a copy of "Virus" was tough for
The Crypt Newsletter to find. It was. And if not for alert reader
Captain AeroSmith who shipped one air-freight from Cleveland, we
might not have seen it at all.
That said, the first issue of "Virus" wasn't bad. Fair art, good
dialogue and a story that revolves around an abandoned Chinese
radar and telemetry ship that comes under the power of some
inter-cosmic computer virus that has beamed down into its radio
antenna and set up shop in the mainframe. The original crew is
butchered, necessitating the trapping of some ocean-wandering riff-raff
who think they're going to appropriate the boat for lots of cash
money. "Virus" nixes this plan at once by ripping the
breast-bone out of one of the thieves with the aid of a
computer-controlled winch.
"Aaaiiieeee!" screech the trapped sailors. They want out, but not
before being attacked by something that looks like a cross between
a kite and a flying pipe-wrench made from sails and human integuement.
What does this have to do with viruses or the computer
Page 6
underground? Who knows! "Virus" is cracked, but I guarantee you'll
be negotiating with your local dealer for the next issue.
*******************************************************************
IN THE READING ROOM II: MONDO 2000 - A User's Guide To The
New Edge by R. U. Sirius, Queen Mu and Rudy Rucker (HaperPerennial)
*******************************************************************
"Thanks for a country where no one's allowed to mind their
own business . . . Thanks for a nation of finks."
--William S. Burroughs in "Mondo 2000"
I'm no expert on the "cyberpunk" magazine, but MONDO 2000 -
the book - squeezed a smirk out of me when the William Burroughs
quote cropped up amidst non sequiturs and chapters on pranking the
media and "smart" drugs. That the wizened author of "Naked Lunch" is
now a center piece in such an effort surely has some kind of
quantum significance. So, know that MONDO 2000 is the literary
equivalent of a Ren & Stimpy cartoon: stretches of intense
flatulence punctuated by flashes of brilliance and dumb cunning.
[Much like the Crypt Newsletter, perhaps.]
For instance, the chapters on "smart" drugs and tarantulas (?!)
are patent nonsense. The "smart" drug idea comes from that
small segment of the populace who've accidentally rediscovered
how absorbing a read the Physician's Desk Reference is when your mind
has that "roasted" character that comes from too many simultaneous
hits of caffeine and unfiltered Camels. Tarantulas, Queen Mu says,
are deadly, too. (I knew it, I knew there had to be a reason they
sell the ugly things to any schnook who goes into a pet store!)
If you can overlook stuff like that, MONDO 2000 is hep.
Rudy Rucker's introductory essay, for one thing, is inspirational.
And there's plenty of weird computer jokes, BBS's to call,
summaries of all the important stuff that's gone down in "cyberspace"
in the past ten years - in other words, MONDO 2000's a good book for
the coffee table. It will impress your friends, I bet.
********************************************************************
QUICK AND DIRTY DISASSEMBLY OF VIRUS CODE: THE SANDRA VIRUS -
AN ENCRYPTED ANTI-ANTI-VIRUS VIRUS SPILLS ITS SECRETS TO ANY
LAYMAN
*******************************************************************
This month, two articles crossed Crypt Newsletter desks that painted
the picture that virus disassembly is a job best left to the experts.
It is a common myth - a nuts, self-serving statement propagated by
greedheads who WANT you to think that you are a helpless schnook.
In reality, anyone who works seriously with viruses knows that in
90% all cases, virus disassembly is about a 5-minute job, tops.
As an illustration, the Crypt Newsletter will walk you through
a quick and dirty dissection of the SANDRA virus using only
two tools: the shareware ZanySoft debugger and the retail Sourcer
commenting disassembler programs.
Since the Sandra virus came into this country as a "naked" file, there
is little need to instruct you in how to execute the
virus onto a clean, small, workable "host." Since no virus researcher
had to do it, we will presume, in this case, that you won't have
to either. (And that leaves room for another chapter in this
story in the next issue.)
Page 7
The first step is a no-brainer. Fire up Sourcer with the following
command line (this presumes you have created the SANDRA virus from
the DEBUG script supplied with the Crypt Newsletter):
C>SR SANDRA.COM
This will load SANDRA into Sourcer and bring up the disassembler's
menu. The Sourcer defaults will suffice, so hit "G" for GO.
In less than 15 seconds Sourcer will have coughed out a file
called SANDRA.LST. Take a look at it. By the black-coated
turd from Jesus's arse! What gibberish. You'll see that SANDRA
appears to be a small segment of cryptic assembly code instructions,
then some words that almost look like English and quite an oodle of
hexadecimal values arrayed in columnar "define byte" (or "db")
format.
This immediately tells the experienced that SANDRA is
encrypted, and rather weirdly at that. (If SANDRA had been unencrypted,
your job would be finished. The virus would be laid out in front
of you.)
The next step, then, is to trick the virus into decrypting itself
and then writing the "plain text" version to disk. This is simple
in theory, only slightly more difficult in practice. Envision that
the portion of the virus you want to execute is the decryptor
loop, a small stretch of instructions which will unscramble the
virus in memory. Might not that segment of cryptic assembly gobble
that Sourcer produced on its first pass contain the keys to
the decryptor? Yup, good guess. And it looks like this:
seg_a segment byte public
assume cs:seg_a, ds:seg_a
org 100h
sandra proc far
3C44:0100 start:
3C44:0100 F8 clc ; Clear carry flag
3C44:0101 E8 002F call sub_2 ; (0133)
3C44:0104 FB sti ; Enable interrupts
3C44:0105 F8 clc ; Clear carry flag
3C44:0106 <--execute to this address jmp loc_6 ;*(027C)
3C44:0106 E9 73 01 db 0E9h, 73h, 01h
3C44:0109 3C data_3 db 3Ch ; xref 3C44:013D
3C44:010A 00 data_4 db 0 ; xref 3C44:0149
You notice that SANDRA starts by calling a sequence of instructions
dubbed "sub_2" by Sourcer. Looking down the listing (which is
not included here) you see that "sub_2" is another segment of
plain-text assembly code. This is the viral unscrambler and when
we have returned from it, the virus is ready to cook off. The next
job for SANDRA, then, is to begin its work. Looking at
the assembly commands above, you see SANDRA jumps (jmp) to a new
location, which looks encrypted in the listing you're
working on.
The idea you want to use is that by executing the virus right
up to the "jmp," it's possible to get it to translate itself
Page 8
in memory without it looking for a file to infect, infecting that
file and re-garbling itself. This is easy to do with any
debugger. We'll use the ZanySoft product because it's not
as intimidating as DOS's DEBUG to the novice user. In fact,
it is almost idiot-proof and requires little overhead on
the part of anyone.
Fire up the ZanySoft debugger by typing:
C>ZD86
ZanySoft is menu driven. Use its "File" drop-down menu to
load the virus. Then bring down its "Run" menu and double-click
on the "go to xxxx:xxxx" command. This tells ZanySoft to
execute the loaded program to a certain address - which it
will prompt you to supply -- and stop. The address needed is
the one corresponding to the "jmp" in the above listing. Sourcer
has supplied it, and it is ear-marked in the diagram: 0106.
Type in 0106 at ZanySoft's prompt and hit <enter>. The virus
is decrypted. Now, return to the "Files"
menu and select the option, "Write to .COM." Accept the
default value ZanySoft brings up and hit <enter> again. The
virus has now been written to the disk from memory, and in
"plain-text" or unencrypted form. Look at it under a file
viewer. Remember those words that looked like English? Well,
now they ARE English. You should see some gobble like "the
Nazg'l," "dedicated to Sandra H.", and "*.EXE," "*.COM," the
latter two giveaways that the virus hunts for these files.
Load the unencrypted virus into Sourcer once again. Accept
the defaults and hit "Go". Fifteen seconds later the
virus has been disassembled for you, only now it's almost
all assembly instructions. Is this so mysterious? Even
though you may know next to nothing about assembly, you can
still use the Sourcer listing to make some informed deductions
about the virus.
Go to the bottom of the listing and look at the interrupt
usage synopsis. It looks like this:
±±±±±±±±±±±±±±±±±± Interrupt Usage Synopsis ±±±±±±±±±±±±±±±±±±
Interrupt 16h : Keyboard i/o ah=function xxh
Interrupt 20h : DOS program terminate
Interrupt 21h : DOS Services ah=function xxh
Interrupt 21h : ah=2Ch get time, cx=hrs/min, dx=sec
Interrupt 21h : ah=3Bh set current dir, path @ ds:dx
Interrupt 21h : ah=3Ch create/truncate file @ ds:dx
Interrupt 21h : ah=3Dh open file, al=mode,name@ds:dx
Interrupt 21h : ah=3Eh close file, bx=file handle
Interrupt 21h : ah=40h write file bx=file handle
Interrupt 21h : ah=41h delete file, name @ ds:dx
Interrupt 21h : ax=4301h set attrb cx, filename @ds:dx
Interrupt 21h : ah=4Eh find 1st filenam match @ds:dx
Interrupt 21h : ah=4Fh find next filename match
Interrupt 21h : ax=5701h set file date+time, bx=handle
As you see, SANDRA has instructions for "find first filename
match", "find next filename match" and "set current directory,
path." If you've seen this newsletter and its source listings
before, you might suspect that SANDRA is a direct-action
(or non-resident) virus. Coupled with the .COM/.EXE filemasks,
that's a good, educated guess.
Page 9
Like any virus, it has a "write to file" function. However, in
this case, cross-referencing your listing shows that SANDRA
doesn't worry about adding itself to the end of the file during
the write. This means SANDRA's an "overwriter." It's the simplest
kind of infector, a feature exclusively the domain of primitive
direct-action viruses. And since it means that the virus
destroys everything it lands on, an instantly noticeable
stunt, it marks SANDRA as a trivial pest at best.
Your eye might also be drawn to the "delete file" and
"truncate file" functions. "Ah-ha!" you say having
a vague understanding about how sneaky viruses work.
SANDRA deletes files corresponding to the list of plain-text
filenames it carries around. And those file names are for
anti-virus software programs! SANDRA is an anti-anti-virus
virus! Wow.
Now you know enough to broadly characterize SANDRA as an
encrypted, over-writing virus that tries to delete a
raft of anti-virus programs. You might even be tempted
to run a test and execute SANDRA against some bait files.
If you do that on a typical American system, you'll find
another interesting feature at once. A great many systems
now use WINDOWS, and that means they're set up with either
QEMM or MS-DOS's EMM386 as memory managers. If SANDRA is
executed on any of these environments it will generate an
"exception" forcing a reboot of the machine.
Why is that, for cryin' out loud? Actually, it's another
anti-anti-virus measure, although a back-handed one.
NEMESIS, a German memory resident anti-virus monitor
uses expanded memory to monitor a system at the sector
level. Because of this, it requires the user to have
the requisite amount of expanded memory and the manager
for it: QEMM or EMM. SANDRA seems to make the generous
assumption that any machine using one of these might have
NEMESIS installed, and it forces a shutdown through EMM
to stop the infection and avoid potential detection.
Since SANDRA appears to be German, it is not unreasonable
that its author might be more concerned about NEMESIS
than anyone in the U.S., where the program is nonexistent.
In real terms, this feature makes SANDRA, at best,
a reluctant virus. On many machines, it will just
flat out refuse to infect.
By further combing over the code on breaks from hanging about
the water-cooler, you'll find that SANDRA deletes the
following data-integrity files from selected a-v software:
- "ANTIVIR.DAT"
- "CHKLIST.CPS" --Central Point AV
- "C:\CPAV\CHKLIST.CPS" --same as above
- "C:\NAV_._NO" --Norton Antivirus
- "NOVIRCVR.CTS"
- "NOVIPERF.DAT"
- "C:\TOOLKIT\FSIZES.LST" --Solomon's Toolkit
- "C:\FSIZES.QCV" --Solomon's Toolkit
- "C:\UNTOUCH\UT.UT1" --Untouchable
- "C:\UNTOUCH\UT.UT2" --Untouchable
- "C:\VS.VS"
- "C:\TBAV\VIRSCAN.DAT" --Thunderbyte, truncates file
Page 10
- "C:\)(.ID -- Integrity Master, I believe
By now, you're very confident you can execute SANDRA without
hurting yourself. Actually, you could have done that after
a quick look at the interrupt synopsis. In any case, you're
still cautious so you install FLU-SHOT. Haha! SANDRA
won't infect. And you've uncovered its last interesting
secret: it exits when FLU-SHOT or a couple of other
resident programs are present.
This isn't the definitive book on SANDRA, but it's more than
enough for reasonable purposes. After all, this IS the "quick and
dirty" guide to virus disassembly. And the rules here can be
applied to a full 90% of the viruses you might come across.
Sure, there can be the occasional bird with tricks in it
to make this kind of fast interpretation a thorny job.
But, chances are, you will never see one.
So after a few more stabs at this with viruses from the
newsletter, your home collection, or wherever, you can sell
yourself as an experienced hand at "quick & dirty" virus
disassembly.
****************************************************************
****************************************************************
THE LOKJAW PROGRAMS: MORE SIMPLE IMPLEMENTATIONS OF RETALIATING
ANTI-ANTI-VIRUS VIRUSES
****************************************************************
Intrigued by the Proto-T scam, virus writer Nikademus sent his
LOCKJAW program to the Crypt Newsletter for examination. The
Nikademus LOCKJAW virus is a variant of "Proto-T," a resident
.COM infector originally derived from Civil War, altered to
delete a series of anti-virus programs when they are executed.
As an added fillip, the virus marks the deletion with an
entertaining "chomping" graphic effect!
The easiest way to soak this up is to head right for the assembly
listings included in this issue. The actual file recognition
and deletion routines can be adapted for many resident viruses.
As an example, the newsletter has transformed LOCKJAW into a
spawning .EXE-infecting virus in its "ZWEI" and "DREI" variants.
File deletion on load isn't novel in resident viruses. But by
coupling it to anti-virus recognition LOCKJAW underscores the
necessity of having the user realize he MUST remove the virus
from memory before using his software, or at the very least,
operate from a write-protected diskette. (Although, as you will
see with LOKJAW-DREI, the latter step is also potentially dodgey
business.)
In the wild, the entertaining virus "chomp" would be removed, as it
is a dead giveaway that the virus is present and in control
of the machine. (For that matter, so is sudden file deletion.
But the effect would remain puzzling to uninformed users.)
Taking this idea one step further, LOKJAW-DREI is a modification
which removes file deletion and replaces it with a fake
disk-trashing routine which the virus uses to strike the hard file
when an anti-virus program is called to find it.
Although LOKJAW-DREI only makes the drive temporarily inacessible,
it doesn't take a great leap of imagination to see its
Page 11
potential. Mark Ludwig talked about this at length in an article
on "retaliating viruses" published in American Eagle's "Computer
Virus Developments Quarterly #1" In that issue he supplied the
code for such an animal, the direct action Retaliator virus, an
Intruder variant.
The point that he made, and a valid one, is that the existence
of such a virus on a machine makes it absolutely necessary
that the user know what he's doing when he goes out looking
for it.
The LOCKJAW viruses, however, are easy to "play" with. They
will become resident below the 640k boundary and infect .COMs or
.EXE's, depending upon the variant, upon execution. They will
also show a noticeable 4k drop in memory available to free programs.
By running Scan, F-Prot, Integrity Master or Central
Point Anti-Virus when LOCKJAW is present, the "retaliating"
effect is shown. Of course, this software is deleted so
don't use your only copy unless you want it erased. (Not a
bad strategy for some software.)
LOCKJAW can be removed from memory by simply rebooting from a
clean, write-protected system disk.
[In a related note: The SANDRA and LOKJAW viruses come with
Central Point Anti-virus as a default. Even though the
software is continually drubbed in product reviews and word-of
mouth gossip, it is included in the coming MS-DOS 6.0. This
ensures that it will be even more ubiquitous on home and business
machines in 1993 - a fact of interest to virus and competing
anti-virus developers alike.]
***************************************************************
***************************************************************
IN THE READING ROOM III: CRITIQUE OF DISCOVER PIECE ON THE
BULGARIAN VIRUS CONNECTION
***************************************************************
I'm sure a number of alert newsletter readers have, by now,
browsed through the February issue of Discover magazine and seen
the excerpt from another book on "hackers" called "Approaching Zero,"
to be published by Random House. The digested portion is from a
chapter dealing with what authors' Bryan Clough and Paul Mungo call
"the Bulgarian virus connection."
While it was interesting - outwardly a brightly written
article - to someone a little more familiar with the subject matter
than the average Discover reader, it was another flawed attempt
at getting the story right for a glossy magazine-type readership.
First, we were surprised that reporters Mungo and Clough fell
short of an interview with virus author, the Dark Avenger. Since
they spent so much time referring to him and publishing a few
snippets of his mail, it was warranted, even if he is a very tough
contact.
In addition, they continually exaggerate points for the sake of
sensationalism. As for their claim that the Dark Avenger's "Mutating
Engine" maybe being the "most dangerous virus ever produced,"
there's no evidence to support it. First, they continue the
hallowed media tradition of calling the Mutation Engine
a virus. It's not. The Mutation Engine is a device which we've gone
Page 12
over in these pages again and again.
The Crypt reader knows it doesn't automatically make the virus
horribly destructive, that's a feature virus-writers put into
viruses separate from the Engine.
And although the first Mutation Engine viruses introduced into
the U.S. could not be detected by scanners included in
commercial anti-virus software, most of these packages included
tools to monitor data passively on any machine. These tools
COULD detect Mutation Engine viruses, a fact that can still be
demonstrated with copies of the software. And one that almost
everyone covering the Mutation Engine angle glosses over, if they
bother to mention it at all. In any case, Mutation Engine code
is well understood and viruses equipped with it are now no more
hidden than viruses which don't include it.
Of greater interest, and an issue Mungo and Clough don't get to, is
the inspiration the Dark Avenger Mutation Engine supplied to virus
programmers.
By the summer of 1992, disassembled versions of the Mutation Engine
were everywhere, for all intents.
It seemed only a matter of time before similar code kernels with
more sophisticated properties popped up and this has been the case.
Coffeeshop, a virus mentioned in the original Discover piece,
is just such an animal, although the authors don't get into it.
Coffeeshop utilizes a slightly more sophisticated variable encryptor
- called the Trident Polymorphic Engine - which adds a few features
not present in the Dark Avenger model as well as decreasing its
size. It, too, has been distributed in this country as a device
which can be utilized by virus authors interested in shot gunning
it into their own creations. It is of Dutch origin, produced by
a group of programmers known as "TridenT." TridenT, a group with
a taste for whimsy, freely acknowledges the inspiration of
the Mutation Engine. Curiously, Coffeeshop is Dutch slang for a
place to pick up some marijuana. Very interesting, is it not?
However, the Trident Polymorphic Engine is no more inherently
dangerous than the Mutation Engine. Viruses utilizing it can be
detected by the same tools used to detect Mutation Engine viruses
before those could be scanned.
The reporters also claim that disassembling a virus to find out
what it does is a "difficult and time-consuming process" capable
of being carried out "only by specialists." This is another myth
which feeds the perception that viruses are incredibly
complicated and that one can only be protected from them by the
right combination of super-savvy experts.
It has little basis in reality which is why we spent some time
shooting it in the rear end in an earlier portion of this
issue.
And that's what's the most irritating about Mungo and Clough's
research. In search of the cool story, they further the dated idea
that virus-programming is some kind of arcane art, practiced by
"manic computer freaks" living in a few foreign countries where
politics and the economy are oppressive . While it's true that
a few viruses are clever, sophisticated examples of programming, the
reality is that almost anyone (from 15-year olds to
Page 13
middle-aged men) with a minimal understanding of assembly language
can (and does) write them from scratch or cobble new ones together
from pieces of found code or toolkits.
Since everyone's computers DON'T seem to be crashing from viral
infection right and left (remember Michelangelo?), Mungo and Clough,
in our opinion, really stretch the danger of the "Bulgarian virus
factory."
This is such an old story it has almost become shtick, a routine
which researcher Vesselin Bontchev (apparently Clough and Mungo's
primary source) has parlayed into an intriguing career.
A great number of the 200 or so Bulgarian viruses the reporters
mention in fear-laden terms ARE already here, too - stocked on
a score of BBS's run by programmers and computer enthusiasts.
Mungo and Clough write of "the scope of the problem . . . not
[becoming] apparent for several years." That's an easy, leading
call to make because no one will remember or hold them to it in
2000. The Crypt newsletter suggests "We don't know."
Now that would have been more honest. But we doubt if it would have
sold as well.
[To add insult to injury, the authors warn of the ominous LoveChild
virus, counting toward zero, waiting to ambush your hard file. It's
worth noting the Skulason's F-Prot casually dismisses LoveChild as
a buggy virus which only operates on machines running DOS 3.3.
Solomon's Toolkit modestly judges it as capable of "moderate"
damage.]
=-=In true domino effect, PRODIGY - the "interactive home computer
service" for numerous, mixed-up, Bush-voting, Democrat yuppies -
recycled segments of the Discover article on January 30 in its
"Headline News" section. The un-bylined story loudly proclaimed
"the Mutating Engine . . . the most dangerous virus ever" and re-
iterated ominous news of LoveChild, a program which won't function
on many systems. LoveChild, alert Crypt newsletter readers may
be interested to know, "will erase all of a computer's memory,"
according to PRODIGY Headline News.=-=
****************************************************************
IN THE READING ROOM IV: WRITER AND EX-JOCKEY DICK FRANCIS
REPORTS ON COMPUTER VIRUSES IN "DRIVING FORCE," HIS LATEST NOVEL
OF MYSTERY AND INTRIGUE
****************************************************************
It turns out that one of the Crypt Newsletter staffers is a
fiend for Dick Francis. In case you don't know, Francis is an
entire publishing company unto himself. He cranks out enough
material in a year to give Stephen King a run for his money.
However, he's never been pegged as a "computer" writer.
So it came as a surprise when a staffer shrieked in glee,
ran over to where I was lurking by the water-cooler and
thrust Francis's manuscript into my face.
"Look, look, Michelangelo!!" she gibbered. And there it
was, a fictional account of someone's office getting cold-cocked
by the virus. But enough of this, here's a teaser:
-=[ The computer man, perhaps twenty, with long light brown hair
through which he ran his fingers in artistic affectation every
few seconds, had given up trying to resuscitate our hardware by
the time I got back to the office.
"What virus?" I asked, coming to a halt by by Isobel's desk
and feeling overly beleaguered. We had flu, we had aliens, we
had bodies, we had vandals, we had concussion. A virus in
the computer could take the camel to its knees.
"All our records," Isobel mourned.
Page 14
"And our accounts," chimed Rose.
"It's prudent to make backups," the computer man told them
mock-sorrowfully, his young face more honestly full of scorn.
"Always make backups,ladies."
"Which virus?" I asked again.
He shrugged, including me in his stupidity rating. "Maybe
Michelangelo . . . Michelangelo activates on March 6 and
there's still a lot about."
"Enlarge," I said.
"Surely you know?"
"If I knew, I've forgotten."
He spelled it out as to an illiterate. "March 6 is Michelangelo's
birthday. If you have the virus lying doggo in your computer
and you switch on your computer on March 6, the virus activates."
"Michelangelo is a boot-section virus," the expert said, and to
our blank-looking expressions long-sufferingly explained. "Just
switching the machine on does the trick. Simply switching it on,
waiting a minute or two and switching off. Switching on is called
booting up. All the records on your hard disk are wiped out at
once with Michelangelo and you get the message 'Fatal disk error.'
That's what happened to your machine. The records are gone. There's
no putting them back."
"What exactly is a virus?" Rose inquired miserably.
"It's a program that tells the computer to jumble up or wipe
out everything stored in it." He warmed to his subject. "There
are at least three thousand viruses floating around. There's
Jerusalem II that activates every Friday the 13th, that's a
specially nasty one. It's caused a lot of trouble, has that
one."
"But what's the point?" I asked.
"Vandalism," he said cheerfully. "Destruction and wrecking for
its own sake." He ran his fingers through his hair. "For instance,
I could design a sweet little virus that would make all your
accounts come out wrong. Nothing spectacular like Michelangelo,
not a complete loss of everything, just enough to drive you mad.
Just enough to make errors so that you'd be forever checking and
adding and nothing would ever come out right." He loved the idea,
one could see.
"How do you stop it?" I asked.
"There are all sorts of expensive programs nowadays for detecting
and neutralizing viruses. And a whole lot of people thinking up
ways to invent viruses that can't be got rid of. It's a whole
industry. Lovely, I mean, rotten."
Viruses, I reflected, meant income, to him. ]=-
How's that? Not bad, for a mystery writer! Why, Francis seems
more knowledgable about the subject than the writers of glossy-cover
Page 15
"suit" computer publications! But we're not gonna tell you how
it ends, you'll just have to dig up "Driving Force" (Putnam)
for yourself.
*****************************************************************
IN THE READING ROOM V: NEW YORK TIMES AND THE PHRAKR TRAKR -
BBS's: THE ROOT OFFAL EVIL (OUCH, PUNNY!)
******************************************************************
In a January 25 'A' section article, a N.Y. Times reporter profiles
the "Phrakr Trakr," a federal undercover man keeping our
electronic streets safe from cybernetic hoodlums too numerous to
mention singly.
Reporter Ralph Blumenthal immediately reveals himself as yet
another investigator from the mainstream who has never gotten
anything from underground BBS's first-hand, focusing on the
Phrakr Trakr's tales of nameless computer criminals trafficking
in "stolen information, poison recipes and bomb-making
instructions."
We're not going to dwell on the issue of phone-related phraud
and the misappropriation of credit card accounts (which has
been well-established), but Blumenthal's continued
attention to text files for "turning household chemicals into
deadly poisons, [or] how to build an 'Assassin Box' to supposedly
send a lethal surge through a telephone line" is sickening. It
furthers the generalization that all reporters are fetal-alcohol
damaged rubes with little educational background beyond elementary
school. Anyone who's seen or stock-piled text files on a BBS knows
they're either menacingly written trivial crap or bowdlerized
reprints from engineering, biology and chemistry books. In either
case, hardly noteworthy unless you're one who can't tell the
difference between comic books and real news.
The Times delivers a back-to-the-camera photo of the Phrakr Trakr,
an overweight man with a handcuff dangling from
his suspenders. He "patrols THOUSANDS [emphasis ours] of computer
bulletin boards" states the photo's slug-line, an absurd claim which
neatly overlooks the fact that there's not enough time in a year
to physically accomplish the deed.
The Phrakr Trakr has his own newsletter, F.B.I., for
"Find um [sic], Bust um [sic], Incarcerate um [sic]." "Got any
codez?" indeed.
*****************************************************************
FICTUAL FACT/FACTUAL FICTION
*****************************************************************
HOUSE AD: CRYPT INFOSYTEMS BBS is now running full-time. Pick
up the newest useless files and Crypt Newsletters direct. Bask
in the scintillating conversation and avuncular charm of
sysop and editor, URNST KOUCH. Meet the very funny PALLBEARER.
And acquaint yourself with all their fine friends.
The number? 215.868.1823.
-----------------------------------------------------------------
GRAY AREAS magazine is looking to interview virus authors for
a continuing series of articles. The Crypt Newsletter editorial
staff recently had an opportunity to meet with the editor
of GRAY AREAS, Netta Gilboa, and came away with the conviction
that the magazine is dedicated to exposing all points of view
on many subjects. In other words, you don't need a highly paid
mouthpiece, a movie contract or the Congressional Medal of
Honor to be of interest to its editors. A recent
issue featured an excellent interview with John Perry Barlow
among other sections too numerous to cover adequately here.
Contact GRAY AREAS at any of the following:
grayarea@well.sf.ca.us
ph: 215.353.8238
mail: POB 808
Broomall, PA 19008-0808
--------------------------------------------------------------------
Phalcon/SKISM programmer Dark Angel has produced the G2, or
Second Generation viral code generator. Capable of producing
resident .COM/.EXE infecting virus with limited poylmorphism,
Dark Angel's documentation states the G2 supersedes the
PS-MPC. The Phalcon/SKISM programmer plans to update the G2 code
base as time allows; he maintains in the instructions to the program
that G2 has much more flexibility than the PS-MPC, capable
of multiple arrangements of commented code and data segments.
Although the G2 is separate from the PS-MPC, it appears that
those users familiar with the former will have no trouble
adapting to the latter.
---------------------------------------------------------------------
PRODIGY, the "interactive home computer service" for numerous
mixed-up, Bush-voting, Democrat yuppies, has cut its work force
by 25, putting approximately 250 people onto the street.
----------------------------------------------------------------------
IBM - panicked by the tolling bell of impending corporate doom - has
moved to can CEO John Akers, presumably because the company is
non-competitive under his leadership. Akers will remain to head
the team selected to draft his replacement. Does this make sense
to you or are WE nuts? Draft the guy you're firing to find his own
replacement. Yes, this is a GOOD PLAN. Sell your IBM stock while
you still can. That's the Crypt Newsletter's advice.
____________________________________________________________________
END CREDITS: Thanks and a tip o' the hat to NIKADEMUS, CAPTAIN
AEROSMITH and the usual crew of alert readers.
Page 16
--------------------------------------------------------------------
The Crypt Newsletter includes virus source code in each issue.
If assembled, it will produce working copies of the viruses
described. In the hands of incompetents, irresponsibles and
and even the experienced, these programs can mess up the software
resources of any IBM-compatible PC - most times, irretrievably.
Public knowledge that you possess such samples can make you
unpopular - even shunned - in certain circles of your computer
neighborhood, too.
To assemble the software included in this issue of the newsletter,
copy the MS-DOS program DEBUG.EXE to your current directory,
unzip the newsletter archive into the same directory and
type MAKE at the DOS prompt.
This issue of the newsletter should contain the following
files:
CRPTLT.R12 - this document
MAKE.BAT - instant "maker" for this issue's software.
Ensure that the MS-DOS program DEBUG.EXE is in the
machine path or current directory, before
typing "MAKE".
LOCKJAW.ASM - assembly listing for the LOCKJAW virus
LOKJAWZ.ASM - " " " LOKJAW-ZWEI
LOKJAWD.ASM - " " " LOKJAW-DREI
LOCKJAW.SCR - scriptfile for LOCKJAW
LOKJAWZ.SCR - " " LOKJAW-ZWEI
LOKJAWD.SCR - " " LOKJAW-DREI
SANDRA.SCR - " " SANDRA virus
You can pick up the Crypt Newsletter at these fine BBS's, along with
many other nifty, unique things.
CRYPT INFOSYSTEMS 1-215-868-1823 Comment: Crypt Corporate East
DARK COFFIN 1-215-966-3576 Comment: Crypt Corporate West
THE HELL PIT 1-708-459-7267
DRAGON'S DEN 1-215-882-1415
RIPCO ][ 1-312-528-5020
AIS 1-304-420-6083
CYBERNETIC VIOLENCE 1-514-425-4540
THE VIRUS/BLACK AXIS 1-804-599-4152
NUCLEAR WINTER 1-215-882-9122
UNPHAMILIAR TERRITORY 1-602-PRI-VATE
THE OTHER SIDE 1-512-618-0154
MICRO INFORMATION SYSTEMS SERVICES 1-805-251-0564
REALM OF THE SHADOW 1-210-783-6526
STAIRWAY TO HEAVEN 1-913-235-8936
THE BIT BANK 1-215-966-3812
CYGNUS-X 1-215-791-2457
The Crypt Newsletter staff welcomes your comments, anecdotes,
thoughtful articles and hate mail. You can contact Urnst Kouch
Crypt BBS, CSERVE#:70743,1711 or Internet: 70743.1711@compuserve.com
Page 17
For those who treasure hardcopy, Crypt Newsletter is available as a
FAX subscription: $20 for a ten issue run. It can also be had as one of
those Mickey Mouse-looking papyrus newsletters produced by WordPerfect
C.A.N.T.'s [Corporate Animal, No Talent] for the same price. All
inquiries should be directed to the Crypt Newsletter e-mail
addresses.
-*-
Page 18
