Copy Link
Add to Bookmark
Report
Digital Free Press Vol 1 Issue 3
######### ############ #########
########### ############ ###########
#### #### #### #### ####
#### #### #### #### ####
#### #### ######## ###########
#### #### ######## #########
#### #### #### ####
#### #### #### ####
########### #### ####
######### #### ####
DIGITAL FREE PRESS
-------------------------------------------------------------------------------
Volume 1.0 Issue 3.0
-------------------------------------------------------------------------------
* A Publication of The Underground Computing Foundation (UCF) *
* Send Subscription Requests to: dfp-req%underg@uunet.uu.net *
* Send Submissions to: hackers%underg@uunet.uu.net *
* Editor: Max Cray (max%underg@uunet.uu.net) *
* BBS: The Underground (401) 847-2603 (v.32) *
Back issues can be found in the CUD archives at EFF.ORG.
------------------------------------------------------------------------------
Statement of Purpose and Disclaimer
The Digital Free Press is an uncensored forum to document current
activities in and of the world of modern technology. It is published under the
premise that it is better to know, rather than not know, so no attempt is made
to hide any information no matter how dangerous it may be. Information is a
double edged sword. It is neither good nor bad, and can be used for either
good or bad. Warning: Some information in this document could be used for
illegal activities. Use at your own risk. Articles are the opinion of the
authors listed, and not of the editor (unless of course the editor wrote
it).
------------------------------------------------------------------------------
In this Issue:
1. Mail to Max
2. Viral Footprints by GodNet Raider
3. Character Codes by The BBC
4. Mail Insecurity on Telegard BBS Systems by Hard Rock
5. The NNSC Info Server by Max Cray
------------------------------------------------------------------------------
Mail to Max:
------------------------------------------------------------------------------
To: max%underg@underg.UUCP
Subject: Re: Digital Free Press #2
Newsgroups: alt.bbs,alt.cyberpunk,comp.org.eff.talk,ri.cug
Organization: The Puzzle Palace, UKentucky
Date: Mon, 9 Mar 92 15:03:42 GMT
From: Wes Morgan <uunet!ms.uky.edu!morgan>
Sender: uunet!ms.uky.edu!morgan
In article <wVe0gB2w164w@underg.UUCP> you write:
>[Editor's note: Lesson here is be sure you know your upstream sysadmin's
>policy on distribution of controversial material. I was able to get the uucp
>connection back, but only after agreeing not to distribute DFP anymore
>through his site.]
I was glad to see this comment. Given the fact that "the net" now en-
compasses everything from Crays to AppleIIs, cooperation between admins
and users (even in mundane matters such as electronic mail) is more
necessary than ever before.
I was puzzled, however, when I continued reading this issue of DFP. Even
after you alluded to the importance of foreknowledge, discussion, and
cooperation, you wrote this:
>Accessing and using equipment that you do not own is okay as long as
>you do not prevent those who own it from using it, or damage anything.
How does a remote hacker KNOW the results of his actions? How will the
remote hacker KNOW if he causes damage? How does the remote hacker KNOW
that he is using one of a limited number of access ports? The simple answer,
in many cases, is that he does not, and will not, know the results of many
of his actions.
I have watched hackers attempt to bring my system to a halt through both
subtle and gross methods. I have watched hackers muck about aimlessly in
user files, erasing/corrupting them at random. There are some types of
files which can be corrupted by simply opening them with an editor!
[ Editor's comment: How does a hacker know? By trying it and seeing what
happens, of course, or by reading information, asking others. Same way
everyone else learns. Now why would a hacker try to bring down your system?
Hackers *LIKE* computers. Just because someone was trying to cause you harm
does not mean that all hackers are vandals. Perhaps you could post some
guidelines on your machine, for example a list of files not to be opened
with the editor, and ways that those files could be viewed, etc.]
>Sure he got the source code for VMS, but is there any evidence
>that he used this information for personal gain, or did he simply use the
>information to improve his understanding of the VMS operating system?
This is a moot point. The source code for VMS (or any commercial operating
system) is a copyrighted work. By securing his own copies, he violated that
copyright law and deprived DEC of revenue. There are any number of books
available for loan/purchase which give details of operating system design.
I have seen several such texts which explicitly document VMS internals.
Why weren't those texts an acceptable alternative?
[ Editor's comment: You mean Kevin M. would have bought a copy of VMS,
but since he was able to just take it, he deprived them of revenue? I do
not think so. He never would have bought it. DEC has the same amount of
money no matter if Kevin had the code, or not.
However, I would be interested in that information you have on the
VMS internals.]
>Who owns the Internet?
There is no single entity to which we can assign the label "Internet". The
"Internet" is, in reality, is a conglomerate of cooperating networks. Some
of these networks, such as SURANet, are regional networks; these are funded
by their members. Others, such as THEnet, are limited to a single state;
these are often funded by the government of the State in question. Others
are not really "networks" at all; uucp, which is based on store-and-forward
via telephone calls (rather than a constant connection over a leased line),
is a good example. There is a "backbone" which connects many of these par-
ticipating networks; it is known as NSFnet, and it is maintained by the
National Science Foundation. Many nets which participate in the "Internet"
are commercial; HP, DEC, and IBM have gatewayed their internal networks to
the "Internet".
There may be parts of this conglomerate for which we can determine owner-
ship. Obviously, HP's network belongs to HP, while THEnet belongs to the
State of Texas. Their participation in large-scale networking does NOT
effect any change in their ownership of their own networks/systems.
>Is it some mysterious 'them'
>or is it our net?
It is, most assuredly, NOT "our net". The mere fact that we can access
a facility does NOT imply that we have any rights/privileges whatsoever
on that facility.
Actually, the fact that a network connects two sites is irrelevant. The
question is a simple one: Have the operators/owners of that site granted
me any privileges to use that system? If the system in question has a
GUEST login or, perhaps, an anonymous FTP service, then I have been granted
a certain "privilege of use"; if not, I have neither the privilege nor the
right to attempt access to that system. As I said, the existence of a
connective network is irrelevant; the same rules would apply to me if I
walked into the machine room at that remote site, wouldn't they?
[ Editor's comment: Ok so what good is having access if you don't have any
rights or privledges? Who decides what those rights or privledges are?
Are these rights or privledges stated anywhere? Who said Morris did not
have authorization to write a self-propagating program?]
>If it is our net, then we should be able to try some stuff
>on it, and to heck with 'them' if they can't take a joke.
When someone's "stuff" results in downtime, corrupted files, and trashed
systems, it is NOT a joke. I know sysadmins who spent days recovering from
hacker "exploration" of their system. If it's a commercial site (one which
charges for access), it may lose thousands of dollars in revenue during
recovery. If it's an academic site, hundreds (or thousands) of users may
suffer; research grinds to a halt, academic assignments cannot be finished,
electronic mail stops in its tracks, and all users are displaced by hackers'
exploration. Is this a "joke"? Is your "exploration" and "learning" more
important than the work of hundreds, or thousands, of others?
[Editor's comment: Hey mistakes happen. That is part of life. If you can't
handle it then you should not be a sysadmin, and if you do decide to quit
your job let me know. I would love to be a sysadmin and get to work with big
computers.If its a commercial site my heart bleeds for them. If its an
academic site, then maybe everyone learned something from the experience.]
> It is my contention that hackers did not change. Society changed, and it
>changed for the worse. The environment the early hackers were working in
>correctly viewed these activities as the desire to utilize technology in a
>personal way.
There is an important distinction between the "early hackers" and those of
today. The early hackers did not operate on any system they could find;
their activities were restricted to local machines. In a sense, this limita-
tion made them responsible for their activities. RMS didn't go looking for
systems to "explore" at other universities. Today, hackers rarely operate
on their own systems; most of them prefer to anonymously wander the networks,
looking for systems which they can use/misuse/abuse. To me, that "crosses
the line" between "good" and "bad" hacking. In addition, most of today's
hackers refuse to accept responsibility for their actions. The Dutch hacker
conglomerate, for instance, believes that they can hack any system in the
world, since hacking is currently legal under Dutch law. They saw no prob-
lem in hacking/cracking/crashing systems throughout Europe and the USA. In
fact, one of them said in an interview, "In the real world, I would never
commit a crime."; this person has a badly skewed set of morals, in my opinion.
[ Editor's comment: I do not really see much of a distinction here. Why is it
okay to hack on a local machine that does not belong to you, but not a
networked machine that does not belong to you?
I agree with you about the responsibility thing. I do think hackers
should be responsible for thier actions, even in cyberspace.]
>By definition hackers believe in the free access to computers
>and to the freedom of information.
This definition, sadly, is no longer correct. Today's hackers believe
that computing should be free FOR THEMSELVES; they don't really care
about others. RMS kept to his principles; the gnu.ai.mit.edu systems
provide access for almost anyone who asks. Some other ex-hackers have
set up public access sites, such as Nyx; these are in keeping with the
hacker ethic of the past.
Today's hackers, on the other hand, don't want to expend any of their
own resources. In a recent email conversation with a hacker, he claimed
that his lack of resources gave him the "right" (his word) to hack on
other systems through the networks. That's ridiculous.
I've even been hacked from MIT, a site which has far greater compu-
ting resources than mine. Why would someone at MIT *need* to hack my
systems, when so much is available to them there? The only conclu-
sion I can reach is that those hackers do not want to accept respon-
sibility for their actions. Are you arguing that I have some obli-
gation to condone/support/accept such irresponsibility?
[Editors comment: Perhaps many of today's hackers do not believe in the
hacker ethic of the past. I believe one of the main points of my editorial
was that we should reinforce the hacker ethic. Encourage them to contribute
and be responsible. Perhaps they could perform some sort of service for you
on your machine, in exchange for its use?
Of course they did not *need* to hack your system. A hacker does not
*need* to do anything. There was probably something about your system
they liked. Consider it a compliment.]
>Current bad mouthing of hackers is simply snobbery.
Hardly; I know that my attitude toward today's hackers comes from my
obligation and responsibility to the owners of my systems, as well as
my obligation to the legitimate users.
[ Editors's comment: You are sounding an awful lot like a suit...]
We had a local hacking incident last year. After tracking down the
responsible parties, I offered to give them full access to a small
Unix system (an AT&T 3B2/310), with only one condition; they would
be responsible for the actions taken with that system. None of the
individuals involved wanted to assume responsibility, even though I
was willing to give them root access to a Unix system.
[ Editors comment: ? Got me. I would have taken it. Was it networked? Of
course networked machines are always more interesting.]
>Rather than cracking down on the modern hacker, we
>should reinforce the hacker ethic, a code of conduct not based upon greed and
>lust for the almighty dollar, but instead for personal growth through the free
>access of computers and information, and a respect for technology.
How about adding "respect for the property of others" to that statement?
If I purchased a Porsche, would you assume that you have the "right" to
open up the hood and start tinkering with the engine? I don't think so.
Why should my purchase of, say, a Convex C240 be treated any differently?
[ Editor's comment: Hmm maybe you are right. Maybe they should not be
treated differently. Where do you park it? :) ]
In closing, let me address the question of resources. Many hackers have
told me that "they don't have the money for a Unix system"; in fact, this
is often one of their cardinal arguments in defense of their actions. A
Unix system for 286/386 microcomputers may be purchased for US$99. I find
it very difficult to believe that these people cannot afford that small
amount of money. Most of today's hackers would prefer to siphon their
needs from the monies and efforts spent by the owners/operators of other
systems. They want someone else to fund their "exploration".
[ Editor's comment: The old 'Coherent is just as good as my mainframe'
argument. It is just not the same. Ok, I want to learn VMS. So how about
a $99 VMS clone for my PC?]
My systems are intended for use by a particular group of users; we cannot
fund the needs of the world. No single site can afford to support everyone.
If I could afford to support such activities, I would set up a public access
system. I can't afford that, so I expect others to respect my policies.
This entire discussion boils down to a single question, and no one has been
able to provide a suitable answer:
Why should a site be expected to provide access to anyone
other than those for whom it is purchased/maintained?
Best,
Wes Morgan
--
morgan@ms.uky.edu |Wes Morgan, not speaking for| ....!ukma!ukecc!morgan
morgan@engr.uky.edu |the University of Kentucky's| morgan%engr.uky.edu@UKCC
morgan@ie.pa.uky.edu |Engineering Computing Center| morgan@wuarchive.wustl.edu
------------------------------------------------------------------------------
[Editor's note: Thanks for your e-mail Wes. And to answer your question, I do
not think a site should be expected to provide access to anyone other than
those for whom it is purchased/maintained. However it would be nice if it
did.]
------------------------------------------------------------------------------
##############################################################################
------------------------------------------------------------------------------
From: gnr@tsf.UUCP (GodNet Raider)
Subject: virus scanner codes.
Organization: The CyberUnderground
-=[ The 'McAfee scan' viral footprint codes ]=-
-or-
/*******************************************/
/* A fool and his scanner, can part a user */
/* from his hard earned money. */
/*******************************************/
- written by -
GodNet Raider
- of -
The CyberUnderground
-=[ "Information is the greatest weapon of power to the modern wizard." ]=-
]----------------------------------------------------------------------------[
Introduction:
-------------
Recently I began to wonder about the usefulness of 'virus scanners'
and what if any difference do they have with a simple text/hex search
program (like Nortons filefind/ts). And if there was no real DIFFERENCE,
how secure is the system that used them.
Problems with scanning:
-----------------------
The first question I had to ask was, What does a 'virus scanner' actually
look for? Does it only look for one string of codes or several at different
places in the file?
To answer this question I called a local BBS an dl'ed McAfee's
Scan3.7v64 (to evaluate and after my tests, it was erased for its lack of
offering any real protection). Then I went to my archives to retrieve some
viruses I have experimented with in the past (of which where Jerusalem B and
Dark Avenger).
I ran scan to verify that the virus files where viruses (3 of which did
not set off any alarm even tho there was a listing in the documentation for
them, so I removed them from the test). Then using a sector editor looked at
the source for the McAfee asso. Scan3.7v64 (here after know just as Scan64)
to find that the footprint information was encoded. Needless to say this did
not stop me (for the sake of those who are into the tech aspects of things,
the actual method used to get the codes are included at the end of the
article with the codes found), It took less than an hour to get the codes I
was looking for (without disassembling the code but by looking into the
memory allocated to the program).
What I found out was that Scan was just a simple hex searcher (that kept
its data locked up till needed). It could also be fooled by any program
that contained the same hex string as a real virus (this was proved when,
using a sector editor, I added the Scan64 footprint for the Jerusalem B
into the top of a text file (a place this code would never show up in a real
infection) then renamed it to *.com; Scan64 reported it as infected).
Once the codes where obtained, using Debug directly on a virus file,
I was able to mutate the virus to no longer be detectable by Scan64 without
destroying the integrity of it. For the virus was still able to infect files,
and Scan64 could no longer track it. I was still able to track and control it
using Norton's filefind, diskmon, diskedit, and (of course) DOS erase.
So it seems my question was answered. Some 'virus scanners' just scan
for a single string of hex character. This is fine if viruses NEVER changed
or programs would NEVER use code similar to what a virus would (the smaller
the footprint string the bigger the chance of mistaken alarms). For if
a 'virus scanner' programer just keeps making a new release each time there
is a new virus (an I will not get into the morality of charging customers
the full price of an software upgrade rather than allowing them to buy/dl
new footprint data files as they become available) for the program will
eventually grow to unwieldy sizes. An it should be noted there are other
programs that may do the same job faster, more upward compatibility, and
you may already have them on hand.
A possible solution:
--------------------
One thing that I think is a good idea is when a program allows users
to add new footprint data to it (like Nortons' virus package). For now
users don't need to buy new releases for detection of viruses they may not
get/be able to detect. Instead for the cost of a call to a support bbs (part
of the original software agreement?) the user can get new data as it becomes
available or when they fine a new one on their system they can immediately
add the new footprint rather than wait for the next version to be released.
Method used to obtain footprints:
---------------------------------
After finding the data I was looking for was encoded I thought, How can
I get the data I wanted for my tests?
Disassembling was out, not for any MORAL reason but, for the time
involved. So I thought it must have to decode the data for it's own use
and to save time it would do it all before the scan rather than slow the
process down by doing a full decode. So I needed to look at the memory
image of the running program. Thanks to DOS 5.0 and Dosshell I was able to
do this.
After spawning the scan task under the dos shell I used alt-tab to
swap back to the shell. Once back in the shell I used the shell commands to
copy the ~tmpxxx.swp to foo.img and terminating Scan64 and Dosshell.
Then using a sector editor I searched though the temp file created by
the dos shell. I found an area of data that contained the virus names and
non ascii text data separating them. Even though the strings of ascii data
(virus names) ended with a zero character (as variable strings have a
tendency to), the random data did not end with a common signal character (as
expected for code can be any character). There was also no character count
stored (the data length varied so it could not be assumed by the scan
program as well). So I continued to search though the data.
I eventually found another area that had the same text strings (virus
names). This time the first character of the none ascii data gave the count
of the data size to the following text string. I knew I had found it so I
extracted this data to another file (starting at 0 offset in the new file).
Then wrote down the some codes and checked them against viruses I had.
The codes I had did not seem match. This did not stop me. I took one
virus (that my understanding said scan was only looking for 6 consecutive
bytes to match) and started zapping bytes (in a file scan said was infected)
to find what it was looking for. The processes involved zapping one sector
at a time till scan said it was not infected, then half of that sector, then
half of a half, and so on. It came down to 6 CONSECUTIVE bytes as I expected.
But they where DIFFERENT from the ones I had.
So I went to the windows calculator (it allows byte arithmetic in hex,
ie.. 0xff + 0x04 = 0x03 (rollover, carry is ignored), it would be outside
the scope of this ARTICLE to explain why I thought byte arithmetic was
important). Some quick subtraction found a 0x93 (decimal 147) DIFFERENCE
between the actual codes and the ones from the allocated memory uses by
scan.
So taking another virus that scan said was infected I did the minor
hex math on the codes in the allocated memory used by scan and found the
codes. Then i zapped only the codes and ran scan on the updated virus file.
It said there was no infection. I knew I now had the right codes (after a few
more checks).
So I created a simple C program (see below) to convert the extract file I
created and converted the codes to a readable form (output from program
listed at end of ARTICLE). Then tested other viruses against the list. An
found the same results.
Binary to hex program:
----------------------
/*
fp2txt.c
Convert footprint binary information to text.
by GodNet Raider
Notes:
Please forgive the unrefined/un annotated nature of this code it was
designed as a one shot.
*/
#include <stdlib.h>
#include <stdio.h>
#define TRUE 1
#define MAGICNUM 0x93
void
main (void);
void main (void)
{
unsigned char
sVirusFP [128],
*ptVirusInfo,
szVirusName [128];
register unsigned int
nTmpCnt;
FILE
*Stream;
Stream = fopen ("fp2.img", "rb");
while (!feof (Stream))
{
ptVirusInfo = sVirusFP;
if (!(*sVirusFP = getc (Stream)))
exit (0);
nTmpCnt = (unsigned int) *sVirusFP;
while (nTmpCnt--)
*(++ptVirusInfo) = ((unsigned char) getc (Stream)) - MAGICNUM;
ptVirusInfo = szVirusName;
while ((*(ptVirusInfo++) = getc (Stream)));
printf ("\n%s:\n ", szVirusName);
ptVirusInfo = sVirusFP;
nTmpCnt = (unsigned int) *sVirusFP;
while (nTmpCnt--)
{
printf ("0x%02x ", (unsigned int) *(++ptVirusInfo));
if (nTmpCnt && !((*sVirusFP - nTmpCnt) % 8))
printf ("\n ");
}
printf ("\n");
getc (Stream);
}
exit (0);
}
Footprints discovered:
----------------------
The following is a list of the footprint codes found in McAfee asso.
Scan3.7v64.
1008 Virus [1008]:
0x81 0xed 0x38 0x00 0xe8 0xc3
Stoned-II Virus [S-2]:
0x9c 0x2e 0xff 0x1e 0x09 0x00
VHP-2 Virus [VHP2]:
0x1c 0x8c 0x44 0x02 0xb8 0x24 0x35 0xcd
0x21 0x89
VHP Virus [VHP]:
0x07 0x89 0x7e 0x8a 0x8d 0x7e 0x90 0x89
0x7e 0x88
Taiwan3 Virus [T3]:
0x17 0x0f 0x32 0x0a 0x32 0x0a 0x90 0x0b
0xfb 0x08
Armagedon Virus [Arma]:
0xb8 0x00 0x43 0xcd 0x21 0x2e 0x89 0x0e
0x48 0x01
1381 Virus [1381]:
0x1e 0x06 0x8c 0xc8 0x8e 0xd8 0xb8 0x40
0x00 0x8e
Tiny Virus [Tiny]:
0xb4 0x40 0x8d 0x94 0xab 0x01 0xb9 0x02
0x00 0xcd
Subliminal Virus [Sub]:
0x8b 0x3e 0x25 0x01 0x8b 0xd7 0x2e 0x8e
0x06 0x27
Sorry Virus [Sorry]:
0xeb 0x96 0x83 0x2e 0x12 0x00 0x40 0x83
0x2e 0x03
1024 Virus [1024]:
0xc8 0x75 0xed 0x8b 0xd1 0xb8 0x00 0x42
0xcd 0x21 0x72
RedX Virus [RedX]:
0x52 0x8b 0x9c 0x17 0x04 0xb9 0x19 0x03
0x8d 0x94
VP Virus [VP]:
0x21 0x89 0x1e 0x22 0x03 0x8c 0x06 0x24
0x03 0xb4
Print Screen-2 [P-2]:
0x74 0x01 0xbf 0x03 0x00 0xb9 0x20 0x00
0xf3 0xa4
Joshi Virus [Joshi]:
0xf3 0xa4 0x8c 0xc0 0x05 0x20 0x00 0x8e
0xc0 0xbb
Microbes Virus [Micro]:
0x8e 0xd0 0xbc 0x00 0xf0 0xfb 0xa1 0x13
0x04 0x2d 0x04
Print Screen Virus [Prtscr]:
0xcd 0x05 0xfe 0xc8 0xa2 0x60 0x01 0xc3
0x6f 0x6e 0x2d
Form Virus [Form]:
0xe8 0xb2 0x00 0x5a 0x5e 0x1f 0x33 0xc0
0x50 0xb8 0x00 0x7c
June 13th Virus [J13]:
0x12 0x00 0xb9 0xb1 0x04 0x2e 0x30 0x04
0x46 0xe2
JoJo Virus [JoJo]:
0x4d 0x2b 0xd0 0x4a 0x45 0x03 0xe8 0x45
0x8e 0xc5
Victor Virus [Victor]:
0x74 0x26 0x80 0xfc 0x5b 0x74 0x21 0x80
0xfc 0x39
5120 Virus [5120]:
0x10 0xa2 0xf6 0x0f 0xe8 0xd0 0xfe 0x80
0x3e 0x4a 0x10 0x02 0x7d 0x22 0xc6 0x46
W-13 Virus [W13]:
0xf3 0xa4 0x8b 0xfa 0xb4 0x30 0xcd 0x21
0x3c 0x00
Slow Virus [Slow]:
0x81 0xc6 0x1b 0x00 0xb9 0x90 0x06 0x2e
0x80 0x34
Liberty Virus [Liberty]:
0xe8 0xfd 0xfe 0x72 0x2a 0x3b 0xc1 0x7c
0x27 0xe8
Fish Virus [Fish]:
0x0e 0x01 0xcf 0xe8 0x00 0x00 0x5b 0x81
0xeb 0xa9
Shake Virus [Shake]:
0x31 0xd2 0x8b 0xca 0xcd 0x21 0x3d 0x00
0xf0 0x73
Murphy Virus [Murphy]:
0x81 0x7c 0xfe 0x2e 0x43 0x75 0xed 0xb8
0x02 0x3d
V800 Virus [V800]:
0x51 0xad 0x33 0xd0 0xe2 0xfb 0x59 0x31
0x15 0x47
Kennedy Virus [Kennedy]:
0x8c 0x55 0x02 0xb8 0x01 0x43 0x33 0xc9
0xcd 0x21
Yankee Two Virus [Doodle2]:
0x73 0x03 0x5a 0x5e 0xc3 0x8b 0xf2 0xf6
0x44 0x15
1971 Virus [1971]:
0x33 0xd2 0xb8 0x00 0x42 0xcd 0x21 0x72
0x26 0x81 0x7c
June 16th Virus [June16]:
0x4d 0xa9 0xa5 0x2e 0x70 0x66 0x2e 0x57
0x09 0x0f
AIDS II Virus [A2]:
0xa4 0x00 0x55 0x89 0xe5 0x81 0xec 0x02
0x02 0xbf 0xca 0x05 0x0e 0x57 0xbf 0x3e
0x01
1210 Virus [1210]:
0xc4 0x74 0xf0 0x2e 0x80 0x3e 0x2f 0x04
0x01 0x75
1720 Virus [1720]:
0xd8 0x2e 0xa1 0x2c 0x00 0xa3 0xfc 0x03
0x2e 0xa0
Saturday 14th Virus [Sat14]:
0x0e 0x1f 0xb8 0x24 0x35 0xcd 0x21 0x8c
0x06 0x6f
XA1 (1539) Christmas Virus [XA1]:
0xfa 0x8b 0xec 0x58 0x32 0xc0 0x89 0x46
0x02 0x81
1392 (Amoeba) Virus [1392]:
0x16 0xa3 0x21 0x01 0x8b 0x44 0x14 0xa3
0x23 0x01
Vcomm Virus [Vcomm]:
0x77 0x02 0xb9 0x20 0x00 0xb4 0x4e 0xcd
0x21
ItaVir Virus [Ita]:
0xb8 0x58 0x45 0x89 0x40 0x02 0xb0 0x00
0x88 0x40 0x04
Korea Virus [Korea]:
0x8e 0xd0 0xbc 0xf0 0xff 0xfb 0xbb 0x13
0x04
Solano Virus [Solano]:
0x12 0x75 0x0e 0x2e 0x8b 0x0e 0x03 0x01
V2000 Virus [2000]:
0x51 0xe8 0x39 0xfd 0x8e 0xc3 0x26 0x8b
12 Tricks Trojan [Tricks]:
0x64 0x02 0x31 0x94 0x42 0x01 0xd1 0xc2
0x4e 0x79 0xf7
12 Tricks Trojan [Tricks-B]:
0xe4 0x61 0x8a 0xe0 0x0c 0x80 0xe6 0x61
1559 Virus [1559]:
0x03 0x26 0x89 0x1e 0x92 0x00 0xfb 0xc3
0x50 0x53 0x51 0x52 0x06
512 Virus [512]:
0x01 0x8c 0x45 0x70 0x1f 0x89 0x57 0x14
0x8c 0xca 0x8e 0xda
EDV Virus [EDV]:
0x75 0x1c 0x80 0xfe 0x01 0x75 0x17 0x5b
0x07 0x1f 0x58 0x83
Icelandic-3 Virus [Ice-3]:
0x24 0x2e 0x8f 0x06 0x3b 0x03 0x90 0x2e
0x8f 0x06
Perfume Virus [Fume]:
0x04 0x06 0xbf 0xba 0x00 0x57 0xcb 0x0e
0x1f 0x8e 0x06
Joker Virus [Joke]:
0x56 0x07 0x45 0x07 0x21 0x07 0x1d 0x49
0x27 0x6d 0x20 0x73 0x6f 0x20 0x6d 0x75
0x63
Virus-101 [101]:
0xb3 0x01 0xb4 0x36 0x70 0xb7 0x01 0xb4
0x36 0x70 0x8b 0x37 0xb4 0x36 0x70 0xb3
0x03 0xb4 0x36 0x70 0x03 0xf3 0xb4
Halloechen Virus [Hal]:
0x8c 0xd0 0x8b 0xd4 0xbc 0x02 0x00 0x36
0x8b 0x0e
Taiwan Virus [Taiwan]:
0x8a 0x0e 0x95 0x00 0x81 0xe1 0xfe 0x00
0xba 0x9e
Oropax Virus [Oro]:
0x3e 0x01 0x1d 0xf2 0x77 0xd1 0xba 0x00
Chaos Virus [Chaos]:
0xa1 0x49 0x43 0x68 0x41 0x4f 0x53 0x50
0x52 0x51 0xe8
4096 Virus [4096]:
0xf6 0x2e 0x8f 0x06 0x41 0x12 0x2e 0x8f
0x06 0x43
Virus-90 [90]:
0x81 0xb8 0xfe 0xff 0x8e 0xd8 0x2d 0xcc
AIDS Information Trojan [Aids]:
0x31 0x30 0x30 0x2c 0x36 0x32 0x2c 0x33
0x32 0x00
Devil's Dance Virus [Dance]:
0x5e 0x1e 0x06 0x8c 0xc0 0x48 0x8e 0xc0
0x26
Amstrad Virus [Amst]:
0x72 0x02 0xeb 0x36 0x76 0xba 0x80 0x00
0xb4 0x1a 0xcd 0x21 0x80 0x3e
Datacrime II-b Virus [Crime-2B]:
0x2e 0x8a 0x07 0x32 0xc2 0xd0 0xca 0x2e
Holland Girl Virus [Holland]:
0x36 0x03 0x01 0x33 0xc9 0x33 0xc0 0xac
Do Nothing Virus [Nothing]:
0x72 0x04 0x50 0xeb 0x07 0x90 0xb4 0x4c
Lisbon Virus [Lisb]:
0x8b 0x44 0x79 0x3d 0x0a 0x00 0x72 0xde
Sunday Virus [Sunday]:
0x75 0x10 0x07 0x2e 0x8e 0x16 0x45 0x00
0x2e 0x8b
Typo COM virus [Typo]:
0x99 0xfe 0x26 0xa1 0x5a 0x00 0x2e 0x89
DBASE Virus [Dbase]:
0x80 0xfc 0x6c 0x74 0xea 0x80 0xfc 0x5b
0x74 0xe5
Ghost Virus :
0x90 0xea 0x59 0xec 0x00 0xf0 0x90 0x90
Jerusalem Virus Strain B [Jeru]:
0x47 0x00 0x33 0xc0 0x8e 0xc0 0x26 0xa1
0xfc 0x03
Alabama Virus [Alabama]:
0x8f 0x06 0x18 0x05 0x26 0x8f 0x06 0x1a
1701/1704 Virus - Version B [170X]:
0x31 0x34 0x31 0x24 0x46 0x4c
Datacrime Virus [Crime]:
0x36 0x01 0x01 0x83 0xee 0x03 0x8b 0xc6
0x3d 0x00
Stoned Virus [Stoned]:
0x00 0x53 0x51 0x52 0x06 0x56 0x57 0xbe
Vacsina virus [Vacs]:
0xb8 0x01 0x43 0x8e 0x5e 0x0e 0x8b 0x56
0x06 0x2e
Den Zuk Virus :
0x8e 0xc0 0xbe 0xc6 0x7c 0xbf 0x00 0x7e
Ping Pong Virus (old string):
0x59 0x5b 0x58 0x07 0x1f 0xea
Pakistani Brain Virus [Brain]:
0x8e 0xd8 0x8e 0xd0 0xbc 0x00 0xf0 0xfb
0xa0 0x06
Yale/Alameda Virus [Alameda]:
0xb4 0x00 0xcd 0x13 0x72 0x0d 0xb8 0x01
Lehigh Virus [Lehigh]:
0x5e 0x83 0xee 0x03 0x8b 0xde 0x81 0xeb
0x91 0x01
Pakistani Brain/Ashar Virus [Brain]:
0x20 0x8c 0xc8 0x8e 0xd8 0x8e 0xd0
Fu Manchu Virus - Version A [Fu]:
0x26 0xc7 0x06 0xfc 0x03 0xf3 0xa4 0x26
0xc6 0x06
Ping Pong Virus - Version B [Ping]:
0@xa1 0@xf5 0x81 0@xa3 0@xf5 0x7d 0x8b 0x36
0xf9 0x81
1536 (Zero Bug) Virus [Zero]:
0xeb 0x2b 0x90 0x5a 0x45 0xcd 0x60 0x2e
Vienna (DOS 62) Virus - Version B [Vienna]:
0x8b 0@xfe 0x36 0x6f 0xc7 0x1f 0x36 0x6f
0x8b 0@xde 0x36 0x6f 0xc6 0x1f
Ghost Version of DOS-62 [Ghost-C]:
0x8e 0xd8 0@xa1 0x13 0x04 0x2d 0x02 0x00
0x90 0xa3 0x13
Friday 13th Virus [@Fri13]:
0xb4 0x4f 0xcd 0x21 0x73 0@xf7 0x58
405 virus [405]:
0x19 0xcd 0x21 0x26 0xa2 0x49 0x02 0xb4
0x47 0x04 0x01 0x50
3066/2930 Traceback Virus [3066]:
0x14 0x8b 0x4d 0x16 0x8b 0xc1 0x8a 0xcd
Pentagon Virus :
0xeb 0x34 0x90 0x48 0x41 0x4c 0x20 0x20
Israeli Boot Virus:
0xcd 0x13 0xb8 0x02 0x02 0xb9 0x06 0x27
0xba 0x00 0x01
Typo Boot Virus:
0x24 0x13 0x55 0xaa
Datacrime-2 Virus [Crime-2]:
0x8a 0x94 0x03 0x01 0x8d 0xbc 0x29 0x01
0x8d 0x8c 0xea 0x06
Ohio Virus:
0xeb 0x29 0x90 0x49 0x34 0x12 0x00 0x01
0x00 0x00 0x00 0x00
3551 (Syslock) Virus [Syslock]:
0x33 0x06 0x14 0x00 0x31 0x04 0x46 0x46
0xe2 0xf2
Dark Avenger virus [Dav]:
0xa1 0x4f 0x07 0x89 0x07 0x2e 0xa1 0x51
MIX1/Icelandic Virus [Ice]:
0x43 0x81 0x3f 0x45 0x58 0x75 0xf1 0xb8
0x00 0x43
Disk Killer Virus [Killer]:
0xc3 0x10 0xe2 0xf2 0xc6 0x06 0xf3 0x01
0xff 0x90 0xeb 0x55
AIDS Virus [Taunt]:
0x42 0xe8 0xef 0xe3 0xbf 0xca 0x03 0x1e
Yankee Doodle Virus [Doodle]:
0x35 0xcd 0x21 0x8b 0xf3 0x8c 0xc7
Suriv A Virus [SurivA]:
0x90 0x73 0x55 0x52 0x49 0x56 0x00
Suriv B Virus [SurivB]:
0x00 0x73 0x55 0x52 0x49 0x56 0x00
]============================================================================[
--
...uunet!underg!tsf!gnr (GodNet Raider)
-=[ "Information is the greatest weapon of power to the modern wizard." ]=-
-=[ "You gotta learn to listen, before you learn to play." ]=-
[ Editor's note: This was recently posted to alt.hackers, and comp.viruses
and is republished for those who missed it, or do not have access to Usenet,
and for archival purposes. A more devious mind could think of all sorts of
fun using this information, like fake virus programs, etc. The scan
signatures themselves are not dangerous.]
------------------------------------------------------------------------------
##############################################################################
------------------------------------------------------------------------------
Phun With Character Codes
by The BBC
Sunny day... Bringing the clouds your way... On your way to where
the minds aren't clean.......... Can you tell us how to get... How
to get to Hackers street... How to get to Hackers street... How to
get to Hackers street.........
Today on Hackers street... We learn about the control letters...
S... and G... An the number....... 0....
Hello kiddies, An what a dreary day in the neighborhood... [Oops
sorry wrong show]..... Well any way welcome to Hackers street... We
are your good friends The BBC... Today we thought.... Why look there
is Big Hackbird, an he looks depressed, lets find out why...
Hackbird Why so down... 'Well BBC it seems that all the
users\sysop stoped using ANSI [AAAAHHHHHHHH] on their systems'...
'Now I can't make problem messages'... 'What is a Hackbird to do'...
Never fear, Hackbird, The BBC is here... Have we ever let you down
before??? 'Well yes, there was that time you dropped me and a short
sysop from the world trade center to prove that all objects fall at
the same rate on last weeks show and...' [Smack] Well anyway...
So today then we will learn [Thanks to the new feature of some
boards that let users [and hackers] upload messages using protocols
other than ascii]... Yes now you can imbed into messages special
chars. that can not be typed in, in some cases... Three of which
are... ^G, ^S, and the null char. [0x00]... An what nasty little
things they could be used for... Not that We would even suggest
such things...
First we will talk about ^G [0x07] better know as the bell
char.... 'Me, know about bell. Noisy, don't like'... 'But it bother
ears to put in and some boards don't take'... 'An what is few beep
anyway'...That is true Crashy monster... But, Remember there are now
boards that let us upload large messages... An we are no longer
talking a few beeps but instead a few thousand beeps... For till a
paused is reached [80 * 24 or 1920 chars. in some cases] a person
must listen to our lil' musical... Crash in 'c' minor... 'Yes, me
see... Me like, me like'... Well if you liked that you will love
what comes next... But first would like to help us test something...
'Ya, Ya what... New Virus, Trojan, Password cracker'... No just this
new trap door and spiked pit... 'What spiked... AHHHHHHHHhhhhhh
[Splat]'...
'Yes, this is Kermit t. Protocol reporting from BBC labs'...
Today they are hard at work with their new toy ^S [0x13]...
'Professor BBC tell us about this ^S'... Well lil' green buddy it is
the infamous Xoff char.... It is used to signal the remote not to
send anymore chars. till a ^Q [0x11 (Xon)] is received... What this
will do is make the caller think his keyboard is locked for what he
types is not sent... Ohhhh if they have any brains they will hit
the ^Q manually but don't expect much... An to put a few of these
in a message will cause a bit of a problem... An the quote features
will carry them forward as well.. 'That is nice, what else is BBC
labs working on'... We are glad you asked... We have branched out
into the realm of comedy... Like over here is out latest joke... How
would you like to be part of this great experiment kermy... 'Well I
guess... what the blender for?'... Ok, Ready... What is green and
red n' goes 120 MPH... 'I don't know... Hey! What are you doing...'
.. Kermit t. Protocol in a blender... [BUZZZZZZZZZZZ]
'Ahhhhhhhhhhhhhhhhhh...
Finally kiddies, Grover the pirate will help us with... 'Yes! I
Grover the pirate will help the BBC with their talk about...'
Groovy... Now, you want to be in next weeks show, right... 'Well
yes.. but why wouldn't I'... Well you could meet with a nasty
mishap... 'What kind of mishap?'... Well like someone could hit this
rope with a knife [Snap]... 'So'... Well that rope supported a 16
ton weight over your head... 'What 16 to....[Splat]'... Now kids we
hope you learned from this, an remember never play with knives near
ropes attached to 16 ton weights... Well now that we will not be
bothered... The Null char. [0x00] is a funny little thing in that
some BBS software will not send it in ansii mode... So you ask what
good is a char. like that... Well there may come the time you need a
timer... a way to make the host wait a few seconds after sending a
group of chars. like an Attention signal [in most cases '+++']...
For to get a message to the host modem you must sent an attention
signal then wait about 3 seconds before sending the hangup command
[ATH0] to have the users session bail out in mid message... Of
course you will have to send about 5 pages worth [no line returns]
of this char. to get the right delay... But thank to the non ascii
upload method this will be easy... An we would hope you will not use
this to send an hangup followed by a call command to a 900 number...
That would be most evil... An you may grow up to be scum like...
The BBC
----------------------------------------------------------------------
...uunet!underg!tsf!bbc (The BBC)
-=[ "Anarchy is never HAVING to say you're sorry." ]=-
----------------------------------------------------------------------
------------------------------------------------------------------------------
##############################################################################
------------------------------------------------------------------------------
To: hackers@underg.UUCP
Subject: All I want is to be is in DFP #3
From: hardrock@underg.UUCP (hard rock)
Date: Wed, 15 Apr 92 18:13:56 EDT
Organization: Underground Computing Foundation
******************************************************************
** WAY TO READ OTHER PEOPLE'S MAIL ON TELEGARD BBS! **
******************************************************************
Well a friend of yours or maybe a enemy, well who ever this person
is, is a regular caller of the BBS type Telegard v2.7. You out of
normal curious nature, would like to know what he is writing about
to the other babes on the system. Well a couple of ways can be
used, some legal some not:
A) Break into the sysop's house when he/she is at work, or on
vacation and just reading, hoping the neighbors didn't hear
you use TNT to break down the door. This method can be
somewhat dangerous, but still possible.
B) Find out the working schedule of the sysop and when he/she is
not home, spend it trying to hack out the privileged accounts.
This could get kind of boring or tiring after a while. Also,
if you are a *real* hacker, you live on pizza and chips. Well
the chip company and local pizza joint will be getting a lot
of your drug money.
C) Use the method I am going to tell you. Can be a little tedious,
if you want to read a lot of mail from different users.
D) And any other scummy forms of hacking.
Well, I feel the most logical one is 'C'. Well to get down to how
to do it, first you must find out the full alias used by the
victim. For example: Let me pick a name randomly out of my head,
well how about 'TWO FACE'. Hey, no booing allowed!!! What I
mean by FULL ALIAS, is don't try it will TWO or 2FACE, basically
use that thing between your ears. With this name, you would try
to log on as 'TWO FACE2' or 'TWO FACE1'. The object is to make
sure a character follows the real name. It will allow you to log
on, after the logon, go to the message section and start reading.
The reason this works is because, simple: In the message section
the computer looks at the first message FROM:Peter Pan TO:Killer
Bee. Your name, TWO FACE2, doesn't start with a P or a K so it
skips that message. The next message it looks at, FROM:Amy Lowell
TO:TWO FACE. The 'T''W''O'' ''F''A''C''E'' is all equal. It
allows you to read it. It doesn't check to see that you have a
extra character.
Well enjoy, this small but useful hack. I will be reporting if
this works on other BBS systems. Maybe, PCBoard has a small error
like this. (c)1992 Hard Rock
* * * * * * * * * * * * * * * NOTE * * * * * * * * * * * * * * *
I am NOT in any way responsible for you getting you ass screwed
because you attempt to mess around with some local subscription
system. Don't say to the sysop or cops, well it was HARD ROCK,
yeah that dude who wrote the document. LAST TIME: THIS IS FOR
INFORMATION USE ONLY!!!
------------------------------------------------------------------------------
##############################################################################
------------------------------------------------------------------------------
The NNSC Info Server
by Max Cray
The National Science Foundation Network Service Center (NNSC) operates
the Info-Server for the purpose of providing important Internet
documents by email.
To order the help document, Send a message to info-server@nnsc.nsf.net.
The Subject field does not matter and may be omitted. Place the
following text in the body of the message:
request: info
topic: help
For example, this document can be obtained from this service:
------------------------------------------------------------------------------
NETWORK PROVIDER REFERRAL LIST
NSF Network Service Center (NNSC)
13 April 1992
The NSF Network Service Center (NNSC) often receives the initial calls from
sites wishing to connect to the Internet. The NNSC refers such callers to
the appropriate contacts for any networks which might be able to serve them.
The current list of contacts used by NNSC for this purpose follows. If you
have any updates or corrections to this information, please send a message
to nnsc@nnsc.nsf.net.
-------------------------------------------------------------------------
Network Service Area
Contact Name Phone Number Mail Address
-------------------------------------------------------------------------
Providers Based in the United States of America
-------------------------------------------------------------------------
Alternet US and International
UUNET (800) 4UUNET3 alternet-info@uunet.uu.net
ANS US and International
Joel Maloff (313) 663-7610 maloff@nis.ans.net
BARRNET Bay Area, California (CA)
William Yundt (415) 723-3104 gd.why@forsythe.stanford.edu
CERFnet Western US and International
CERFnet Hotline (800) 876-2373 help@cerf.net
CICnet Midwest US (MN, WI, IA, IN, IL, MI, OH)
John Hankins (313) 998-6102 hankins@cic.net
CO Supernet Colorado (CO)
Ken Harmon (303) 273-3475 kharmon@csn.org
CONCERT North Carolina (NC)
Joe Ragland (919) 248-1404 jrr@concert.net
International Connections Manager (ICM) International
Robert Collet (703) 904-2230 rcollet@icm1.icp.net
INet Indiana (IN)
Dick Ellis (812) 855-4240 ellis@ucs.indiana.edu
JVNCnet US and International
Sergio Heker (800) 35TIGER market@jvnc.net
Allison Pihl
Los Nettos Los Angeles Area (CA)
Ann Westine Cooper (213) 822-1511 los-nettos-request@isi.edu
MichNet/Merit Michigan (MI)
Jeff Ogden (313) 764-9430 jogden@merit.edu
MIDnet Mid US (NE, OK, AR, MO, IA, KS, SD)
Dale Finkelson (402) 472-5032 dmf@westie.unl.edu
MRnet Minnesota (MN)
Dennis Fazio (612) 342-2570 dfazio@mr.net
MSEN Michigan (MI)
Owen Medd (313) 741-1120 info@msen.com
NEARnet Northeastern US (ME NH VT CT RI MA)
John Curran (617) 873-8730 nearnet-staff@nic.near.net
netILLINOIS Illinois (IL)
Joel L. Hartman (309) 677-3100 joel@bradley.bradley.edu
NevadaNet Nevada (NV)
Don Zitter (702) 784-6133 zitter@nevada.edu
NorthwestNet Northwestern US (WA OR ID MT ND WY AK)
Eric Hood (206) 562-3000 ehood@nwnet.net
NYSERnet New York (NY)
Jim Luckett (315) 443-4120 info@nysernet.org
OARnet Ohio (OH)
Alison Brown (614) 292-8100 alison@oar.net
PACCOM Hawaii (HI) and Australia, Japan, Korea, New Zealand, Hong Kong
Torben Nielsen (808) 956-3499 torben@hawaii.edu
PREPnet Pennsylvania (PA)
Thomas Bajzek (412) 268-7870 twb+@andrew.cmu.edu
PSCNET Eastern US (PA, OH, WV)
Eugene Hastings (412) 268-4960 pscnet-admin@psc.edu
PSINet US and International
PSI, Inc. (800) 82PSI82 info@psi.com
Sesquinet Texas (TX)
Farrell Gerbode (713) 527-4988 farrell@rice.edu
SDSCnet San Diego Area (CA)
Paul Love (619) 534-5043 loveep@sds.sdsc.edu
SURAnet Southeastern US (WV, VA, SC, NC, TN, KY, LA, MS, AL, GA, FL)
Jack Hahn (301) 982-4600 hahn@sura.net
THEnet Texas (TX)
Tracy LaQuey Parker (512) 471-2444 tracy@utexas.edu
VERnet Virginia (VA)
James Jokl (804) 924-0616 jaj@virginia.edu
Westnet Western US (AZ, CO, ID, NM, UT, WY)
Pat Burns (303) 491-7260 pburns@yuma.acns.colostate.edu
WiscNet Wisconsin (WI)
Tad Pinkerton (608) 262-8874 tad@cs.wisc.edu
WVNET West Virginia (WV)
Harper Grimm (304) 293-5192 cc011041@wvnvms.wvnet.edu
-------------------------------------------------------------------------
Providers Based Outside the United States of America
-------------------------------------------------------------------------
AARNet Australia
AARNet Support +61 6 249 3385 aarnet@aarnet.edu.au
UKnet United Kingdom of Great Britain and Northern Ireland
UKnet Support +44-227-475497 postmaster@uknet.ac.uk
EUnet Europe, CIS-region, and Northern Africa
EUnet Support +31 20 592-5124 glenn@eu.net
--------
------------------------------------------------------------------------------
##############################################################################
------------------------------------------------------------------------------
Well folks, thats all for DFP #3. Information needed for future articles:
1. Hacker and Computer Underground Resources: Magazines, Journals, BBSes,
Archives, etc. If you have any information to share please e-mail
complete details to hackers%underg@uunet.uu.net. The information
will be summarized in a future article.
2. E-Mail addresses of famous people. If you know of any e-mail addresses
of famous people please e-mail them. All sources will be kept
confidential. If you are a famous person, and do not want to be on
the list please send e-mail (heheh).
Keep that e-mail coming!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-= Max Cray =-
Internet: underg!max@uunet.uu.net Support
UUCP: ...!uunet!underg!max Free
Data: The Underground Computing Foundation BBS Software
401-847-2603 -=- 9600 baud (v.32) (w/src)
CI$: 76334,2203
