Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/VIRUS/V101PT1

Text File | 1989-04-26 | 15KB | 242 lines

Portal-Rmail-To: [e-mail]
Received: by portal.com (3.2/Portal 8)
    id AA13151; Wed, 26 Apr 89 01:38:19 PDT
Received: from Sun.COM (arpa-dev) by sun.Sun.COM (4.0/SMI-4.0)
    id AA18511; Tue, 25 Apr 89 23:07:04 PDT
Received: from sun by Sun.COM (4.1/SMI-4.0)
    id AB12617; Tue, 25 Apr 89 23:06:36 PDT
Message-Id: <[e-mail]>
Received: from LEHIIBM1.BITNET by IBM1.CC.Lehigh.Edu (IBM VM SMTP R1.2) with BSMTP id 5944; Wed, 26 Apr 89 02:02:41 EDT
Received: by LEHIIBM1 (Mailer R2.03A) id 5718; Wed, 26 Apr 89 02:02:38 EDT
Date:         Wed, 26 Apr 89 02:02:37 EDT
From: Revised List Processor (1.5o) <[e-mail]>
Subject:      File: "V101 1" being sent to you
To: "Gary F. Tom" <sun!portal!cup.portal.com!garyt>

Subject: Virus 101 - Chapter 1
From: [e-mail] (George Woodside)
Newsgroups: comp.sys.atari.st,comp.sys.apple,comp.sys.mac,comp.sys.ibm.pc
Date: 1 Mar 89 14:39:58 GMT
Organization: Citicorp/TTI, Santa Monica

Preface: The program VKILLER is specific to the ATARI ST. My apologies for
not making this clear in the previous posting, which went to several
newsgroups. I have recieved far too many requests for the program from users
of other systems to reply to each one individually, and the mailer has
bounced some of the replies I tried to send. If you have an Atari, VKILLER
was posted here a few weeks ago, and is available in the archives, on GEnie,
Compuserve, and from most public domain disk distributors and User Group
libraries. The current version is 2.01.

Initial postings will cover virus fundamentals, as they apply to the area of
the Atari ST and, similarly, to MS-DOS systems. The file systems of the two
machines are nearly identical. These general information articles will be
cross-posted to the newsgroups in which this topic is now active. Future
postings will be made only to the Atari newsgroup, since they will deal with
viruses (the plural, according to Webster's, is viruses) known to exist in
the ST world.  They would automatically be different than an IBM virus,
since they are in the 68000 instruction set, or from a Mac or Amiga virus,
since the file systems differ. Since all the viruses I have located are the
"BOOT SECTOR" type (far and away the most common), that's what I will dwell
upon. If and when the proposed newsgroup comp.virus becomes active, it will
be added to the list for all postings.

Your generic disclaimer: I just an old-school computer hacker, with 20 years
in the software business. I built my first IMSAI many years ago, and have
had several different computers. That qualifies me to have spent a lot of
time on computers, but nothing further. I may be wrong about some things,
may have a different opinion than you or anybody else, or most anything else
you'd care to have disclaimed. What I think is my own opinion, and in no way
represents the opinion or position of my employer or anyone else. I've
written several articles for magazines as well as software related to virus
detection and killing, but I have been known to be wrong (so they tell me
:^)).

While posting any kind of information about viruses may trigger someone to
attempt creating one, I believe that the benefit of the knowledge to
potential victims outweighs that risk. I don't believe that you can stop
someone (who wishes to) from creating a virus by withholding information -
it is already available from many sources.  Since not all viruses act the
same, or attempt to attack in the same manner, it may help potential (or
current) victims to learn about the symptoms of the viruses known to exist,
and how to protect themselves.

While the concept of viruses can be complex, I'll try to keep things at a
level that should be understandable by most anyone past the casual user
genre. However, since I've been at this sort of thing for some time, what I
consider basic knowledge may not be familiar to everyone. Advance apologies
are offered here for any invalid assumptions, typos, smart alec remarks,
grammatic errors, or whatever offends you.

Some basic terms, as they have come to be used in this area:

A VIRUS is any program which spreads itself secretly. It may be destructive,
a prank, or even intended to be helpful, but it spreads.

A TROJAN HORSE is a program which executes one function secretly while
appearing to be accomplishing some other task, or appearing to be some other
program entirely. One task a Trojan Horse may accomplish is to install a
virus, which would then spread itself.

A WORM is a program or function which imbeds itself inside another program,
be it an application, part of a system, a library or whatever. It may or may
not spread itself by some means, and may or may not have destructive
intents.

Now, to the basics of a disk (specifically floppies, but true of most hard
disks as well):

A DIRECTORY is a list of files and sub-directories. There is one primary
directory (called the root directory) on a disk. It contains the entries for
files, and other directories (called sub-directories, or folders on the
Atari). Sub-directories (folders) may contain entries of other
sub-directories, files, or both. Every file has one entry in the disk
directory (or in some sub-directory). That entry contains, among other
things, the file name, date and time of creation, length, and the address of
the first entry in the File Allocation Table (FAT) for the file.

A FAT is a File Allocation Table. It is a road map of how the operating
system will locate data on a disk. Essentially, it is a series of pointers.
The directory entry of a file points to the first FAT entry of that file.
That entry points to the next, and so on, until the last entry, which
contains a special value indicating end of file. There are two copies of the
FAT on the disk, since it is absolutely critical. Lose the FAT, and the data
on the disk becomes un-accessable.

A BOOT SECTOR is the first sector on a floppy disk. With the Atari (and
MS-DOS) system, it contains configuration information about the disk. That
information includes how many tracks are on the disk, how many sectors per
track, how many sides on the disk, how big the FATs and directories are,
where the data begins, etc. On the MS-DOS systems, the boot sector contains
the ID of the operating system under which it was formatted. On the Atari,
that value is not used, but replaced (in part) by a number. That number
should be different on every disk, and is used as part of the mechanism by
which disk changes are detected. The boot sector may or may not contain
executable code.  If it does contain executable code, it is normally
executed only at system powerup or system reset time.

On all such disks, the boot sector is number 0, the first sector on the
first side of the first track. On a standard format Atari disk, the next
five sectors are the first copy of the FAT, the next five sectors are the
second copy of the FAT, the next seven sectors are the root directory, and
the remainder of the disk is available for data.

Now, on with the show:

Floppy disks are changed on a regular basis while the computer is being
used. More so on systems with no hard disks, but periodically on most all
systems. This event, referred to as a "Media Change", is detected by the
computer's disk drive. The disk door is opened, the status of the write
protection changes as one disk is removed and another is inserted, etc. When
that happens, the operating system must recognize that the disk has been
changed before attempting to read or write to the new disk. The operating
system reads the disk's boot sector to learn about the newly inserted disk.
That instant, when the operating system checks the new disk, is when nearly
all the boot sector viruses spread. We'll get to that in the next chapter,
but first, a more primary question:

How did the virus get in there?

When a computer is booted up from a power off state, or reset (in most
cases), it starts executing code from internal ROMs. Those ROMs set up
primary vectors, minimal configuration information, and perform s