Hacker 2/HACKER2.mdf/virus/virusl2/virusl2.225

Text File | 1995-01-03 | 16KB | 348 lines

VIRUS-L Digest   Friday, 27 Oct 1989    Volume 2 : Issue 225

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc., and sent to [e-mail] (that's
LEHIIBM1.BITNET for BITNET folks).  Information on accessing
anti-virus, document, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].
 - Ken van Wyk

Today's Topics:

A lesson involving 'CRACKERS' (APPLE II)
Virus infection in commercial package (PC)
How to get start to be an anti-virus worker for Mac?
re: Jerusalem virus infects boot sector ? No! (PC)
"THIS_1S_NEXT" virus? (PC)
re: Jerusalem virus infects boot sector ? No! (PC)
Imbeded virus detection
A new virus from Iceland (PC)

---------------------------------------------------------------------------

Date:    Thu, 26 Oct 89 18:43:55 +0000
From:    [e-mail]
Subject: A lesson involving 'CRACKERS' (APPLE II)

This message is being sent to both RISKS and VIRUS lists.
Apologies to those who receive both digests.

    I was well shocked in finding-out that there was actually a virus
running on the Apple II family of computers ! Where could the
LODE RUNNER virus have infected such a small machine, with no
integrated hard disk, and the possibility of rebooting the machine
quickly by using a simple sequence of control codes ? (open-apple-ctrl-
reset ). In FRANCE, of course !

    The Apple II did very well in France. It is very widely used
over there. This success, like in the U.S.A., triggered a large
market for pirated copies of programs.

    I have been an Apple II owner since 1982. It is absolutely amazing
how many copies of programs went around since that time. I guess that
virtually every program for this type of computer was available as a
pirated copy in France. This is because of the following:

1. There are laws about unlawful software copying, but they are very hard to
   enforce. In addition to that, it is extremely difficult to find the
   originators of the software. ie: The "top" pirates are well hidden,
   and if the police was to catch every person who copies a program,
   then they'd probably have to prosecute virtually *any* computer user !
2. Most software was copied and "exchanged" against other software, a bit
   like a one to one swap. Commercial pirate factories were discovered in
   Lyons a few years ago. There, the programs were deprotected, copied, and
   then protected again, and sold to customers for a fraction of the price.
   The pirates were arrested and heavily fined (and given a prison sentence).

SOME SORT OF COMPETITION

    There were many independent groups of pirates. The average age was
16-22 years old. All of them were experts at Apple II's Disk Operating
System. The most "advanced" of these "crackers" were the CCB.  CCB for
"Clean Crack Band". From the number of programs that they have
cracked, they seemed to spend their days and nights cracking games and
software. Some French magazines and newspapers wrote articles and
interviews with them. They even went on national French TV. Of course,
they were in hiding; a bit like drug dealers, really. The quality of
their "work" was unbelievable. The program was as good as new, only it
had their name in the presentation page. Often, they added pretty
graphics, and additional options in some cases. In fact, it looked as
though they had completely re-written the program entirely.  At the
end of 1985, I think, they renamed themselves, the SHC, "Solex Hack
Band". (A Solex used to be a cheap moped at the time) They hacked a
few French Computers by using dial lines; they did one "Hacking"
direct, on TV, showing the journalists how vulnerable computers were.
Since that time, I don't know what happened to them.

OTHER GROUPS

    There are a lot of other groups of pirates around France. The CCB
were based in Paris (according to the press), and the two most famous
members of this group called themselves: Aldo Reset, and Laurent Rueil.
Other groups include:

- - Johnny Diskette: this name was used by many anonymous pirates who had
  formed some kind of club in Paris, where they had competitions (!)
  on who would be the fastest to unprotect a disk.
- - BCG (Baby Crack Gang): funny name. They seemed to like Karateka games.
- - CES (Cracking Elite Software): They added features to games from time
  to time.
- - Chip Select and the Softman: These pirates went as far as including a
  digitised picture of themselves wearing dark glasses and saying:
  "I am Chip Select". A Certain Eric IRQ (Interrupt Request) was also
  part of this group.
- - Mister Z (Geneva): These were Swiss pirates, but for some reason, they
  were sending copies to French crackers, telling them to change the
  title page that they had made-up. It was some kind of competition of:
  "We can protect this program; can you unprotect it ?"
- - MAC (Marseilles Association of Crackers): group based in Marseilles.
- - P.Avenue Nice: and this one is in Nice...

These groups deprotect the software. Once deprotected, it can be
copied very easily using a normal copy program.  Most copying goes-on
in large computer centres, where machines can be used free of charge.
There is no supervision there, and no control on what goes-on. Somes
places are popular just because it is such an easy way to get hold of
any program for no charge (well... just the cost of a diskette). Since
1987, though, the shops are more careful since they could be held
responsible for what happens on their machines.

HIDDEN INFO

If you use a track/sector disassembler, you can see the information on
the tracks of the disk displayed as ASCII characters. Often crackers would
converse between themselves in this way. Software is copied through a
string of intermediaries, and the messages can therefore be passed this way.
It is impossible to know if there is some hidden information on the
disk if it is not analysed by using a track/sector disassembler.
It is therefore very easy to hide other programs within the disk, whether
they are games, or even viruses !

IN CONCLUSION

So in fact, considering the level of expertise that these crackers have,
it would be very easy for them to hide a virus within a floppy disk,
which would be triggered by the actual program. I am talking here about
the APPLE II computer, but I am sure that other computers (including PC's)
have their "expert" crackers, who no doubt, would be very happy to write
viruses/worms/trojan horses/time bombs etc.
Why do they do it ?
My idea is that they do it for "fame", just to see other people talk
about "their" virus. Any suggestions ?

Olivier Crepin-Leblond, Computer Systems & Electronics,
Electrical & Electronic Eng., King's College London

Disclaimer: My own views. Any comments/flames/congratulations welcome !

------------------------------

Date:    Thu, 26 Oct 89 16:42:57 -0400
From:    [e-mail] (SPAN Security Manager [phone])
Subject: Virus infection in commercial package (PC)

         AI32                                        October 23, 1989

         FROM:     AI32/Fred A. Rodrigue

         SUBJECT:  Personal Computer Virus


         Attention:  Personnel responsible for personal computers.

         Kennedy  Space  Center  (KSC)  has  discovered  a  virus  in  a
         commercially purchased software package, Unlock Masterkey.  The
         HELP.COM file contained the 648 virus, also known as the Vienna
         virus,  Austrian  virus,  DOS-68  virus  and  the  One-in-Eight
         virus.  Fortunately, the virus was not active because there was
         no "jump" to the malicious code.

         The  virus was discovered by Lockheed Space Operations Company,
         a  KSC  contractor,  using  a  commercially   available   virus
         detection  program.   The  infected  diskette was marketed by a
         company, Transec Systems, Inc., that has gone out of  business.
         PCEasy,  Inc.,  Unlock  Masterkey's  developer,  learned of the
         virus several months ago and notified its  customers.   PCEasy,
         Inc., has no knowledge of Transec Systems, Inc., customers.

         Additional  information  is  available from Mark Mason, EX-INF,
         Kennedy Space Center, FL  32899, (407)-867-7293, FTS 823-7293.

         In case of an incident, contact AI32, Fred  Rodrigue,  544-2843
         or Bob Keasling, 544-1223.


         original signed by

         Fred A. Rodrigue
         Automated Information
         Security Coordinator

------------------------------

Date:    24 Oct 89 20:36:35 +0000
From:    [e-mail] (Wing Leung)
Subject: How to get start to be an anti-virus worker for Mac?

        I've been reading this news group for quite a while and I am very
interested to become an anti-virus worker.  I do have the basic antiviral
programs like disinfectant, but I'd like to know more about virus from the
lower level.  I have Fedit and Resedit.  Can anyone recommend me to
a good reference to get start with?  Basically I am focusing on Mac.
        Thanks in advance.
                                                        Peter--
  _    _  ____  ____   _        * Internet:     [e-mail]
 (/   /  //  / //   ) (/        * BITNET  :     WCPL_LTD@UORDBV
 / / /  //    //___/ _/         * DecNet  :     UORHEP::PETER
/_/_/  //__/ //     _/\___/     * UUCP    :     ...rochester!uhura!wcpl_ltd

------------------------------

Date:    27 Oct 89 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: re: Jerusalem virus infects boot sector ? No! (PC)

No, the only viruses I've ever heard called "Jerusalem" infect
only COM and EXE files.   So either what you were reading just
contains an error (happens to all of us!), or they're using the
name "Jerusalem" to describe some other virus (not a good idea...).

DC

------------------------------

Date:    Thu, 26 Oct 89 16:24:01 -0500
From:    Dave Boddie <[e-mail]>
Subject: "THIS_1S_NEXT" virus? (PC)

I need to find some quick information from anyone who knows what type of
virus replaces your harddisk label with the above subject line. I have
just notice this to appear on the label, and I have no idea what it (the
perpetrator) will do, or when it will do its little job.

VIRUSCAN v4.2 will not locate any virus on this machine.

By the way, can I get a copy of the new version of 'SCAN from someone???

Dave Boddie
Computer Operator
Remote4 Lab
University of Arkansas, Fayetteville

------------------------------

Date:    27 Oct 89 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: re: Jerusalem virus infects boot sector ? No! (PC)

I wrote to Jan T. about this, and he confirms that the "Jerusalem"
does *not* infect boot sectors.   His officially-distributed list
of virus signatures doesn't say that it does, so what you were
reading was probably a version that someone else had modified
by inserting wrong information.  Message from Jan follows.

(Note that the "Virscan" program that he's talking about is *not*
the IBM Virus Scanning Program, but another program whose
executable is also called VIRSCAN...)

" I would appreciate if you could explain that the list that is distributed via
" the "Software Distribution Network" on FIDONET is a *verified* list of virus
" signatures that has been extensively tested by a number of people. The list
" contains a notice not to distribute modified copies of the original file.
" For those without access to other networks, the latest fresh copy of the
" VIRSCAN.DAT file is available on any of the "SDN" nodes in FIDONET within 24
" hours after the master copy on 2:512/10.0 is refreshed. The file is usually
" available as VIRUSSIG.ZIP or VIRUSSIG.PAK
" Anything that is not directly pulled off a "SDN" node is probably not the
" original......
"
" There were several modified versions of the file going round with the wrong
" information and 1 version of the file rendered the Virscan program useless
" because of the info being in the wrong format, pointing to EXE instead of COM
" files, etcetera.
"
" <JT>

------------------------------

Date:    Fri, 27 Oct 89 11:51:19 -0400
From:    Bob McCabe <[e-mail]>
Subject: Imbeded virus detection

  As a consultant who writes software for the PC I am worried
about the possibility of my programs getting infected and
becoming vectors by which viri are spread.
  In particular I am developing an application that will be hand
carried from site to site to gather data by a number of users. If
this program were to get infected it could cause wide spread loss
of data to an important research project, not to mention other
programs and data on affected systems. I am looking at including
a check to see if there has been any change in the EXE files.
Failure on such a check would cause the program to disable it's
self and report a possible infection.
  While working out the algorithm for this check it struck me
that it should be possible to work out a scheme by which any
program could check itself at load time for infection. In order
to avoid programs using identical checks that a virus writter
could get around, the algorithm would include some form of
encryption parameter that could be 'customized' in each program.
Presently, I am working on a system of prime number coding in
which the CRC check of the EXE file is compared with a encoded
CRC. The coding of the CRC would be done with a large prime
number, chosen at random from a table. If written in assemblier
this scheme would not slow down load time by that much.
  I have not had much time to persue this but hope to get back to
it next month. I would welcome any comments, criticisms and
suggestions.

========================================================================
BITNET     : [e-mail]                Bob McCabe
CoSy       : bmccabe                                Computer Consultant
Phone      : [phone]                         University of Guelph
                                                    Guelph, Ont. Canada
=========================================================================

------------------------------

Date:    Fri, 27 Oct 89 17:08:16 +0000
From:    Fridrik Skulason <[e-mail]>
Subject: A new virus from Iceland (PC)

New virus - first report......

I have just obtained a copy of a new virus, which seems to be of Icelandic
origin, at least a text string inside the virus contains the message

        "Ghostballs, Product of Iceland"

The virus is a combination of the Vienna virus and the Ping-Pong virus.

It infects .COM files, just like "Vienna", but at the same time it
tries to place a copy of Ping-Pong on the boot sector in drive A: This
copy of Ping-Pong has, however, been heavily patched. Actually it can
not be called a virus, since it does not replicate - large parts of
the code have been replaced with NOP instructions. The "Vienna" part
seems to have been only slightly modified, but I have not yet had time
to disassemble it.

Infected files grow by 2351 bytes.

This virus was discovered when a person I had given an utility to
remove the Ping-Pong virus called back to complain that it did not
work, the virus would simply reappear on all diskettes, even if he
booted from a "clean" diskette. The reason was that most of his .COM
files on the hard disk had been infected.

One final note - the patched Ping-Pong virus seems based on the '286
variant reported recently.

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253