HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / CRYPT12.ZIP / CRPTLT.R12 next >

Wrap

Text File | 1993-02-11 | 61.0 KB | 1,224 lines

▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄ ▄▄▄▄▄▄ ▄▄ ▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ █▒▒█ █▒▒▒▒▒▒▒█ █▒▒█ █▒▒▒▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒▒▒█ █▒▒▒▒▒▒█ █▒▒▒▒█ █▒▒█ ▀▀▀▀▀▀▀▀ █▒▒█ ▀▀▀▀█▒▒█ █▒▒█ █▒▒█ █▒▒█ ▀▀▀█▒▒█ ▀▀▀█▒▒█ ▀▀▀▀▀ █▒▒█ █▒▒█ ▄▄▄▄█▒▒█ █▒▒█ █▒▒█ █▒▒█ ▄▄▄█▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒▒▒▒█ ▀▀ █▒▒█ █▒▒█ █▒▒▒▒█ █▒▒█ █▒▒█ █▒▒█ ▀▀▀▀█▒▒█ █▒▒█ █▒▒█ ▀▀▀▀▀ █▒▒█ █▒▒█ ▄▄▄▄▄▄▄▄ █▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒▒▒▒▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒█ █▒▒█ ▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀ ▀▀ ▀▀▀ ▀▀ NEWSLETTER NUMBER 12 ********************************************************************** Another festive, info-glutted, tongue-in-cheek training manual provided solely for the entertainment of the virus programmer, security specialist, casual home/business user or PC hobbyist interested in the particulars - technical or otherwise - of cybernetic data replication and/or mutilation. Jargon free, too. EDITED BY URNST KOUCH, January - February 1993 CRYPT INFOSYSTEMS BBS - 215.868.1823 ********************************************************************** TOP QUOTE: "We live in cheap and twisted times." --Hunter S. Thompson, "Songs of The Doomed," 1990. ------------------------------------------------------------------- IN THIS ISSUE: NEWS . . . Anti-anti-virus virus's revisited: the LOCKJAW series, quick analysis of the SANDRA virus . . . IN THE READING ROOM: critique of various articles; review of MONDO 2000 annual; VIRUS: The comic book! . . . return to MICHELANGELO virus: an appraisal of the media's mishandling of the March 1992 affair and software vendor collusion . . . sophisticated, but warped, humor . . . and the usual potpourri of material. ********************************************************************** ******************************************************************** MICHELANGELO HYPE REVISITED: A SKEPTIC'S VIEW ******************************************************************** Just about a year ago the media exploded with weird stories of impending catastrophe at the hands of a mysterious computer program. Thrown a newsprint and TV body-block by techno-impaired editors and reporters lacking even the sense to pour piss from a boot, the world reeled. But the sky refused to fall and in the best tradition of "calendar" journalism, the Crypt Newsletter has received permission to reprint a critique of the events surrounding March 6, 1992. "THE LITTLE VIRUS THAT DIDN'T: The press couldn't get enough of Michelangelo. But did it fall prey or save the day?" Republished from the Washington Journalism Review, May 1992. The great Michelangelo computer virus scare of 1992 has proved to be another classic example of Chicken Little journalism -- or the Reporters Who Cried Wolf, depending on your tast in fairy tales. At first glance, the story was a sexy one. The virus had an instantly recognizable name. It was attached to a specific date -- March 6 --an attractive hook for editors with a penchant for calendar Page 1 journalism. It was simple: On the birthday of its namesake, the virus would destroy data within the computers it had infiltrated through infected disks. And it boasted big numbers: By one estimate, as many as 5 million IBM and IBM-compatible computers worldwide were going to be victims of Michelangelo, a relatively small computer code written and unleashed by an anonymous, devious programmer. Newspapers around the country ran headlines warning of imminent disaster. "Thousands of PC's could crash Friday," said USA Today. "Deadly Virus Set to Wreak Havoc Tomorrow," said the Washington Post. "Paint It Scary," said the Los Angeles Times. Weeks after M-day, many antiviral software vendors and some reporters still insist the coverage prevented thousands of computers from losing data. John Schneidawind of USA Today says "everyone's PC's would have crashed" had the media not paid much attention to Michelangelo. The San Jose Mercury News credited the publicity with saving the day. One widely quoted antiviral vendor, John McAfee of McAfee Associates, says the press deserves a medal. In reality, many of the predictions were suspect. Those making them, often computer security product vendors or closely related industry associations, usually stood to profit from the widespread coverage. And many reporters bit hard. One vendor who played a key role was McAfee, one of the nation's leading antiviral software manufacturers and founder and chairman of the nonprofit Computer Virus Industry Association (CVIA). It was McAfee who told many reporters that as many as 5 million computers were at risk. He says he made the projection based on a study that the virus had infected 15 percent of computers at 600 sites. Both Reuters and the Associated Press sent the figure around the world. McAfee says he didn't present it the way it was reported. "I told reporters all along that estimates ranged from 50,000 to 5 million," he says. "I said, '50,000 to 5 million, take your pick,' and they did." But researcher Charles Rutstein of the International Computer Security Association (ICSA), a for profit consulting group, says even 50,000 was an exaggeration. Also widely quoted, Rutstein says he told reporters early on to expect no more than 10,000 computers infected worldwide. (There are more than 35 million computers in the United States alone, according to some estimates.) "Five million is just ridiculous, but the press believed it because they had no reason not to," Rutstein says now. "McAfee seems credible." (McAfee responds that the ICSA and other critics are "fringe groups.") While many articles failed to disclose or merely mentioned in passing that McAfee's antiviral software has sold more than 7 million copies of its Viruscan and expects revenues of more than $20 million this year, McAfee scoffs at the idea that he or other vendors hyped the threat to generate sales. "I never contacted a single reporter, I never sent out a press release, I never wrote any articles," he says. "I was just sitting here doing my job and people started calling." He maintains that the coverage of Michelangelo cost him money. "It was the worst thing for our business, short-term," he says. "We offer shareware [where users are trusted to pay], so we got tons of calls from non-paying customers. Page 2 "Before the media starts to crucify the antivirus community," he continues, "they should look in the mirror and see how much [of the coverage] came from their desire to make it a good story." But he adds quickly, "Not that I'm a press-basher." Schneidawind's and AP's efforts after March 6 to track Michelangelo found only a few thousand afflicted computers worldwide, including 2,400 erroneously reported to be at the New Jersey Institute of Technology. The institute actually had only 400 computers infected with any virus; few had Michelangelo. A Philadelphia Inquirer reporter got it wrong, says institute spokeman Paul Hassen, and it spread quickly. "That was the first time I've been that close to a feeding frenzy," he says. Perhaps the most embarrassed news organization was CNN, which on March 6 staked out McAfee's offices in Santa Clara, California, waiting for a doomsday that never came. Soon after the clock struck midnight on March 6, may reporters seemed to suspect they'd been had. The Los Angeles Times, which had quoted McAfee's 5 million figure on March 4, carried a Reuters story three days later that reported the "Black Death" had turned out to be little more than "a common cold." AP downgraded its "mugger hiding in the closet" to a mere "electronic prank." AP Deputy Business Editor Rick Gladstone says the wire service quickly downplayed the story after its initial reports and included comments from the ICSA's Rutstein, who said the threat from the virus had been exaggerated. "Our big oversight was to quote McAfee's 5 million figure in the beginning of the coverage but we backed off that," Gladstone says, adding that his staff "felt somewhat vindicated" when relatively few computers were affected on March 6. "Some of us in the press were suckered," he says. Schneidawind doesn't feel he was. "We went into this with our eyes open," he says. But on March 9, in an article entitled "Computer virus more fright than might" (the subhead was a more confident "Michelangelo kept at bay by early detection"), the USA Today reporter chronicled his frustrations tracking the virus. He reported that he had asked Rutstein and McAfee, again identified as the CVIA chairman, to provide a working sample of Michelangelo. Both declined. "It'd be like giving him a biological virus because he wanted to play with it," McAfee says. McAfee was also "reluctant to divulge the names of companies struck by the virus" according to Reuters. McAfee now estimates that only 10,000 systems were stricken worldwide on March 6, a number he says he derived by counting the number of calls he received from victims and guessing that they estimated 5 percent of the total. But he insists the numbers aren't as important as "the scope of the problem," which, he says the press largely ignored. "For the first time, you had large well-respected companies shipping the virus with their new computers and software. How did it filter into secure environments like that?" Schneidawind agrees. "The estimates may have been overblown, but no one new for sure until the 6th," he says. "Consider the BCCI scandal, where everyone faulted the press for not being there. I'd rather err on the side of caution." Page 3 Schneidawind didn't seem to do that in a sidebar to his March 9 article in which he listed other computer pests poised to strike in March. Supplied by yet another antiviral software vendor, the list did not reveal that most of the bugs were either variants of the same root virus -- known as "Jerusalem" -- or rare species found only in eastern Europe. Like many others the story did not make clear that every week of the year is filled with trigger dates for numerous viruses. (Or that user mistakes destroy more data than viruses do.) More importantly, only a handful of some 1,000 worldwide viruses are common enough that a user may occasionally encounter one. Of those, most only display silly messages or compel the computer to play a tune. On March 6, Michael Rogers and Bob Cohn of Newsweek offered a post mortem to Michelangelo that warned readers to "beware the next round of computer viruses," including the Maltese Amoeba and "the scariest new virus . . . the Mutation Engine." What they and others such as Ted Koppel of ABC's Nightline and John Fried and Michael Rozansky of the Philadelphia Inquirer failed to say was that the Maltese Amoeba had only been active in Ireland. Moreover, the Mutation Engine isn't a virus at all, but a user-friendly encryption tool that virus-writers use to disguise their creations. To their credit, neither The New York Times nor The Wall Street Journal gave much credence to Michelangelo. John Markoff of the Times in particular provided restrained, intelligent coverage that virtually ignored McAfee and other antivirus vendors. And The Journal's Walter Mossberg wrote a "Personal Technology" column that realistically appraised the viral threat as minimal. Unfortunately, the hype over Michelangelo could cause wary journalists to ignore more prevalent destructive viruses that could occur in the future. It will cause more of the rogue programs to be circulated, if only because their creators love the attention. For some soul, the coverage given to Michelangelo must have provided quite an adrenalin rush. It certainly did for the press. --------------------------------------------------------------------- As for a look back a year later: 1. Whatever happened to the Maltese Amoeba? The answer: Who cares? 2. Where is the sound of PC's crashing in 1993 to the tune of the "scariest new virus . . . the Mutation Engine"? ***************************************************************** MODEL ANTI-VIRUS AUTHOR LEGISLATION PRESSED INTO THE HANDS OF THE CRYPT NEWSLETTER: PETER TIPPETT HAS COMPANY NAME ATTACHED TO RISIBLE DRIVEL ***************************************************************** Recently we've had the time to look over a back issue of Virus News and Reviews which contained some "model" legislation designed for the express purpose of combating computer viruses. Devised by Peter Tippett of Certus International, the document makes clear that it was written to impress people ignorant of computers in even the most general sense. It propagates the idiotic notion that writing viruses is some kind of specialized skill, or "art" as Tippett puts it, and by Page 4 regulating individuals expert in the "art," the computer virus problem can be solved. For example, an excerpt from Tippett's "model" in Virus News and Reviews (July 1992): "A computer virus may only be created or modified, but never sold, distributed, or allowed to be distributed, for bonafide research purposes, and then only under the following circumstances: "1. The virus is created for a legitimate, localized research purpose; "2. Strict provisions are made to always contain the virus within the expressed domain of its author/researcher and to not allow the virus to replicate or otherwise move to any media or computing system outside of the author's/researcher's direct control; "3. At least five days before any computer virus is created or modified under this sub-part, the intent to create or modify a computer virus must be publicly announced by its intended author in at least three publicly available publications, each with a circulation of at least 100,000. The announcement will contain at least: 1) the name, company, title, address and telephone number of the responsible party, 2) the name, company, title, address and telephone number of the computer virus author, if different than the responsible party, 3) the address and location of the intended research, 4) the start date and intended finish date of the intended research, and 5) the expressed intent to create or modify a computer virus. "4. The research or study virus, or virus modification must contain within its own code, and in a form that survives replication to all progeny of the parent virus, the name of the responsible party and other information sufficient for anyone of average skill in the art to reliably discover." Point 1 calls for the formation of a judging group which will appraise virus research as worthy of license. To this day, no such group exists in any field of scientific (professional or non-professional) endeavor, at least not in the way envisioned by Tippett's model legislation. The closest things to this are government research and granting agencies like the National Science Foundation. But, while the NSF doesn't have to grant money for research it feels inexpert or uninteresting, it has no power to make it taboo. (It can create an environment where certain avenues of research are seen as "unfundable." This can be crippling in some fields, but not in this case where just about anyone with a couple PC's, a modem and a real desire to work can set up shop.) Tippett's legislation would be a first in this regard. We think this is a laughable assumption that shows a typical businessman's lack of knowledge about how the critical pursuit of information proceeds in any field. (In an aside: Tippett's writing brings to mind Robert X. Cringely's assessment of Lotus Development's Jim Manzi as an American businessman who shuns PC's, hates using them and considers researchers and technical people "dickheads.") Page 5 In Point 3, Tippett requires publication notice for virus creation. This is an unenforceable bureaucratic requirement which would be unlikely to be taken seriously even by people working in a "legitimized" environment. As for Point 4: Many virus authors and researchers already put plenty of identification in their creations. This hasn't changed anything nor does it prevent people from erasing or altering such identification at whim. This point serves no obvious purpose and, in our opinion, is legally meaningless. The remainder of Tippett's "model" is similarly uninformed as to the reality of virus construction and distribution, embarrassing when one considers that he's published in Virus News and Review. But perhaps this is intentional, since the facts are difficult to adequately describe in a mere one-page letter. As a "paper" or proposal in any college course worth its salt, Tippett's submission would gain a solid F. But for congressional legitimacy, if that's its aim, excellence is not a requirement. Maybe Peter Tippett is a lot smarter than we think. ********************************************************************** IN THE READING ROOM: VIRUS - THE COMIC BOOK! ******************************************************************** It had to happen. There have been sci-fi and techno-thrillers about viruses, so WHY NOT a comic book? You'd expect this to be strange, but so what! Aren't a lot of comics? Why should "Virus," published by Dark Horse, be an exception? But first, a little background. Dark Horse has made its name by peddling an endless flood of titles devoted to squeezing the last drop of greenish ichor from movies like "Alien" and "Predator." That philosophy ensures just about anything it prints is a big hit, selling out immediately in the kinds of comic stores run by tubercular, ex-artfags with an intense dislike for patrons who don't reserve at least ten new titles each month. You'd imagine, then, that a copy of "Virus" was tough for The Crypt Newsletter to find. It was. And if not for alert reader Captain AeroSmith who shipped one air-freight from Cleveland, we might not have seen it at all. That said, the first issue of "Virus" wasn't bad. Fair art, good dialogue and a story that revolves around an abandoned Chinese radar and telemetry ship that comes under the power of some inter-cosmic computer virus that has beamed down into its radio antenna and set up shop in the mainframe. The original crew is butchered, necessitating the trapping of some ocean-wandering riff-raff who think they're going to appropriate the boat for lots of cash money. "Virus" nixes this plan at once by ripping the breast-bone out of one of the thieves with the aid of a computer-controlled winch. "Aaaiiieeee!" screech the trapped sailors. They want out, but not before being attacked by something that looks like a cross between a kite and a flying pipe-wrench made from sails and human integuement. What does this have to do with viruses or the computer Page 6 underground? Who knows! "Virus" is cracked, but I guarantee you'll be negotiating with your local dealer for the next issue. ******************************************************************* IN THE READING ROOM II: MONDO 2000 - A User's Guide To The New Edge by R. U. Sirius, Queen Mu and Rudy Rucker (HaperPerennial) ******************************************************************* "Thanks for a country where no one's allowed to mind their own business . . . Thanks for a nation of finks." --William S. Burroughs in "Mondo 2000" I'm no expert on the "cyberpunk" magazine, but MONDO 2000 - the book - squeezed a smirk out of me when the William Burroughs quote cropped up amidst non sequiturs and chapters on pranking the media and "smart" drugs. That the wizened author of "Naked Lunch" is now a center piece in such an effort surely has some kind of quantum significance. So, know that MONDO 2000 is the literary equivalent of a Ren & Stimpy cartoon: stretches of intense flatulence punctuated by flashes of brilliance and dumb cunning. [Much like the Crypt Newsletter, perhaps.] For instance, the chapters on "smart" drugs and tarantulas (?!) are patent nonsense. The "smart" drug idea comes from that small segment of the populace who've accidentally rediscovered how absorbing a read the Physician's Desk Reference is when your mind has that "roasted" character that comes from too many simultaneous hits of caffeine and unfiltered Camels. Tarantulas, Queen Mu says, are deadly, too. (I knew it, I knew there had to be a reason they sell the ugly things to any schnook who goes into a pet store!) If you can overlook stuff like that, MONDO 2000 is hep. Rudy Rucker's introductory essay, for one thing, is inspirational. And there's plenty of weird computer jokes, BBS's to call, summaries of all the important stuff that's gone down in "cyberspace" in the past ten years - in other words, MONDO 2000's a good book for the coffee table. It will impress your friends, I bet. ******************************************************************** QUICK AND DIRTY DISASSEMBLY OF VIRUS CODE: THE SANDRA VIRUS - AN ENCRYPTED ANTI-ANTI-VIRUS VIRUS SPILLS ITS SECRETS TO ANY LAYMAN ******************************************************************* This month, two articles crossed Crypt Newsletter desks that painted the picture that virus disassembly is a job best left to the experts. It is a common myth - a nuts, self-serving statement propagated by greedheads who WANT you to think that you are a helpless schnook. In reality, anyone who works seriously with viruses knows that in 90% all cases, virus disassembly is about a 5-minute job, tops. As an illustration, the Crypt Newsletter will walk you through a quick and dirty dissection of the SANDRA virus using only two tools: the shareware ZanySoft debugger and the retail Sourcer commenting disassembler programs. Since the Sandra virus came into this country as a "naked" file, there is little need to instruct you in how to execute the virus onto a clean, small, workable "host." Since no virus researcher had to do it, we will presume, in this case, that you won't have to either. (And that leaves room for another chapter in this story in the next issue.) Page 7 The first step is a no-brainer. Fire up Sourcer with the following command line (this presumes you have created the SANDRA virus from the DEBUG script supplied with the Crypt Newsletter): C>SR SANDRA.COM This will load SANDRA into Sourcer and bring up the disassembler's menu. The Sourcer defaults will suffice, so hit "G" for GO. In less than 15 seconds Sourcer will have coughed out a file called SANDRA.LST. Take a look at it. By the black-coated turd from Jesus's arse! What gibberish. You'll see that SANDRA appears to be a small segment of cryptic assembly code instructions, then some words that almost look like English and quite an oodle of hexadecimal values arrayed in columnar "define byte" (or "db") format. This immediately tells the experienced that SANDRA is encrypted, and rather weirdly at that. (If SANDRA had been unencrypted, your job would be finished. The virus would be laid out in front of you.) The next step, then, is to trick the virus into decrypting itself and then writing the "plain text" version to disk. This is simple in theory, only slightly more difficult in practice. Envision that the portion of the virus you want to execute is the decryptor loop, a small stretch of instructions which will unscramble the virus in memory. Might not that segment of cryptic assembly gobble that Sourcer produced on its first pass contain the keys to the decryptor? Yup, good guess. And it looks like this: seg_a segment byte public assume cs:seg_a, ds:seg_a org 100h sandra proc far 3C44:0100 start: 3C44:0100 F8 clc ; Clear carry flag 3C44:0101 E8 002F call sub_2 ; (0133) 3C44:0104 FB sti ; Enable interrupts 3C44:0105 F8 clc ; Clear carry flag 3C44:0106 <--execute to this address jmp loc_6 ;*(027C) 3C44:0106 E9 73 01 db 0E9h, 73h, 01h 3C44:0109 3C data_3 db 3Ch ; xref 3C44:013D 3C44:010A 00 data_4 db 0 ; xref 3C44:0149 You notice that SANDRA starts by calling a sequence of instructions dubbed "sub_2" by Sourcer. Looking down the listing (which is not included here) you see that "sub_2" is another segment of plain-text assembly code. This is the viral unscrambler and when we have returned from it, the virus is ready to cook off. The next job for SANDRA, then, is to begin its work. Looking at the assembly commands above, you see SANDRA jumps (jmp) to a new location, which looks encrypted in the listing you're working on. The idea you want to use is that by executing the virus right up to the "jmp," it's possible to get it to translate itself Page 8 in memory without it looking for a file to infect, infecting that file and re-garbling itself. This is easy to do with any debugger. We'll use the ZanySoft product because it's not as intimidating as DOS's DEBUG to the novice user. In fact, it is almost idiot-proof and requires little overhead on the part of anyone. Fire up the ZanySoft debugger by typing: C>ZD86 ZanySoft is menu driven. Use its "File" drop-down menu to load the virus. Then bring down its "Run" menu and double-click on the "go to xxxx:xxxx" command. This tells ZanySoft to execute the loaded program to a certain address - which it will prompt you to supply -- and stop. The address needed is the one corresponding to the "jmp" in the above listing. Sourcer has supplied it, and it is ear-marked in the diagram: 0106. Type in 0106 at ZanySoft's prompt and hit <enter>. The virus is decrypted. Now, return to the "Files" menu and select the option, "Write to .COM." Accept the default value ZanySoft brings up and hit <enter> again. The virus has now been written to the disk from memory, and in "plain-text" or unencrypted form. Look at it under a file viewer. Remember those words that looked like English? Well, now they ARE English. You should see some gobble like "the Nazg'l," "dedicated to Sandra H.", and "*.EXE," "*.COM," the latter two giveaways that the virus hunts for these files. Load the unencrypted virus into Sourcer once again. Accept the defaults and hit "Go". Fifteen seconds later the virus has been disassembled for you, only now it's almost all assembly instructions. Is this so mysterious? Even though you may know next to nothing about assembly, you can still use the Sourcer listing to make some informed deductions about the virus. Go to the bottom of the listing and look at the interrupt usage synopsis. It looks like this: ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Interrupt Usage Synopsis ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ Interrupt 16h : Keyboard i/o ah=function xxh Interrupt 20h : DOS program terminate Interrupt 21h : DOS Services ah=function xxh Interrupt 21h : ah=2Ch get time, cx=hrs/min, dx=sec Interrupt 21h : ah=3Bh set current dir, path @ ds:dx Interrupt 21h : ah=3Ch create/truncate file @ ds:dx Interrupt 21h : ah=3Dh open file, al=mode,name@ds:dx Interrupt 21h : ah=3Eh close file, bx=file handle Interrupt 21h : ah=40h write file bx=file handle Interrupt 21h : ah=41h delete file, name @ ds:dx Interrupt 21h : ax=4301h set attrb cx, filename @ds:dx Interrupt 21h : ah=4Eh find 1st filenam match @ds:dx Interrupt 21h : ah=4Fh find next filename match Interrupt 21h : ax=5701h set file date+time, bx=handle As you see, SANDRA has instructions for "find first filename match", "find next filename match" and "set current directory, path." If you've seen this newsletter and its source listings before, you might suspect that SANDRA is a direct-action (or non-resident) virus. Coupled with the .COM/.EXE filemasks, that's a good, educated guess. Page 9 Like any virus, it has a "write to file" function. However, in this case, cross-referencing your listing shows that SANDRA doesn't worry about adding itself to the end of the file during the write. This means SANDRA's an "overwriter." It's the simplest kind of infector, a feature exclusively the domain of primitive direct-action viruses. And since it means that the virus destroys everything it lands on, an instantly noticeable stunt, it marks SANDRA as a trivial pest at best. Your eye might also be drawn to the "delete file" and "truncate file" functions. "Ah-ha!" you say having a vague understanding about how sneaky viruses work. SANDRA deletes files corresponding to the list of plain-text filenames it carries around. And those file names are for anti-virus software programs! SANDRA is an anti-anti-virus virus! Wow. Now you know enough to broadly characterize SANDRA as an encrypted, over-writing virus that tries to delete a raft of anti-virus programs. You might even be tempted to run a test and execute SANDRA against some bait files. If you do that on a typical American system, you'll find another interesting feature at once. A great many systems now use WINDOWS, and that means they're set up with either QEMM or MS-DOS's EMM386 as memory managers. If SANDRA is executed on any of these environments it will generate an "exception" forcing a reboot of the machine. Why is that, for cryin' out loud? Actually, it's another anti-anti-virus measure, although a back-handed one. NEMESIS, a German memory resident anti-virus monitor uses expanded memory to monitor a system at the sector level. Because of this, it requires the user to have the requisite amount of expanded memory and the manager for it: QEMM or EMM. SANDRA seems to make the generous assumption that any machine using one of these might have NEMESIS installed, and it forces a shutdown through EMM to stop the infection and avoid potential detection. Since SANDRA appears to be German, it is not unreasonable that its author might be more concerned about NEMESIS than anyone in the U.S., where the program is nonexistent. In real terms, this feature makes SANDRA, at best, a reluctant virus. On many machines, it will just flat out refuse to infect. By further combing over the code on breaks from hanging about the water-cooler, you'll find that SANDRA deletes the following data-integrity files from selected a-v software: - "ANTIVIR.DAT" - "CHKLIST.CPS" --Central Point AV - "C:\CPAV\CHKLIST.CPS" --same as above - "C:\NAV_._NO" --Norton Antivirus - "NOVIRCVR.CTS" - "NOVIPERF.DAT" - "C:\TOOLKIT\FSIZES.LST" --Solomon's Toolkit - "C:\FSIZES.QCV" --Solomon's Toolkit - "C:\UNTOUCH\UT.UT1" --Untouchable - "C:\UNTOUCH\UT.UT2" --Untouchable - "C:\VS.VS" - "C:\TBAV\VIRSCAN.DAT" --Thunderbyte, truncates file Page 10 - "C:\)(.ID -- Integrity Master, I believe By now, you're very confident you can execute SANDRA without hurting yourself. Actually, you could have done that after a quick look at the interrupt synopsis. In any case, you're still cautious so you install FLU-SHOT. Haha! SANDRA won't infect. And you've uncovered its last interesting secret: it exits when FLU-SHOT or a couple of other resident programs are present. This isn't the definitive book on SANDRA, but it's more than enough for reasonable purposes. After all, this IS the "quick and dirty" guide to virus disassembly. And the rules here can be applied to a full 90% of the viruses you might come across. Sure, there can be the occasional bird with tricks in it to make this kind of fast interpretation a thorny job. But, chances are, you will never see one. So after a few more stabs at this with viruses from the newsletter, your home collection, or wherever, you can sell yourself as an experienced hand at "quick & dirty" virus disassembly. **************************************************************** **************************************************************** THE LOKJAW PROGRAMS: MORE SIMPLE IMPLEMENTATIONS OF RETALIATING ANTI-ANTI-VIRUS VIRUSES **************************************************************** Intrigued by the Proto-T scam, virus writer Nikademus sent his LOCKJAW program to the Crypt Newsletter for examination. The Nikademus LOCKJAW virus is a variant of "Proto-T," a resident .COM infector originally derived from Civil War, altered to delete a series of anti-virus programs when they are executed. As an added fillip, the virus marks the deletion with an entertaining "chomping" graphic effect! The easiest way to soak this up is to head right for the assembly listings included in this issue. The actual file recognition and deletion routines can be adapted for many resident viruses. As an example, the newsletter has transformed LOCKJAW into a spawning .EXE-infecting virus in its "ZWEI" and "DREI" variants. File deletion on load isn't novel in resident viruses. But by coupling it to anti-virus recognition LOCKJAW underscores the necessity of having the user realize he MUST remove the virus from memory before using his software, or at the very least, operate from a write-protected diskette. (Although, as you will see with LOKJAW-DREI, the latter step is also potentially dodgey business.) In the wild, the entertaining virus "chomp" would be removed, as it is a dead giveaway that the virus is present and in control of the machine. (For that matter, so is sudden file deletion. But the effect would remain puzzling to uninformed users.) Taking this idea one step further, LOKJAW-DREI is a modification which removes file deletion and replaces it with a fake disk-trashing routine which the virus uses to strike the hard file when an anti-virus program is called to find it. Although LOKJAW-DREI only makes the drive temporarily inacessible, it doesn't take a great leap of imagination to see its Page 11 potential. Mark Ludwig talked about this at length in an article on "retaliating viruses" published in American Eagle's "Computer Virus Developments Quarterly #1" In that issue he supplied the code for such an animal, the direct action Retaliator virus, an Intruder variant. The point that he made, and a valid one, is that the existence of such a virus on a machine makes it absolutely necessary that the user know what he's doing when he goes out looking for it. The LOCKJAW viruses, however, are easy to "play" with. They will become resident below the 640k boundary and infect .COMs or .EXE's, depending upon the variant, upon execution. They will also show a noticeable 4k drop in memory available to free programs. By running Scan, F-Prot, Integrity Master or Central Point Anti-Virus when LOCKJAW is present, the "retaliating" effect is shown. Of course, this software is deleted so don't use your only copy unless you want it erased. (Not a bad strategy for some software.) LOCKJAW can be removed from memory by simply rebooting from a clean, write-protected system disk. [In a related note: The SANDRA and LOKJAW viruses come with Central Point Anti-virus as a default. Even though the software is continually drubbed in product reviews and word-of mouth gossip, it is included in the coming MS-DOS 6.0. This ensures that it will be even more ubiquitous on home and business machines in 1993 - a fact of interest to virus and competing anti-virus developers alike.] *************************************************************** *************************************************************** IN THE READING ROOM III: CRITIQUE OF DISCOVER PIECE ON THE BULGARIAN VIRUS CONNECTION *************************************************************** I'm sure a number of alert newsletter readers have, by now, browsed through the February issue of Discover magazine and seen the excerpt from another book on "hackers" called "Approaching Zero," to be published by Random House. The digested portion is from a chapter dealing with what authors' Bryan Clough and Paul Mungo call "the Bulgarian virus connection." While it was interesting - outwardly a brightly written article - to someone a little more familiar with the subject matter than the average Discover reader, it was another flawed attempt at getting the story right for a glossy magazine-type readership. First, we were surprised that reporters Mungo and Clough fell short of an interview with virus author, the Dark Avenger. Since they spent so much time referring to him and publishing a few snippets of his mail, it was warranted, even if he is a very tough contact. In addition, they continually exaggerate points for the sake of sensationalism. As for their claim that the Dark Avenger's "Mutating Engine" maybe being the "most dangerous virus ever produced," there's no evidence to support it. First, they continue the hallowed media tradition of calling the Mutation Engine a virus. It's not. The Mutation Engine is a device which we've gone Page 12 over in these pages again and again. The Crypt reader knows it doesn't automatically make the virus horribly destructive, that's a feature virus-writers put into viruses separate from the Engine. And although the first Mutation Engine viruses introduced into the U.S. could not be detected by scanners included in commercial anti-virus software, most of these packages included tools to monitor data passively on any machine. These tools COULD detect Mutation Engine viruses, a fact that can still be demonstrated with copies of the software. And one that almost everyone covering the Mutation Engine angle glosses over, if they bother to mention it at all. In any case, Mutation Engine code is well understood and viruses equipped with it are now no more hidden than viruses which don't include it. Of greater interest, and an issue Mungo and Clough don't get to, is the inspiration the Dark Avenger Mutation Engine supplied to virus programmers. By the summer of 1992, disassembled versions of the Mutation Engine were everywhere, for all intents. It seemed only a matter of time before similar code kernels with more sophisticated properties popped up and this has been the case. Coffeeshop, a virus mentioned in the original Discover piece, is just such an animal, although the authors don't get into it. Coffeeshop utilizes a slightly more sophisticated variable encryptor - called the Trident Polymorphic Engine - which adds a few features not present in the Dark Avenger model as well as decreasing its size. It, too, has been distributed in this country as a device which can be utilized by virus authors interested in shot gunning it into their own creations. It is of Dutch origin, produced by a group of programmers known as "TridenT." TridenT, a group with a taste for whimsy, freely acknowledges the inspiration of the Mutation Engine. Curiously, Coffeeshop is Dutch slang for a place to pick up some marijuana. Very interesting, is it not? However, the Trident Polymorphic Engine is no more inherently dangerous than the Mutation Engine. Viruses utilizing it can be detected by the same tools used to detect Mutation Engine viruses before those could be scanned. The reporters also claim that disassembling a virus to find out what it does is a "difficult and time-consuming process" capable of being carried out "only by specialists." This is another myth which feeds the perception that viruses are incredibly complicated and that one can only be protected from them by the right combination of super-savvy experts. It has little basis in reality which is why we spent some time shooting it in the rear end in an earlier portion of this issue. And that's what's the most irritating about Mungo and Clough's research. In search of the cool story, they further the dated idea that virus-programming is some kind of arcane art, practiced by "manic computer freaks" living in a few foreign countries where politics and the economy are oppressive . While it's true that a few viruses are clever, sophisticated examples of programming, the reality is that almost anyone (from 15-year olds to Page 13 middle-aged men) with a minimal understanding of assembly language can (and does) write them from scratch or cobble new ones together from pieces of found code or toolkits. Since everyone's computers DON'T seem to be crashing from viral infection right and left (remember Michelangelo?), Mungo and Clough, in our opinion, really stretch the danger of the "Bulgarian virus factory." This is such an old story it has almost become shtick, a routine which researcher Vesselin Bontchev (apparently Clough and Mungo's primary source) has parlayed into an intriguing career. A great number of the 200 or so Bulgarian viruses the reporters mention in fear-laden terms ARE already here, too - stocked on a score of BBS's run by programmers and computer enthusiasts. Mungo and Clough write of "the scope of the problem . . . not [becoming] apparent for several years." That's an easy, leading call to make because no one will remember or hold them to it in 2000. The Crypt newsletter suggests "We don't know." Now that would have been more honest. But we doubt if it would have sold as well. [To add insult to injury, the authors warn of the ominous LoveChild virus, counting toward zero, waiting to ambush your hard file. It's worth noting the Skulason's F-Prot casually dismisses LoveChild as a buggy virus which only operates on machines running DOS 3.3. Solomon's Toolkit modestly judges it as capable of "moderate" damage.] =-=In true domino effect, PRODIGY - the "interactive home computer service" for numerous, mixed-up, Bush-voting, Democrat yuppies - recycled segments of the Discover article on January 30 in its "Headline News" section. The un-bylined story loudly proclaimed "the Mutating Engine . . . the most dangerous virus ever" and re- iterated ominous news of LoveChild, a program which won't function on many systems. LoveChild, alert Crypt newsletter readers may be interested to know, "will erase all of a computer's memory," according to PRODIGY Headline News.=-= **************************************************************** IN THE READING ROOM IV: WRITER AND EX-JOCKEY DICK FRANCIS REPORTS ON COMPUTER VIRUSES IN "DRIVING FORCE," HIS LATEST NOVEL OF MYSTERY AND INTRIGUE **************************************************************** It turns out that one of the Crypt Newsletter staffers is a fiend for Dick Francis. In case you don't know, Francis is an entire publishing company unto himself. He cranks out enough material in a year to give Stephen King a run for his money. However, he's never been pegged as a "computer" writer. So it came as a surprise when a staffer shrieked in glee, ran over to where I was lurking by the water-cooler and thrust Francis's manuscript into my face. "Look, look, Michelangelo!!" she gibbered. And there it was, a fictional account of someone's office getting cold-cocked by the virus. But enough of this, here's a teaser: -=[ The computer man, perhaps twenty, with long light brown hair through which he ran his fingers in artistic affectation every few seconds, had given up trying to resuscitate our hardware by the time I got back to the office. "What virus?" I asked, coming to a halt by by Isobel's desk and feeling overly beleaguered. We had flu, we had aliens, we had bodies, we had vandals, we had concussion. A virus in the computer could take the camel to its knees. "All our records," Isobel mourned. Page 14 "And our accounts," chimed Rose. "It's prudent to make backups," the computer man told them mock-sorrowfully, his young face more honestly full of scorn. "Always make backups,ladies." "Which virus?" I asked again. He shrugged, including me in his stupidity rating. "Maybe Michelangelo . . . Michelangelo activates on March 6 and there's still a lot about." "Enlarge," I said. "Surely you know?" "If I knew, I've forgotten." He spelled it out as to an illiterate. "March 6 is Michelangelo's birthday. If you have the virus lying doggo in your computer and you switch on your computer on March 6, the virus activates." "Michelangelo is a boot-section virus," the expert said, and to our blank-looking expressions long-sufferingly explained. "Just switching the machine on does the trick. Simply switching it on, waiting a minute or two and switching off. Switching on is called booting up. All the records on your hard disk are wiped out at once with Michelangelo and you get the message 'Fatal disk error.' That's what happened to your machine. The records are gone. There's no putting them back." "What exactly is a virus?" Rose inquired miserably. "It's a program that tells the computer to jumble up or wipe out everything stored in it." He warmed to his subject. "There are at least three thousand viruses floating around. There's Jerusalem II that activates every Friday the 13th, that's a specially nasty one. It's caused a lot of trouble, has that one." "But what's the point?" I asked. "Vandalism," he said cheerfully. "Destruction and wrecking for its own sake." He ran his fingers through his hair. "For instance, I could design a sweet little virus that would make all your accounts come out wrong. Nothing spectacular like Michelangelo, not a complete loss of everything, just enough to drive you mad. Just enough to make errors so that you'd be forever checking and adding and nothing would ever come out right." He loved the idea, one could see. "How do you stop it?" I asked. "There are all sorts of expensive programs nowadays for detecting and neutralizing viruses. And a whole lot of people thinking up ways to invent viruses that can't be got rid of. It's a whole industry. Lovely, I mean, rotten." Viruses, I reflected, meant income, to him. ]=- How's that? Not bad, for a mystery writer! Why, Francis seems more knowledgable about the subject than the writers of glossy-cover Page 15 "suit" computer publications! But we're not gonna tell you how it ends, you'll just have to dig up "Driving Force" (Putnam) for yourself. ***************************************************************** IN THE READING ROOM V: NEW YORK TIMES AND THE PHRAKR TRAKR - BBS's: THE ROOT OFFAL EVIL (OUCH, PUNNY!) ****************************************************************** In a January 25 'A' section article, a N.Y. Times reporter profiles the "Phrakr Trakr," a federal undercover man keeping our electronic streets safe from cybernetic hoodlums too numerous to mention singly. Reporter Ralph Blumenthal immediately reveals himself as yet another investigator from the mainstream who has never gotten anything from underground BBS's first-hand, focusing on the Phrakr Trakr's tales of nameless computer criminals trafficking in "stolen information, poison recipes and bomb-making instructions." We're not going to dwell on the issue of phone-related phraud and the misappropriation of credit card accounts (which has been well-established), but Blumenthal's continued attention to text files for "turning household chemicals into deadly poisons, [or] how to build an 'Assassin Box' to supposedly send a lethal surge through a telephone line" is sickening. It furthers the generalization that all reporters are fetal-alcohol damaged rubes with little educational background beyond elementary school. Anyone who's seen or stock-piled text files on a BBS knows they're either menacingly written trivial crap or bowdlerized reprints from engineering, biology and chemistry books. In either case, hardly noteworthy unless you're one who can't tell the difference between comic books and real news. The Times delivers a back-to-the-camera photo of the Phrakr Trakr, an overweight man with a handcuff dangling from his suspenders. He "patrols THOUSANDS [emphasis ours] of computer bulletin boards" states the photo's slug-line, an absurd claim which neatly overlooks the fact that there's not enough time in a year to physically accomplish the deed. The Phrakr Trakr has his own newsletter, F.B.I., for "Find um [sic], Bust um [sic], Incarcerate um [sic]." "Got any codez?" indeed. ***************************************************************** FICTUAL FACT/FACTUAL FICTION ***************************************************************** HOUSE AD: CRYPT INFOSYTEMS BBS is now running full-time. Pick up the newest useless files and Crypt Newsletters direct. Bask in the scintillating conversation and avuncular charm of sysop and editor, URNST KOUCH. Meet the very funny PALLBEARER. And acquaint yourself with all their fine friends. The number? 215.868.1823. ----------------------------------------------------------------- GRAY AREAS magazine is looking to interview virus authors for a continuing series of articles. The Crypt Newsletter editorial staff recently had an opportunity to meet with the editor of GRAY AREAS, Netta Gilboa, and came away with the conviction that the magazine is dedicated to exposing all points of view on many subjects. In other words, you don't need a highly paid mouthpiece, a movie contract or the Congressional Medal of Honor to be of interest to its editors. A recent issue featured an excellent interview with John Perry Barlow among other sections too numerous to cover adequately here. Contact GRAY AREAS at any of the following: grayarea@well.sf.ca.us ph: 215.353.8238 mail: POB 808 Broomall, PA 19008-0808 -------------------------------------------------------------------- Phalcon/SKISM programmer Dark Angel has produced the G2, or Second Generation viral code generator. Capable of producing resident .COM/.EXE infecting virus with limited poylmorphism, Dark Angel's documentation states the G2 supersedes the PS-MPC. The Phalcon/SKISM programmer plans to update the G2 code base as time allows; he maintains in the instructions to the program that G2 has much more flexibility than the PS-MPC, capable of multiple arrangements of commented code and data segments. Although the G2 is separate from the PS-MPC, it appears that those users familiar with the former will have no trouble adapting to the latter. --------------------------------------------------------------------- PRODIGY, the "interactive home computer service" for numerous mixed-up, Bush-voting, Democrat yuppies, has cut its work force by 25, putting approximately 250 people onto the street. ---------------------------------------------------------------------- IBM - panicked by the tolling bell of impending corporate doom - has moved to can CEO John Akers, presumably because the company is non-competitive under his leadership. Akers will remain to head the team selected to draft his replacement. Does this make sense to you or are WE nuts? Draft the guy you're firing to find his own replacement. Yes, this is a GOOD PLAN. Sell your IBM stock while you still can. That's the Crypt Newsletter's advice. ____________________________________________________________________ END CREDITS: Thanks and a tip o' the hat to NIKADEMUS, CAPTAIN AEROSMITH and the usual crew of alert readers. Page 16 -------------------------------------------------------------------- The Crypt Newsletter includes virus source code in each issue. If assembled, it will produce working copies of the viruses described. In the hands of incompetents, irresponsibles and and even the experienced, these programs can mess up the software resources of any IBM-compatible PC - most times, irretrievably. Public knowledge that you possess such samples can make you unpopular - even shunned - in certain circles of your computer neighborhood, too. To assemble the software included in this issue of the newsletter, copy the MS-DOS program DEBUG.EXE to your current directory, unzip the newsletter archive into the same directory and type MAKE at the DOS prompt. This issue of the newsletter should contain the following files: CRPTLT.R12 - this document MAKE.BAT - instant "maker" for this issue's software. Ensure that the MS-DOS program DEBUG.EXE is in the machine path or current directory, before typing "MAKE". LOCKJAW.ASM - assembly listing for the LOCKJAW virus LOKJAWZ.ASM - " " " LOKJAW-ZWEI LOKJAWD.ASM - " " " LOKJAW-DREI LOCKJAW.SCR - scriptfile for LOCKJAW LOKJAWZ.SCR - " " LOKJAW-ZWEI LOKJAWD.SCR - " " LOKJAW-DREI SANDRA.SCR - " " SANDRA virus You can pick up the Crypt Newsletter at these fine BBS's, along with many other nifty, unique things. CRYPT INFOSYSTEMS 1-215-868-1823 Comment: Crypt Corporate East DARK COFFIN 1-215-966-3576 Comment: Crypt Corporate West THE HELL PIT 1-708-459-7267 DRAGON'S DEN 1-215-882-1415 RIPCO ][ 1-312-528-5020 AIS 1-304-420-6083 CYBERNETIC VIOLENCE 1-514-425-4540 THE VIRUS/BLACK AXIS 1-804-599-4152 NUCLEAR WINTER 1-215-882-9122 UNPHAMILIAR TERRITORY 1-602-PRI-VATE THE OTHER SIDE 1-512-618-0154 MICRO INFORMATION SYSTEMS SERVICES 1-805-251-0564 REALM OF THE SHADOW 1-210-783-6526 STAIRWAY TO HEAVEN 1-913-235-8936 THE BIT BANK 1-215-966-3812 CYGNUS-X 1-215-791-2457 The Crypt Newsletter staff welcomes your comments, anecdotes, thoughtful articles and hate mail. You can contact Urnst Kouch Crypt BBS, CSERVE#:70743,1711 or Internet: 70743.1711@compuserve.com Page 17 For those who treasure hardcopy, Crypt Newsletter is available as a FAX subscription: $20 for a ten issue run. It can also be had as one of those Mickey Mouse-looking papyrus newsletters produced by WordPerfect C.A.N.T.'s [Corporate Animal, No Talent] for the same price. All inquiries should be directed to the Crypt Newsletter e-mail addresses. -*- Page 18