HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / pc / CRYPT7.ZIP / CRPTLET.TR7 next >

Wrap

Text File | 1992-10-08 | 25.2 KB | 489 lines

******************************************* The CRYPT Newsletter (#7) - Early Oct.,1992 Another in a continuing series of info-glutted humorous monographs solely for the enjoyment of the virus programmer or user interested in the particulars of cyber-electronic data replication and corruption. --Edited by URNST KOUCH ******************************************** This issue's top quote! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "Ross Perot is an empty valise." -Ed Koch on the former Electronic Data Systems leader's re-entry into the presidential race. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ IN THIS ISSUE: SPECIAL Election Day viruses: VOTE and VOTERASE...the DEICIDE virus...FIDO news...INCAPABILITIES: Off-the-cuff evaluations & fear and loathing on PRODIGY... from the Reading Room: "Cyberpunk" by Hafner and Markoff ...McAfee Associates close in on "fuck you money"...Vidkun Quisling Medal awarded...more... ---------------------------------------------------------- NEWS! NEWS! NEWS! VITRIOL! NEWS! This issue we award the Vidkun Quisling Gold Medal of Rank Hypocrisy to Gary Watson of Data Systems. Here at the newsletter bungalow we couldn't help but notice programmer Gary Watson's insistence that he has been the victim of a disinformation campaign launched by virus exchange BBS's. "Do I upload source codes to virus boards, not so, not so!" is the essence of this claim, aired on the FidoNet VIRUS_INFO echo. To help get at the truth, we're releasing a log and archive listing documenting Watson's visit to the Dark Coffin BBS in Pennsylvania. What follows is a reprint of a BBS log generated by WWIV 4.21, the software in use on Dark Coffin: 1702: Gary Watson #58 23:54:19 08/07/92 [Torrance CA] Q, S, X, >, >, >, S, Q, Q, X, T, L, >, >, >, *, Q, X, T, *, X, Q, , Q //S**T! I GOTTA CHECK THE F****N MESSAGE BASES...., T, ?, U, Z, <, >, <, < <, <, <, <, <, F, //WELL, ONE OF EM AT LEAST, *, U, X, U >>>+DANGER .ZIP uploaded on NEW UPLOADS<<< C, C, H, A, T, X, /, \, \, Q, Q, ?, O, Read: 20 Time on: 16 All comments following // are command line messages one of us used to type to the other. Notice upload of DANGER.ZIP. Next, the PKUNZIP listing of what was kept from that archive: PKUNZIP (R) FAST! Extract Utility Version 1.93 ALPHA 10-15-91 Copr. 1989-1991 PKWARE Inc. All Rights Reserved. PKUNZIP/h for help PKUNZIP Reg. U.S. Pat. and Tm. Off. Searching ZIP: DANGER.ZIP Length Method Size Ratio Date Time CRC-32 Attr Name ------ ------ ----- ----- ---- ---- -------- ---- ---- 24704 Implode 7072 72% 09-25-91 10:44 26dbaec9 --w- MIX1.ASM 3193 Implode 1527 53% 03-05-89 22:21 1d1d5ed8 --w- AMST-847.ASM 13009 Implode 3179 76% 01-01-80 00:06 ec3b2f22 --w- BADBOY2.ASM 19037 Implode 6318 67% 06-05-90 11:54 ce10ca04 --w- MURPHEXE.ASM 12453 Implode 2783 78% 04-04-90 17:35 78c45414 --w- STONE.ASM 26586 Implode 5754 79% 04-04-90 17:35 50ad447b --w- DATACRIM.ASM 19495 Implode 7985 60% 01-03-90 23:19 31f550c8 --w- EDDIE.ASM 8897 Implode 2914 68% 05-05-90 18:13 0953d928 --w- DIAMOND.ASM 45577 Implode 10889 77% 05-05-91 18:51 065542d3 --w- V2100_.ASM 15042 Implode 2663 83% 04-18-91 16:58 19fc2ef6 --w- LEECH.ASM 58090 Implode 12176 80% 08-11-92 22:43 ddccc22e --w- VSOURCE.ASM 19310 Implode 6330 68% 03-09-91 15:53 50e8c26a --w- HORSE2.ASM 47596 Implode 11030 77% 03-13-91 18:29 21efc392 --w- 4096.ASM 3042 Implode 1139 63% 12-28-88 12:32 a7404cb9 --w- BOOT1.ASM 10830 Implode 2939 73% 08-11-92 22:43 a7ae08a6 --w- DIR2.ASM 7212 Implode 2215 70% 08-11-92 22:47 4de925cf --w- MASTER.ASM ------ ------ --- ------- 334073 86913 74% 16 And an extracted header from one of the source codes, STONE.ASM: ; IMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM; ; : British Computer Virus Research Centre : ; : 12 Guildford Street, Brighton, East Sussex, BN1 3LS, England : ; : Telephone: Domestic 0273-26105, International +44-273-26105 : ; : : ; : The 'New Zealand' Virus : ; : Disassembled by Joe Hirst, November 1988 : ; : : ; : Copyright (c) Joe Hirst 1988, 1989. : ; : : ; : This listing is only to be made available to virus researchers : ; : or software writers on a need-to-know basis. : ; HMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM< Now, while this isn't IRONCLAD proof of Gary Watson's duplicity, it IS close enough for most purposes. And, yes, here at the bungalow we can still imagine cries of "Disinformation!" or "It's a FRAME-UP!" or "I never did that!" We feel confident that the reasonable Crypt reader will weigh the veracity of a Gary Watson (who self-admittedly views those unlike him as "targets" and has an ego so big he is easily stroked into flaming on the FidoNet by barbs from those much younger than he) against that of the urbane and always courteous editors of the Crypt Newsletter. We are pleased to award Gary Watson the Quisling Medal. When ex-New York City mayor Ed Koch was asked to comment on the Quisling award, he said, "Gary Watson is an empty valise." A HOT TIP! Nowhere Man informs the Crypt Newsletter that he is readying a polymorphic encryption module for domestic release. This is in addition to his work on VCL 2.0 which could be coming to you sometime around the holiday season! ***************************************************************** A CRYPT NEWSLETTER SPECIAL: VOTE and VOTERASE, custom Election Day viruses!!! ***************************************************************** In this issue, we give the readers the VOTE! VOTE (or VOTE, SHITHEAD) is a memory resident, spawning virus which is not detected by the recent versions of SCAN, Thunderbyte's tbSCAN, Datatechnik's AVScan, NORTON Antivirus or Central Point Antivirus. Upon installation, VOTE will reside in a small hole in system memory invisible to all but the most discerning eye. It hooks INT 21 and monitors the DOS load function. From there, it will create hidden/ read-only 'companion' files for every .EXE program called. All of these 'infected' programs will continue to function normally; VOTE's disk writes are minimal and not likely to be noticed by anyone NOT looking for the virus. VOTE will accumulate on the infected system's hard file in an almost totally transparent manner until Election Day. On Election Day, at the start of the morning's computing, the first .EXE executed which has a VOTE 'companion' counterpart will result in activation. VOTE will lock the machine into a loop in which the user is gently but insistently reminded to go to the polling place. Computing will be impossible on Nov. 3rd, unless VOTE is completely removed from the system. After Nov. 3rd, VOTE will again become transparent. VOTE is an ideal virus and we encourage the Crypt reader to do his bit (ouch!) to reawaken democracy in this country. VOTE will not harm files in any way. VOTE is simply removed by booting from a clean disk, tallying up all the 'hidden/read-only' 348 byte .COM duplicates of .EXE files, and deleting the .COMfiles. No special anti-virus software is necessary, as long as the user knows VOTE is afoot and what to look for. The Crypt reader will remember the basic characteristics of the INSUFF spawning virus in issue #6. VOTE utilizes the same principles, attacking poorly implemented systems auditing and integrity checking software like that found in CPAV. In fact, VOTE can operate IN THE TEETH of a number of a-v software default installations. Unlike unknown resident viruses which instantly attempt to infect a-v software as it fires up, thus making the set upon program squeal about file modification, VOTE can successfully 'infect' any program which can't scan it. It will instantly create a 'companion' which will go resident any time the a-v program is subsequently used. Tested against CPAV, SCAN, tbSCAN, AVScan and Leprechaun's Virus-Buster, VOTE capably created 'companions' for each executable as they were employed. And none of the packages seemed to mind. Some a-v types prefer to refer to viruses like VOTE as "worms," because like the archetypical INTERNET "worm," they do not alter the programs they 'infect.' Recently, another corporate-military-security stiff even suggested the term "viro-worm" on the CSERVE VIRUSFORUM. This is an example of idiot-savant jargon. Good for cowing the uninitiated, it serves the additional purpose of convincing a dupe that he has actually gotten value for his money if ever he hands over a certified check for someone's "computer security paper." You should know "companion virus" remains a perfectly acceptable term for programs like VOTE. It is clear, concise and descriptive, something "viro-worm" is not. The source code for the VOTE "companion virus," as well as its DEBUG script, are included in this issue. The TASM listing invites the reader to extend the life of VOTE beyond November 3rd by simply changing the activation. However, for those Crypt subscribers convinced that democracy has failed and that Election Day is a mere sham perpetrated by the ruling elite, we include VOTERASE. VOTERASE is exactly like VOTE, EXCEPT on Election Day it wakes up and expunges all files from an infected system. VOTERASE displays no message, it merely makes Election Day into an even harder working day. VOTERASE is quick. Files disappear in mere fractions of a second. A heavily infected disk could, theoretically, be emptied in minutes after the start of the day's computing on Nov. 3rd. The DEBUG script for VOTERASE is included with this issue. (Note: VOTERASE will not damage the partition table of the hard file or overwrite programs with gobble. The hard disk will experience boot failure if its command processor and system files are removed by VOTERASE. In most cases, a simple restoration from backup after elimination of VOTERASE should get things moving again.) The Crypt Newsletter has included the VOTE viruses to commemorate America's long tradition of rule by and for the people! Disclaimer: The VOTE viruses are non-partisan. Neither recommend you vote for any particular candidate. So remember, just VOTE!!! Your computer could be watching!! *********************************************************************** *********************************************************************** INCAPABILITIES: PRODIGY USERS GRUMBLE ABOUT NORTON ANTIVIRUS 2.1 *********************************************************************** In Crypt newsletter #6, we reprinted an ad issued by SYMANTEC touting the new Norton Antivirus's ability to scan for Mutation Engine-loaded viruses. To make a point, we created the INSUFF viruses to poke a hole in this claim. Our tests showed that Norton Antivirus 2.1 did not detect ANY mutations generated by ANY of the MtE-loaded INSUFF viruses. Now users of NAV 2.1 are starting to complain on PRODIGY, the Sears Roebuck electronic info service for novice computerists, that the SYMANTEC software detects the MtE in some data files. Henri Delger, a virus watcher on PRODIGY who advises people with questions on rogue programming, has chronicled this as a nasty false-positive bug inherent in NAV 2.1. He recommends users demand free upgrade to the next version. Delger estimated that NAV 2.1 reliably detects about 40% of known viruses. Smart consumer advice: NAV 2.1 will detect false MtE images in your data, but remains incapable of detecting real MtE infections. In a spot evaluation of Central Point Software's Anti-Virus, we ran its scanner against 350 virus samples generously obtained from Long John Silicon by way of Todor Todorov's virus collection. CPAV identified 68% of the samples, as contrasted to F-PROT 2.05, which detected a full 98%. Smart consumer advice: Why pay $100 for something which works poorly, when you can have a finely tooled racin' machine for free? ******************************************************************** ADDITIONAL DATA ON HILGRAEVE's HyperACCESS/5 COMM PROGRAM: You may still be interested in the virus scanner part of Hilgraeve's HA/5, commented on only briefly in the previous issue. But you require more information before you unhitch your trucker's wallet. Here, then, in Hilgraeve's own words: "To give you the most comprehensive, up-to-date protection possible, Hilgraeve uses the same signatures as the IBM Virus Scanning Program, with IBM's consent. This is an excellent source, because IBM devotes tremendous effort to collecting and identifying viruses." Sez who? Does anyone you know actually use IBM software? Anyway, while HA/5 remains a fine terminal program we continued to be dismayed at its HyperGuard 'virus filter' performance as we used it to transfer samples between BBS's in eastern Pennsylvania. Eventually, we just turned the 'filter' off. As of now, BBS and comm program scanners have a long way to go before they are of much practical use. And that doesn't even begin to deal with programming tricks like PKliting and stand-alone encryption which are used to 'conceal' scanned viruses and logic bombs during electronic transfer. We recommend Hilgraeve delete this feature from future versions of HA/5 and replace it with an in-line file archiver to complement the software's handy "Unpack" de-archiver. ************************************************************************** MCAFEE GOES PUBLIC, TRANSLATION: EMPLOYEE STOCKHOLDERS GET 'FUCK YOU' MONEY - DON'T YOU WISH YOU DID?? Purloined from CSERVE's Online Today, Oct. 7, 1992 ************************************************************************** Online Today MCAFEE ASSOCIATES GOES PUBLIC (Oct. 7) McAfee Associates Inc., known for its line of anti-virus software, has gone public and investors gave the stock of the Santa Clara, Calif., firm a warm reception. On its first day of public trading, the stock rose 25 percent over its initial price. According to United Press International, McAfee offered 1.05 million shares, with the remaining 1.55 million coming from stockholders. It has 11 million shares of common stock outstanding after the offering. Yesterday, McAfee shares closed at $20.125 in over-the-counter trading. Its 2.6-million-share offering was priced at $16 a share. Besides its anti-virus software, McAfee recently released it first two general purpose utilities to enable users to repair damaged files and disks. Reports from United Press International are accessible in CompuServe NewsGrid database (GO NEWSGRID) and through the Executive News Service (GO ENS). --Charles Bowen [Well, look who it is!] **************************************************************************** ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ IN THE READING ROOM: "Cyberpunk: Outlaws and Hackers on the Computer Frontier" by Katie Hafner and John Markoff (Simon & Schuster paperback) Divided into three discrete sections, "Cyberpunk," for the most part, attempts to retell the tale told by Cliff Stoll in "The Cuckoo's Egg." And why not? The story of a bunch of disgruntled, drug-gobbling Huns attempting to steal phony U.S. defense secrets off the INTERNET for a computer-ignorant KGB is too fantastic to be anything less than riveting. And so what if it's old news! It's the telling that counts and though it's fairly obvious that the authors know about as much about computers as the journalists who covered Michelangelo, "Cyberpunk" is still a better read than anything a systems programmer could dream up. [Well, maybe I'm a little unfair to the authors. Katie Hafner WAS an editor at Data Communications magazine, so she MUST know what a computer is. However, John Markoff reports on the industry for the New York Times and as far as I can tell there's never been any sign of sentient life in 'tech' reporting from that quarter.] As for the virus story there's almost none unless you count Robert T. Morris, Jr's, INTERNET "worm." But, you'll thrill to the description of Morris's father, anyway. You'll be able to picture him as just the kind of patronizing, intellectual turd you'd expect would be asked to be the head of a NSA research arm secretly figuring out new ways to break codes, new ways to open people's mail, still more interesting and new ways to listen in on your telephone conversations, even more fun and interesting ways to waste taxpayer money without having to tell you about it, yet more ways to raise a kid who uses tips you've given him from the NSA to create a national scandal, new and great ways to be a king-asshole snoop gr-zz-rrz-zzzz, etc. Yeah, that's hot! And "Cyberpunk" has all the info on "hacker" Kevin Mitnick who terrorized small businesses, the phone company and numerous college administrators in Southern California. His was a glorious life, spending long hours cajoling lonely business secretaries into giving away system passwords over the phone, just like the cons at the local jail who even as you read this are no doubt ripping off someone stupid from the pay phone in the prison lounge. Yes, a most excellent "phone-phreak" life, where you take off for a weekend of brute-force hacking ensconced in the luxurious digs of the local "hooker" crashpad. Yup, learn how to be an elite "cyberpunk," cuffed to a chair in the night watchman's office like a common piss-soaked drunk caught wandering the campus of a local community college. That's where it's at, man. And "Cyberpunk" will give you a good idea on just how to go about it. The Crypt Newsletter recommends "Cyberpunk"! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 666 - the DEICIDE virus, for all the Crypt Newsletter's Slayer fans ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ DEICIDE is a simple, horribly destructive overwriting virus. It will attempt to infect all .COM files except COMMAND.COM in the root directory on any disk. Once it has run out of .COM files to infect, it will smash the C: hard file by meddling with its first 80 sectors. Programs infected by DEICIDE are completely destroyed. When called DEICIDE will display "File corruption error," just the kind of cryptic DOS message that will send a new computer user into paroxysms of confusion. The A86 source of DEICIDE is included in this issue. Liner notes and an 'altered' DEBUG script are also provided, supplying a 'new' copy of DEICIDE to readers interested in further study. DEICIDE is not very long-legged as viruses go; in fact, one might consider it more along the lines of a slightly 'delayed' trojan. Its author, "Glen Benton," has written a number of other similar viruses from his refuge in Holland. ********************************************************************** ADDITIONAL SOFTWARE DOCUMENTATION FOR CRYPT NEWSLETTER #7: ********************************************************************** By now, perhaps, you know the drill. Software described in the Crypt newsletter is supplied as source code, DEBUG scripts, or both. For those without an assembler, copy the .SCR files in this archive into a directory and bring up the C:> prompt. If the DOS program DEBUG is in your path, merely type DEBUG <*.scr where *.scr is the .scr file for the software you wish to produce. Then hit <enter>. After a few moments, the program should be ready for you in the current directory. [If even this seems like a mystery, feel free to get someone to help who knows what he's doing. We recommend, however, that in this case you NOT try executing Crypt Newsletter software.] This issue contains the VOTE viruses. VOTE is included as a listing and DEBUG script, while VOTERASE is supplied only as a script. In addition, you will found the A86 source listing for the DEICIDE virus and its corresponding scriptfile. Additional user notes for this issue are found in the headers of the accompanying assembly listings. Remember, that programs included with the Crypt Newsletter are quite capable of destroying your data, executable valuables and/or making your day seem overlong. In fact, your computing day WILL be made longer if you are stupid and careless with them. Indeed, your father, wife or significant other will probably not find DEICIDE clever and amusing at all if it gets loose for half an hour on the family system while the company news organ or some equivalent, but necessary, twaddle is being prepared. ****************************************************************** This issue of the Crypt Newsletter SHOULD contain: CRPTLET.TR7 - this text VOTE.ASM - TASM source listing for the VOTE virus VOTE.SCR - DEBUG script for the VOTE virus VOTERASE.SCR - DEBUG script for the VOTERASE virus DEICIDE.ASM - A86 listing for Glen Benton's DEICIDE virus DEICIDE2.SCR - DEBUG script for the DEICIDE virus If any of these files are missing: Complain at once, go to any of the BBS's listed following this text, and grab a COMPLETE copy. ****************************************************************** Additional note: Vidkun Quisling is an in-famous trademark of the Norwegian government. Quisling, a WWII Axis collaborator, aided Adolf Hitler in his conquest of Norway in 1940. In gratitude, Der Fuehrer made him Norway's puppet ruler. After the war ended, angry Norwegians tried Quisling for treason, won an easy conviction and had him shot. ****************************************************************** Readers should feel free to send e-mail to editor URNST KOUCH on any of the BBS's listed in this file. On Hell Pit, I can be reached as COUCH. To ensure you don't miss an issue of the newsletter, I invite you to come to DARK COFFIN and e-mail me with a data number of your favorite BBS. I'll include it in my database and begin delivery if they'll have it. This guarantees you'll be the first on your block to get fresh issues. The Crypt newsletter is distributed first at the following sites: ╔════════════════════════════════════════════════════════════════════╗ ║ This V/T info phile brought to you by Çτÿ₧, ║ ║ Makers/Archivists/Info Specialists on Viruses/Trojans. ║ ╠════════════════════════════════════════════════════════════════════╣ ║ Dark Coffin ···················· HQ/Main Support ··· 215.966.3576 ║ ╟────────────────────────────────────────────────────────────────────╢ ║ VIRUS_MAN ······················ Member Support ···· ITS.PRI.VATE ║ ║ Callahan's Crosstime Saloon ···· Southwest HQ ······ 314.939.4113 ║ ║ Nuclear Winter ················· Member Board ······ 215.882.9122 ║ ╚════════════════════════════════════════════════════════════════════╝