NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/rec/games/mud/tiny/1198

Internet Message Format | 1993-01-03 | 6.6 KB

Xref: sparky rec.games.mud.tiny:1198 rec.games.mud.admin:1036 news.admin.policy:1027 alt.fan.furry:2584
Path: sparky!uunet!vtserf!polaris.async.vt.edu!jfurr
From: [e-mail] (J. Furr)
Newsgroups: rec.games.mud.tiny,rec.games.mud.admin,news.admin.policy,alt.fan.furry
Subject: Re: Quicksilver virus on furry Muck -- solved!
Message-ID: <[e-mail]>
Date: 3 Jan 93 22:23:44 GMT
References: <[e-mail]>
Organization: Virginia Center for Lemur Fandom (subscribe to alt.fan.lemurs TODAY)
Lines: 110

In article <[e-mail]> [e-mail] writes:
>[ On new year's eve and new years day, FurryMUCK got hit with a virus program.
>It copied itself from descriptions of people, so that when you looked at
>someone who was infected, you too would be infected. No doubt more posts
>will be made to this effect.  But now you get to see something totally
>different.  You will see what went on from the eyes of the people who wrote
>the virus itself. ]
>
>[ Note: Yozduk was the name of the character who loaded the virus program
>online.  Yozduk's comments will be enclosed in {}s, and my comments will
>be enclosed in []s. ]

Note: "my" does not mean me, Joel Furr, it means "me", whomever authored
the post.  [e-mail] does not exist, as the sysadmin there has
stated.  There were apparently two culprits: one person who played the
character "Yozduk" and one who played another character, also present.

>[ First a little background on what this virus did.  As stated, the virus
>was able to copy itself inside of player descriptions.  But...  The virus
>also copied itself onto exits, so every time someone exited a room or
>used an exit linked to a program, they got reinfected if they removed the
>protection before.  In fact, the virus copied itself onto everything it
>could get its hands on.  It copied itself into the room description, so
>that you would get infected even when you just WALKED INTO a room.  It
>infected all of the room exits it could, and all of the contents.  In
>addition to this, it also had a list of all of the exits in the global
>environment (for you non-muckers, an exit in the global environment can
>be used by ANYONE in the muck ANYWHERE in the muck).  It checked every
>single exit and tried to infect it if it could.  If the virus could get
>into globals such as 'say' or 'pose' it could infect the entire set of
>connected players.  Furry was lucky that this did not happen.  Furry was
>also graced with a second blessing.  The program was set up to rename one
>of the global exits to something that would gag almost all commands in
>the muck from working.  This included commands like @shutdown, which shuts
>down the muck, @wall, which is used to give messages to everyone online,
>and @name, so that the exit couldn't be removed.  However, this fate did not
>occur.
>
>  No matter.  The virus still spread at an alarming rate.  If you were
>infected, the virus would make a new set of exits on your person which
>would override many of the global exits.  These exits were say, pose,
>whisper, page, and spoof; the only ways of getting messages out (aside
>from @wall, which only wizards can do).  The exits were linked to copies
>of the say, pose, page, whisper, and spoof programs that furry used.
>The only differece was this small patch.  If the time was 11:58 pm or
>later, when you tried to output a message, YOU would see it but everyone
>ELSE who was supposed to see it would not.  In effect, people would think
>that everyone was ignoring them.
>

[stuff deleted]

>  I'm sure by now the code has all been listed and people are beginning
>to piece together what happened New Year's Eve.  I just have one final
>message to all of you furries:

Yeah, we're piecing things together.

1) People who looked at the virus code said "my, this programming looks
verrrrry similar to code written by Targhan."  Targhan is a player on many
MUCKs who was responsible for disrupting events on MasqueMUCK with a
program that made everyone slur drunkenly, among other things.  Targhan
plays the character on FurryMUCK called "Korthedon."  Korthedon will deny
being Targhan but has admitted being Targhan to several people.  Targhan
and Korthedon also have the same email address, [e-mail].

2) Korthedon and Yodzuk showed up at a New Year's celebration on FurryMUCK
together, right before the virus hit.  They showed up, the virus hit.

3) The email message (i.e. "the gloat") this follows up was posted as if
coming from the University of Texas, making use of a mail-to-news gateway.
The sysadmin there has posted that the gloat originated at staff.tc.umn.edu.

Not really proof of anything, but heck, why not:

4) After the virus had shut down, Korthedon wandered around FurryMUCK,
hanging out quietly in any area where the virus's work was being
discussed, saying nothing but in all likelihood logging every word to
show to his accomplice.

I don't know who Targhan's accomplice was, i.e, the person who played
Yozduk.  I assume that either Targhan or his accomplice wrote the gloat
post, authoring it as coming from "[e-mail]" since
"[e-mail]" would kind of given the game away.  I am sure who
wrote the code, however.  Comparing the virus code with other programs
written by Targhan has been sufficient circumstantial evidence to convince
several people familiar with his programs and his style of play.  The fact
that the gloat post came from Targhan's home site, staff.tc.umn.edu,
further points a finger.

Let's put it this way.  Targhan/Korthedon and "Yozduk" show up at a Furry
party.  The virus immediately strikes.  The virus program looks very
similar to Targhan's style of programming, a very idiosyncratic style.
Then, the gloat post shows up, mailed from his site.  It doesn't have
Targhan's fingerprints and wallet left at the scene, but it comes pretty
damn close.

Finally, departing from evidence available to all, I have been told by the
wizards after supplying them with some information needed to show that
Targhan and Korthedon were one and the same that Targhan/Korthedon were
heard telling a few people he apparently presumed he could trust that he
planned to infect FurryMUCK with a virus.  I don't know when, I don't know
where.  I don't even know who told the wizards this.  Make of it what you
will.

I don't know who Targhan's sidekick in the virus misadventure was -- or
which one of the commenting voices in the gloat log was Targhan's and
which was that of his accomplice.  I _do_ know that Targhan was in it up
to his ass, and if you dislike what he did, why not mail
[e-mail] and say so?