NetNews Usenet Archive 1992 #26/NN_1992_26.iso/spool/comp/virus/4267

Internet Message Format | 1992-11-12 | 6.2 KB

Path: sparky!uunet!ukma!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: CHRISTMA: The "Card"! (CVP)
Message-ID: <[e-mail]>
Date: 11 Nov 92 15:36:28 GMT
Sender: [e-mail]
Lines: 134
Approved: [e-mail]

On Fri, 06 Nov 92 12:21:47 -0800 Robert M. Slade <[e-mail]> said:
> HISVIRH.CVP   921022
>
>                      CHRISTMA EXEC - the card

Though Robert Slade's reports are usually quite reliable, I have to
mend some (admittedly: minor) errors and omissions in this particular
one. On this occasion, I'd like to thank Robert for the valuable
service he has provided to the VIRUS-L subscribers.

> In December of 1987 IBM mainframe computers in Europe, connected via
> the EARN network, experienced a "mailstorm".

Actually, the mailstorm was not confined to Europe. EARN is only part
of a world-wide academic network; other parts of this network are
known as "Bitnet", and "Netnorth". The mailstorm origined in Europe
(in the University at the small German town Clausthal-Zellerfeld, if I
am not mistaken), and wandered once around the globe, in about three
days. Allegedly, it also hit the IBM internal network, VNet, which was
connected to Bitnet via a gateway that would let pass information only
between selected partners.

However, not all computers in the network were affected alike.
EARN/Bitnet/Northnet (in the sequel, I'll use "Bitnet" as an
abbreviation) is a heterogenious network, connecting computers of many
different brands.  CHRISTMA EXEC can only reproduce in the CMS, one of
the operating systems that run in IBM, and compatible, hosts. The CMS
hosts were busy reproducing and sending the EXEC, while the other
hosts just suffered from the dramatically increased network load.

> This mailstorm,
> however, was of unprecedented severity.  It shut down whole sections
> of the net, at least as far as effective work was concerned.

Yes. The reason being, that Bitnet is a store-and-forward network.
I.e., a message normally travels through several hosts, until it
eventually reaches its destination. Hence, the whole network suffered
from the increased load, irrespective of the fact that the items
originated only from a comparably small percentage of its hosts.

> For many, probably for most, users, email is simply text.  A select
> group are involved with the exchange of programs or other binary
> files, [...]

Bitnet provides three independent transport services:
1. Mail (as implied by the paragraph partially quoted),
2. arbitrary files (*not* embedded in Mail items),
3. short, interactve messages.

> The CHRISTMA EXEC was a message that contained such a program.

No. CHRISTMA EXEC was a source file that contained comment lines.

> "Christmas card" messages with this system can be more than just the
> usual "ASCII tree". [...]

Of course: programs can do anything conceivable (if technically
feasable).

> The message header
> contained a note that "Browsing this message is no fun at all.  Just
> type Christmas .." [...]

Rather, a similar message was contained in a screen-sized comment
block in the program which came after five (or so) screens of rather
boring REXX statements of the sort "display so-and-so many asterisks,
then so-and-so many blanks...". Of course it said "Reading dull
programs like this one is no fun.." or something along this line.

> Typing either "Christmas" or "Christma" would generate the "card" [...]

You had to do a RECEIVE command first (or at least hit the equivalent
PF9 key). This would generate a file named CHRISTMA EXEC on your disk.
Then, "Christma" would be the normal command to interpret the REXX
programm contained in that file; "Christmas" would work also, as CMS
chops the command verb after 8 characters.

> However, at the same time that it was displaying the tree
> on the screen, it was also searching for the NAMES and NETLOG files
> associated with the user's account. [...]

These are CMS specific files. This is the main reason why CHRISTMA
EXEC could only replicate in CMS systems, and not in other systems --
even if they had a REXX interpreter, which at that time very few
non-CMS systems had. (Personal REXX for MS-DOS appeared in 1985, REXX
for TSO only in 1988.)

> This provided a list of other
> users that either sent mail to or received mail from this account.
> The important thing was that it was a list of valid email addresses.
> The CHRISTMA EXEC would then mail copies of itself to all of these
> accounts.

The NETLOG file is sort of a certificate of posting: it contains a
list of files and mail items sent to, or received from, other users
(including the network addresses involved). The NAMES file is sort of
a personal directory: it contains only personal notes on people the
user knows, mostly including their network addresses.

> The important point, technically, was that all of the accounts were
> valid.

Well, most of them...

> As a side benefit, all of those accounts would be used to
> receiving mail from the account that had just read it.  And they
> would tell 40 friends, and they would tell ...

Hence, CHRISTMA EXEC could easily pass the Bitnet-VNet gateway.

May I add that it was a traumatic experience for many users to run the
EXEC (not for me, as I usually read programs donated to me before I
run them :-) At that time, most Bitnet nodes sent an interactive
message back to the original sender whenever they had forwarded a
file, or a mail item (as if every post employee who handles your
letter would send you a telegram to acknowledge that fact). This
resulted in one to about twenty lines (depending on the distance) on
the senders screen for every addressee the file was sent to,
interrupting normal work and filling the screen (which had then to be
cleared to proceed).

> [...]

In short: CHRISTMA EXEC came as a program that had to be received and
run by the user. The program would run only under the CMS operating
system.  When run, the program would send exact copies of itself to
other Bitnet users known by the user who had run the program.

I hope I am not perceived as being too picky in saying this. Thanks
again to Robert Slade.

Best wishes,
                    Otto Stolz <[e-mail]>
                               <[e-mail]>