The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/pc/virus/virus.doc

Text File | 2003-06-11 | 200.3 KB | 6,201 lines

COMPUTER VIRUS EPIDEMIC
1987-1991


ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART ONE

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition since the
outbreak in November 1987 through March
1988.)

"VIRUS" INFECTS COMMODORE COMPUTERS

  (Nov. 20)
  A "virus" has been infecting
Commodore's Amiga computers, and what
was once considered an innocent bit of
hacking has turned into a disaster for
some users.
  The "virus" is a secret modification
to the boot block, an area on many disks
using operating system facilities of the
Amiga. In addition to its transparent
purpose --- starting the operating
system -- the virus contains code that
can infect other disks.  Once a virus
infected disk is used on a computer, the
computer's memory becomes a breeding
ground and all other bootable disks that
find their way to that computer will
eventually become infected. Any exchange
of diskettes with another computer then
infects the new computer.
  Although the original intention of the
virus apparently was benign, it may have
spread to thousands of Amiga computers
and disrupted their normal operations.
Since some commercial software
developers use coded information in the
boot block of their distribution disks,
the virus can inadvertently damage these
disks and render the software useless.
Knowledgeable users say the virus was
meant to be a high-tech joke that
displayed a message after it had
completely infiltrated a user's disks
library.
  According to Amiga technical support
personnel, the only sure way for users
to keep the virus out of their systems
is to avoid warm starting the computer.
It should always be powered down first.
  --


VIRUS MOVES TO IBM COMPUTERS

  (Dec. 7)
  On the heels of the Amiga virus,
reported recently in Online Today, a new
apparently less benign virus has been
making the rounds of IBM personal
computers. The IBM-related virus was
first noted at Lehigh University where,
last week, a representative in the User
Services section reported its discovery
by student consultants.
  As with other similar viruses, this
one is spread by means of an infected
system file. In this case, a hacked
version of IBM's COMMAND.COM processor
is the host that harbors the virus.
Once infected, the host PC will then
infect the first four computers with
which it comes in contact. In all cases,
the virus is spread through an illegally
modified version of the IBM command
processor.
  Once the host has infected four other
computers, the host virus is reported to
purposely destroy the boot tracks and
allocation tables for all disks and
diskettes that are online to the host
computer. The action renders the disks
completely unreadable, even when
reconstructs are attempted with popular
disk repair software.
  The consultant at Lehigh University
who first alerted general users to the
virus says that it can be detected by
examining the date on the COMMAND.COM
file. A recent date would suggest that
the file had been illegally modified.
  --


CHRISTMAS GREETINGS MESSAGE TIES UP
IBM'S ELECTRONIC MAIL SYSTEM

  (Dec. 12)
  IBM nearly lost its Christmas spirit
yesterday. It seems that a digital
Christmas card sent through its
electronic mail system jammed computers
at plants across the United States for
up to 90 minutes.
  The Associated Press quotes IBM
spokesman Joseph Dahm as saying the
incident caused no permanent damage, but
forced the company to turn off links
between computer terminals for a while.
  AP says, "Curious employees who read
the message discovered an illustration
of a Christmas tree with 'Holiday
Greetings' superimposed on it. A caption
advised, 'Don't browse it, it's more fun
to run it.' Once a person opened the
computer message on their screen, it
rarely accepted a command to stop the
message from unfolding on the screen. As
a result, several people shut off their
computers and lost reports or mail that
had not previously been filed."
  Apparently the message also
automatically duplicated itself and was
sent to other workstations.
  Online plants in Texas and New York
were affected, Dahm said. Meanwhile,
sources said that other facilities in
Charlotte, N.C.; Lexington, Ky.;
California and Europe also received the
message.
  Federal agents even may investigate
the incident, the wire service says,
since the message apparently crossed
state lines.
  --



COMPUTER VIRUS THREATENS HEBREW
UNIVERSITY'S EXTENSIVE SYSTEM

  (Jan. 8)
  In Jerusalem, Hebrew University
computer specialists are fighting a
deadline to conquer a digital "virus"
that threatens to wipe out the
university's system on the first Friday
the 13th of the year. That would be May
13.
  Associated Press writer Dan Izenberg
says the experts are working on a
two-step "immune" and "unvirus" program
that could knock down the vandalized
area of the system.
  "Viruses" are the latest in computer
vandalism, carrying trojan horses and
logic bombs to a new level, because the
destructiveness is passed from one
infected system to another. Izenberg
quotes senior university programmer
Yisrael Radai as saying that other
institutions and individual computers in
Israel already have been contaminated.
  "In fact," writes the wire service,
"anyone using a contaminated computer
disk in an IBM or IBM-compatible
computer was a potential victim."
  Radai says the virus was devised and
introduced several months ago by "an
evidently mentally ill person who wanted
to wield power over others and didn't
care how he did it."
  AP describes the situation this way:
  "The saboteur inserted the virus into
the computer's memory and the computer
then infected all disk files exposed to
it. Those disk files then contaminated
healthy computers and disks in an
electronic version of a contagious
cold."
  Apparently, the intruder wanted to
wipe out the files by Friday, May 13,
but may have gotten impatient, because
he then had his virus order contaminated
programs to slow down on Fridays and on
the 13th day of each month.
  Radai thinks that was the culprit's
first mistake, because it allowed
researchers to notice the pattern and
set about finding the reason why.
  "Another clue," says AP, "was derived
from a flaw in the virus itself. Instead
of infecting each program or data file
once, the malignant orders copied
themselves over and over, consuming
increasing amounts of memory space. Last
week, experts found the virus and
developed an antidote to diagnose and
treat it."
  Of viruses in general, computer expert
Shai Bushinsky told AP, "It might do to
computers what AIDS has done to sex. The
current free flow of information will
stop. Everyone will be very careful who
they come into contact with and with
whom they share their information."
  --


TAMPA COMPUTERISTS FIGHT VIRUS

  (Jan. 10)
  Tampa, Fla., computerists say they are
fighting a digital "virus" that sounds
as if it may be the same crank program
now plaguing a university in Jerusalem.
  As reported earlier, Hebrew University
computer specialists are contending with
a virus program that threatens to wipe
out the university's system on the first
Friday the 13th of the year -- May 13.
The Jerusalem team is working on a
two-step "immune" and "unvirus" program
that could knock down the vandalized
area of the system.
  Meanwhile, members of the Tampa Amiga
User's Group now tell United Press
International that they, too, are
fighting a computer virus, and UPI
quotes one expert as saying a version of
that vandalizing program also is
designed to begin destroying files on
May 13.
  Computer viruses are self-propagating
programs that spread from one machine to
another and from one disk to another, a
sort of new generation of more
destructive trojan horses and logic
bombs.
  "It kinda creeps up on you," president
Jeff White of the Amiga group told the
wire service, adding that the group's
membership was infiltrated by the
program.
  UPI reports, "Experts don't yet know
what, if any, damage the virus can cause
to the disks or programs. Similar
problems have erased programs and
information. ... White said the program
spread itself to more than 20 of his
floppy disks before he discovered it.
But by then, the program had spread to
the disks of many of the club's members
via its regular disk-of-the-month
distribution."
  White said he doesn't know how the bug
got to Tampa, but suspects it came from
West Germany on a disk from an overseas
user group.
  "White said the program works
invisibly," says UPI. "When the computer
is turned on, the program stores itself
in the machine's main memory and then
begins spreading copies of itself to new
disks used in the machine."
  He added that the Tampa club members
now use a "virus-checker" program to
test disks to prevent another infection.
  --


VIRUS PROGRAMS COULD HAVE USEFUL
APPLICATIONS, SAYS COLUMNIST

  (Jan. 11)
  Despite all the recent negative
publicity about computer "viruses" --
self-propagating programs that spread
from one machine to another in way that
has been called the computer version of
AIDS -- a California computer columnist
says there could be a positive result.
  Writing in The San Francisco Examiner,
John Markoff observes, "In the future,
distributed computing systems harnessed
by software programs that break tasks
into smaller parts and then run portions
simultaneously on multiple machines will
be commonplace. In the mid-1970s
computer researchers John Shoch and Jon
Hupp at Xerox's Palo Alto Research
Center wrote experimental virus programs
designed to harness many computers
together to work on a single task."
  Markoff points out that some of the
programs in that work functioned as
"'town criers' carrying messages through
the Xerox networks; others were
diagnostic programs that continuously
monitored the health of the computers in
the networks."
  Also the researchers called one of
their programs a "vampire worm" because
it hid in the network and came out only
at night to take advantage of free
computers. In the morning, it
disappeared again, freeing the machines
for human users.
  For now, nonetheless, most viruses --
particularly in the personal computing
world -- are viewed as destructive
higher forms of trojan horses and logic
bombs.
  Markoff traces the first virus to the
military ARPAnet in 1970. On that
system, which links the university,
military and corporate computers,
someone let loose a program called
"creeper."
  Notes the paper, "It crawled through
the network, springing up on computer
terminals with the message, 'I'm the
creeper, catch me if you can!' In
response, another programmer wrote a
second virus, called 'reaper' which also
jumped through the network detecting and
'killing' creepers."
  Markoff also pointed out that Bell
Labs scientist Ken Thompson, winner of
the prestigious Turing Award, recently
discussed how he created a virus in the
lab to imbed in AT&T's Unix operating
system, which he and colleague Dennis
Ritchie designed.
  In a paper, Thompson noted how he had
embedded a hidden "trapdoor" in the Unix
log-on module each time it created a new
version of the operating system. The
trapdoor altered the log-on mechanism so
that Unix would recognize a password
known only to Thompson.
  Thompson and Ritchie say the Unix
virus never escaped Bell Labs.
  --


SUBSCRIBER, SYSOP BLOCK POSSIBLE "VIRUS"
IN APPLE HYPERCARD FORUM

  (Feb. 8)
  Quick reactions by a subscriber and a
veteran forum administrator have blocked
a possible computer "virus" program that
was uploaded over the weekend to
CompuServe's new Hypercard Forum.
  The suspicious entry was an Apple
Hypercard "stack" file called
"NEWAPP.STK," which was uploaded Friday
to the forum's Data Library 9,
"HyperMagazines." It was online for
about 24 hours before it was caught.
  Subscriber Glenn McPherson was the
first to blow the whistle. Saturday
night McPherson posted a message saying
that when he ran the application, the
file altered his Macintosh's systems
file. "I don't know why it did this," he
wrote, "but no stack should touch my
system file."
  Neil Shapiro, chief forum
administrator of the Micronetworked
Apple Users Group (MAUG), quickly
investigated and removed the suspicious
file.
  In a bulletin to the membership,
Shapiro warned those who already had
downloaded NEWAPP.STK that the stack
would alter the system files with
unknown results. He also warned against
using system files from any disk that
was run while the NEWAPP.STK's modified
system was in effect.
  Said Shapiro, "If you run NEWAPP.STK,
it will modify the system on the disk it
is on so that the system's INITs contain
an INIT labeled 'DR.' Then, if you use
another system with the DR-infected
system as your boot system, the new
system will also contain the
self-propagating 'DR' INIT Resource.
While it is possible to, apparently,
'cut' this resource from infected
systems with the Resource Editor, the
only sure course of action is to trash
any system file that has come in contact
with this stack."
  It was not immediately known if the
system alternations were deliberately or
accidentally programmed into NEWAPP.STK.
Shapiro notes the file's uploader has
been locked off the entire system and
that "he will be contacted by CompuServe
and/or myself."
  Computer "viruses" -- self-
propagating programs that infect system
files and then spread to other disks --
have been in the news for the past six
months. To- date, most of their targets
have been regional computer users
groups, private and semi-public networks
and stand-along bulletin board systems.
This apparently is the first report of a
virus-like program on a national
consumer information service.
  Shapiro says in his bulletin that in
eight years of the various Apple forums'
operation, this is the only such
occurrence.
  "While I, of course, cannot say it
will be the last, I still have just as
much confidence as always in the fact
that 99.99999999% of the Mac community
are quite trustworthy and that there is
no real need to fear downloads," he
wrote.
  Shapiro also urged his membership, "If
you have not used (NEWAPP.STK) yet, do
not! If you have uploaded it to other
BBS or network systems, please
immediately advise the sysops there of
the problem. If you have placed it on a
club disk, please be certain to remove
it from that disk before distribution
and -- if it has been run from the
'Master' disk already -- don't just
remove it, but trash the system."
  Subscriber McPherson indicates the
suspect file already has spread to other
systems. His forum note says he found
the same stack program also in a
software library on the General
Electric's GEnie network.
  --



DOD TRIES TO PROTECT ITS COMPUTERS FROM
ELECTRONIC VIRUS

  (Feb. 9)
  Just as a medical virus can spread
rapidly, so does the deadly computer
virus seem to be making the rounds.
  In an effort to inoculate itself
against an outbreak, the Department of
Defense has taken steps to prevent the
electronic sabotage from affecting its
computers, reports Government Computer
News.
  The computer viruses are self-
propagating programs that are designed
to spread automatically from one
computer to another and from one disk to
another, totally disrupting normal
operations.
  As reported in Online Today, such
viruses have already struck computer
systems at Hebrew University in
Jerusalem and IBM Corp.'s regional
offices in Tampa, Fla.
  "It can spread through computer
networks in the same way it spreads
through computers," said DOD spokeswoman
Sherry Hanson. "The major problem areas
are denial of service and compromising
data integrity."  In addition to basic
security measures, computer scientists
at the National Security Agency are
installing programming tools and
hardware devices to prevent the
infiltration of virus programs. Hanson
told GCN that DOD is also using
specialized ROM devices and intrusion
detectors.  The virus only comprises a
few lines of programming code and is
easy to develop with few traces.
  After IBM was infiltrated last
December with an innocent- looking
Christmas message that kept duplicating
itself many times over and substantially
slowed the company's massive message
system, specialists installed a filter
program to monitor the system and
protect against further intrusion.
  According to GCN, executable programs
can't be transferred from one computer
to another within IBM's network.
  Even personal computer users are
worried, since the virus remains hidden
in a computer's main memory. For
instance, almost the entire membership
of a Florida Commodore Amiga users group
was infected by a virus before it was
discovered.
  The president of the group said he
believed the virus originated in Europe
on a disk of programs the group received
from an overseas source. The club now
has a checker program to check disks for
viruses before they are used.
  Al Gengler, a member of the Amiga
group, compared the virus to AIDS.
"You've got to watch who you compute
with now," he said.
  --Cathryn Conroy


EXPERTS SEES TWO SCENARIOS FOR THE
COMPUTER "VIRUS" PROBLEM

  (Feb. 9)
  Don Parker, who heads the information
security program for the Menlo Park,
Calif., SRI International, has been
studying the problem of computer
"viruses" and now says he see two
possible directions in the future.
  Speaking with Pamela Nakaso of the
Reuter Financial News Service, Parker
said his scenarios are:
  -:- One, that viruses will be too
difficult to design and use for
infiltration, and that interest in using
them as "weapons" will die away.
  -:- Or, two, viruses will increase in
destructiveness as more sophisticated
saboteurs use them to destroy the public
domain software resources available.
  Nakaso also quotes editor Harold
Highland of the magazine Computers and
Security as saying that "hysteria" over
the few documented incidents may fuel
even more viruses, which are defined as
self-propagating files that usually
damage a computer's systems files and
then spread to other disks.
  Highland pointed out that in a recent
Australian virus case among Amiga
computers, one tabloid newspaper
reported the incident with a headline
that spanned the entire cover, reading,
"Terror Strikes in the DP Industry."
  Parker told Reuter, "The vulnerability
is growing at the same rate as the
number of computers and number of
communications with computers."
  Nakaso writes, "Parker estimates that
of the 2,000 cases of documented
computer crime he has compiled at SRI,
about 20 to 30 have been virus attacks.
There is no question, however, the
reported incidents are rising, and they
are expanding beyond personal computers
to mainframes and other networks."
  --



COMPUTER VIRUS CALLED FRAUD

  (Feb. 10)
  Computer viruses may be frauds.
Although lots of people are talking
about computerdoms latest illicit fad,
to date, no one has produced a copy of a
living breathing virus. Now, a
University of Utah expert on urban
legends thinks that the dreaded virus
may be have become the high tech version
of the bogey man.
  Professor Jan Harold Brunvand has
written three books about urban legends
and he seems to think that the virus is
just the latest incarnation in a long
line of legends. Brunvand, and others,
have pointed out that there are striking
similarities among reports of the virus
and legends such as the cat in the
microwave oven. For one thing, there are
lots of reported sightings but no
concrete evidence. And urban legends
always seem to appear and affect those
things about which urban dwellers are
just coming to terms with: shopping
malls and microwave ovens in the 70's,
computers in the 80's.
  In today's society, a berserk computer
that destroys its owner's data certainly
qualifies as the stuff about which
legends are made. Even the way in which
the deed is accomplished has mystical
qualities: a computer wizard works
strange magic with the secret
programming codes of a computer
operating system.
  Brunvand, a computer owner himself,
says that although viruses could be
created, he has found absolutely no
evidence to support claims about their
existence.
  --



HYPERCARD VIRUS JUDGED "HARMLESS"

  (Feb. 12)
  Administrators of a CompuServe forum
supporting the Apple Hypercard
technology have confirmed that a file
uploaded to their data libraries last
weekend did indeed contain a so-called
computer "virus."
  However, they also have determined the
program apparently was harmless, meant
only to display a surprise message from
a Canadian computer magazine called
MacMag.
  As reported earlier this week, forum
administrator Neil Shapiro of the
Micronetworked Apple Users Groups (MAUG)
removed the suspicious entry, a
Hypercard "stack" file called
"NEWAPP.STK," after a forum member
reported that the file apparently
altered his Macintosh's system files.
  Computer "viruses," a hot topic in the
general press these days, have been
defined as self-propagating programs
that alter system files and then spread
themselves to other disks.
  Since removing the file last weekend,
the Apple administrators have been
examining the file and now Shapiro says
it apparently was designed merely to
display a message from MacMag on March
2.
  On the HyperForum message board (G
APPHYPER), Shapiro reports, "Billy
Steinberg was able to reverse engineer
(disassemble) the INIT that the virus
places into system files. The good news
is that the virus is harmless. But it
*is* a computer virus."
  Shapiro says that if the downloaded
file remained in the user's system, then
on March 2, the screen would display:
  "Richard Brandnow, publisher of
MacMag, and its entire staff would like
to take this opportunity to convey their
universal message of peace to all
Macintosh users around the world."
  Apparently the file is so designed
that after March 2 it removes itself
from the user's system.
  Shapiro notes that, while this file
apparently is harmless, it still raises
the question of the propriety of
database entries that quietly alter a
user's system files.
  Shapiro said he has spoken to
publisher Brandnow. "It was not his
intention to place it in a HyperCard
stack nor to have it on (CompuServe),"
Shapiro writes. "What he did do was to
develop the INIT in December and 'left'
it on their (MacMag's) own machines with
the hope that 'it would spread.'"
  Subsequently, someone else apparently
captured the file, added it to his
"stack" and uploaded to the CompuServe
forum and other information services.
  While Brandnow maintains the
system-altering INIT file was harmless,
Shapiro says he's concerned about what
the NEWAPP.STK incident could represent.
  "While the INIT itself is
non-destructive," Shapiro wrote, "I
believe it was at least irresponsible
for MacMag to have perpetrated this type
of problem and to have caused the
confusion that they did. I also fear
that this could give other people ideas
on less peaceful uses of such a virus.
  "I believe that MacMag has opened here
a Pandora's Box of problems which will
haunt our community for years. I hope I
am wrong."
  --


PUBLISHER DEFENDS HIS "VIRUS" PROGRAM AS
"GOOD FOR COMMUNITY"

    (Feb. 13)
  The publisher of Canadian computer
magazine MacMag contends the computer
"virus" program his staff initiated
recently was not only harmless but was
"good for the Macintosh community."
  Says 24-year-old Richard Brandow, "If
other people do nasty things (with virus
programs), it is their responsibility.
You can't blame Einstein for Hiroshima."
  Speaking by phone with reporter Don
Clark of The San Francisco Chronicle,
Brandow maintained his magazine's virus
program, which spread through the Apple
Macintosh community this week on this
continent and apparently reached Europe,
was intended to do nothing more than
display a "peaceful" message on Mac
screens on March 2, the first
anniversary of the introduction of the
Apple Mac II.
  Of the so-called "virus" technology,
Brandow said, "This message is very good
for the Macintosh community."
  The controversy centered around an
Apple Hypercard "stack" file called
"NEWAPP.STK" that was uploaded to
various public domain databases around
the country, including the data library
of CompuServe's HyperForum (G APPHYPER).
  When subscribers discovered that the
file quietly altered their Mac's system
files when it was executed, a warning
was posted and forum administrator Neil
Shapiro immediately removed the data
library entry. Only after the forum's
sysops had disassembled the suspect file
could it be determined that NEWAPP.STK's
only apparent function was to display a
March 2 greeting from Brandow and the
MacMag staff.
  HyperForum members now have been
informed that the file, while indeed a
"virus," apparently is harmless.
However, Shapiro contends MacMag
staffers were "at least irresponsible
... to have perpetrated this type of
problem and to have caused the confusion
that they did."
  Shapiro is quoted in The Chronicle as
adding, "This is very similar to someone
breaking into your home and writing a
message of good will in red lipstick on
your wall. It is a violation of the
right of private property... Our
computers are machines that belong to us
and other people should remain out of
them."
  On the other side of the argument,
Brandow told the paper, "The idea behind
all this is to promote peaceful methods
of communication between individuals
using harmless ways."
  Montreal-based MacMag, with a
circulation of 40,000, is Canada's only
Macintosh magazine. Brandow also heads a
1,250-member Mac user group, which he
says is Canada's largest.
  Brandow told Clark that programmers
worked more than a year on the virus,
adding that it was inspired by two
groups, known as "The Neoists" and "The
Church of the SubGenius." (He said the
latter was formed in Texas as a satire
on fundamentalist religion and inspired
a 1983 book.)
  As noted here earlier, the MacMag
virus also reached beyond CompuServe to
other information services and private
bulletin board systems. For instance,
The Chronicle quotes General Manager
Bill Louden of General Electric's GEnie
as saying that about 200 users
downloaded the file from that
information service before it was
discovered and removed early Monday.
Meanwhile, Shapiro told Clark that only
about 40 of CompuServe's subscribers
retrieved the file before it was removed
early Sunday.
  The Chronicle says that Mac devotees
in the Bay Area were "stunned" by news
of the virus, but not all were upset.
For example, Apple wizard Andy
Hertzfeld, a co-designer of the original
Mac, told the paper, "As far as I'm
concerned, it doesn't have any malicious
intent and is just some people having
fun. I don't see why people are so
uptight."
  Meanwhile, a spokeswoman for Apple at
company headquarters in Cupertino,
Calif., said the company is searching
for details of the virus and could not
comment on it at present.
  --



TWO FIRMS OFFER TO "INOCULATE" US
AGAINST THE COMPUTER "VIRUSES"

  (March 4)
  The debate continues over whether
computer "viruses" are real or just the
latest urban legend, but at least two
companies are hoping that we don't want
to take any changes.
  Independent of each other, the firms
this week both claimed to have the first
commercial software to "inoculate"
systems against those reported rogue
programs that damage data and systems
files.
  One of the companies, Lasertrieve Inc.
of Metuchen, N.J., introduced its
VirALARM product during Microsoft
Corp.'s CD-ROM conference in Seattle.
  In addition, in Stockholm, a Swedish
company called Secure Transmission AB
(Sectra) today announced a similar
anti-virus program called TCELL, after a
counterpart in human biology.
  A Lasertrieve statement contends that
previous anti-viral software utilities
-- mostly offered in the public domain
-- work by drawing attention to the
virus's attempted alterations of system
files, noting a change of file size, or
monitoring the dates of program changes.
However, the New Jersey firm contends,
this approach makes such programs
"easily fooled by sophisticated
viruses."
  Lasertrieve says its VirALARM contains
a program designed to protect another
program, creating a software "barrier."
According to the statement, before
anyone can use the protected program,
VirALARM checks to determine whether the
program has been altered since it was
inoculated. If there has been any
change, the software then blocks use of
the altered program, notifies the user
and suggests a backup copy of the
program be substituted.
  Meanwhile, Bo-Goran Arfwidsson,
marketing director of the Swedish
company, told Bengt Ljung of United
Press International that its TCELL
"vaccine" gives a database a partial
outside protection, sounds an alarm if a
computer virus appears inside a database
and identifies the infected file so it
can be isolated. The contaminated part
then can be replaced with a backup file.
  Sectra spokesman Torben Kronander said
that TCELL has been "tested for a year
now and there is no question that it
works," adding that since early 1987 the
software has functioned on computers of
major Swedish manufacturing companies.
Arfwidsson declined to name those
companies for security purposes.
  Kronander said TCELL simply made the
task of creating a virus so complicated
that only vast computer systems would be
able to carry it out. "We've effectively
removed the hacker type of attack, and
these have been the problem. It will
take the resources of a major software
producer or a country to produce a virus
in the future."
  UPI says Sectra is a 10-year-old
research company with 19 employees in
Linkoping in central Sweden, closely
tied to the city's Institute of
Technology.
  --



"VIRUS" SPREADS TO COMMERCIAL PROGRAM;
LEGAL ACTION CONSIDERED

  (March 16)
  That so-called "benign virus" that
stirred the Apple Macintosh community
earlier this year when it cropped up in
a public domain file in forums on
CompuServe and other information
services now apparently has invaded a
commercial program called FreeHand.
  The publisher, Seattle's Aldus Corp.,
says it had to recall or rework some
5,000 FreeHand packages once the virus
was discovered and now is considering
legal action against those who admitted
writing the self- propagating program.
  Meanwhile, other major software
companies reportedly are worried that
the virus may have affected some of
their products as well.
  At the heart of the controversy is a
"peace message" that Canadian Richard
Brandow, publisher of Montreal's MacMag
magazine, acknowledged writing. As
reported here earlier, that file was
designed to simply pop up on Mac screens
around the world on March 2 to celebrate
the first anniversary of the release of
the Macintosh II. However, many Mac
users reacted angrily when they learned
that the file quietly had altered their
systems files in order to make the
surprise message possible.
  Now the virus has re-emerged, this
time in FreeHand, a new Mac program
Aldus developed. Aldus spokeswoman Laury
Bryant told Associated Press writer
George Tibbits that Brandow's message
flashed when the program was loaded in
the computer.
  Bryant added that, while it "was a
very benign incident," Aldus officials
are angry and "are talking with our
attorneys to understand what our legal
rights are in this instance.... We feel
that Richard Brandow's actions deserve
to be condemned by every member of the
Macintosh community."
  This may be the first instance of a
so-called "virus" infecting commercial
software.
  Tibbits says the Brandow virus
apparently inadvertently spread to the
Aldus program through a Chicago
subcontractor called MacroMind Inc.
  MacroMind President Marc Canter told
AP that the virus appears to have been
in software he obtained from Brandow
which included a game program called
"Mr. Potato Head," a version of the
popular toy.
  Canter said that, unaware of the
digital infection, he ran the game
program once, then later used the same
computer to work on a disk to teach Mac
owners how to use FreeHand. That disk,
eventually sent to Aldus, became
infected. Then it inadvertently was
copied onto disks sold to customers and
infected their computers, Canter said.
  Upset with Brandow, Canter says he
also is considering legal action. For
his part, Brandow says he met Canter,
but denied giving him the software.
  The whole incident apparently has some
at other companies worried because they
also use Canter's services. Tibbits says
that among MacroMind's clients are
Microsoft, Ashton-Tate, Lotus
Development Corp. and Apple Computers.
A-T has not commented, but officials at
Microsoft, Apple and Lotus all told AP
that none of their software was
infected.
  Meanwhile, Brandow told Tibbits that,
besides calling for world peace, the
virus message was meant to discourage
software piracy and to encourage
computer users to buy original copies.
  The full message read: "Richard
Brandow, the publisher of MacMag, and
its entire staff would like to take this
opportunity to convey their universal
message of peace to all Macintosh users
around the world." Beneath that was a
picture of a globe.
  Brandow said that originally he
expected people making unauthorized
copies of programs on the machine would
spread the virus in the Montreal area
and possibly a few other areas of Canada
and the United States. However, he said
he was shocked later to find that, after
the virus program began to appear in the
databases of online information
services, an estimated 350,000 people in
North America and Europe saw the message
pop up on their computers on March 2.
  --



Last page !m

Online Today            OLT-2039

COMPUTER VIRUS EPIDEMIC

 1 Backgrounder, Part I
 2 Backgrounder, Part II
 3 Backgrounder, Part III
 4 Backgrounder, Part IV
 5 Backgrounder, Part V
 6 Backgrounder, Part VI

Enter choice !2

Online Today            OLT-3125

ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART TWO

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition from April
through November 1988.)


Press <CR> for more !s


THREAT OF "VIRUS" BLOWN OUT OF
PROPORTION, NORTON AND SYSOPS SAY

  (April 10)
  The threat of so-called computer
"viruses" has been vastly overrated,
according to software guru Peter Norton
and two CompuServe forum administrators.
  "We're dealing with an urban myth,"
Norton told Insight magazine. "It's like
the story of alligators in the sewers of
New York. Everyone knows about them, but
no one's ever seen them. Typically,
these stories come up every three to
five years."
  Don Watkins, administrator of
CompuServe's IBM Users Network forums
(GO IBMNET) also told the general
interest magazine that he's more
concerned about being hit by a meteor
than a computer virus.
  "In five years," Watson said, "I've
seen only one program that was designed
to do intentional damage. That was about
three years ago, and it wasn't very
sophisticated.
  "I have never spoken to anyone who
personally, firsthand, has ever seen or
experienced a program like this," Watson
added, "and my job keeps me in touch
with tens of thousands of people."
  CompuServe forum administrators check
each piece of user-contributed software
before posting it in data libraries for
general distribution.
  The alleged virus problem received
widespread attention in early March when
an unauthorized message was placed onto
Freehand, a commercial software product
for the Apple Macintosh published by
Aldus Corp. Earlier, the same message
circulated in several information
services and was uploaded to
CompuServe's Hyper Forum, a forum
devoted to the Hypertext technology that
is part of the Micronetworked Apple
Users Groups (GO MAUG).
  The message read "Richard Brandow,
publisher of MacMag, would like to take
this opportunity to convey a universal
message of peace to all Macintosh
users." It then erased itself without
doing any harm.
  Of the situation, Neil Shapiro, MAUG's
chief sysop, said, "The whole problem
has been completely hyped out of
proportion."
  --Daniel Janal


COMPUTER VIRUS NEWSLETTER DEBUTS

  (April 13)
  If you want to follow all the latest
news on insipid computer viruses, you
might be interested in the debut of
"Computer Virology," a newsletter
devoted to identifying and analyzing
those annoying computer diseases.
  Produced by Director Technologies
Inc., the developers of Disk Defender, a
hardware device that write protects PC
hard disks, the newsletter will be
published monthly. Topics will include
developments for protection against the
viruses, precautions and procedures to
follow to insure that terrorists not let
loose this rampant epidemic.
  "The latest strain of computer viruses
presently causing serious damage at
university labs, scientific research
facilities, hospitals and business
organizations worldwide, has created a
very real concern for the future of
having free access to the tremendous
amounts of information that are now
readily available for unlimited use,"
said Dennis Director, president of
Director Technologies.
  "The potential dangers of such viruses
is that they can be used not only as a
means to facilitate malicious pranks in
the home computer area, but also pose a
real `terrorist' threat to academic
computing labs, scientific research
projects and business. Data loss can
cost hundreds of thousands of dollars in
real money, as well as in wasted
man-hours."
  The newsletter is distributed free of
charge. For information or to subscribe,
contact Director Technologies Inc., 906
University Pl., Evanston, IL 60201.
312/491-2334.


SIR-TECH UNVEILS ANTI-VIRUS

  (April 14)
  Sir-tech Software Inc., the
Ogdensburg, N.Y., firm best known for
its recreational programs such as the
acclaimed "Wizardry" series of adventure
games, now has released a free program
called "Interferon, the Magic Bullet"
that it says is meant to "halt the
devastation of computer virus."
  A company statement reports that
Robert Woodhead, 29-year-old director of
Sir-tech's Ithaca, N.Y., development
center, designed the Apple Macintosh
program to "detect and destroy the
highly-publicized computer virus which
threatens the integrity of the world's
computer systems."
  Sir-tech says the program will be
offered free for downloading from
related services on CompuServe and
GEnie. In addition, it is available by
mailing a diskette with a
self-addressed, stamped envelope to
Sir-tech, 10 Spruce Lane, Ithaca, N.Y.
14850.
  While the program itself is free,
Woodhead asks for donations to a fund
established to buy computer equipment
for visually impaired users. A notice in
the software gives details on the fund.
  Woodhead said he has worked since
early this year to come up with
Interferon, named for the antiviral
treatment for cancer. "Just as a virus
leaves clues in a human body, the
computer virus is detectable if users
know what to look for," Woodhead said.
  The Interferon program recognizes
changes that computer viruses make as
they spread their infection and will
indicate that there is something amiss,
the statement said. "The infection can
be cured by deleting the diseased
files," it added. "As new viruses are
discovered, Interferon will be updated
for instant detection."
  --



NEW VIRUS PLAGUES MACINTOSHES AT NASA
AND APPLE

  (April 18)
  Apple Macintosh computers at the
National Aeronautics and Space
Administration and at Apple Computer as
well as other business offices around
the country have caught a new computer
virus, reports Newsday.
  The latest high-tech plague is under
investigation by Apple and federal
authorities.
  During the past three weeks, Apple has
been receiving reports of a virus called
Scores. Although it has not been known
to erase any data, it can cause
malfunctions in printing and accessing
files and can cause system crashes,
Cynthia Macon of Apple Computer told
Newsday.
  Two hundred of the 400 Macintosh
computers at the Washington, D.C.
offices of NASA have been infected.
Many of them are connected to local area
networks and are spreading the virus.
"This particular virus does not attack
data.  We have no record indicating
anyone lost anything important," said
Charles Redmond, a NASA spokesman.
  Newsday notes that the Scores virus
can be detected by the altered symbols
that appear in Scrapbook and Note Pad,
two Macintosh files.  Instead of the Mac
logo, users see a symbol that looks like
a dog-eared piece of paper.  Two days
after the virus is transmitted, it is
activated and begins to randomly infect
applications, such as word processing
and spreadsheet programs.
  EDS Corp. of Dallas, Texas was also
infected with the Scores virus, but
managed to stop its spread.
  -- Cathryn Conroy



FRIDAY THE 13TH "VIRUS" FIZZLES

  (May 14)
  Good morning, computerdom! It's
Saturday the 14th and we're all still
here. At least, we all SEEM to still be
here, though some are saying it's too
early to tell for sure.
  Yesterday, the first Friday the 13th
of the year, was widely reported to be
the target date for the denotation of a
computer virus called "Black Friday"
which was first discovered in the
computers of the Hebrew University in
Jerusalem late last year. The virus,
which was reported to have spread from
Jerusalem to computers around the world,
was said to be designed to destroy
computer files on May 13.
  However, no early reports of damage
have surfaced. Computer experts in
Jerusalem told Associated Press writer
Karin Laub that the so-called virus was
undone because most computer users were
alerted in time. Hebrew University
researchers detected the virus on Dec.
24 because of a flaw in its design,
according to senior programmer Yisrael
Radai.
  Nonetheless, a few experts are saying
that we aren't out of the woods yet.
  For instance, Donn Parker of the SRI
International research firm in Menlo
Park, Calif., told The Washington Post
this morning that he hadn't heard of any
virus-related damage, "but we have been
holding our breath. I think it will be a
dud, but we won't know until next week,
and only then if people whose computers
go down talk about it."
  Some software companies tackled the
virus scare. AP reports that the Iris
software publisher of Tel Aviv developed
an anti-virus program for the Israeli
computing community and sold 4,000
copies before yesterday. President Ofer
Ahituv estimated that 30 percent of his
6,000 customers, most of them
businesses, had been infected by the
Black Friday virus.
  Meanwhile, some are saying the
apparent fizzle of the virus is what
they expected all along.
  "Viruses are like the bogyman," said
Byron C. Howes, a computer systems
manager at the University of North
Carolina at Chapel Hill. Speaking with
AP, he compared programmers who believe
in viruses to "people who set little
bowls of milk outside our doors to feed
the dwarfs."
  Barry B. Cooper, owner of Commercial
Software in Raleigh, N.C., agreed. "I
just think that the whole thing is a
joke," like the prediction by medieval
seer Nostradamus of a major earthquake
on May 8, 1988. "That didn't come true,
and this won't come true."
  --


R.I. NEWSPAPER DISLODGES VIRUS

  (May 16)
  The Providence, R.I., Journal-Bulletin
says it worked for the past week and a
half to stamp out a "virus" that
infected an in-house personal computer
network used by reporters and editors,
but not before the virus destroyed one
reporter's data and infected scores of
floppy disks.
  Writing in The Journal, Jeffrey L.
Hiday said the virus was "a well-known,
highly sophisticated variation called
the 'brain' virus, which was created by
two brothers who run a computer store in
Lahore, Pakistan."
  Variations of the virus, he noted,
have been discovered at companies and
colleges across the country, including,
last week, Bowie State College in
Maryland, where it destroyed five
students' disks. Online Today reported
on April 23 that a similar
Pakistan-based virus infected a student
system used at Miami University in Ohio,
threatening to wipe out term papers
stored there.
  Apparently this is the first time a
virus has invaded a US newspaper's
system.
  Hiday said The Journal contacted one
of the Pakistan brothers by phone, who
said he created this particular virus
merely to keep track of software he
wrote and sold, adding that he did not
know how it got to the United States.
  However, Hiday added, "US computer
programming experts ... believe the
Pakistanis developed the virus with
malicious intent. The original version
may be relatively harmless, they point
out, but its elegance lends itself to
alterations by other programmers that
would make it more destructive."
  The newspaper says it discovered the
virus on May 6 when a message popped up
on computer screens reading, "Welcome to
the Dungeon. ... Beware of this VIRUS.
Contact us for vaccination." The message
included a 1986 copyright date, two
names (Basit and Amjad), a company
(Brain Computer Services), an address
(730 Nizam Block Allama Iqbal in Lahore,
Pakistan) and three phone numbers.
  Journal-Bulletin systems engineer
Peter Scheidler told Hiday, "I was sort
of shocked. I never thought I'd see a
virus. That's something you read about."
  The virus infected only the PC
network; neither the paper's Atex
news-editing system nor its IBM
mainframe that supports other
departments were affected.
  Hiday says the newspaper now is taking
steps to protect itself against another
virus attacks. It has tightened
dissemination of new software and
discussed installing "anti-virus"
devices. In addition, computer users
have been warned not to use "foreign"
software, and reporters have been
instructed to turn their computers off
and then on again before inserting
floppy disks.
  --


EPA MACINTOSHES RECOVER FROM VIRUS

  (May 18)
  Although Apple Macintosh computers at
the Environmental Protection Agency were
recently plagued with a virus, all of
them seem to be on the mend now.
  According to Government Computer News,
the computers were vaccinated with Virus
Rx, a free program issued by Apple
Computer Inc. to help users determine if
their hard disks have been infected.
Apple has begun an educational campaign
to promote "safe computing practices,"
Apple spokeswoman Cynthia Macon told
GCN.
  Virus Rx is available on CompuServe in
the Apple Developers Forum (GO APPDEV)
in Data Library 8 under the name
VIRUS.SIT.
  Macon said the best long-term response
to viruses "is to make users aware of
steps they can take to protect
themselves." These include backing up
data files, knowing the source of
programs and write-protecting master
disks. Other steps include booting from
a floppy disk and running all programs
from floppies rather than installing and
running them from the hard disk.
  EPA is having some trouble with
reinfection. Since up to 20 people may
use one Macintosh, someone may
unknowingly insert a virus-plagued disk
into a clean machine. "It's like mono.
You just never get rid of it," said
Leslie Blumenthal, a Unisys Corp.
contract employee at EPA.
  FBI agents in Washington, D.C. and San
Jose, Calif. are investigating the
spread of the Macintosh virus, notes
GCN.
  -- Cathryn Conroy


CONGRESS CONSIDERS VIRUS PROBLEMS

  (May 19)
  Computer viruses have come to the
attention of Congress and legislators
would like to be assured that US defense
computers are safe from the replicating
little bugs. Although defense systems
can't be reached simply by telephoning
them, a virus could be contracted
through an infected disk containing
non-essential information.
  The Defense Authorization Bill for FY
1989 is likely to direct the Defense
Department (DoD) to report on its
methods for handling potential viral
infections. Congress also wants to know
what DoD has done about safeguarding
military computers. They'd like some
assurance that the Defense Department
also has considered situations where a
primary contractor's computer could be
infected and subsequently endanger DoD's
own computers.
  Anticipating future hearings,
Congressional staffers are soliciting
comments from knowledgeable users as to
what the report to Congress should
cover. Interested parties should forward
their comments to Mr. Herb Lin, House
Armed Services Committee, 2120 Rayburn
House Office Building, Washington DC
20515. Further information is available
by calling 202/225-7740. All comments
will be kept in confidence.
  --


TEXAN STANDS TRIAL FOR ALLEGEDLY
INFECTING SYSTEM WITH "VIRUS"

  (May 24)
  In Fort Worth, Texas, a 39-year-old
programmer is to stand trial July 11 on
felony charges that he intentionally
infected an ex-employer's system with a
computer "virus." If convicted, he faces
up to 10 years in prison.
  The man, Donald Gene Burleson,
apparently will be the first person ever
tried under the state's tougher computer
sabotage law, which took effect Sept. 1,
1985.
  Dan Malone of the Dallas Morning News
broke the story this morning, reporting
on indictments that accuse Burleson of
executing programs "designed to
interfere with the normal use of the
computer" and of acts "that resulted in
records being deleted" from the systems
of USPA and IRA Co., a Fort Worth-based
national securities and brokerage.
  The paper quoted police as saying the
electronic interference was a "massive
deletion" of more than 168,000 records
of sales commissions for employees of
the company, where Burleson once worked
as a computer security officer.
  Burleson currently is free on a $3,000
bonding pending the trial.
  Davis McCown, chief of the Tarrant
County district attorney's economic
crimes division, said of the alleged
virus, "You can see it, but you can't
see what it does -- just like a human
virus. It had the ability to multiply
and move around and was designed to
change its name so it wouldn't be
detected."
  McCown also told Malone he wanted to
make sure "that this type of criminal
understands that we have the ability to
make these type of cases; that it's not
so sophisticated or complicated that
it's above the law."
  Company officials first noticed a
problem on Sept. 21, 1985. Says the
Dallas newspaper, "Further investigation
revealed that an intruder had entered
the building at night and used a
'back-door password' to gain access to
the computer. ... Once inside, the
saboteur covered his tracks by erasing
computer logs that would have followed
his activity, police said. With his
access to the computer complete, the
intruder manually deleted the records."
  Authorities say that only a few of the
200 workers in the USPA home office --
including Burleson -- had access and the
knowledge needed to sabotage the system.
  Earlier USPA was awarded $12,000 by a
jury in a civil lawsuit filed against
Burleson.
  --


FBI CALLED TO PROBE VIRUS CASE

  (July 4)
  The FBI has been called in by NASA
officials to investigate an alleged
computer virus that has destroyed data
on its personal computers and those of
several other government agencies.
  The New York Times reported this
morning that the rogue program --
apparently the so- called "Scores" virus
that surfaced last April -- was designed
to sabotage data at Dallas' Electronic
Data Systems. The paper said the virus
did little damage to the Texas company
but did wreak havoc on thousands of PCs
nationwide.
  The Times quoted NASA officials as
saying the FBI was called in because,
even though damage to government data
was limited, files were destroyed,
projects delayed and hundreds of hours
were spent tracking the culprit at
various government agencies, including
NASA, the Environmental Protection
Agency, the National Oceanic and
Atmospheric Administration and the US
Sentencing Commission.
  NASA says it doesn't know how the
program, which damaged files from
January to May, spread from the Texas
EDS firm to PC networks nor whether the
virus was deliberately or accidentally
introduced at government agencies.
  Meanwhile, the Times quoted experts as
saying that at least 40 so-called
"viruses" now have been identified in
the United States, defining a virus as a
program that conceals its presence on a
disk and replicates itself repeatedly
onto other disks and into the memory of
computers.
  As reported here in April, the Scores
virus was blamed for infecting hundreds
of Apple Macintosh computers at NASA and
other facilities in Washington, Maryland
and Florida.
  The Times says the spread of the virus
was exacerbated when private contractors
in Washington and North Carolina
inadvertently sold dozens of computers
carrying the virus to government
agencies. The virus spread for as long
as two months and infected networks of
personal computers before it was
discovered.
  --



NEW MEXICO BBS SUES OVER VIRUS

  (Aug. 17)
  The operator of a New Mexico computer
bulletin board system has filed what may
be the first federal suit against a
person accused of uploading a computer
"virus."
  William A. Christison, sysop of the
Santa Fe Message BBS, alleges in his
suit that a man named Michael Dagg
visited his board in the early hours of
last May 4 and "knowingly and
intentionally" uploaded a
digitally-infected file called
"BBSMON.COM."
  The suit says Christison "checked the
program before releasing it to the
public and discovered that it was a
'Trojan Horse'; i.e., it appeared to be
a normal program but it contained hidden
commands which caused the program to
vandalize Plaintiff's system, erasing
the operating system and damaging the
file allocation tables, making the files
and programs stored in the computer
unusable."
  Christison says that the defendant
re-visited the BBS nine times between
May 5 and May 12, sometimes logging in
under a pseudonym. "Several of these
times," the suit says, "he sent in
messages and on May 7, 1988, he
knowingly and intentionally sent in by
modem a program of the same name,
BBSMON.COM, as the original 'Trojan
Horse' computer program."
  Through attorney Ann Yalman,
Christison asks the court to grant
$1,000 for each Trojan Horse violation
and to enjoin the defendant "from
sending 'Trojan Horses' or 'viruses' or
other vandalizing programs to Plaintiff
or anyone else."
  A copy of the Santa Fe Message's suit
has been uploaded to CompuServe's IBM
Communications Forum. To see it, visit
the forum by entering GO IBMCOM at any
prompt. The ASCII file is VIRUS.CHG in
forum library 0.
  Also, you can reach Christison BBS
directly with a modem call to
505/988-5867.
  --



VIRUS FIGHTERS FIGHT EACH OTHER

  (Aug. 31)
  Two groups that mean to protect us in
the fight against so-called computer
"viruses" seem to be spending rather a
lot of their energies fighting each
other.
  "I personally know most of the people
in this industry and I have never seen
this kind of animosity," Brian Camenker
of the Boston Computer Society tells
business writer Peter Coy.
  The bickering grew louder on Monday in
page-one article in MIS Week trade
newspaper in which each side accused the
other of using sloppy techniques and
manipulating the testing process for its
own purposes.
  Says Coy, "The intensity of the debate
has left some software developers
disgusted with the whole business."
  The argument, which centers around
fair evaluation anti-virus "vaccine"
software, pits the 2- month-old Computer
Virus Industry Association led by John
McAfee, president of InterPath Corp. of
Santa Clara, Calif., against what Coy
terms "a loose collection of other
computer experts" led by consultant Jon
R. David of Tappan and editor Harold
Highland of Computers & Security
magazine.
  "Customers and producers agree on the
need for an independent panel of experts
to review the (vaccine) software," Coy
comments. "The question splitting the
industry is who should be in charge."
  CVIA is pulling together an
independent university testing panel
made up of representatives of Pace
University, Adelphi University and Sarah
Lawrence College and headed by John
Cordani, who teaches computer science at
Adelphi and Pace. However, David and
Highland say these people don't have the
necessary credentials and that McAfee's
InterPath products will have an
advantage in the testing because McAfee
invented a virus simulator that will be
used as a testing mechanism.
  Meanwhile, Highland says he's getting
funding from his publisher, Elsevier
Advanced Technology Publications, for
his own review of anti-viral software,
but adds he isn't interested in
operating an ongoing review board.
  --



VIRUS TRIAL BEGINS IN FORT WORTH

    (Sept. 7)
  A 40-year-old Texas programmer has
gone on trial this week, accused of
using a "virus" to sabotage thousands of
computer records at his former
employer's business.
  If convicted in what is believed to be
the nation's first virus-related
criminal trial, Donald G. Burleson faces
up to 10 years in jail and a $5,000
fine.
  Reporting from the state criminal
district court in Fort Worth, Texas, The
Associated Press notes Burleson was
indicted on charges of burglary and
harmful access to a computer in
connection with damage to data at USPA &
IRA Co. securities firm two days after
he was fired. The trial is expected to
last about two weeks.
  USPA, which earlier was awarded
$12,000 in a civil suit against
Burleson, alleges the defendant went
into its offices one night and planted a
virus in its computer records that, says
AP, "would wipe out sales commissions
records every month. The virus was
discovered two days later, after it had
eliminated 168,000 records."
  --


VIRUS ATTACKS JAPANESE NETWORK

    (Sept. 14)
  Japan's largest computer network --
NEC Corp.'s 45,000- subscriber PC-VAN
service -- has been infected by a
computer "virus."
  McGraw-Hill News quotes a NEC
spokesman as saying that over the past
two weeks 13 different PC- VAN users
have reported virus incidents.
  Subscribers' user IDs and passwords
"were apparently stolen by the virus
planter when the members accessed one of
the service's electronic bulletin
boards," MH says. "The intruder then
used the information to access other
services of the system and charged the
access fees to the password holders."
  NEC, which says it has not yet been
able to identify the virus planter, gave
the 13 subscribers new user IDs and
passwords to check the proliferation of
the virus.
  --


JURY CONVICTS PROGRAMMER OF VIRUS

    (Sept. 20)
  After deliberating six hours, a Fort
Worth, Texas, jury late yesterday
convicted a 40-year-old programmer of
planting a "virus" to wipe out 168,000
computer records in revenge for being
fired by an insurance firm.
  Donald Gene Burleson is believed to be
the first person convicted under Texas's
3-year-old computer sabotage law. The
trial, which started Sept. 6, also was
among the first of its kind in the
nation, Judge John Bradshaw told the
Tarrant County jury after receiving its
verdict.
  The Associated Press says jurors now
are to return to State District Court to
determine the sentence.
  Burleson, an Irving, Texas, resident,
was found guilty of harmful access to a
computer, a third-degree felony with a
maximum penalty of 10 years in prison
and a $5,000 fine. However, as a
first-time offender, Burleson also is
eligible for probation.
  As reported here earlier, Burleson was
alleged to have planted a rogue program
in computers used to store records at
USPA and IRA Co., a Fort Worth insurance
and brokerage firm.
  During the trial, prosecutor Davis
McCown told the jury the virus was
programmed like a time bomb and was
activated Sept. 21, 1985, two days after
Burleson was fired as a programmer at
the firm because of alleged personality
conflicts with other employees.
  AP quoted McCown as saying, "There
were a series of programs built into the
system as early as Labor Day (1985).
Once he got fired, those programs went
off."
  McCown added the virus was discovered
two days later after it had eliminated
168,000 payroll records, holding up
paychecks to employees for more than a
month.
  Expert witnesses also testified in the
three-week trial that the virus was
entered in the system via Burleson's
terminal by someone who used Burleson's
personal access code.
  However, the defense said Burleson was
set up by someone else using his
terminal and code. Says AP, "Burleson's
attorneys attempted to prove he was
vacationing in another part of the state
with his son on the dates in early
September when the rogue programs were
entered into the system. But prosecutors
presented records showing that Burleson
was at work and his son was attending
school on those dates."
  The Fort Worth Star-Telegram reports
that also during the trial, Duane
Benson, a USPA & IRA senior programmer
analyst, testified the automated virus
series, which was designed to repeat
itself periodically until it destroyed
all the records in the system, never was
automatically activated. Instead, Benson
said, someone manually set one of the
programs in motion Sept. 21, 1985,
deleting the records, then covering his
or her tracks by deleting the program.
  Prosecutor McCown says data damage in
the system could have amounted to
hundreds of thousands of dollars had the
virus continued undetected.
  As reported here earlier, Burleson
also has lost a civil case to USPA in
connection with the incident. That jury
ordered him to pay his former employers
$12,000.
  Following the yesterday's verdict,
McCown told Star-Telegram reporter
Martha Deller, "This proves (virus
damage) is not an unprosecutable
offense. It may be hard to put a case
together, but it's not impossible."
  --


UNIVERSITY PROFESSORS ATTACK COMPUTER
VIRUSES

  (Sept. 30)
  Because they have not been given
access to the National Security Agency's
anti-virus research, several university-
based computer experts are planning to
begin their own testing and validating
of software defenses against computer
viruses, reports Government Computer
News.
  Led by John Cordani, assistant
professor of information systems at
Adelphi University, the results will be
made public, unlike those being
researched by NSA. The work being done
by the Department of Defense is too
classified for use by the general
computer community.
  GCN notes that computer viruses are
hard-to-detect programs that secretly
replicate themselves in computer
systems, sometimes causing major damage.
  Cordani and five other academics will
establish secure laboratories to study
viruses in three New York colleges:
Adelphi University, Pace University and
Sarah Lawrence College. The lab will
test anti-virus software developed by
companies that are members of the
Computer Virus Industry Association, a
consortium of anti-virus defense
developers.
  The group will then publish what it is
calling "consumer reports" in the media
and on electronic bulletin board
systems. Once sufficient research is
completed, more general grading systems
will be applied, said Cordani. In
addition, the lab will use viruses sent
to them by the CVIA to develop
classification algorithms to aid in
describing a virus' actions and effects.
  -- Cathryn Conroy



SECOND VIRUS FOUND AT ALDUS CORP.

  (Oct. 21)
  For the second time this year, a
computer "virus" has been found in a
commercial program produced by Seattle's
Aldus Corp. The infection was found in
the latest version of the FreeHand
drawing software, the same software that
was invaded by a different virus last
March.
  An Aldus official told The Associated
Press the company was able to prevent
the virus's spread to programs for sale
to the public, but that an entire
computer network within Aldus'
headquarters has been infected.
  The virus was found in a version of
the Apple Macintosh software that was
sent to specific users to be tested
before going to market. One of the
testers discovered the virus, dubbed
"nVir," and two days later, Aldus
realized the virus was in its own
in-house network.
  Said Aldus spokeswoman Jane Dauber,
"We don't know where it came from. That
is the nature of the virus. You can't
really track it."
  AP says Aldus officials said the new
virus has remained dormant so far, a
tiny program that merely attaches itself
to other programs.
  "We don't know why," Dauber said. "We
don't know what invokes this virus. With
some of them, you have to launch the
program a certain number of times," for
the virus to activate.
  The company told the wire service
that, while it does not know where the
virus originated, reports are that it
apparently has infected at least one
unidentified East Coast university's
computers.
  Another Aldus spokeswoman, Laury
Bryant, added, "You just can't always
stop these things from coming in the
door. But what we have done is to set up
systems which eliminate them before they
are actually in full version,
shrink-wrap software and stop them from
going out the door."
  Last March, in what was apparently the
first instance of an infection in
commercial software, a virus called the
"March 2 peace message" was found in
some FreeHand programs. The invasion
caused Aldus to recall or rework
thousands of packages of the new
software.
  --



MAN SENTENCED IN NATION'S FIRST
VIRUS-RELATED CRIMINAL COURT CASE

    (Oct. 23)
  Donald Gene Burleson, the first person
ever convicted of using a computer
"virus" to sabotage data, has been
sentenced to seven years' probation and
ordered to pay back nearly $12,000 to
his former employer.
  The 40-year-old Irving, Texas, man's
attorney told United Press International
he will appeal the sentenced handed down
late Friday by District Judge John
Bradshaw in Fort Worth, Texas.
  As reported earlier, Burleson was
convicted Sept. 19 of the third-degree
felony, the first conviction under the
new Texas state computer sabotage law.
He was accused of infecting the
computers of USPA & IRA, a Fort Worth
insurance and securities firm a few days
after his firing Sept. 18, 1985.
  Burleson could have received two to 10
years in prison and a fine up to $5,000
under the 1985 law. As a first-time
offender, however, he was eligible for
probation.
  As reported during last month's trial,
a few days after Burleson's firing in
1985, company officials discovered that
168,000 records of sales commissions had
been deleted from their system.
  Burleson testified that he was more
than 300 miles away from Fort Worth on
Sept. 2 and Sept. 3 when the virus was
created. However, UPI notes that
evidence showed that his son was not
traveling with him as he said but in
school, and that a credit card receipt
Burleson said proved he was in Rusk on
Sept. 3 turned out to be from 1987.
  Associated Press writer Mark Godich
quoted Burleson's lawyer, Jack Beech, as
saying he had asked for five years'
probation for his client, and
restitution not to exceed $2,500.
  Godich also observed that the
Burleson's conviction and sentencing
"could pave the way for similar
prosecutions of people who use viruses."
  Chairman John McAfee of the Computer
Virus Industry Association in Santa,
Clara, Calif., told AP the Texas case
was precedent-setting and that it's rare
that people who spread computer viruses
are caught. He added his organization
had documented about 250,000 cases of
sabotage by computer virus.
  --


BRAIN VIRUS HITS HONG KONG

  (Oct. 30)
  According to Computing Australia, a
major financial operation in Hong Kong
was infected with a version of the
"Brain" virus.  This is the first
reported infection of a commercial
business in the East.
  Business International, a major
financial consulting firm in Hong Kong,
is believed not to have suffered any
major damage. A company spokeswoman
played down the appearance of the virus
and said that no data had been lost.
  The "brain" virus has been reported as
a highly sophisticated piece of
programming that was created by two men
in Lahore, Pakistan who run the Brain
Computer Services company.  It's last
reported appearance in the US was during
May when it popped up at the Providence,
R.I., Journal- Bulletin newspaper.
  --


60 COMPUTER FIRMS SET VIRUS GOALS

  (Nov. 2)
  Some 60 computer companies have
organized a group to set guidelines that
they say should increase reliability of
computers and protect the systems from
so-called "viruses."
  The Reuter Financial News Service says
that among firms taking part in the
movement are Microsoft Corp., 3Com Inc.,
Banyan Systems and Novell Inc. At the
same time, though, declining to join the
efforts are such big guys as IBM and
Digital Equipment Corp.
  Reuter reports, "The companies said
the measures would promote competition
while allowing them to cooperate in
making computers more reliable and less
vulnerable to viruses."
  However, the firms apparently have
shied away from specific proposals,
instead issuing broad recommendations
that leave it up to each company to
develop the technology needed to prevent
the spread of viruses, Reuter said.
  --



Last page !m

Online Today            OLT-2039

COMPUTER VIRUS EPIDEMIC

 1 Backgrounder, Part I
 2 Backgrounder, Part II
 3 Backgrounder, Part III
 4 Backgrounder, Part IV
 5 Backgrounder, Part V
 6 Backgrounder, Part VI

Enter choice !3

Online Today            OLT-1005

ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART THREE

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition beginning in
November 1988.)


Press <CR> for more !s


NEW LAN LABORATORY GROUP OFFERS
SUGGESTIONS FOR VIRUS PREVENTION

  (Nov. 7)
  Just a week or so before thousands of
networked computers across the country
were struck by a rapid virus, some 60
computer companies endorsed a set of
virus-prevention guidelines drafted by
the National LAN Laboratory.
  The Reston, Va., group, devoted to
local area networks, hopes its tips can
prevent and control future viruses and
worm program intrusions.
  Speaking with business writer Peter
Coy of The Associated Press, LAN Lab
spokesman Delbert Jones said, "The key
issue is that with proper precautions,
one can continue to live a normal
existence. ... "It's very much like the
AIDS virus: The best solution is
precaution."
  Here, according to AP, are the
suggestions by the LAN Lab group:
  1. All software should be purchased
from known, reputable sources.
  2. Purchased software should be in its
original shrink wrap or sealed disk
containers when received.
  3. Back-up copies should be made as
soon as the software package is opened.
Back-ups should be stored off-site.
  4. All software should be reviewed
carefully by a system manager before it
is installed on a network.
  6. New software should be quarantined
on an isolated computer. This testing
will greatly reduce the risk of system
virus contamination.
  7. A back-up of all system software
and data should be made at least once a
month, with the back-up copy stored for
at least one year before re-use. This
will allow restoration of a system that
has been contaminated by a
"time-released" virus. A plan that
includes "grandfathered" rotation of
back-up copies will reduce risk even
further.
  8. System administrators should
restrict access to system programs and
data on a "need-to-use" basis. This
isolates problems, protects critical
applications, and aids problem
diagnosis.
  9. All programs on a system should be
checked regularly for program length
changes. Any program-length deviations
could be evidence of tampering, or virus
infiltration.
  10. Many shared or free programs are
invaluable. However, these are the prime
entry point for viruses. Skeptical
review of such programs is prudent.
Also, extended quarantine is essential
before these programs are introduced to
a computer system.
  11. Any software that exhibits
symptoms of possible virus contamination
should be removed immediately. System
managers should develop plans for quick
removal of all copies of a suspect
program, and immediate backup of all
related data. These plans should be made
known to all users, and tested and
reviewed periodically.
  --



"BRAIN VIRUS" APPEARS IN HOUSTON

  (Nov. 9)
  A version of the so-called "Brain
virus," a rogue program believed to have
originated in Pakistan, now has cropped
up in computers used by University of
Houston business students. Texas
officials say that the virus, while a
nuisance, has posed no real problem.
  University research director Michael
Walters told The Associated Press, "It
probably hasn't cost us much, except a
few days of people-time to clean up
these disks, but it probably cost the
students a good bit of frustration."
  Some students report they have lost
data, but Walters told the wire service
he knows of no one who has lost an
entire term paper or other large
quantity of work. Nonetheless, reports
still were coming in from students late
yesterday.
  This version of the Brain virus, which
last spring was traced to a computer
store in Lahore, Pakistan, announced
itself at the university early last week
on the screen of one of the 150 PCs the
business department has for students and
faculty. Walters said the virus hasn't
spread to the school's larger computers.
  AP quotes Walters as saying the virus
flashed this message (with these
misspellings) to students who tried to
use infected programs:
  "Welcome to the dungeon. Copyright
1968 Brain & Amjads, PVT, LTD. Virus
shoe record V9.0. Dedicated to the
dynamic memory of millions of virus who
are no longer with us today -- Thank
Goodness. BEWARE OF THE VIRUS. This
program is catching. Program follows
after these messeges."
  The original "Brain" virus -- which
appeared in May at colleges and
businesses along the East Coast and in
the computers of The Providence, R.I.,
Journal-Bulletin newspaper -- flashed
the "Welcome to the Dungeon" message,
but added "Contact us for vaccination."
It also gave names, an address and a
phone number of two brothers who run a
Lahore, Pakistan, computer store.
  Walters said the Houston version of
the virus says nothing about any
vaccine, and the "V9.0" in its message
suggests it may be a modified version.
  Before this, the most recent sighting
of the "Brain" virus was at Business
International, a Hong Kong financial
operation. It was thought to be the
first reported digital infection of a
commercial business in the East. The
firm is believed not to have suffered
any major damage.
  --



UNIX EXPERT SAYS VIRUS "PANIC"
UNNECESSARY, BLAMES BAD PLANNING

  (Nov. 10)
  An expert on the Unix operating system
says that much of last week's "panic"
over the virus that brought down some
6,000 networked computers was caused by
poor management technique.
  In a statement from his Rescue,
Calif., offices, newsletter editor Bruce
Hunter said, "Most of the damage was
done by the organizations themselves,
not the virus."
  Hunter, who edits Root, a bimonthly
Unix administration and management
journal published by InfoPro Systems,
observed that more than 50,000 users
were reportedly cut off at a single site
due to last week's virus, and that more
than a million people are believed to
have been directly affected.
  However, Hunter said, "By dropping
network connections, administrators were
ensuring that the virus was winning.
Good communications and information
sharing between administrators is what
helped people on the network find and
implement a solution to the virus
quickly."
  Hunter, who also is an author and
mainframe Unix system manager, said that
one job of an administrator is to keep
all system resources available to users,
and another is to "go around searching
for possible trouble."
  He said the most important lesson
learned from last week's virus was that
a definite plan is imperative to avoid
inappropriate reactions.
  Hunter made these suggestions to
managers:
  -:- Develop a set of scenarios and
responses for future virus attacks as
well as physical disasters.
  -:- Keep a printed list of system
administrators at all company sites.
  -:- Establish a central point of
information.
  -:- Coordinate an emergency response
task force of key personnel.
  -:- Keep current off-site backups of
all data.
  -:- Perform regular security audits.
  --



MICHIGAN WEIGHS ANTI-VIRUS LAW

  (Nov. 15)
  Michigan lawmakers soon will consider
a proposed state law that would impose
felony penalties against anyone
convicted of creating or spreading
computer "viruses."
  Sponsoring the bill, Republican Sen.
Vern Ehlers told United Press
International, "Because this is a new
type of crime, it is essential we
address it directly with a law that
deals with the unique nature of
computers."
  Citing this month's virus attack on
military and research computers linked
by ARPANET and other networks, Ehlers
added, "The country recently saw how
quickly a virus can spread through
network users. The Defense Department
and its contractors were extremely
fortunate that the virus was relatively
harmless."
  The senator said his bill, still being
drafted, is expected to include
provisions making it a felony for anyone
to deliberately introduce a virus into a
computer system.
  UPI notes Ehlers is a physicist with a
Ph.D who has 30 years' experience with
computers.
  --



VIRUS STRIKES CALIF. MACINTOSHES

  (Nov. 15)
  Students at Southern California
universities were being warned today of
a rapidly spreading West German virus
that reportedly is disrupting functions
of Apple Macintosh computers.
  "In general, this thing is spreading
like mad," Chris Sales, computer center
consultant at California State
University at Northridge, told The
Associated Press. "It originated in West
Germany, found its way to UCLA and in a
short time infected us here."
  AP quotes school officials as saying
that at least a dozen Macs at the
suburban San Fernando Valley campus have
been infected since the virus first
cropped up last week. Cal State says the
virus apparently does not erase data,
but that it does stall the computers and
removal requires hours of reprogramming.
  The wire service said students' disks
are "being tested for the virus" before
they can rent a Mac at the university
bookstore.
  --



COMPUTER SECURITY EXPERT OFFERS TIPS

  (Nov. 15)
  The need to protect against computer
viruses has heralded the end of the
user-friendly computer era, says one
security expert.
  According to Government Computer News,
Sanford Sherizen, president of Data
Security Systems Inc. of Natick, Mass.
said the objective now is to make
software bullet-proof, not accessible.
  He said that since the advent of
computers in offices, managers have been
faced with the conflicting needs of
protecting the data versus producing it.
Data must be accessible to those who
need it and yet at the same time secure
from those who can alter, delete,
destroy, disclose or steal it or steal
computer hardware.
  Sherizen told GCN reporter Richard A.
Danca that non- technical managers can
contribute to computer security as
advocates and facilitators. Users must
learn that security is a part of their
jobs.
  He predicted that security managers
will soon use biometric security
measures such as comparing retinal blood
vessels or fingerprints. Needless to
say, such techniques raise complicated
issues of civil liberties and privacy.
  Sherizen said that all information
deserves protection.
  --Cathryn Conroy



VIRUS THREAT SAID EXAGGERATED

  (Nov. 16)
  Because of the latest reports of
attacks by computer "viruses," some in
the industry are ready to blame such
rogue programs for anything that goes
wrong.
  However, expert Charles Wood told a
15th annual computer security conference
in Miami Beach, Fla., this week, "Out of
over 1,400 complaints to the Software
Service Bureau this year, in only 2
percent of the cases was an electronic
virus the cause of the problem. People
are jumping to the conclusion that
whenever a system slows down, it's a
virus that's responsible."
  The Associated Press reports that Wood
and other panelists cautioned that
computer-dependent companies should
focus more on the day-to-day breakdowns
caused by human error than on viruses.
  President Steve Irwin of LeeMah
Datacom Security Corp. told the
conference that this month's virus
assault on networked computers on the
ARPANET system "could be a cheap
lesson."
  Said Irwin, "We were lucky because it
was not a real malicious attempt ... If
(the virus' author) had ordered the
programs to be erased, the loss could
have gone into billions, lots of
zeroes."
  AP quoted Wood as adding, "The virus
is the hot topic right now, but actually
the real important subject is disaster
recovery planning. But that's not as
glamorous as the viruses."
  --



SPA FORMS GROUP TO KNOCK DOWN RUMORS
ABOUT COMPUTER VIRUSES

  (Nov. 17)
  Upset over wild rumors about the
destructiveness of computer viruses, the
Software Publisher Association has
formed a special interest group to
address computer security.
  In a statement released today at the
Comdex trade show in Las Vegas, SPA says
its new Software Security SIG will help
distribute information and serve as
liaison for software publishers,
industry analysts and consultants.
  McGraw-Hill News quotes SPA member
Ross Greenberg, president of Software
Concepts Design, as saying, "Recent
unsubstantiated statements regarding the
actual damage caused by viruses...has
caused more of a public fervor than
served as a public service."
  At the SIG's organizational meeting,
several companies discussed setting
standards on how to educate the public
regarding viruses and various anti-viral
products now being advertised.
  --



FEDERAL COMPUTERS AT RISK

  (Nov. 22)
  Many federal computer systems are
vulnerable to viruses and other security
problems because of inadequate controls
on the design and operation, reports The
Washington Post of a report issued by
the General Accounting Office.
  GAO warned that the planned computer
expansion (some $17 billion will be
spent by Uncle Sam in 1989) could only
increase security risks since the
computer growth will be so rapid. It
advised that particular attention be
paid to security concerns, especially in
the early phases of system development.
  "Recent instances of security breaches
in automated information systems have
resulted in the loss of assets,
compromise of program objectives and
leaks of sensitive information," said
the report, which is part of series
prepared by GAO for the incoming Bush
administration on national problems it
views as critical.
  The Post notes that some computer
experts said that the government's
security woes are no worse than those
that affect corporate or university
systems.
  GAO cited specific cases where
government computer security had been
breached:
  -:-A clerk used a computer processing
system to embezzle more than $800,000;
  -:-employees prepared fraudulent
documents for a tax processing system
and had the refunds sent to themselves
and others;
  -:-about 30 employees obtained illicit
access to computer files and made
unauthorized disclosures of highly
sensitive information;
  -:-several federal agencies have been
the victims of computer viruses that
have destroyed software and data.
  -- Cathryn Conroy


VIRUS THREAT ANALYZED BY EXPERTS

  (Nov. 23)
  The Computer Virus Industry
Association reports there have been 300
recorded "events" of computer virus
attacks on some 48,000 computers during
the past eight months.
  John McAfee, chairman of the
association, told The Washington Post
that 97 percent of those incidents
involved personal computers.  He says he
considers them to be more vulnerable
than larger systems because people
frequently stick their disks into other
people's computers to share data or
software or just to use another's
printer.
  Sharing data is not considered a risky
proposition; sharing software is another
matter, since viruses attach themselves
to programs.  And once infected, that
program can spread the virus to other
programs and computers.
  McAfee told The Post his group has
counted some 30 strains of viruses that
affect PCs, some of which are quite
innocuous while others have potentially
disastrous consequences. Some viruses
act immediately; others sit like time
bombs waiting to go off at a set time.
  But the experts warn users to not
become hysterical over the threat of
viruses.  Peter Norton, author of the
popular Norton Utility programs, likens
viruses to "urban myths, like alligators
in the New York sewers."
  The CVIA says that just four percent
of the cases reported to it have
actually be verified as real viruses.
Most are software bugs, system errors or
similar problems, notes The Post.
  -- Cathryn Conroy


FBI PROBES INTERNET INTRUSION

  (Nov. 24)
  Although the so-called virus "attack"
that affected a number of national
computer networks has been characterized
as unintentional, the Federal Bureau of
Investigation is apparently gathering
information to support criminal
sanctions against the virus' developer.
The FBI's authority to pursue such an
investigation stems from the Computer
Fraud and Abuse Act of 1986 --
legislation that criminalizes
unauthorized access to a computer system
being operated for the use of the
federal government.
  The network intrusion on November 3,
affected a number of computers at
federal installations including those at
the Lawrence Livermore National
Laboratory in San Francisco and the NASA
Ames Research Center in Mountain View,
Calif.
  Reportedly, the FBI Case Agent has
asked the Defense Data Network (DDN)
Project Management Office "to collect
the names of organizations and Points of
Contact (names and phone numbers) that
were hit by the Virus."  Those who wish
to submit information will be contacted
by their local FBI Field Office.
  Additional information is available
from the DDN security office at
703/285-5206.
  --




"CORE WARS" CREATOR URGES VIRUS CONTROL
CENTERS TO BE SET UP

  (Nov. 25)
  A Canadian professor and computer
columnist with Scientific American says
that governments ought to set up centers
for "computer virus control" patterned
after the Centers for Disease Control.
  Alexander Dewdney, professor of
computer science at the University of
Western Ontario, told reporter Stephen
Strauss of The Toronto Globe and Mail
that the centers could isolate, identify
and then develop antidotes for
self-replicating viruses.
  Dewdney became famous a few years ago
by writing in Scientific American about
how the principle of computer viruses
could be turned into a game he called
"Core Wars."
  Strauss writes, "Under Dewdney's plan,
an organization knowing or suspecting
its system of being infected by a virus
would send a copy of all or part of its
main operating program to the center.
There, the contaminated program would be
routed to a special 'clean room' portion
of the center's computer memory where it
would not be able to attack anything
else. Virus experts would then examine
the program to determine what kind of
bug was let loose... Once the viral type
was determined, countermeasures could be
put into effect."
  Dewdney suggests this last step could
be either a program counteracting the
original virus or one which made the
invading virus destroy all copies of
itself.
  "People," he said, "could expect that
within 24 hours some kind of remedy
would be in place."
  --



GOVERNMENT RESPONDS TO RECENT VIRUS
ATTACKS

  (Nov. 25)
  Federal computer security officials
are scrambling to prevent further
attacks by computer viruses on
government systems.
  According to Government Computer News,
top officials from both the
military-based National Security Agency
and the civilian-based National
Institute of Standards and Technology
are working together to develop
solutions to threat.
  One idea that is being considered,
according to Stuart Katzke, NIST
computer security chief, is the
formation of a federal center for
anti-virus effort that would be operated
jointly by NIST and NSA.
  He told GCN that the center would
include a clearinghouse that would
collect and disseminate information
about threats, such as flaws in
operating systems as well as solutions.
In addition, it would help organize
responses to emergencies by quickly
warning users of new threats and
defenses against them.  Katzke explained
that those who have solutions to a
threat could transmit their answers
through the center to threatened users.
A database of experts would be created
to speed response to immediate threats.
  The center would also develop means of
correcting flaws in software, such as
trapdoors in operating systems.  Vendors
would even be asked to develop and field
solutions, notes GCN.
  The only stumbling block is funding
and personnel for the center.
  Katzke did emphasize that viruses are
actually less of a threat than poor
security that allows abusers to access
systems.  Excellent technical anti-virus
defenses are of no use at all if
management does not maintain proper
control of the computer system, he told
GCN.
  Congress is expected to respond to the
recent outbreak of virus attacks.  One
bill that died in the 100th Congress,
The Computer Virus Eradication Act of
1988, will be reintroduced by Rep. Wally
Herger (R-Calif.).
  -- Cathryn Conroy



LINK BETWEEN ARPANET AND MILITARY SYSTEM
CUT BECAUSE OF INTRUDER

  (Dec. 1)
  Apparently because of an unknown
computer intruder, the Pentagon this
week cut links between its unclassified
military network called Milnet and
Arpanet, the national academic and
corporate network.
  The link reportedly was cut at 10 p.m.
Monday and was expected to be restored
sometime today.
  According to The New York Times this
morning, Pentagon officials are saying
officially that the move was due to
technical difficulties. However, The
Times quoted several unidentified
security experts as saying the
connection was broken after a recent
intrusion into several computers
operated by defense contractors and the
military.
  The Times said the Defense Department
apparently acted after a computer at the
Mitre Corp., a Bedford, Mass., think
tank, was illegally entered several
times over the past month. Officials at
several US and Canadian universities
said the intruder used their computers
to reach Mitre's.
  A Mitre spokeswoman confirmed that one
of the firm's computers had indeed been
entered, but said the systems involved
had not handled any classified or
sensitive information and that the
problem was fixed within hours of
detection.
  Seven computer gateways link Milnet to
Arpanet.
  Arpanet is the same network that was
stymied for 36 hours a month ago by a
so-called virus allegedly created by
Cornell University graduate student
Robert Morris Jr., 23, of Arnold, Md.
The Times quoted its experts as
speculating that the Pentagon may have
kept the connection between Milnet and
Arpanet severed while it tried to rid
the system of a security flaw.
  Speaking of Morris, two Harvard
University computer experts, graduate
student Paul Graham and programmer
Andrew H. Suddeth, appeared yesterday
before a federal grand jury in Syracuse,
N.Y., which is investigating the virus
incident.
  Suddeth said earlier that Morris
called him in a panic for help in
getting out a message to other computer
operators after he reportedly realized
what the virus was doing.
  The Associated Press says a third
person subpoenaed -- Mark Friedell, an
associate professor of computer science
-- was excused from testifying because
he told prosecutors he knew nothing
about the allegations of Morris'
involvement with the virus.
  Morris has not been subpoenaed to
appear before the grand jury, lawyer
Thomas Guidoboni of Washington, D.C.,
told the Syracuse Herald-Journal.
  Says AP, "Guidoboni so far has advised
Morris not to talk with anyone about the
virus, including FBI agents. But the
lawyer said an agreement may soon be
reached in which an interview with
agents would be arranged."
  --



CONGRESS TO PROBE VIRUS

  (Dec. 4)
  The Internet "WORM", previously
characterized as a virus, has caught the
attention of federal legislators. Two
congressional committees plan to
schedule hearings on the purported
actions of a 23-year-old Cornell
University student said to be
responsible for inserting the WORM
program into a national computer
communications network.
  The House Science, Space and
Technology Committee and the Crime
Subcommittee of the House Judiciary
Committee are planning hearings on the
Internet WORM when the new 101st
Congress meets. Representative Robert
Roe (D-N.J.) and Rep. William Hughes
(D-N.J.), the respective chairmen of the
two legislative groups, are apparently
concerned that even more serious
pitfalls await computers used in the
federal government. Rep. Hughes is
well-known in computer security circles
and has been instrumental in introducing
computer-related legislation.
  Both chairman are said to be concerned
about the vulnerability of federal
computers to intrusions either planned
or accidental. Committee hearing dates
will probably be scheduled soon after
the new congress convenes on January 9.
  --



PENTAGON FORMS VIRUS "SWAT TEAM"

  (Dec. 7)
  The Pentagon is bringing together some
100 unidentified computer experts from
across the country to act as a kind of
"SWAT team" to respond to
self-replicating "virus" programs that
might threaten US defense computers.
  Called CERT (the Computer Emergency
Response Team), the group includes
technical experts, site managers,
government officers, industry contacts,
executives and representatives from
investigative agencies.
  United Press International quotes a
Pentagon statement as saying the
experts' knowledge will be called upon
when needed; otherwise, they will go
about their usual jobs.
  CERT is to be coordinated from the
Software Engineering Institute at
Pittsburgh's Carnegie Mellon University,
where a six-member staff already is in
place, UPI says.
  A Pentagon spokeswoman characterized
the group as "sort of a SWAT team" that
will respond to security threats such as
the virus that thwarted Arpanet
computers for some 36 hours on Nov. 2
and 3.
  The government says CERT will assist
researchers in responding to emergencies
and will be able to rapidly establish
communications with experts working to
solve the problems, with affected
computer users and with government
authorities.
  --



NIST AND NSA JOIN IN VIRUS DEFENSE PLAN

  (Dec. 12)
  The National Security Agency and the
National Institute of Standards and
Technology have developed 11 possible
courses of action in a plan to fight the
recurrence of computer viruses on
federal computer systems, reports
Government Computer News.
  Although many details of the plans are
incomplete, sources told GCN that some
of the ideas include establishment of an
anti-virus coordination center for the
federal government where problems would
be reported and jointly supported by NSA
and NIST. The center might actually
evolve into a national command center
that would also support commercial
networks. GCN notes that staff experts
would carry beepers so they could be
summoned around the clock for immediate
response to a virus attack.
  Other plans called for the development
of standard virus analysis tools to aid
in the disassembly and study of viruses
as well as the establishment of a
response team from the government,
industry and academia with the
specialized skills to analyze viruses
and develop defenses.
  GCN notes that the group also
recommended that a network of experts be
maintained to ensure access to their
specialized skills in a crisis. The
establishment of an emergency broadcast
network to disseminate attack warnings
and virus defenses was also suggested.
Anti-virus defenses could be broadcast
over telephone lines by phones using
recorded messages.
  Other recommendations include better
training for operators, improved back-up
procedures to prevent viruses from being
copied to secure backup disks and
greater participation of law enforcement
agencies in emergencies.
  All the recommendations could be
implemented under the Computer Security
Act, which gives NIST authority to
oversee security for civilian computer
systems.
  Before the plan can be implemented
formally, however, NIST and NSA
officials must approve it, money must be
allocated and personnel must be hired.
  --Cathryn Conroy



SOVIETS FIGHT COMPUTER VIRUSES

  (Dec. 19)
  The Soviet Union says it has contended
with its first computer virus, one that
may have stemmed from a computer studies
"summer camp" there attended earlier
this year by Soviet and foreign
children.
  Computer specialist Sergei Abramov of
the USSR Academy of Sciences told Radio
Moscow yesterday that the virus was
found last August at the academy's
Institute of Program Systems. He said
the virus invaded systems in at least
five government-run institutions, but
that scientists now have developed a way
to detect known viruses and to prevent
serious damage.
  Charles Mitchell of United Press
International quoted Abramov as saying
the virus, dubbed DOS-62, infected 80
computers at the academy before it was
brought under control 18 hours later.
Abramov believes the virus was
introduced when Soviet students used the
institute's computers to copy infected
application programs and games for
personal computers.
  Of the computer summer camp, Abramov
did not say from which countries the
foreign students came, but added, "Here
in the Soviet Union there was not a
single instance of a computer virus
attack until August of this year but now
at least two different viruses have been
encountered by five different
institutions."
  He did not identify the five
institutions, nor did he say whether
viruses had infected any Soviet
computers connected to Western European
databases.
  Mitchell also quoted Abramov as saying
that concern about viruses caused Soviet
scientists to place a high priority on
finding a defense for what he said were
the 15 known digital virus strains in
the world. He said he headed the team
that found such a shield.
  "This protective system has no
counterpart in the world," Abramov said,
adding that details remain a state
secret but that the defense, known
formally as PC-Shield, has been tested
on IBM computers in the Soviet Union.
  "The system provides early warning of
an attack by practically any virus known
in the world," he said. "It has a
two-tiered system of protection. The
first tier warns the user of an attack
enabling him to stop the computer. The
second tier assures the detection of any
virus still unknown as well as known and
prevents it from spreading."
  UPI also quoted Radio Moscow as saying
that earlier this year an unidentified
programer at the Gorky Automobile Works
on the Volga river was charged with
deliberately using a virus to shut down
an assembly line in a dispute over work
conditions. The broadcast said the man
was convicted under Article 206, the
so-called Hooliganism law, which
provides for a jail term of up to six
years for "violating public order in a
coarse manner and expressing a clear
disrespect toward society."
  --



ANOTHER COMMERCIAL PROGRAM SAID TO BE
INFECTED BY "NVIR" VIRUS

  (Dec. 20)
  For the third time this year, a
commercial software package has been
infected by a computer virus. This time
the rogue program -- apparently another
version of the so-called "nVir" virus --
has shown up on a compact disk.
  Business writer Peter Coy of The
Associated Press says the virus was
found in seven programs on the second
edition of a CD-ROM called MegaROM,
which is sold for the Apple Macintosh
community by Quantum Leap Technology
Inc. of Coral Gables, Fla.
  Coy says the infection, which was
detected with virus- screening programs,
apparently occurred when the disk was
being prepared for duplication at Nimbus
Records in Charlottesville, Va. The
virus, which does not appear to be
dangerous, was spotted after about 400
copies of the disk had been shipped, he
says.
  John Sands, technical operations
manager of Nimbus' CD- ROM division,
told the wire service the virus came
from a piece of software residing on a
hard disk for Macintosh computers that
was manufactured by CMS Enhancements
Inc. of Tustin, Calif. Sands faulted CMS
for not alerting Nimbus and its other
disk drive customers about the virus
threat.
  In response, CMS President Jim
Farooque told Coy that as of yesterday
afternoon he hadn't been able to verify
that the virus had indeed come from his
company. Conceding that some of his
employees previously had told people at
Nimbus that the virus had come on a CMS
floppy disk used to prepare the hard
disk for receiving data, Farooque said,
"It's possible that ... they are
communicating back and forth information
that may or may not be true."
  He added the company voluntarily was
helping people get rid of the viruses
without admitting responsibility for
them.
  Quantum Leap President Robert Burr
told Coy his firm was alerted to the
virus on Dec. 9 and began notifying
recipients of the infected MegaRom disks
last week. The infected disks are
imprinted with a green decorative
pattern, while the new disks that are
virus-free have a blue pattern.
  Coy also noted, "Almost half of the
infected disks were shipped to members
of the computer press for review. The
disks are filled with programs, known as
shareware or freeware, that are
available for free from places such as
computer bulletin boards."
  The nVir virus first appeared in
another commercial program -- Aldus
Corp.'s FreeHand drawing software for
the Mac -- last October. Until now,
Aldus was the only commercial software
firm to publicly report a virus problem.
Last March, an earlier version of
FreeHand was infected by different
virus.
  --


VIRUSES TEST COMPUTER CRIME LAWS

  (Dec. 20)
  The perpetration of computer viruses
is a punishable crime that is generally,
although not specifically, addressed by
a number of federal and state criminal
statues. Despite this, law enforcement
officials are finding that successful
prosecutions tend to decrease
dramatically as the sophistication of
the misdeed increases, reports the Los
Angeles Times.
  "There are a lot of hairy evidence
questions with computer crimes," said
Jack Bologna, head of the International
Association of Computer Crime
Investigators. "Documentation today is
different than when you had a complete
paper trail. It is now possible to cause
a computer crime in which you destroy
all the evidence."
  Traditionally, computer thieves have
been tried under ordinary grand theft
and fraud sections of state criminal
codes, but since 1984 (a year after the
debut of the movie "War Games"), the
laws have been changing to keep up with
the state of technology. Now, 48 states
and the federal government have specific
laws governing against computer crime.
  Statistics show that an overwhelming
majority of cases that reach a judge
result in convictions, according to the
National Center for Computer Crime Data.
But most of the crimes are never
prosecuted because of lack of sufficient
evidence or because the victims, usually
large corporations, are too embarrassed
to notify authorities. But to date,
there have been no prosecutions of
computer viruses, which first emerged
about 18 months ago.
  Even the notorious case of Robert T.
Morris Jr., the 23- year-old Cornell
University graduate student suspected of
creating the virus that madly replicated
across the vast network of military and
university computers this fall, has not
yet been prosecuted. The Times notes
that the FBI is now studying four
federal criminal statutes to determine
whether it should prosecute Morris.
Authorities concede the case is fraught
with legal problems, meaning it is
possible he will never be prosecuted.
  --Cathryn Conroy



Online Today            OLT-1512

ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART FOUR

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition beginning in
January 1989.)

VIRUS STRIKES UNIVERSITY OF OKLA.

  (Jan. 11)
  Officials at the University of
Oklahoma in Norman, Okla., blame a
computer virus for ruining several
students' papers and shutting down
terminals and printers in a student lab
at the university library.
  Manager Donald Hudson of Bizzell
Memorial Library told The Associated
Press that officials have purged the
library computers of the virus. He said
the library also has set up extra
computers at its lab entrance to inspect
students' programs for viruses before
they are used on other computers.
  The wire service said the library's
virus probably got into a computer
through a student's disk, but the
student may not have known the virus was
there. Hudson said the library's
computers are not linked to any
off-campus systems. However, the
computers are connected through
printers, which he said allowed the
virus to spread.
  --


"FRIDAY THE 13TH" VIRUS STRIKES

  (Jan. 13)
  Data files and programs on personal
computers throughout Britain apparently
were destroyed today by what was termed
a "Friday the 13th" computer virus.
  Alan Solomon, managing director of S
and S Enterprises, a British data
recovery center, told The Associated
Press that hundreds of users of IBM and
compatible PCs reported the virus, which
he said might be a new species.
  Solomon, who also is chairman of an
IBM users group, told the wire service
that phone lines to the center were busy
with calls for help from businesses and
individuals whose computers were struck
by the virus.
  "It has been frisky," he said, "and
hundreds of people, including a large
firm with over 400 computers, have
telephoned with their problems."
  S and S hopes to figure out how the
virus operates and then attempt to
disable it. "The important thing is not
to panic and start trying to delete
everything in a bid to remove the
virus," Solomon said. "It is just a
pesky nuisance and is causing a lot of
problems today."
  --


"FRIDAY THE 13TH" VIRUS MAY BE NEW
VERSION OF ONE FROM ISRAEL

  (Jan. 14)
  Investigators think the "Friday the
13th" virus that struck Britain
yesterday might be a new version of the
one that stymied computers at the Hebrew
University in Jerusalem on another
Friday the 13th last May.
  As reported here yesterday (GO
OLT-308), hundreds of British IBM PCs
and compatibles were struck by the
virus, which garbled data and deleted
files.
  Jonathan Randal of The Washington Post
Foreign Service reports the program is
being called the "1,813" variety,
because of the number of unwanted bytes
it adds to infected software.
  He says the specialists are convinced
the program "is the brainchild of a
mischievous -- and undetected --
computer hacker at Hebrew University."
  Alan Solomon, who runs the IBM
Personal Computer User Group near
London, told the Post wire service that
1,813 was relatively benign, "very
minor, just a nuisance or a practical
joke."
  Solomon said he and other specialists
first noted the virus in Britain several
months ago when it began infecting
computers. Solomon's group wrote
security software with it distributed
free, so, he said, the virus basically
struck only the unlucky users who didn't
take precautions.
  --



LIBRARY OF CONGRESS VIRUS VICTIM

  (Jan. 27)
  An official with the US Library of
Congress acknowledges that the
institution was struck by a computer
virus last fall.
  Speaking to a delegation of Japanese
computer specialists touring Washington,
D.C., yesterday, Glenn McLoughlin of the
library's Congressional Research Service
disclosed that a virus was spotted and
killed out of the main catalog computer
system before it could inflict any
damage to data files.
  Associated Press writer Barton Reppert
quoted McLoughlin as saying, "It was
identified before it could spread or
permanently erase any data."
  McLoughlin added the virus was found
after personnel logged onto computers at
the library and noticed they had
substantially less memory space to work
with than they had expected.
  He said the virus apparently entered
the system through software obtained
from the University of Maryland. "We
don't know," he said, "whether it was a
student at Maryland, or whether Maryland
had gotten it from somebody else. That
was simply the latest point of departure
for the software."
  Meanwhile, Reppert also quoted
computer security specialist Lance J.
Hoffman of George Washington University
as saying the world may be heading
toward a catastrophic computer failure
unless more effective measures are taken
to combat viruses.
  Comparing last November's virus
assault on the Pentagon's ARPANET
network to a nuclear accident that
"could have had very disastrous
consequences for our society," Hoffman
told the visitors, "It wasn't Chernobyl
yet, it was the Three Mile Island -- it
woke a lot of people up."
  Online Today has been following
reports of viruses for more than a year
now. For background files, type GO
OLT-2039 at any prompt. And for other
stories from The Associated Press, type
GO APO.
  --



CHRISTMAS VIRUS FROM FRANCE?

   (Jan 30)
   A little noticed software worm, the
so-called Christmas Decnet virus, may
have originated from Germany or France.
Apparently released at the end of
December, the worm replicated itself
only onto Digital Equipment Corp.
computers that were connected to Decnet,
a national communications network often
accessed by DEC users.
  At least one system administrator has
noticed that the worm collected
identifying information from the invaded
terminals and electronically mailed that
information to a network node in France.
The assumption is that the French node
collected the information and,
subsequently, used it to propagate the
worm throughout the network.
  The so-called German connection came
about because of the way the worm
presents text information on invaded
terminals. Though written in English,
the worm message is said to contain
strong indications of Germanic language
syntax. Predictably, a German
"connection" has led to speculation that
Germany's Chaos Computer Club may have
had a role in worm's creation.
  --



FEDERAL GROUP FIGHTS VIRUSES

  (Feb. 3)
  The Computer Emergency Response Team
(CERT) has been formed by the Department
of Defense and hopes to find volunteer
computer experts who will help federal
agencies fight computer viruses. CERT's
group of UNIX experts are expected to
help users when they encounter network
problems brought on by worms or viruses.
  A temporary group that was formed last
year after Robert T. Morris Jr.
apparently let loose a bug that infected
the Department of Defense's Advanced
Project Agency network (ARPANET), will
be disbanded.
  The Morris case has some confusing
aspects in that some computer groups
have accused federal prosecutors with
reacting hysterically to the ARPANET
infection. It has been pointed out that
the so-called Morris infection was not a
virus, and that evidence indicates it
was released onto the federal network
accidentally.
  CERT is looking toward ARPANET members
to supply its volunteers. Among those
users are federal agencies, the Software
Engineering Institute and a number of
federally-funded learning institutions.
Additional information is available from
CERT at 412/268- 7090.
  --



COMPUTER VIRUSES HOT ISSUE IN CONGRESS

  (Feb. 3)
  One of the hottest high-tech issues on
Capitol Hill is stemming the plague of
computer viruses.
  According to Government Computer News,
Rep. Wally Herger (R-Calif.) has pledged
to reintroduce a computer virus bill
that failed to pass before the 100th
Congress adjourned this past fall.  The
measure will create penalties for people
who inject viruses into computer
systems.
  "Unfortunately, federal penalties for
those who plant these deadly programs do
not currently exist," said Herger. "As a
result, experts agree that there is
little reason for a hacker to even think
twice about planting a virus."  (Herger
then later corrected himself saying
those who plant viruses are not hackers
but rather criminals.)
  GCN notes that the bill calls for
prison sentences of up to 10 years and
extensive fines for anyone convicted of
spreading a computer virus. It would
also allow for civil suits so people and
businesses could seek reimbursement for
system damage caused by a virus attack.
  If the bill is referred to the
Judiciary Committee, as is likely, it
stands a reasonable chance of passage.
Rep. Jack Brooks, a longtime technology
supporter, is the new head of that
committee and he has already stated that
the new position will not dampen his
high-tech interests.
  -- Cathryn Conroy CONGRESS LOOKS AT
ANOTHER COMPUTER PROTECTION BILL

    (Feb. 27)
  The Computer Protection Act (HR 287)
is the latest attempt by Congress to
battle computer viruses and other forms
of sabotage on the high-tech machines.
  Introduced by Rep. Tom McMillan
(D-Md.), the bill calls for a maximum of
15 years in prison with fines of
$100,000 to $250,000 for those convicted
of tampering with a computer, be it
hardware or software.
  "With the proliferation of various
techniques to tamper with computers, we
need to fill the void in federal law to
deal with these criminals," said
McMillan.  "This legislation will send
the clear signal that infiltrating
computers is not just a cute trick; it's
against the law."
  The bill, which has been referred to
the Judiciary Committee, is written
quite broadly and is open to
interpretation.
  -- Cathryn Conroy



VIRUS CREATOR FOUND DEAD AT 39

  (March 17)
  A Californian who said he and one of
his students created the first computer
virus seven years ago as an experiment
has been found dead at 39 following an
apparent aneurysm of the brain.
  Jim Hauser of San Luis Obispo died
Sunday night or Monday morning, the
local Deputy Coroner, Ray Connelly, told
The Associated Press.
  Hauser once said he and a student
developed the first virus in 1982,
designing it to give users a "guided
tour" of an Apple II. He said that,
while his own program was harmless, he
saw the potentially destructive
capability of what he termed an
"electronic hitchhiker" that could
attach itself to programs without being
detected and sneak into private systems.
  --



HOSPITAL STRUCK BY COMPUTER VIRUS

   (March 22)
  Data on two Apple Macintoshes used by
a Michigan hospital was altered recently
by one or more computer viruses, at
least one of which apparently traveled
into the system on a new hard disk that
the institution bought.
  In its latest edition, the prestigious
New England Journal of Medicine quotes a
letter from a radiologist at William
Beaumont Hospitals in Royal Oak, Mich.,
that describes what happened when two
viruses infected computers used to store
and read nuclear scans that are taken to
diagnose patients' diseases.
  The radiologist, Dr. Jack E. Juni,
said one of the viruses was relatively
benign, making copies of itself while
leaving other data alone. However, the
second virus inserted itself into
programs and directories of patient
information and made the machines
malfunction.
  "No lasting harm was done by this,"
Juni wrote, because the hospital had
backups, "but there certainly was the
potential."
  Science writer Daniel Q. Haney of The
Associated Press quoted Juni's letter as
saying about three-quarters of the
programs stored in the two Mac II PCs
were infected.
  Haney said Juni did not know the
origin of the less harmful virus, "but
the more venal of the two apparently was
on the hard disk of one of the computers
when the hospital bought it new. ... The
virus spread from one computer to
another when a doctor used a word
processing program on both machines
while writing a medical paper."
  Juni said the hard disk in question
was manufactured by CMS Enhancements of
Tustin, Calif.
  CMS spokesman Ted James confirmed for
AP that a virus was inadvertently put on
600 hard disks last October.
  Says Haney, "The virus had
contaminated a program used to format
the hard disks. ... It apparently got
into the company's plant on a hard disk
that had been returned for servicing.
James said that of the 600 virus-tainted
disks, 200 were shipped to dealers, and
four were sold to customers."
  James also said the virus was "as
harmless as it's possible to be," that
it merely inserted a small piece of
extra computer code on hard disks but
did not reproduce or tamper with other
material on the disk. James told AP he
did not think the Michigan hospital's
problems actually were caused by that
virus.
  --




MORE HOSPITALS STRUCK BY VIRUS

  (March 23)
  The latest computer virus attack, this
one on hospital systems, apparently was
more far- reaching than originally
thought.
  As reported here, a radiologist wrote
a letter to the New England Journal of
Medicine detailing how data on two Apple
Macintoshes used by the William Beaumont
Hospital in Royal Oak, Mich., was
altered by one or more computer viruses.
At least one of the viruses, he said,
apparently traveled into the system on a
new hard disk the institution bought.
  Now Science writer Rob Stein of United
Press International says the virus --
possibly another incarnation of the
so-called "nVIR" virus -- infected
computers at three Michigan hospitals
last fall. Besides the Royal Oak
facility, computers at another William
Beaumont Hospital in Troy, Mich., were
infected as were some desktop units at
the University of Michigan Medical
Center in Ann Arbor.
  Stein also quoted Paul Pomes, a virus
expert at the University of Illinois in
Champaign, as saying this was the first
case he had heard of in which a virus
had disrupted a computer used for
patient care or diagnosis in a hospital.
However, he added such disruptions could
become more common as personal computers
are used more widely in hospitals.
  The virus did not harm any patients
but reportedly did delay diagnoses by
shutting down computers, creating files
of non-existent patients and garbling
names on patient records, which could
have caused more serious problems.
  Dr. Jack Juni, the radiology who
reported the problem in the medical
journal, said the virus "definitely did
affect care in delaying things and it
could have affected care in terms of
losing this information completely." He
added that if patient information had
been lost, the virus could have forced
doctors to repeat tests that involve
exposing patients to radiation. Phony
and garbled files could have caused a
mix-up in patient diagnosis. "This was
information we were using to base
diagnoses on," he said. "We were lucky
and caught it in time."
  Juni said the virus surfaced when a
computer used to display images used to
diagnose cancer and other diseases began
to malfunction at the 250-bed Troy
hospital last August. In October, Juni
discovered a virus in the computer in
the Troy hospital. The next day, he
found the same virus in a similar
computer in the 1,200-bed Royal Oak
facility.
  As noted, the virus seems to have
gotten into the systems through a new
hard disk the hospitals bought, then
spread via floppy disks.
  The provider of the disk, CMS
Enhancements Inc. of Tustin, Calif.,
said it found a virus in a number of
disks, removed the virus from the disks
that had not been sent to customers and
sent replacement programs to
distributors that had received some 200
similar disks that already had been
shipped.
  However, CMS spokesman Ted James
described the virus his company found as
harmless, adding he doubted it could
have caused the problems Juni described.
"It was a simple non-harmful virus,"
James told UPI, "that had been created
by a software programmer as a
demonstration of how viruses can infect
a computer."
  Juni, however, maintains the version
of the virus he discovered was a mutant,
damaging version of what originally had
been written as a harmless virus known
as "nVIR." He added he also found a
second virus that apparently was
harmless. He did not know where the
second virus originated.
  --


GOVERNMENT PLANS FOR ANTI-VIRUS CENTERS

  (March 24)
  Federal anti-virus response centers
that will provide authentic solutions to
virus attacks as they occur will be
developed by the National Institute of
Standards and Technology, reports
Government Computer News.
  The centers will rely on unclassified
material throughout the federal
government and provide common services
and communication among other response
centers.
  NIST will urge agencies to establish a
network of centers, each of which will
service a different use or technological
constituency.  They will offer emergency
response support to users, including
problem-solving and identification of
resources. GCN notes they will also aid
in routine information sharing and help
identify problems not considered
immediately dangerous, but which can
make users or a system vulnerable to
sabotage.
  A prototype center called the Computer
Emergency Response Team is already
operational at the Defense Advanced
Research Projects Agency and will serve
as a model for the others.
  Although NIST and the Department of
Energy will provide start-up funds, each
agency will have to financially support
its response center.
  --Cathryn Conroy




ILLINOIS STUDIES VIRUS LAW

  (April 15)
  The virus panic in some state
legislatures continues as anti- virus
legislation is introduced in Illinois.
  Illinois House Bill 498 has been
drafted by Rep. Ellis B. Levin
(D-Chicago) to provide criminal
penalties for loosing a so-called
computer virus upon the public.  The
bill is similar to one that has been
introduced in Congress.
  Rep. Levin's bill provides that a
person commits "'computer tampering by
program' when he knowingly: inserts into
a computer program information or
commands which, when the program is run,
causes or is designed to cause the loss,
damage or disruption of a computer or
its data, programs or property to
another person; or provides or offers
such a program to another person."
  Conviction under the legislation would
result in a felony.  A second conviction
would bring harsher penalties.
  Currently, the bill is awaiting a
hearing in the Illinois' House Judiciary
II Committee.  It is expected that
testimony on HB 498 will be scheduled
sometime during April.
  --


ERRORS, NOT CRACKERS, MAIN THREAT

  (April 28)
  A panel of computer security experts
has concluded that careless users pose a
greater threat than malicious saboteurs
to corporate and government computer
networks.
  Citing the well-publicized allegations
that Cornell University graduate student
Robert T. Morris Jr. created a worm
program last November that swept through
some 6,000 networked systems, Robert H.
Courtney Jr. commented, "It was a
network that no one attempted to
secure."
  According to business writer Heather
Clancy of United Press International,
Courtney, president of Robert Courtney
Inc. computer security firm, said the
openness of Internet was the primary
reason it was popular among computer
crackers, some of whom are less talented
or more careless than others.
  "People making mistakes are going to
remain our single biggest security
problems," he said. "Crooks can never,
ever catch up."
  Sharing the panel discussion in New
York, Dennis D. Steinauer, a computer
scientist with the National Institute
for Standards and Technologies, added
that network users should not rely only
on technological solutions for security
breaks.
  "Not everyone needs all security
products and mechanisms out there," he
said. "The market is not as large as it
is for networking equipment in general."
He added that a standard set of program
guidelines, applicable to all types of
networks, should be created to prevent
mishaps. "There has been a tremendous
amount of work in computer (operating)
standards. The same thing is now
happening in security."
  Fellow panelist Leslie Forman, AT&T's
division manager for the data systems
group, said companies can insure against
possible security problems by training
employees how to use computers properly
and tracking users to make sure they
aren't making potentially destructive
errors. "It's not a single home run that
is going to produce security in a
network," she said. "It's a lot of
little bunts."
  --


EXPERTS TESTIFY ON COMPUTER CRIME

  (May 16)
  Electronic "burglar alarms" are needed
to protect US military and civilian
computer systems, Clifford Stoll, an
astronomer at the Harvard- Smithsonian
Center for Astrophysics, told a Senate
Judiciary subcommittee hearing on
computer crimes, reports United Press
International.
  Stoll was the alert scientist who
detected a 75-cent accounting error in
August 1986 in a computer program at
Lawrence Berkeley Laboratory that led
him to discover a nationwide computer
system had been electronically invaded
by West Germans.
  "This was a thief stealing information
from our country," he said. "It deeply
bothers me that there are reprobates who
say, `I will steal anything I can and
sell it to whoever I want to.' It opened
my eyes."
  Following his discovery, Stoll was so
immersed in monitoring the illegal
activity that he was unable to do any
astronomy work for a year.
  "People kind of look at this as a
prank," Stoll said. "It's kind of funny
on the one hand. But it's people's work
that's getting wiped out."
  The West German computer criminals,
who were later determined to have been
working for Soviet intelligence,
searched the US computer network for
information on the Strategic Defense
Initiative, the North American Defense
Command and the US KH-11 spy satellite.
They also withdrew information from
military computers in Alabama and
California, although no classified
information was on any of the computer
systems.
  William Sessions, FBI director, also
appeared before the Senate subcommittee
and said the bureau is setting up a team
to concentrate on the problem.
  He explained that computer crimes are
among "the most elusive to investigate"
since they are often "invisible."  The
FBI has trained more than 500 agents in
this area.
  UPI notes that Sessions agreed to
submit his recommendations to Sen.
Patrick Leahy (D-Vt.), the subcommittee
chairman, for new laws that could be
used to protect sensitive computer
networks from viruses. Currently, there
are no federal laws barring computer
viruses.
  The FBI is working with other federal
agencies to assess the threat of such
crimes to business and national
security.
  William Bayes, assistant FBI director,
told the senators he likens a computer
to a house with locks on the door.  He
explained that he has placed a burglar
alarm on his computer at Berkeley,
programming it to phone him when someone
tries to enter it.  He said more
computer burglar alarms may be needed.
  -- Cathryn Conroy


MASS. CONSIDERS NEW INTRUSION LAW

  (May 21)
  In Boston, a state senator has offered
a bill that would make it a violation of
Massachusetts law to enter a computer
without authorization. It also would
level penalties against those caught
planting so-called computer "viruses."
  Sen. William Keating, the bill's
sponsor, told The Associated Press his
measure considers this new category of
crime to be analogous to breaking into a
building.
  "It's an attempt," Keating added, "to
put on the statutes a law that would
penalize people for destruction or
deliberate modification or interference
with computer properties. It clarifies
the criminal nature of the wrongdoing
and, I think, in that sense serves as a
deterrent and makes clear that this kind
of behavior is criminal activity."
  The senator credits a constituent,
Elissa Royal, with the idea for the
bill. Royal, whose background is in
hospital administration, told AP, "I
heard about (computer) viruses on the
news. My first thought was the clinical
pathology program. Our doctors would
look at it and make all these decisions
without looking at the hard copy. I
thought, what if some malevolent, bright
little hacker got into the system and
changed the information? How many people
would be injured or die?"
  Keating's bill would increase
penalties depending on whether the
attacker merely entered a computer,
interfered with its operations or
destroyed data. In the most serious
case, a person found guilty of knowingly
releasing a virus would be subject to a
maximum of 10 years in prison or a
$25,000 fine.
  AP says the bill is pending in
committee, as staff members are refining
its language to carefully define the
term "virus."
  --


COMPUTER VACCINE MARKET THRIVES ON USER
FEAR

  (May 23)
  The computer protection market is
thriving. The reason? Fear. Fear of the
spread of computer viruses and worms has
caused a boom in products that are
designed to protect unwitting users from
the hazards of high- tech diseases.
  According to the Dallas Morning News,
there is a surging cottage industry
devoted to creating "flu shots" and
"vaccines" in the form of software and
hardware; however, many of these cures
are nothing more than placebos.
  "There's a protection racket springing
up," said Laura A. DiDio, senior editor
of Network World, the trade publication
that sponsored a recent executive
roundtable conference in Dallas on
"Network Terrorism."
  Last year alone, American businesses
lost a whopping $555.5 million, 930
years of human endeavor and 15 years of
computer time from unauthorized access
to computers, according to statistics
released by the National Center for
computer Crime Data in Los Angeles,
Calif.
  The most difficult systems to protect
against viruses are computer networks
since they distribute computing power
throughout an organization. Despite the
threat, sales are thriving.  Market
Intelligence Research says sales of
personal computing networking equipment
grew 50 percent last year and are
expected to grow another 41 percent this
year to $929.5 million.
  Meanwhile, the Computer Virus Industry
Association says that the number of
computer devices infected by viruses in
a given month grew last year from about
1,000 in January to nearly 20,000 in
November and remained above 15,000 in
December.
  -- Cathryn Conroy



PENDING COMPUTER LAWS CRITICIZED

  (June 18)
  Computer attorney Jonathan Wallace
says that the virus hysteria still
hasn't quieted down and that legislation
that will be reintroduced in Congress
this year is vague and poorly drafted.
  Noting that at least one state, New
York, is also considering similar
legislation, Wallace says that
legislators may have overlooked existing
laws that apply to "software weapons."
In a newsletter sent out to clients,
Wallace notes that both the Electronic
Communications Privacy Act (ECPA) and
the Computer Fraud and Abuse Act (CFAA)
cover the vast majority of software
crimes.
  Wallace points out that both the ECPA
and the CFAA already impose criminal
penalties on illegal actions.  Even the
Senate Judiciary Committee has refutted
the idea that more federal laws are
needed. "Why don't we give existing laws
a chance to work, before rushing off to
create new ones," Wallace asks.
  Wallace is the editor of Computer Law
Letter and is an Assistant System
Administrator on CompuServe's Legal
Forum (GO LAWSIG).
  --


NEW VIRUS HITS THAI COMPUTERS

  (June 27)
  A newspaper in Bangkok is reporting
that a new computer virus, said to be
the most destructive yet discovered, has
struck computer systems in Thailand.
  According to the Newsbytes News
Service, computer security specialist
John Dehaven has told The Bangkok Post,
"This is a very subtle virus that can
lay dormant, literally, for years."
  The wire service says that two Thai
banks and several faculties at
Chulalongkorn University were hit by the
rogue program -- called the "Israeli
virus," because it was first detected
there -- at the beginning of last month.
Newsbytes says the infection spreads
quickly through any computer once it is
activated.
  --



CONGRESS STUDIES COMPUTER VIRUSES

  (July 21)
  The Congress is taking a hard look at
a new report that says major computer
networks remain vulnerable to computer
viruses that are capable of crippling
communications and stopping the nation's
telecommunications infrastructure dead
in its tracks.
  Rep. Edward Markey (D-Mass.), chairman
of the House telecommunications
subcommittee, told a hearing earlier
this week that federal legislation may
be needed to ease the threats posed by
computer viruses.
  "The risk and fear of computer-based
sabotage must be reduced to an
acceptable level before we can
reasonably expect our national networks
to accomplish the purposes for which
they were created," Markey said during a
hearing Wednesday on the new
congressional study.
  "We must develop policies that ensure
(network's) secure operation and the
individuals' rights to privacy as
computer network technologies and
applications proliferate," he added.
  The report by the General Accounting
Office examined last year's virus attack
that shut down the massive Internet
system, which links 60,000 university,
government and industry research
computers.
  The GAO found that Internet and other
similar systems remain open to attack
with much more serious results than the
temporary shutdown experienced by
Internet.
  The GAO warned that the Internet
virus, a "worm" which recopied itself
until it exhausted all of the systems
available memory, was relatively mild
compared to other more destructive
viruses.
  "A few changes to the virus program
could have resulted in widespread damage
and compromise," the GAO report said.
  "With a slightly enhanced program, the
virus could have erased files on
infected computers or remained
undetected for weeks, surreptitiously
changing information on computer files,"
the report continued.
  The GAO recommended the president's
science advisor and the Office of
Science and Technology Policy should
take the lead in developing new security
for Internet.
  In addition, the report said Congress
should consider changes to the Computer
Fraud and Abuse Act of 1986, or the Wire
Fraud Act, to make it easier to bring
charges against computer saboteurs.
  Joining in sounding the alarm at the
hearing was John Landry, executive vice
president of Cullinet Software of
Westwood, Mass., who spoke on behalf of
ADAPSO.
  "The range of threats posed by
viruses, worms and their kin is limited
only by the destructive imagination of
their authors," Landry said. "Existing
computer security systems often provide
only minimal protection against a
determined attack."
  Landry agreed the Internet attack
could have been much worse. He said
viruses have been found that can modify
data and corrupt information in
computers by means as simple as moving
decimal points one place to the left or
right.
  One recently discovered virus, he
said, can increase disk access speed,
resulting in the wearing out of disk
drives. They also have been linked to
"embezzlement, fraud, industrial
espionage and, more recently,
international political espionage," he
said.
  "Virus attacks can be life
threatening," Landry said, citing a
recent attack on a computer used to
control a medical experiment. "The risk
of loss of life resulting from
infections of airline traffic control or
nuclear plant monitoring systems is
easily imaginable," he said.
  Landry said ADAPSO endorses the
congressional drive toward tightening
existing law to ensure that computer
viruses are covered along with other
computer abuses.
  --J. Scott Orr



GLOSSARY OF VIRUS-RELATED TERMS

  (July 21)
  Until last year's computer virus
attack on the massive Internet network
made headlines, computer sabotage
attracted little attention outside
computer and telecommunications circles.
  Today "computer virus" has become a
blanket term covering a wide range of
software threats.
  ADAPSO, the computer software and
services industry association, believes
the term has been thrown around a little
too loosely. Here, then, is ADAPSO's
computer virus glossary:
  -:- COMPUTER VIRUS, a computer program
that attaches itself to a legitimate,
executable program, then reproduces
itself when the program is run.
  -:- TROJAN HORSE, a piece of
unauthorized code hidden within a
legitimate program that, like a virus,
may execute immediately or be linked to
a certain time or event. A trojan horse,
however, does not self-replicate.
  -:- WORM, an infection that enters a
computer system, typically through a
security loophole, and searches for idle
computer memory. As in the Internet
case, the worm recopies itself to use up
available memory.
  -:- TRAPDOOR, a program written to
provide future access to computer
systems. These are typical entryways for
worms.
  -:- TIME BOMB, a set of computer
instructions entered into a system or
piece of software that are designed to
go off at a predetermined time. April
Fool's Day and Friday the 13th have been
popular times for time bomb's to go off.
  -:- LOGIC BOMB, similar to a time
bomb, but linked instead to a certain
event, such as the execution of a
particular sequence of commands.
  -:- CHAOS CLUB, a West German
organization that some have alleged was
formed to wreak havoc on computer
systems through the use of viruses and
their kin.
  --J. Scott Orr


ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART FIVE

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition beginning on
July 31, 1989, the first time word was
received of the so-called "Datacrime" or
"Columbus Day virus.")


RESEARCHER UNCOVERS OCT. 12 VIRUS

  (July 31)
  An official with a British firm that
markets anti-virus software says the
company has uncovered a new virus called
"Datacrime" is set to attack MS-DOS
systems starting Oct. 12.
  Dr. Jan Hruska of Sophos UK tells
Computergram International the virus
apparently appends itself to .COM
(command) files on MS-DOS systems.
  "Operating on a trigger mechanism," CI
says, "the virus reformats track 0 of
the hard disk on or after Oct. 12. It
has no year check and so will remain
active from Oct. 12 onwards destroying
or losing programs and data."
  Hruska told the publication this is a
relatively new virus and that its
encrypted form reveals its name
("Datacrime") and its date of release,
last March 1.
  Sophos markets a program called
Vaccine version 4 designed to detect
known viruses.
  --



NIST FORMS COMPUTER SECURITY NETWORK

  (Aug. 3)
  The National Institute of Standards
and Technology is working with other
federal agencies to establish a
government-wide information network on
security incidents and issues, reports
Government Computer News.
  Organized by NIST's Computer Security
Division, the network would supply the
latest information to agencies on
security threats, develop a program to
report and assess security incidents as
well as offer assistance.
  Dennis Steinauer, evaluation group
manager of the Computer Security
Division, said the plan is a response to
the communications problems federal
agencies suffered during last November's
worm attack on Internet by Cornell
University graduate student Robert T.
Morris Jr.
  In addition to NIST, the departments
of Energy, Justice and Transportation as
well as the National Science Foundation
and NASA are participating in the
project, which calls for each agency to
organize a security incident response
and resource center.
  NIST's network would connect the
centers electronically, allowing them to
communicate with one another. Steinauer
said he wants to set up a master
database of contacts, phone numbers and
fax numbers to ensure communications.
  One aspect of the plan calls for each
center to become expert in some specific
area of the technology, such as personal
computers, local area networks or
multiuser hosts.
  "The answer is not some monolithic,
centralized command center for
government," Steinauer told GCN.
"Problems occur in specific user or
technology communities, and we see the
solutions evolving where the reaction is
by people who know the user community
and the environment."
  He explained that the Computer
Security Act has helped increase
security awareness within the
government, but the emergence of
computer viruses, worms and other
sophisticated threats has demonstrated
the need for more advanced security
tools.
  -- Cathryn Conroy


AUSTRALIAN CHARGED WITH CRACKING

  (Aug. 14)
  Australia is reporting its first
computer cracking arrest. A Melbourne
student is charged with computer
trespass and attempted criminal damage.
  Authorities allege 32-year-old Deon
Barylak was seen loading a personal
computer with a disk that was later
found to possess a computer virus.
  "Fortunately, it was stopped before it
could spread, which is why the charge
was only attempted criminal damage,"
senior detective Maurice Lynn told Gavin
Atkins for a report in Newsbytes News
Service.
  The wire service said Barylak could
face a maximum of 100 years' jail and a
fine.
  Also police expect to make further
arrests in connection with the case.
Authorities said Barylak also faces
charges of possessing computer equipment
allegedly stolen from a community
center.
  --


INTERNET VIRUS BACK?

  (Sept. 4)
  Apparently, neither the threat of
criminal sanctions nor the hazards of
investigation by the FBI is enough to
keep the Internet computer
communications network secure from
intrusion. The Department of Defense
agency responsible for monitoring
Internet security has issued a warning
that unauthorized system activity
recently has been detected at a number
of sites.
  The Computer Emergency Response Team
(CERT) says that the activity has been
evident for some months and that
security on some networked computers may
have been compromised.  In a warning
broadcast to the Internet, CERT says
that the problem is spreading.
  Internet first came to general
attention when a came to much of the
computing communities attention when a
23-year-old Cornell University student
was said to be responsible for inserting
a software "worm" into the network.  The
Department of Defense's Advanced Project
Agency network (ARPANET) also was
infected and CERT was formed to
safeguard networks used or accessed by
DoD emplyees and contractors.
  In its warning about recent
intrusions, CERT says that several
computers have had their network
communications programs replaced with
hacked versions that surreptitiously
capture passwords used on remote
systems.
  "It appears that access has been
gained to many of the machines which
have appeared in some of these session
logs," says a broadcast CERT warning.
"As a first step, frequent telnet
[communications program] users should
change their passwords immediately.
While there is no cause for panic, there
are a number of things that system
administrators can do to detect whether
the security on their machines has been
compromised using this approach and to
tighten security on their systems where
necessary."
  CERT went on to suggest a number of
steps that could be taken to verify the
authenticity of existing programs on any
individual UNIX computer.  Among those
was a suggestion to reload programs from
original installation media.
  --


AIR FORCE WARNS ITS BASES OF POSSIBLE
"COLUMBUS DAY VIRUS"

  (Sept. 10)
  The US Air Force has warned its bases
across the country about a possible
computer virus reportedly set to strike
MS-DOS systems Oct. 12.
  Warning of the so-called "Columbus Day
virus" was issued by the Air Force
Communications Command at Scott Air
Force Base, Ill., at the request of the
Office of Special Investigations.
  OSI spokesman Sgt. Mike Grinnell in
Washington, D.C., told David Tortorano
of United Press International the
advisory was issued so computer
operators could guard against the
alleged virus. "We're warning the
military about this," Grinnell said,
"but anybody that uses MS-DOS systems
can be affected."
  As reported here July 31, Dr. Jan
Hruska, an official with a British firm
called Sophos UK, which markets
anti-virus software, said his company
had uncovered a new virus called
"Datacrime." Hruska told Computergram
International at the time that the virus
apparently appends itself to .COM
(command) files on MS-DOS systems.
  Said CI, "Operating on a trigger
mechanism, the virus reformats track 0
of the hard disk on or after Oct. 12. It
has no year check and so will remain
active from Oct. 12 onwards destroying
or losing programs and data." Hruska
told the publication this was a
relatively new virus and that its
encrypted form revealed its name
("Datacrime") and its date of release,
last March 1.
  Meanwhile, Air Force spokeswoman Lynn
Helmintoller at Hurlburt Field near Fort
Walton Beach, Fla., told UPI that
computer operators there had been
directed to begin making backup copies
of files on floppy disks just in case.
She said the warning was received at the
base Aug. 28.
  Staff Sgt. Carl Shogren, in charge of
the small computer technology center at
Hurlburt, told Tortorano no classified
data would be affected by the possible
virus attack because the disks used for
classified work are different from those
that might be struck.
  UPI quoted officials at Scott Air
Force Base as saying the warning was
sent to every base with a communications
command unit, but that they did not know
how many bases were involved.
  --


COMPUTER VIRUSES PLAGUE CONGRESS

  (Sept. 11)
  Although Congress recently passed the
Computer Security Act to force federal
agencies to guard against high-tech
break- ins and computer viruses, the
legislators may soon realize they made a
costly mistake. The law applies to all
federal agencies -- except Congress
itself.  And according to Government
Computer News, Capitol Hill has been the
victim of several recent virus attacks.
  One virus, for instance, emerged about
a year ago in the Apple Macintosh
computers of several House offices
causing unexplained system crashes.  A
steep bill of some $100,000 was incurred
before experts were confident the
plague, now known as Scores, was
stopped. However, it does still lurk in
the depths of the computers, notes GCN,
causing occasional malfunctions.
  Dave Gaydos, Congress' computer
security manager, says the sources of
many viruses may never be known, since
some 10,000 programmers are capable of
producing them.
  Capitol Hill legislators and staff
members are only now becoming aware of
the potential danger of viruses as more
offices are exploring ways to connect
with online database services and with
each other through local area networks.
  GCN reports that last February, a
California congressional office was the
victim of a virus, caught while using a
so-called vaccine program meant to
detect intruders into the system.
  "I used to laugh about viruses," said
Dewayne Basnett, a systems specialist on
Capitol Hill.  "But now when you ask me
about them, I get very angry.  I think
of all the time and effort expended to
repair the damage they do."
  According to GCN, many of the 3,000
House employees with computers are
ignorant of the risks and unable to take
basic precautions. Although various
computer specialists are trying to
inform Hill users of computer security
issues and offer training sessions,
there is no broad support from the
legislators themselves for such actions.
  "We are working to alert people to the
dangers," said Gaydos, "but it may take
an incident like a destructive virus to
move [Congress] to take precautions."
  -- Cathryn Conroy



VIRUS HITS AUSTRALIA

  (Sept. 12)
  Australian authorities are said to be
confused about the origin of a supposed
computer virus that has been making the
rounds of computer installations in the
South Pacific.  An Australian newspaper,
The Dominion, says that sensitive data
in Defense Department computers has been
destroyed by the virus.
  Dubbed the Marijuana virus because of
the pro-drug message that is displayed
before any data is erased, it is thought
that the misbehaving bug originated in
New Zealand.  Some have even suggested
that the program was purposely
introduced into Australian Defense
computers by agents of New Zealand, a
contention that a Defense Department
spokesman branded as "irresponsible."
The two South Pacific nations have had
strong disagreements about defense
matters, including recent joint
maneuvers in the area by Australian and
US forces.
  A more likely explanation for the
intrusion into Defense computers is the
likelihood that Australian security
specialists were examining the virus
when they inadvertently released it into
their own security system. The Marijuana
virus is known to have been infecting
computers in the country for at least
three months and its only known
appearance in government computers
occurred in a Defense sub-department
responsible for the investigation and
prevention of computer viruses.
  --



VIRUS THREAT ABSURDLY OVERBLOWN, SAY
EXPERTS

  (Sept. 18)
  The so-called "Columbus Day Virus"
purportedly set to destructively attack
MS-DOS computers on Oct. 13 has computer
users -- including the US military --
scampering to protect their machines.
But according to The Washington Post,
the threat is absurdly overblown with
less than 10 verified sightings of the
virus in a country with tens of millions
of computers.
  "At this point, the panic seems to
have been more destructive than any
virus itself," said Kenneth R. Van Wyk,
a security specialist at Carnegie-Mellon
University's Software Engineering
Institute, who has been taking some 20
phone calls daily from callers seeking
advice on the subject.
  Bill Vance, director of secure systems
for IBM Corp., told The Post, "If it was
out there in any number, it would be
spreading and be more noticeable."
  He predicted Oct. 13 is not likely to
be "a major event."
  As reported in Online Today, this
latest virus goes by several names,
including Datacrime, Friday the 13th and
Columbus Day.  It lies dormant and
unnoticed in the computer until Oct. 13
and then activates when the user turns
on the machine. Appending itself to .COM
(command) files, the virus will
apparently reformats track 0 of the hard
disk.
  The Post notes that the federal
government views viruses as a grave
threat to the nation's information
systems and has set in motion special
programs to guard computers against them
and to punish those who introduce them.
  Centel Federal Systems in Reston, Va.,
a subsidiary of Centel Corp. of Chicago,
is taking the threat seriously,
operating a toll-free hotline staff by
six full-time staff members.  More than
1,000 calls have already been received.
  Tom Patterson, senior analyst for
Centel's security operations, began
working on the virus five weeks ago
after receiving a tip from an
acquaintance in Europe.  He said he has
dissected a version of it and found it
can penetrate a number of software
products designed to keep viruses out.
  Patterson told The Post that he found
the virus on one of the machines of a
Centel client. "The virus is out there.
It's real," he said.
  Of course, where there's trouble,
there's also a way to make money. "The
more panicked people get," said Jude
Franklin, general manager of Planning
Research Corp.'s technology division,
"the more people who have solutions are
going to make money."
  For $25 Centel is selling software
that searches for the virus. Patterson
said, however, the company is losing
money on the product and that the fee
only covers the cost of the disk,
shipping and handling. "I'm not trying
to hype this," he said. "I'm working
20-hour days to get the word out."
  -- Cathryn Conroy



SICK SOFTWARE INFECTS 100 HOSPITALS
NATIONWIDE

  (Sept. 20)
  When a hospital bookkeeping computer
program could not figure out yesterday's
date, some 100 hospitals around the
country were forced to abandon their
computers and turn to pen and paper for
major bookkeeping and patient admissions
functions, reports The Washington Post.
  Although there was no permanent loss
of data or threat to treatment of
patients, the hospital accounting
departments found themselves at the
mercy of a software bug that caused
major disruptions in the usual methods
of doing business.
  The incident affected hospitals using
a program provided by Shared Medical
Systems Corp. of Pennsylvania. The firm
stores and processes information for
hospitals on its own mainframe computers
and provides software that is used on
IBM Corp. equipment.
  According to The Post, the program
allows hospitals to automate the
ordering and reporting of laboratory
tests, but a glitch in the software
would not recognize the date Sept. 19,
1989 and "went into a loop" refusing to
function properly, explained A. Scott
Holmes, spokesman for Shared Medical
Systems.
  The firm dubbed the bug a "birth
defect" as opposed to a "virus," since
it was an accidental fault put into the
program in its early days that later
threatened the system's health.
  At the affected hospitals around the
country, patients were admitted with pen
and paper applications.  Hospital
administrators admitted the process was
slower and caused some delay in
admissions, but patient care was never
compromised.
  -- Cathryn Conroy


ARMY TO BEGIN VIRUS RESEARCH

  (Sept. 21)
  Viruses seem to be on the mind of
virtually every department administrator
in the federal government, and the US
Army is no exception.  The Department of
the Army says it will begin funding for
basic research to safeguard against the
presence of computer viruses in
computerized weapons systems.
  The Army says it will fund three
primary areas of research: computer
security, virus detection and the
development of anti-viral products.
Research awards will be made to US
businesses who are eligible to
participate in the Small Business
Innovation Research (SBIR) program.
  The Army program, scheduled to begin
in fiscal year 1990, is at least
partially the result of Congressional
pressure.  For some months,
Congressional staffers have been
soliciting comments about viruses and
their potential effect on the readiness
of the US defense computers.
  Small businesses who would like to bid
on the viral research project may obtain
a copy of Program Solicitation 90.1 from
the Defense Technical Information Center
at 800/368-5211.
  --



SO-CALLED "DATACRIME" VIRUS REPORTED ON
DANISH POSTGIRO NET

  (Sept. 22)
  The so-called "Datacrime" virus, said
to be aimed at MS-DOS system next month,
reportedly has turned up on the Danish
Postgiro network, a system of 260
personal computers described as the
largest such network in Scandinavia.
  Computergram International, the
British newsletter that first reported
the existence of the Datacrime virus
back in July, says, ""Twenty specialists
are now having to check 200,000 floppy
disks to make sure that they are free
from the virus."
  Datacrime is said to attach itself to
the MS-DOS .COM files and reformats
track zero of the hard disk, effectively
erasing it. However, as reported, some
experts are saying the threat of the
virus is absurdly overblown, that there
have been fewer than 10 verified
sightings of the virus in a country with
tens of millions of computers.
  --



  In a rare move, IBM says it is
releasing a program to check for
personal computer viruses in response,
in part, to customer worries about a
possible attack next week from the
so-called "Datacrime" virus.
  "Up until the recent press hype, our
customers had not expressed any
tremendous interest (in viruses) over
and above what we already do in terms of
security products and awareness," Art
Gilbert, IBM's manager of secure systems
industry support, told business writer
Peter Coy of The Associated Press.
  However, reports of a "Datacrime"
virus, rumored to be set to strike
MS-DOS systems, have caused what Coy
describes as "widespread alarm," even as
many experts say the virus is rare and a
relatively small number of PCs are
likely to be harmed.
  IBM says it is releasing its Virus
Scanning Program for MS-DOS systems that
can spot three strains of the Datacrime
virus as well as more common viruses
that go by names such as the Jerusalem,
Lehigh, Bouncing Ball, Cascade and
Brain.
  The $35 program is available directly
from IBM or from dealers, marketing
representatives and remarketers and,
according to Gilbert, will detect but
not eradicate viruses. Gilbert added
that installing a virus checker is not a
substitute for safe-computing practices
such as making backup copies of programs
and data and being cautious about
software of unknown origin.
  Meanwhile, virus experts speaking with
Coy generally praised IBM's actions.
  "It's about time one of the big boys
realized what a problem this is and did
something about it," said Ross
Greenberg, a New York consultant and
author of Flu-Shot Plus. "To date, all
the anti-virus activity is being done by
the mom and pops out there."
  In addition, Pamela Kane, president of
Panda Systems in Wilmington, Del., and
author of a new book, "Virus
Protection," called the move "a very
important and responsible step."
  As noted, experts are differing widely
over whether there is truly a threat
from the Datacrime virus. The alleged
virus -- also dubbed The Columbus Day
virus, because it reportedly is timed to
begin working on and after Oct. 12 --
supposedly cripples MS-DOS- based hard
disks by wiping out the directory's
partition table and file allocation
table.
  Besides the IBM virus scanning
software, a number of public domain and
shareware efforts have been contributed
online, collected on CompuServe by the
IBM Systems/Utilities Forum (GO IBMSYS).
For more details, visit the forum, see
Library 0 and BROwse files with the
keyword of VIRUS (as in BRO/KEY:VIRUS).
  --



DUTCH COMPUTERISTS FEAR 'DATACRIME'
VIRUS

  (Oct. 7)
  The "Datacrime"/Columbus Day virus,
which is being widely down-played in the
US, may be much more common in the
Netherlands. A Dutch newspaper reported
this week the virus had spread to 10
percent of the personal computers there.
  "Those figures are possibly inflated,"
police spokesman Rob Brons of the Hague
told The Associated Press. Nonetheless,
police are doing brisk business with an
antidote to fight the alleged virus.
Brons said his department has sold
"hundreds" of $2.35 floppy disks with a
program that purportedly detects and
destroys the virus.
  As reported, Datacrime has been
described as a virus set to destroy data
in MS-DOS systems on or after Oct. 12.
AP notes that in the US there have been
fewer than a dozen confirmed sightings
of the dormant virus by experts who
disassembled it.
  The wire service also quotes Joe
Hirst, a British expert on viruses, as
saying some now believe the virus was
created by an unidentified Austrian
computerist. He added that as far as he
knew the Netherlands was the only
European country in which the virus had
been spotted.
  --




BY JOVE, THAT'S IT! DATACRIME VIRUS IS
THE VIKINGS' REVENGE

  (Oct. 10)
  Computergram International has a
tongue-in-cheek theory on the origin of
that nasty Datacrime virus which is said
to be poised to strike MS-DOS computers
this week.
  "The latest," the British computer
journal reports in today's edition, "is
that it may have been planted by a
Norwegian: the theory is that as it is
set to destroy data on Columbus Day a
diehard Norwegian, convinced that the
Vikings discovered the American
continent first, is taking revenge."
  Nonetheless, the newsletter adds,
"Computergram prefers the idea that it
is all the work of the Sioux."
  --



AT&T AND IBM WARN STAFF ABOUT DATACRIME
VIRUS

  (Oct. 11)
  Although industry experts say the
so-called Datacrime virus set to invade
MS-DOS systems on Friday, Oct. 13 is not
that great a threat, major corporations
are taking it quite seriously.
  According to Reuter, several companies
are advising their employees to protect
their computer systems.
  AT&T Co. and IBM Corp. have issued
internal memos warning staff members
about the virus.
  "We are taking the virus threat
seriously," said an AT&T Bell
Laboratories spokesman.
  AT&T has specifically asked employees
not use software from unknown sources
and to back up data, while IBM has
instructed staff members to use the
company's anti-viral software introduced
last week and to make copies of their
data.
  "It's very, very rare but very
destructive," said Russell Brand, chief
technical advisor at Lawrence Livermore
Laboratories in Livermore, Calif.
  Brand has examined the virus in an
infected computer and says that unlike
most viruses that allow the data to be
put back together, Datacrime has the
ability to wipe out a complete hard
disk.
  Brand told Reuter that there are about
77 different viruses in circulation now.
  "People are worried about viruses,
especially those that rely on their
PCs," said Michael Riemer, executive
vice president of Foundationware Inc., a
consulting firm in Cleveland. "But what
viruses have done is forced people to
look at security and system management
in place."
  Mike Odawa, president of the Software
Development Council, told Reuter that he
does not anticipate any big problems
caused by Datacrime.  "I think Friday
the 13th will come and everyone will be
disappointed by it," he said.
  -- Cathryn Conroy


GOVERNMENT EMPLOYEES WARNED ABOUT
DATACRIME VIRUS

  (Oct. 11)
  The National Institute of Standards
and Technology is warning federal
agencies to be on guard against the
Datacrime virus, supposedly set to
attack MS-DOS computers this week.
  According to Government Computer News,
NIST has issued the first governmentwide
guide on computer viruses in an attempt
to make security an integral part of any
computer course and to include computer
viruses in agencies' risk analyses and
contingency plans.
  "With the widespread use of personal
computers that lack effective security
mechanisms, it is relatively easy for
knowledgeable users to author malicious
software and then dupe unsuspecting
users into copying it," says the guide,
which is titled Computer Viruses and
Related Threats: A Management Guide.
  Ronald Shoupe, automation group leader
for NASA's Goddard Space Flight Center,
told GCN he found a virus contamination
that strongly resembles Datacrime. The
virus was on a machine Shoupe keeps
separated from others for virus
detection.  He said the nature of the
virus is a mystery to him, since it
activates by itself.
  "I've never seen anything that
triggered by itself.  I don't know of a
way for a file to self-activate unless
it perhaps does something to the boot
track," he explained.
  Shoupe said this was the only
occurrence of the Datacrime virus in
government computers of which he is
aware.  "We're watching but treating it
as a rumor rather than a fact.  We've
alerted the computer security officers.
We're trying not to broadcast this too
much," he admitted.
  Richard Carr, computer security
program manager for NASA, said alerting
users to the danger only serves to
spread more rumors and give would-be
vandals ideas they might not otherwise
have.
  "If we publicize some of the unfounded
rumors, some of the crazies out there
might try to make this a self-fulfilling
prophecy.  We can't let these people
know what protective measures we have.
It's a tough call to make," said Carr.
  He admitted that the ramifications of
a computer virus attack at NASA would be
enormous.  One concern is the upcoming
launch of the next space shuttle early
next week.
  NIST officials are urging government
employees to back up their hard disks
and consider using virus detection
utilities.
  -- Cathryn Conroy



ANTI-VIRUS PUBLISHER GIVES TIPS FOR
VIRUS DETECTION AND REMOVAL

  (Oct. 11)
  You say you've done nothing special to
protect your computer and now the news
media keeps saying the viruses are
coming (...The Viruses Are Coming!) So,
what now?
  Don't panic, says Cleveland- based
FoundationWare Inc., developer of the
Certus anti-virus security system.
You're probably going to come through it
just fine.
  Saying the computing community needs
to meet the "current virus hysteria from
a calm, logical and pragmatic business
perspective," FoundationWare released an
extensive statement today that provides
specific tips for detecting and removing
the so- called Datacrime and Friday the
13th viruses, alleged to be set to
activate in MS-DOS computers starting
tomorrow.
  But also FoundationWare urged
computerists not to over-react to the
current virus fears.
  "The truth is that viruses are not as
common as widely believed," the
statement said. "If you have not already
taken action to protect yourself ... do
not worry about them now. Prepare
yourself and your employees should one
of your machines go down by having (data
only) backups available."
  The software publisher also criticized
one-time, "quick fix" search programs
that look for blocks of code known to be
part of a specific virus, saying such
programs have inherently limited
capabilities.
  "It's like buying a home security
system that protects against blond-hair
blue-eyed people," said FoundationWare
Vice President Michael Riemer, who is
also chairman of the Software Publishers
Association's security special interest
group. "You won't be protected if a
bald, brown-eyed person breaks into your
house."
  Riemer suggested the computing public
needs to begin addressing viruses by
taking "a more global perspective,"
adding that such an approach would
include:

  1. Regular data back-up.
  2. Not backing-up data and programs on
the same diskettes.
  3. Educating users on the threat of
malicious software.
  4. Determining and implementing
appropriate integrity checking, security
and management mechanisms.

    Regarding the Datacrime and Friday
the 13th viruses, the FoundationWare
report suggested that users look for
unexplained increases in file size, "a
telltale sign of most virus infections."
  The company also noted the users could
determine if a disk has been infected by
using the MS-DOS DEBUG utility to scan
executable files in the following
manner:

    A. For the Datacrime virus (also
called "Columbus Day" virus), use DEBUG
to scan .COM files for the Hexadecimal
codes EB00B4OECD21B4, AND/OR,
00568DB43005CD21. If the codes are
present, the system is infected, the
company said.
  B. For the Friday the 13th Virus (also
called the Israeli virus), use DEBUG to
scan .EXE and .COM files for the
Hexadecimal codes 2EFF0E1F00,
E992000000, AND/OR 7355524956.

    The company also made a number of
suggestions for removing viruses,
(though it acknowledged the methods
aren't foolproof nor recommended as "a
complete solution" for fighting these or
future viruses). The suggestions are:
  -:- Never attempt to remove or isolate
a virus from a currently active
computer. Instead, boot from a clean
original and write-protected DOS floppy
disk.
  -:- On a local area network, first
check network operating system files on
local drives before logging onto the
network. Isolate LAN/PCs, so that there
are no active users beside you.
  -:- If you think you have the Friday
the 13th or Datacrime virus (which are
keyed to specific days), give yourself
some extra time before they activate by
simply changing your system time/date to
an earlier date, such as January 15,
1989.
  -:- To create a clean system, boot
your computer from an original,
write-protected DOS floppy disk and run
your backup program (from your original
write-protected floppy source) and
back-up only your data (not your
programs). Perform a low-level and DOS
FORMAT using programs from the original
write- protected distribution disks (not
from your hard disk), then reinstall the
software from original write-protected
disks and restore the "data-only"
backup.
  -:- If you isolate a virus which is
present in your system's boot track or
partition table (this will not be either
the Datacrime or Jerusalem virus), you
have other options. You should boot from
a write-protected original DOS floppy
disk and run a disk utility program that
can replace the partition table. (Note:
be sure the operator is very familiar
with such a program before using it).
  -:- If you believe that a virus is in
the boot track (IO.SYS, MSDOS.SYS) or
the operating system (COMMAND.COM), you
can take still other measures. Boot from
a write-protected original DOS floppy
disk and run the "SYS C:" command from
the clean floppy disk which then
replaces IO.SYS and MSDOS.SYS files. You
should then type "DEL COMMAND.COM" and
replace it with a clean copy of
COMMAND.COM from the A: drive.
  Finally, speaking of viruses in
general, the FoundationWare statement
notes that if you suspect your system is
infected, you should delete all
suspected files (that is, all .EXE and
.COM program files) and those found to
contain a virus and then replace the
questionable software with "trusted
copies" from the original
write-protected distribution disks.
  Also, the report notes, "It has been
suggested that using standard DOS DEL,
ERASE or COPY may in some instances not
be enough to remove the infected program
(though for these two viruses DELETE and
ERASE are adequate). It is recommended
that you use a program which actually
writes over (the) program area to
completely eradicate infected files."
  --



VIRUSES STRIKE IN EUROPE

  (Oct. 13)
  As many predicted all along, the
computer viruses that struck today on
this Friday the 13th didn't mean the end
of computing as we know it. Still, the
day also was not completely free of
system vandalism caused by the rogue
programs.
  While confirmed virus attacks appear
to have been few and minor in the United
States, more serious incidents occurred
in Europe, with virus-related computer
problems reported in Great Britain, the
Netherlands, Portugal, France and
Switzerland.
  As noted earlier, the computing
community was bracing itself for a
double-whammy of virus assaults this
week, from the so-called
Datacrime/Columbus Day virus starting
yesterday and from the Friday the
13th/Jerusalem virus today.
  In the US, at least one CompuServe
subscriber reported a virus incident.
Writing on the message board of the IBM
Systems/Utilities Forum (GO IBMSYS), Tom
Ohlson told his fellow forum members
that a friend of his in Staten Island,
N.Y., had used a copy of an anti- virus
program called SCAN40, downloaded
earlier from the forum, to locate the
Datacrime virus. Ohlson said the friend
had traced the virus to a copy of a game
program that was passed around on a
floppy disk.
  Elsewhere in New York, security
specialist Ross M. Greenberg, creator of
Flu-Shot Plus and Virex-PC anti-viral
software, told The Associated Press that
by midmorning he had received seven
reports of virus strikes since midnight,
but that only one was the Columbus Day
virus.
  Greenberg reported that a dozen PCs at
Columbia University in New York City
were affected, but that the university
had made backup files, so the virus was
merely an inconvenience.
  The other six virus reports concerned
what he called the "PLO virus," an older
virus designed to erase programs every
Friday the 13th. Greenberg said earlier
the PLO virus was far more widespread
and likely would cause more trouble
today than newer viruses.
  Meanwhile, in Urbana, Ill., Michael
Harper, a staff person at the University
of Illinois' Micro Resource Center, told
United Press International a virus was
detected in some of the campus's 1,000
terminals, but that the university was
able to treat the computers before it
did any damage. "We're definitely
breathing easier," Harper said.
  He said a virus was introduced on
campus by a piece of software used for
inputting scientific data. The
university now has a installed an
anti-virus warning program.

    And now, from assorted wire
dispatches, here are virus incidents
reported elsewhere in the world today:

    -:- Great Britain:

    In perhaps the worst virus assault
of the day, computers at London's Royal
National Institution for the Blind were
infected by what experts are saying was
a previously known virus.
  "We found that most of our program
files are gone," Corri Barrett of the
institute told reporters. "Every time we
try to look at a new program file it
vanishes in front of our eyes. It's
horrendous. Months and months of work
has been wiped out here."
  Barrett told a BBC-TV interviewer the
virus might have contaminated disks
distributed to blind clients and that
their systems had been infected.

    -:- The Netherlands:

    In the Netherlands, where the first
alert of the so-called Datacrime virus
was given last summer, a unit set up to
hunt viruses said it had been flooded
with telephone calls from panicked users
today. Many told the officials they had
"lost everything, all their data stored
in memory and all their programs,"
according to a spokesman.
  At the social affairs ministry, a
spokesman said yesterday the Datacrime
virus had been isolated and destroyed
"on several occasions" in recent days.
  Also, Amsterdam university managed to
kill the Datacrime virus in time to save
its data, an official told Dutch
television yesterday.
  In addition, the "Jerusalem" virus,
detected four times in the microcomputer
network of the Dutch rail company, was
rooted out before today, when it was
still dormant, a spokesman said.

    -:- Portugal:

    In Lisbon, at least two infected
computers flashed ominous warning
messages across their screens,
triggering panic among users.
  The first, the "Friday the 13th"
virus, cropped up in the computer system
of a bank. The second, said to be of a
strain dubbed "Pakistan," attacked
computers at a medium-size company. In
both cases, the viruses were
neutralized, a spokesman for a
Portuguese computer association said.

    -:- France:

    Daniel Dutil, in charge of a special
unit set up to search and destroy the
viruses, said that fewer than one
percent of that nation's PCs were
contaminated, adding, "It's a normal
situation, if you take into account that
viruses are always found in computer
programs."
  Dutil said some 2,000 computer
programs had come under the harsh
scrutiny of his unit, dubbed the
anti-viral platform, since it opened its
campaign to wipe out the viruses on
Tuesday. He said that whenever viruses
were programmed to awaken from their
dormant state and activate themselves on
symbolic dates such as January 1, April
1 or July 14, there was usually only
"slight virus activity similar to that
observed today."
  Meanwhile, Guy Hervier, an
administration official at the
University of Nice in southern France,
said yesterday a virus scheduled to
activate today was discovered in the
university's computer lab in June but
was easily detected and destroyed.

    -:- Switzerland:

    Bernhard Schmid, head of the federal
personal computer team, said several
dozen of the government's 3,500 personal
computers were found to have been
carrying a virus. However, experts
managed to cancel and reprogram all
infected systems. He said infected
programs had been found in a wide range
of administrative branches.
    --


VIRUS EXPERTS CITE PREPAREDNESS,
EXAGGERATION, BUSINESS SILENCE

  (Oct. 14)
  On the morning after, some computer
experts today were saying yesterday's
reported low incidence of virus assaults
was due to the exaggeration of the
threat all along, while others were
crediting the computing community's
preparedness due to early warnings.
  Meanwhile, another observer said the
number of virus attacks actually may
have been greater than we realize,
because many corporate users are
reluctant to publicize computer security
violations at their businesses.
  Wes Thomas, editor of a new electronic
newsletter called Virus Alert, told The
Associated Press his group received 50
unconfirmed reports of virus outbreaks
worldwide and that a headquarters was
set up in San Francisco to study the
cases.
  "There's a lot of false positives,"
Thomas said. "We are attempting to form
a center for disease control for
computer viruses so we can centralize
information and find out what's going
on." Thomas said he helped spread the
word about the so- called Columbus Day
or Datacrime virus after attending an
August meeting in Amsterdam where the
rogue program was discussed.
  Actually, most of the reported virus
attacks over the past two days seemed to
have been the work, not of Datacrime,
but of the older Friday the 13th or
Jerusalem virus that was first
discovered at Hebrew University in
December 1987.
  Experts disagree, but one report is
that there now are about 30 different
computer virus strains making the
rounds.
  Fred Cohen, an independent researcher
in Pittsburgh who is credited with
exposing the first computer virus in
1983, told AP he believes this week's
outbreaks were kept down because
computer users took proper precautions.
"Everybody was looking for it."
  However, Cohen also cautioned, "This
is a long-term sort of threat. It's like
biological warfare."
  Speaking with the Reuter Financial
News Service, John McAfee, chairman of
the Computer Virus Industry Association,
said he saw no rise yesterday in
reported computer virus problems, which
he said usually number 30 to 40 a day.
  Elsewhere, Winn Schwartau, president
of American Computer Security Industries
Inc., told Reuter he had been informed
of 25 outbreaks of the Friday the 13th
version this week at organizations
ranging from universities to banks.
  "It's not Armageddon -- it's not going
to all come at once crashing down around
us," he said, but he added the impact
actually could last for months as new
strains develop.
  He said the customer base of his
company, which was started five years
ago, has increased 50 to 100 times in
the past 30 days because of fear of the
viruses after rumors began spreading in
late August.
  He also said accurate virus reports
are difficult to gauge, because most
companies consider the damage to be
confidential information.
  "Major corporations don't want the
publicity," Schwartau said.
  --


ONLINE TODAY'S BACKGROUNDER: COMPUTER
"VIRUS," PART SIX

  (Editor's note: Computer "viruses" --
self-propagating programs that spread
from one machine to another and from one
disk to another -- have been very much
in the news. This file contains
virus-related stories carried by Online
Today's electronic edition beginning in
late October 1989.)


VIRUS DESTROYS DATA IN TOKYO

  (Oct. 30)
  An official at the University of Tokyo
has confirmed a computer virus has
caused at least minor damage to some
research information at the school.
  A representative of the university's
Ocean Research Institute has told The
Associated Press the virus was detected
earlier this month in four or five of
the center's 100 computers, but was
believed to have first infected the
computers last month.
  The official who requested anonymity
told the wire service the virus was
found only in personal computers being
used by researchers, and not major
computer systems, adding the damage was
not serious.
  The source declined to give further
details, but AP says the Japan
Broadcasting Corp. has reported a virus
also had been found in computers at the
university's Earthquake Research
Institute. That report said the virus
was the most sophisticated yet detected
in Japan, where the problem is not
widespread.
  --



10 PERCENT OF CHINESE COMPUTERS STRUCK
BY VIRUSES, NEWSPAPER SAYS

  (Nov. 5)
  A newspaper in Beijing reports 10
percent of China's some 300,000
computers have been struck by computer
viruses.
  The Xinhua Chinese news service quotes
a report yesterday in the China Daily as
saying three types of viruses have been
found so far, called "small ball,"
"marijuana" and "the shell." The paper
says universities and statistical
bureaus have been particularly hard hit
by the viruses.
  Reporting on a computer security
conference in the southwest city of
Kunming, the English-language daily
quoted Yang Zhihui, deputy chief of the
Ministry of Public Security's computer
security department, as saying, "We have
already worked out some vaccination and
sterilization programs for the virus."
  Yang said the wide variety of
computers in use in China -- both
foreign and domestic -- makes it hard
for a sweeping sterilization campaign to
be carried out.
  The newspaper said the estimate that
one in 10 Chinese system have been virus
victims was reached by the Ministry of
Public Security following a survey last
August. The paper did not say how many,
if any, computers in China were struck
by the well- publicized "Friday the
13th"/"Datacrime" viruses last month.
  However, regarding the "small ball"
virus -- which reportedly was found in
statistical bureaus in 21 provincial,
municipal and regional offices -- the
paper gave this description of an
attack:
  "A computer was doing its word
processing, the cursor blinking brightly
on the screen. Suddenly, a jumping white
ball appeared. Then a second one and a
third. Slowly the screen was full of
them. Operation stopped." The paper said
the "small ball" virus can slow down or
halt computer operation, but it does not
appear to affect memory.
  --


CONGRESS URGED TO BE CAUTIOUS IN
WEIGHING ANTI-VIRUS/WORM LAWS

  (Nov. 8)
  The president of the Computer and
Business Equipment Manufacturers
Association says Congress should be
cautious in making laws to fight
computer viruses, because, "Like the
swine flu vaccine of the 1970s, these
anti-virus bills could end up doing more
harm than good."
  In remarks prepared for a hearing of
the House Judiciary subcommittee on
criminal justice, John L. Pickitt added,
"Outlawing some of the programming
techniques used to create computer
viruses might prevent the use of similar
programs for beneficial purposes,
including countering a virus."
  Associated Press writer Barton Reppert
notes Pickitt, whose Washington-based
trade association represents companies
with combined sales of more than $230
billion, aimed his criticism at three
anti-virus bills, including those
sponsored by Reps. Wally Herger,
R-Calif., C. Thomas McMillen, D-Md., and
Edward J. Markey, D-Mass.
  "The same sharing techniques which
make computer networks vulnerable to
virus attack can also be responsible for
breakthroughs in electronics and
telecommunications technology," Pickitt
said. "While Congress may wish to clean
up some of the language in the current
laws ... we urge Congress to act
cautiously in considering new criminal
statutes to deal with computer viruses."
  Of bills currently under
consideration, Reppert observed:
  -:- Herger's measure would impose
penalties of up to 20 years in prison on
people convicted of "interfering with
the operations of computers through the
use of programs containing hidden
commands that can cause harm."
  -:- The McMillen bill seeks to punish
anyone who "willfully and knowingly
sabotages the proper operation of a
computer hardware system or the
associated software."
  -:- Markey's proposal is to make the
introduction of a virus into an
interstate electronic network a federal
crime.
  --



CONGRESS HEARS TESTIMONY ON THE COST OF
VIRUS ATTACKS

  (Nov. 9)
  A computer security official with the
EDP Auditors Association has estimated
for Congress that "hundreds of
thousands" of computer virus attacks
have occurred in recent years on the
systems of American corporations and the
government.
  However, most attacks go unreported,
said specialist Carolyn Conn, "because
there is not a high expectation of
successful prosecution." Also, she said,
"Organizations do not want to publicize
their vulnerabilities when seemingly
there is little or no benefit" from
public disclosure.
  Associated Press writer Barton
Reppert, covering Conn's appearance
yesterday afternoon before the House
Judiciary subcommittee on criminal
justice, quoted her as testifying that
the costs of viruses are "staggering."
  Said Conn, "Viruses have cost
corporations, government agencies and
educational institutions millions of
dollars to prevent, detect and recover
from computer virus attacks."
  Conn, whose Illinois-based EDP
Auditors Association represents some
9,000 electronic data processing
professionals across the country, made
her estimate of the number of virus
attacks in response to questions by the
congressional subcommittee.
  Reppert reports the panel chairman,
Rep. Charles E. Schumer, D-N.Y., asked
her for a estimate of the overall number
of virus attacks that have occurred in
recent years. "Is it tens, is it
hundreds, is it thousands?" he asked.
  Ms. Conn replied, "I think probably in
the hundreds of thousands."
  --



BAR ASSOCIATION FEARS LOOPHOLES IN
EXISTING VIRUS/WORM LAWS

  (Nov. 13)
  The chairman of the American Bar
Association's task force on computer
crime has told a House subcommittee he
is concerned about loopholes in existing
laws that cover computer viruses, worms
and similar rogue programs.
  "There are clearly some types of
computer virus activity that would be
beyond the terms of the current
statute," Joseph B. Tompkins Jr.
testified recently before the House
Judiciary subcommittee on criminal
justice.
  Associated Press writer Barton Reppert
reports Tompkins and other witnesses
posed several questions about activities
that they said might fall through the
cracks of ambiguous federal laws, such
as:
  -:- If a renegade programmer sends a
program containing a hidden virus to a
computer bulletin board system, can he
or she then be prosecuted for harm that
results when other BBS users transfer
the software into their own systems?
  -:- Can virus/worm authors be
successfully prosecuted if they claim
they really didn't have any malicious
intent, but instead were merely trying
to pull off an innocent prank or aiming
to demonstrate existing weaknesses in
security?
  Witnesses said that under current
federal law, the answer to both
questions is "maybe."
  Tompkins said the Computer Fraud and
Abuse Act of 1986 -- which makes it a
federal crime to "intentionally access a
federal interest computer without
authorization and alter, destroy or
damage information in such computer or
prevent authorized access to such
computer if such conduct causes the loss
of $1,000 or more during any one-year
period" -- is not clear enough.
  For instance, he testified, "The
statute does not in clear terms cover
the intentional implantation of a
computer virus in a computer which one
is authorized to access, even if the
perpetrator clearly intended harm or the
virus in fact caused significant harm."
  He said the law also has been attacked
as unconstitutionally vague. "While
these arguments are probably overstated,
clarifying the statute might prevent
such arguments from being raised and
might encourage prosecutors to make more
frequent use of the statute," Tompkins
said.
  --




`CONDOMS' FOR DISKS MAKE GAG GIFT

  (Nov. 27)
  In Christmases past, gag gifts for
computerists have ranged from chocolate
disks to empty "vaporware" packages.
This year.... well... A Fremont, Neb.,
firm called Tekservices Inc. has
announced "Safedisk," a product
described as a "poly floppy disk
condom."
  The Associated Press notes word of
Safedisk spread recently after TV
talk-show host Arsenio Hall tittered
about it on his late- night program.
  Stephen Nabity -- the 33-year- old
"Dr. Safedisk" -- told AP he got the
idea while watching a news broadcast
about a predicted outbreak of computer
viruses earlier this autumn.
  "It came to me that people should
practice safe whatever-they-do," Nabity
said. "A lot of computer viruses were
going around."
  He acknowledged his product doesn't
actually protect against viruses, but he
hopes that, at $7.95, it will be
considered a possible stocking-stuffer
for computer buffs.
  --




COMPANY OFFERS VIRUS INSURANCE

  (Dec. 2)
  Allstate Insurance Co. may be the
first insurer to reimburse customers who
encounter the destruction of programs
and data caused by computer viruses.
Currently, the company offers
inexpensive riders to its homeowners and
renters insurance to cover other types
of damage to personal computers.
  The new virus coverage is included at
no additional cost for customers who
currently have in effect a Standard
Electronic Data Protection Policy.  The
data protection policy was originally
designed for owners of small
businesses.
  Though existing virus protection
insurance carries a $100,000 limit,
higher amounts are available at an
additional cost.  No claims have yet
been filed on any of the policies
currently in force.
  Until recently, Safeware was the only
mass-market insurer with a large base of
policies issued to owners of personal
computers.  The company specializes in
insuring computer equipment against
theft, natural disasters and accidental
damage.  It does not pay for damages
caused by electrical problems or
viruses.
  --



BRITISH GROUP WARNS OF POSSIBLE TROJAN
HORSE IN AIDS INFO DISK

  (Dec. 13)
  In London, the chairman of a PC users
group is warning computer users to avoid
a mailed floppy disk that purports to
give information about AIDS. He says the
disk might contain a "Trojan horse"
sabotage program.
  Speaking with The Associated Press,
Dr. Alan Solomon, who leads the IBM
Personal Computer Users Group, said
several thousand of the disks -- called
"The AIDS Information Introductory
Diskette" -- have been mailed to
computer users.
  Solomon, who also heads a British
company called S and S which specializes
in the examination of computer viruses,
said users' addresses may have been
taken from computer magazines. He said
the full effect of the suspected Trojan
horse program are not yet known.
  He told AP he received one of the
disks in the mail on Monday bearing a
Panama postal box address. He said he
feared more could arrive in the mail
this week.
  Said Solomon, "There is no urgent
panic in the short term but if (the
disk) has already been installed I would
advise (computer users) to seek urgent
help because it is a nasty thing." He
commented that few experienced computer
users would risk installing an
unsolicited disk without first checking
it, but that some less experienced users
might.
  AP says a letter accompanying the disk
asks for payment of $189 for one type of
license and $378 for another.
  --


VANDALIZED AIDS INFORMATION DISK WORRIES
COMPUTERISTS WORLDWIDE

  (Dec. 14)
  Word out of London of an apparently
vandalized computer diskette has caused
concerns among AIDS researchers around
the world and now has prompted one
computer virus expert to call the
incident a "well-orchestrated and
undeniably well-financed terrorist act."
  As reported here, Chairman Alan
Solomon of London's IBM Personal
Computer Users Group was first to sound
a warning to computer users to avoid a
mailed floppy disk called "The AIDS
Information Introductory Diskette,"
because, he said, the software might
contain a "Trojan horse" sabotage
program that destroys data.
  Since that announcement, there have
been these developments, according to
The Associated Press in Britain and in
the US:
  -:- London's Scotland Yard issued a
warning to banks, hospitals,
universities and other institutions to
be on guard against the disk.
Investigators there say the disks have
destroyed information in at least 10
computers.
  -:- Among those reported to have
received the disks are the London Stock
Exchange, British Telecommunications
PLC, which runs most of the nation's
phone network, the Midland Bank, Lloyds
Bank, the Australia and New Zealand Bank
in London, as well as universities,
hospitals and public health
laboratories.
  -:- The British newspaper The Guardian
reports computer systems in hospitals
are among those damaged. It said the
disks also turned up in California,
Belgium and Zimbabwe but gave no
details.
  -:- The British domestic news agency
Press Association quotes an unnamed
Health Education Authority spokesman as
saying a contact in Norway also received
a disk.
  -:- In the US, the Rand Corp., which
has 15 people working on acquired immune
deficiency syndrome research, has warned
its employees. Ann Shoben, a spokeswoman
for the Santa Monica, Calif., research
firm, told AP, "We're safe. We have not
been hit. The concern is for others that
use personal computers and those who
work on AIDS research might pick up this
program and have their databases
destroyed."
  -:- Also in the US, Chase Manhattan
Bank reportedly was one of the first to
report problems with the software.
  As reported yesterday, several
thousand disks were believed to have
been mailed to London area computer
users. Officials there say users'
addresses may have been taken from
computer magazines. Now the UK police
say many of the disks were mailed in
London's South Kensington district.
  A letter accompanying the disk asks
for payment of $189 for one type of
license and $378 for another. The letter
warns that if the money is not paid, the
sender will use program mechanisms to
stop a computer functioning normally.
Also, the program carries this ominous
advisory: "Warning: Do not use these
programs unless you are prepared to pay
for them."
  Joe Hirst, former technical editor of
Virus Bulletin and a consultant on
computer software, told AP's Michael
West in London there are two programs on
the disk.
  "The first," Hirst said, "is an
installation program and the second is a
questionnaire on the risk of AIDS which
will not run unless it is installed on a
hard disk. It then prints off an invoice
for a company in Panama, but the damage
has already been done by the
installation."
  Apparently, that Panama company is
bogus. The London Guardian newspaper
quotes the letter as saying the money
demanded should be sent to "PC Cyborg
Corporation" at a box number in Panama.
However, neither the corporation nor the
box number -- 87-17-44 -- exists.
  (The Guardian adds that the American
computer software company called Cyborg
Systems and its British subsidiary sent
warnings to customers yesterday that it
was not involved in this incident.)
  AP's West said computer companies in
UK believe addresses for receiving the
disks were obtained from PC Business
World, a British weekly trade paper on
computing. Police say PC Business World
sold its 700-name mailing list in good
faith to someone claiming he wanted to
publicize the export of computers to
Nigeria.
  Another London newspaper, The
Independent, reports the list was bought
for about $1,300 by a Kenyan businessman
identified as "E. Ketema."
  Says the paper, "Mr. Ketema had taken
out a short-term subscription with The
Business Center in New Bond Street,
London, to receive mail and telephone
messages on his behalf while he was in
the country from Oct. 31 to Nov. 30. He
described himself as an accountant, but
the center does not know his first name,
nor does it have a forwarding address."
  Meanwhile, in the US, the Rand Corp.
said it warned its employees of the disk
after receiving an advisory from
computer virus expert John McAfee.
  McAfee, chairman of the Computer Virus
Industry Association of Santa Clara,
Calif., told AP writer Louinn Lota it is
unusual for his group to issue such a
blanket warning against a particular
disk, but because he has received calls
from PC users around the world, he
believes the threat is real.
  "This is not a hoax," McAfee said.
"This is not a simple case of a hacker
in a back bedroom somewhere. It is a
well orchestrated and undeniably well
financed terrorist act. Few groups or
individuals can afford to waste hundreds
of thousands of dollars to bring harm to
a party and bring nothing in return."
  He said he believes the topic of AIDS
was used by the creator of the damaging
program because many computer users are
likely curious about the disease. People
are encouraged to use the disk because
it is advertised as being able to
predict the chances a person has of
contracting AIDS, he said.
  "Unlike an accounting program," McAfee
added, "this is a subject everyone is
aware of and virtually all people will
want to learn more about risks of having
AIDS."
  --



MICROCOM BUYS ANTI-VIRUS COMPANY

  (Dec. 26)
  For undisclosed terms, software
publisher Microcom Inc. has acquired HJC
Software Inc., a Durham, N.C., firm that
markets programs for detecting and
eliminating viruses in Apple Macintosh
systems.
  In a statement from Norwood, Mass.,
Microcom says the virus software product
line -- called Virex -- will be
integrated with its own Carbon Copy Plus
and Relay Gold communications packages.
  Microcom President/CEO James M. Dow
said the Virex products "are a key
addition to our strategy of providing
comprehensive network administration and
management tools for the end user."
  Dow noted that because of the large
number of users sharing files, PCs and
their networks "have been especially
vulnerable to viruses." He said the
Virex product line "will substantially
reduce the likelihood of catastrophic
failure for many PC and PC network
users."
  --


From 1990 files:

NEWSBYTES COMPUTER HIT BY VIRUS

  (Jan. 2)
  Newsbytes News Service reports the
Apple Macintosh SE/30 used at its San
Francisco headquarters was infected just
before Christmas by what the editor
describes as one of the faster-
spreading computer viruses on record,
called WDEF A and WDEF B.
  "Before the problem was pinpointed,"
editor Wendy Woods reports, "the virus
had spread to every unlocked floppy disk
and hard disk in use."
  Woods quotes John Norstad of
Northwestern University as saying the
virus that struck Newsbytes was
discovered in early December by
programmers in Belgium. Since then, he
said, it has spread throughout the US in
the past few weeks and now is reported
at "virtually every major university."
  The WDEF virus is said to cause Mac
windows to close, icons to fail to
appear, files to be listed as "locked,"
system error messages to flash on the
screen and applications to crash and
sometimes causes the computer to fail to
start at all.
  Norstad -- author of Disinfectant, a
free program that combats the virus --
told Newsbytes that WDEF infects the
invisible Desktop files used by the
Mac's Finder. It does not infect
applications, document files or other
system files.
  "Unlike the other viruses," Woods
reported, "it is not spread through the
sharing of applications, but rather
through the sharing and distribution of
disks, usually floppy disks."
  Norstad says the virus can be removed
easily: hold down the option and command
keys until the complete desktop has
appeared on screen; this procedure
rebuilds the desktop and eradicates the
virus, he said. Also, his free
Disinfectant 1.5 now is appearing in the
libraries of most major Macintosh
services online.
  According to Norstad, the virus
doesn't intentionally do damage, but it
can cause performance problems on
Appleshare networks with Appleshare
servers.
  Newsbytes said there have been at
least two reports that WDEF can damage
disks. "The virus is known to create
havoc at the Desktop level of a
computer," the wire service said, "but
also causes crashes when a file is saved
under Multifinder. It causes problems
with the proper display of font styles,
the outline style in particular. When an
infected disk is loaded into a Mac IIci
or Portable, the computer will crash."