243 lines
14 KiB
Plaintext
243 lines
14 KiB
Plaintext
|
|
ZDDDDDDDDDDDDDDDDDD? IMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM; ZDDDDDDDDDDDDDDDDDD?
|
|
3 Founded By: 3 : Network Information Access : 3 Founded By: 3
|
|
3 Guardian Of Time CD: 07APR90 :D4 Guardian Of Time 3
|
|
3 Judge Dredd 3 : Judge Dredd : 3 Judge Dredd 3
|
|
@DDDDDDDDBDDDDDDDDDY : File 14 : @DDDDDDDDDBDDDDDDDDY
|
|
3 HMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM< 3
|
|
3 IMMMMMMMMMMMMMMMMMMMMMMM; 3
|
|
@DDDDDDDDDDDDDDD:SPREADING THE DISEASE IGDDDDDDDDDDDDDDDY
|
|
HMMMMMMMMMMMMMMMMMMMMMMM<
|
|
|
|
This was an article in USENET posted by the man who created the first virus
|
|
documentable. I will reprint it here for your general knowlegde and benefit.
|
|
It deals with the virus, the author/creator, and his personal frame of mind.
|
|
The article that follows is in first person told by the virus Author. You can
|
|
contact me at Mother Earth (5p-7a 24hrs weekends) and all questions will be
|
|
entertained. I am sorry about this inconvenience as I will have my NET Id soon.
|
|
|
|
$_Article
|
|
|
|
Sorry this article is rather long, but if you still have any old DOS 3.3
|
|
Apple ][ disks lying around please read it! (Feel free to read it for general
|
|
entertainment value too, of course, even if you don't possess any such
|
|
historical disks.)
|
|
|
|
I have been asked by Gene Spafford to write an article detailing the
|
|
life story of a Virus I wrote for Dos 3.3 on the Apple ][ in December, 1981
|
|
for one of his journals. Spafford wants me to write the story up because it's
|
|
the earliest _documentable_ personal computer virus he's heard of. I'm trying
|
|
to get more information that I plan to use to make that article more complete.
|
|
|
|
1) Why did I write a virus? Am I an evil scum?
|
|
|
|
At the time (remember, this was 1981) I was an undergraduate at Texas
|
|
A+M. There was an active community of Apple ][ users in my dorm (Shuhmacher),
|
|
with an _incredible_ amount of copying of pirated game programs going on. I
|
|
noted that most games were damaged in various sorts of ways, but they were
|
|
almost always still playable despite the damage. (For example, there was one
|
|
popular Star Trek game in BASIC that had occasional garbage control characters
|
|
in non-critical REM and PRINT statements; space war games often had random junk
|
|
replacing some pictures of ships, etc.) I decided that I could explain this by
|
|
invoking a sort of "evolution".
|
|
|
|
For evolution to occur, you need mutation and natural selection. Well,
|
|
there was "mutation" caused by people hacking with the games; more importantly,
|
|
many copies of games were also accidentally mangled by sick disks and computers.
|
|
.
|
|
(People would keep using game disks until they literally disintegrated. My early
|
|
model Apple ][ was notoriously unreliable, and would crash about every 30
|
|
minutes in all sorts of interesting ways. A few well-placed bangs would usually
|
|
get it working again.) "Natural Selection" entered the picture with the actions
|
|
of users to either "reproduce" or "kill" copies of games. (For example, if your
|
|
copy of a game was not playable, you would go get a fresh copy of it from your
|
|
neighbor, reproducing his copy and killing yours. As there was only a finite
|
|
amount of disk space for games, there was also competition between species of
|
|
programs, too.)
|
|
|
|
This idea of programs inhabiting a sort of computer biosphere led
|
|
naturally to the idea of a "Computer Virus" as a likely accidental outcome of
|
|
such evolution. My experiments started when I tried to find out what the minimum
|
|
change to DOS was to make it viral. (I was thinking of something like a prion,
|
|
a sort of proto-virus that can be created by repeated damage to plants. A prion
|
|
can't jump from plant to plant by itself, but it will happily hitch a ride on
|
|
your machete if you let it. Supposedly prions are actually becoming a serious
|
|
agricultural problem with palm trees in some parts of the world.) As I
|
|
remember the answer for DOS 3.3 was about 16 bytes, which was within the
|
|
bounds of what could happen naturally if Apple computers with people randomly
|
|
copying games between them were to exist for a few million years! The next
|
|
logical step was trying to guess what an evolutionarily OPTIMAL program might
|
|
look like. Certainly the program would be more successful if it didn't rely on
|
|
the good will of humans to reproduce, but likewise it is a bad idea to damage
|
|
your host (or give humans a reason to expend effort trying to kill you). So
|
|
the ideal virus would spread by itself, but not cause harm or even any
|
|
"symptoms" of any kind, if it could help it.
|
|
|
|
I discussed these ideas with friends, many of whom also had Apple ]['s.
|
|
None of them had ever heard of such a thing as a "computer virus" at the time.
|
|
(Many Apple ][ users I knew scoffed at the idea that such a thing could possibly
|
|
exist.) Well, by this time creating a virus sounded like a really interesting
|
|
project, and it was a good excuse to learn 6502 machine language, so a group
|
|
of us started working on my "evolutionarily optimal program" off and on in our
|
|
(infrequent) spare time. Our first attempt, "Virus version 1" was finished
|
|
in early 1982. Virus 1 was infectious, but still caused some symptoms on my
|
|
computer despite our best efforts, so we kept it strictly quarantined and
|
|
kept hacking.
|
|
|
|
A couple months later Virus 2 was finished. It seemed to cause no ill
|
|
effects at all, so I proceeded with the next step in my experiments and turned
|
|
it loose in my own disks. The goal of this experiment was to see how quickly
|
|
such a program would spread through my own disks if I continued using my
|
|
computer normally. (So I had another good reason to want to make sure the virus
|
|
|
|
was completely innocuous. In fact, in the end almost all of Virus 2's code was
|
|
to check for various sorts of dangerous situations: non standard DOS, non
|
|
standard disks, programs altering DOS, etc. In these cases the virus would
|
|
either not attempt infection or immediately disconnect itself from DOS,
|
|
committing suicide.)
|
|
|
|
Interest in my "research" was high among the Apple community at A+M,
|
|
so I also gave copies of Virus 2 to several friends who wanted to play with
|
|
it. The idea of computer viruses spread rapidly; several other people started
|
|
working on their own "less boring" (read damaging) ones. Fortunately (as far
|
|
as I ever knew) they spent all of their time trying to dream up interesting
|
|
pranks for the virus to pull, instead of determinedly trying to produce a
|
|
working "evil" virus.
|
|
|
|
2) Did my virus ever escape?
|
|
|
|
At first we carefully kept Virus 2 quarantined, but after a few
|
|
months with no damaging symptoms we got a little lax, and the inevitable
|
|
happened. I first found out Virus 2 had escaped when one of my A+M friends who
|
|
had graduated and moved on to grad school at UIUC reported that everybody's
|
|
copy of a (pirated) game called "Congo" had mysteriously stopped working there.
|
|
|
|
Whenever people tried to get a fresh working copy, they would find that
|
|
previously working copies would then also stop working. My friend realized
|
|
what had happened and wrote me about it. We quickly wrote an "immunizer"
|
|
program and distributed it at UIUC; the standard Apple utility "master create"
|
|
sufficed as a disinfectant. We were never quite sure whether _all_ escaped
|
|
copies of Virus 2 at UIUC were killed off, though.
|
|
|
|
I was disappointed that Virus 2 was a failure, and started work on
|
|
Virus 3. It turned out that Virus 2 caused problems because it made DOS 1 sector
|
|
(256 bytes! a significant chunk of memory!) larger, to accomodate the extra
|
|
code. A very few programs would blow up in strange ways because of this. (The
|
|
solution was simply to boot from a noninfected disk, and THEN run the programs.)
|
|
So the goal for Virus 3 was that it should take up no room in memory, and no
|
|
room on disk. After some thought, we came up with a solution: Most of Virus 3's
|
|
guts resided in unprotected memory where they could be freely written over. A
|
|
small routine buried safely inside holes in DOS's Read-Write Translate Table
|
|
triple-checked the unprotected code before jumping to it. (This code was a real
|
|
nightmare; some bytes in the table served double duty as critical data values
|
|
for DOS and executable op codes for the virus.) Virus 3 was a success; we never
|
|
encountered any program whose behaviour was affected by the virus's presence.
|
|
|
|
The worst part about writing a DOS virus was that whenever I made a
|
|
mistake DOS would stop working, and I'd have to re-poke the bytes in by hand,
|
|
which I kept written down on pieces of junk mail! Using an assembler was out
|
|
of the question, as the whole thing was only about 300 bytes and scattered in
|
|
tiny bits and pieces in several places in DOS. It had lots of JMPs all over
|
|
the place, self-modifying code and other such nightmares, all to make it as
|
|
small as possible. (The larger it was and the more exposed in memory, the more
|
|
work it was to replicate itself and the more chance there was of something
|
|
unexpected going wrong.)
|
|
|
|
3) What finally happened?
|
|
|
|
Well, I don't really know. Since Virus 3 was effectively completely
|
|
invisible, after a while we lost interest and pretty much forgot about the whole
|
|
thing. We again intended to keep the virus quarantined, but a spot check in the
|
|
fall of 1983 shortly after I graduated and moved to Stanford turned it up in
|
|
several of my friends' collections on disks they thought were uninfected.
|
|
By that point they didn't think it was worth the bother of removing it, though,
|
|
so it spread unchecked. Interest in viruses at A+M had died down by this time,
|
|
too. I only heard about my virus once more: around 1984 my friend at UIUC
|
|
reported that an "evil" virus was attacking Apples there, and causing a lot of
|
|
damage by randomly initializing disks. Some disks had a form of immunity to
|
|
the evil virus, however: when infected by the evil virus, they would crash
|
|
at boot time (which was better than appearing to boot normally and then causing
|
|
damage later). It turned out the "immune" disks were ones that had previously
|
|
been infected by Virus 3!
|
|
|
|
>>>>>>>> Here's where I need your help: <<<<<<<<<<
|
|
|
|
4) Does it still exist?
|
|
|
|
That's what I'd like to find out. The Virus wasn't particularly
|
|
infectious; it only spread on "CATALOG" commands. It attached itself only
|
|
to DOS, not programs, and was very careful only to attach itself to
|
|
absolutely vanilla 48K slave DOS 3.3. Still, there are some old DOS 3.3 disks
|
|
out there yet, aren't there?
|
|
|
|
If you would like to look for it, here's where in memory to look:
|
|
|
|
beginning at B6E8 regular DOS 3.3 has a bunch of 00's. Boot the disk you want
|
|
to check to load that disk's copy of DOS into memory. Infected disks or
|
|
non-infectious descendants of infected disks will have text of the form
|
|
|
|
"(GEN 0000000 TAMU)"
|
|
|
|
(in Hex this is "A8 C7 C5 CE A0 B0 B0 B0 B0 B0 B0 B0 A0 D4 C1 CD D5 A9")
|
|
|
|
at B6E8. You can also see this text go by near the end of track 0, sector 0 if
|
|
you use some utility to dump your disk as text. The number is a generation
|
|
count, and so will be different in your copy. (13 generations saturated my own
|
|
and my friends' collections, if you're interested.) If you should find the
|
|
generation count, you might try also looking at 9CFE and 9CFF. If the virus is
|
|
alive, this should contain the initials of the friend of mine who let your
|
|
copy of the virus escape. (If it's JD, then I'm the guilty party.)
|
|
|
|
Hopefully Virus 2 was wiped out, but perhaps it wasn't. If you want to
|
|
check the version, the simplest way is to do a "CATALOG" of the disk you're
|
|
checking, and then look at B3BF. Vanilla DOS 3.3 has a "00" at this location.
|
|
Virus 2 instead has 02, and Virus 3 similarly has 03. (This "immunity" byte
|
|
can spread when a new disk is initialized, thus providing a way for immunity
|
|
to be created and passed on. For example, if a master disk is attacked it
|
|
will be left marked immune but will be free of infection. Slave disks
|
|
initialized off the master disk would then also be immune, even though they
|
|
would otherwise be susceptible.)
|
|
|
|
(If you don't find zeros at B6E8, 9CFE, and B3BF, but also don't find
|
|
the bytes I've mentioned, then I don't know any more about it than you do,
|
|
and there's not much point in getting excited and flaming me via e-mail.)
|
|
|
|
If you DO find my virus on one of your old Apple ][ disks, please
|
|
let me know! It will make the paper much more interesting! I'll acknowledge
|
|
you at the end! (And please accept my apologies!)
|
|
|
|
5) Did the idea of Viruses I started spread or die out?
|
|
|
|
Certainly everybody knows about viruses today. Did you hear rumors
|
|
of some strange person at A+M working on one around 1982-1983? (And no, I
|
|
was NOT the person who was expelled from A+M about that time for breaking
|
|
into the mainframe and stealing Chemistry exams. I never kept my activities
|
|
secret, nor did anything I thought I had to keep secret. For example, my virus
|
|
is mentioned in a "Computer Recreations" column in 1986, but the author of that
|
|
article mangled the information I sent him rather badly.)
|
|
|
|
Do you know anything about the people who were breaking and
|
|
distributing the copy-protected software turning up at A+M? The rumors
|
|
at the time at A+M were that the software was coming "from Chicago".
|
|
Many programs were "signed" by the breakers with such psuedonyms as
|
|
"The Jerk", "The Beaver", and "Apple Pirated Program Library Exchange".
|
|
|
|
Do you know anything about what happened at A+M after spring, 1983,
|
|
after I graduated? I was told by one A+M graduate I met in 1989 that Virus 3
|
|
made it into the A+M Computer User's Group's disks after I left, but I don't
|
|
really know that.
|
|
|
|
6) Any other early virus-writers have any interesting stories to confess?
|
|
|
|
I'd be curious to hear if anybody else tried to write a virus before
|
|
they became commonplace and criminal. Surely the idea must have occurred to
|
|
many other people about that time!
|
|
|
|
$_End Article
|
|
$_EOF
|
|
|
|
[OTHER WORLD BBS]
|
|
|
|
|
|
|