394 lines
21 KiB
Plaintext
394 lines
21 KiB
Plaintext
|
|
ANATOMY OF A VIRUS AUTHOR
|
|
|
|
|
|
A biography of The Black Baron
|
|
|
|
|
|
By
|
|
|
|
|
|
Matthew Probert
|
|
|
|
|
|
|
|
|
|
In 1969 Neil Armstrong stepped onto the moon. It was a momentous year for the
|
|
world. But no-one at the time paid much attention to a baby boy being born in
|
|
a town in southern England. This baby boy was destined to grow into one of the
|
|
most infamous computer virus writers of all time. In 1969 The Black Baron was
|
|
born!
|
|
|
|
The Black Baron never set out to become a computer virus writer. He left
|
|
school at sixteen with a handful of CSE's and a burning desire to be a
|
|
commercial airline pilot. He enjoyed swimming and science fiction comedy
|
|
shows, such as Red Dwarf, and did all the things that any normal, healthy
|
|
young man would do. He learnt to drive, passed his driving test and settled
|
|
down to several years unemployed.
|
|
|
|
He is at pains to point out that he is not a thug, he does not have any
|
|
criminal convictions;
|
|
|
|
"I don't even have a point on my driving licence" he laughs, when asked about
|
|
criminal activities.
|
|
|
|
And yet what inspires a normal, healthy, well balanced young man to create the
|
|
ultimate in computer terrosism, a polymorphic computer virus?
|
|
|
|
In examining Black Baron's motives one must consider his state of mind. Is he
|
|
a shy, withdrawn individual who has problems with inter-personal relationships
|
|
perhaps? No is the answer. He is not the cliche of a computer programmer. He
|
|
owns a single second-hand Tandon 286 PC with an Amstrad monitor, and a rather
|
|
old and modest modem.
|
|
|
|
"I don't even like computer programming!" he says when asked about it.
|
|
|
|
Perhaps however he is upset by his unemployment? An individual with his
|
|
obvious and undeniable talent must surely feel some resentment at being
|
|
unemployed. But he doesn't blame the computer industry directly, he certainly
|
|
does resent the "old school tie" attitude which is so prevalent in England
|
|
today, and he blames the Conservative government for doing much to reinforce
|
|
this approach to employment.
|
|
|
|
"I don't wear the right colour tie" he says.
|
|
|
|
The inspiration to create a computer virus came to Black Baron after he read
|
|
Ross M. Greenberg's comments about computer virus authors. Mr Greenberg, the
|
|
American author of an anti-virus product called "Flu Shot" is very scathing
|
|
and critical of people who write computer viruses. Indeed the introduction to
|
|
the instruction manual which accompanies Flu Shot is preoccupied with
|
|
questioning the emotional stability of the people who write computer viruses.
|
|
I quote:
|
|
|
|
Introduction
|
|
|
|
What is a Trojan?
|
|
=================
|
|
|
|
Back in the good old days (before there were computers), there
|
|
was this bunch of soldiers who had no chance of beating a
|
|
superior force or of even making it into their fortress. They
|
|
had this nifty idea: present the other side with a gift. Once
|
|
the gift had been accepted, soldiers hiding within the gift would
|
|
sneak out and overtake the enemy from within.
|
|
|
|
We can only think of the intellectual giants of the day who would
|
|
accept a gift large enough to house enemy soldiers without
|
|
checking its contents. Obviously, they had little opportunity to
|
|
watch old WWII movies to see the same device used over and over
|
|
again. They probably wouldn't have appreciated Hogan's Heroes
|
|
anyway. No color TV's -- or at least not ones with reliable
|
|
reception.
|
|
|
|
Consider the types of people who would be thrilled at the concept
|
|
of owning their own rough hewn, large wooden horse! Perhaps they
|
|
wanted to be the first one on their block, or something silly
|
|
like that.
|
|
|
|
Anyway, you're all aware of the story of The Trojan Horse.
|
|
|
|
Bringing ourselves a bit closer to the reality we've all grown to
|
|
know and love, there's a modern day equivalent: getting a gift
|
|
from your BBS or user group which contains a little gem which
|
|
will attack your hard disk, destroying whatever data it contains.
|
|
|
|
In order to understand how a potentially useful program can cause
|
|
such damage when corrupted by some misguided soul, it's useful to
|
|
understand how your disk works, and how absurdly easy it is to
|
|
cause damage to the data contained thereon. So, a brief
|
|
technical discussion of the operation of your disk is in order.
|
|
For those who aren't concerned, turn the page or something.
|
|
|
|
Data is preserved on a disk in a variety of different physical
|
|
ways having to do with how the data is encoding in the actual
|
|
recording of that data. The actual *structure* of that data,
|
|
however, is the same between MS-DOS machines. Other operating
|
|
systems have a different structure, but that doesn't concern us
|
|
now.
|
|
|
|
Each disk has a number of "tracks". These are sometimes called
|
|
cylinders from the old type IBMer's. These are the same people
|
|
who call hard disks DASDs (Direct Access Storage Devices), so we
|
|
can safely ignore their techno-speak, and just call them tracks.
|
|
Tracks can be thought of as the individual little grooves on an
|
|
audio record, sort of.
|
|
|
|
Anyway, each track is subdivided into a number of sectors. Each
|
|
track has the same number of sectors. Tracks are numbered, as
|
|
|
|
are sectors. Any given area on the disk can be accessed if a
|
|
request is made to read or write data into or out of Track-X,
|
|
Sector Y. The read or write command is given to the disk
|
|
controller, which is an interface between the computer itself and
|
|
the hard disk. The controller figures out what commands to send
|
|
to the hard disk, the hard disk responds and the data is read or
|
|
written as directed.
|
|
|
|
The first track on the hard disk typically will contain a small
|
|
program which is read from the hard disk and executed when you
|
|
first power up your machine. The power up sequence is called
|
|
"booting" your machine, and therefore the first track is typical
|
|
known as the "boot track".
|
|
|
|
In order to read information from your disk in a logical
|
|
sequence, there has to be some sort of index. An unusual index
|
|
method was selected for MS-DOS. Imagine going to the card index
|
|
in a library, looking up the title you desire, and getting a
|
|
place in another index which tells you where on the racks where
|
|
the book is stored. Now, when you read the book, you discover
|
|
that only the first chapter of the book is there. In order to
|
|
find the next chapter of the book, you have to go back to that
|
|
middle index, which tells you where the next chapter is stored.
|
|
This process continues until you get to the end of the book.
|
|
Sounds pretty convoluted, right? You bet! However, this is
|
|
pretty much how MS-DOS does its "cataloguing" of files.
|
|
|
|
The directory structure of MS-DOS allows for you to look up an
|
|
item called the "first cluster". A cluster represents a set of
|
|
contiguous ("touching or in contact" according to Random House)
|
|
tracks and sectors. It is the smallest amount of information
|
|
which the file structure of MS-DOS knows how to read or write.
|
|
|
|
Based on the first cluster number as stored in the directory, the
|
|
first portion of a file can be read. When the information
|
|
contained therein is exhausted, MS-DOS goes to that secondary
|
|
index for a pointer to the next cluster. That index is called
|
|
the File Allocation Table, commonly abbreviated to "FAT". The
|
|
FAT contains an entry for each cluster on the disk. An FAT entry
|
|
can have a few values: ones which indicate that the cluster is
|
|
unused, another which indicates that the associated cluster has
|
|
been damaged somehow and that it should be marked as a "bad
|
|
cluster", and a pointer to the next cluster for a given file.
|
|
This allows for what is called a linked list: once you start
|
|
looking up clusters associated with a given file, each FAT entry
|
|
tells you what the next cluster is. At the end of the linked
|
|
list is a special indicator which indicates that there are no
|
|
more clusters associated with the file.
|
|
|
|
There are actually two copies of the FAT stored on your disk, but
|
|
no one really knows what the second copy was intended for.
|
|
Often, if the first copy of the FAT is corrupted for some reason,
|
|
a clever programmer could recover information from the second
|
|
copy to restore to the primary FAT. These clever programmers can
|
|
be called "hackers", and should not be confused with the thieves
|
|
|
|
who break into computer systems and steal things, or the "worms"
|
|
[Joanne Dow gets credit for *that* phrase!] who would get joy out
|
|
of causing you heartache!
|
|
|
|
But that heartache is exactly what can happen if the directory
|
|
(which contains the pointer to the first cluster a file uses),
|
|
the FAT (which contains that linked list to other areas on the
|
|
disk which the file uses), or other areas of the disk get
|
|
corrupted.
|
|
|
|
And that's what the little worms who create Trojan programs do:
|
|
they cause what at first appears to be a useful program to
|
|
eventually corrupt the important parts of your disk. This can be
|
|
as simple as changing a few bytes of data, or can include wiping
|
|
entire tracks clean.
|
|
|
|
Not all programs which write to your hard disk are bad ones,
|
|
obviously. Your word processor, spreadsheet, database and
|
|
utility programs have to write to the hard disk. Some of the DOS
|
|
programs (such as FORMAT), if used improperly, can also erase
|
|
portions of your hard disk causing you massive amounts of grief.
|
|
You'd be surprised what damage the simple "DEL" command can do
|
|
with just a simple typo.
|
|
|
|
But, what defines a Trojan program is its delivery mechanism: the
|
|
fact that you're running something you didn't expect. Typical
|
|
Trojan programs cause damage to your data, and were designed to
|
|
do so by the worms who writhe in delight at causing this damage.
|
|
May they rot in hell -- a mind is a terrible thing to waste!
|
|
|
|
Considering the personality required to cause such damage, you
|
|
can rest assured that they have few friends, and even their
|
|
mother doesn't like to be in the same room with them. They sit
|
|
back and chortle about the damage they do with a few other lowly
|
|
worms. This is their entire social universe. You should pity
|
|
them. I know that I do.
|
|
|
|
What is a Virus?
|
|
================
|
|
|
|
Trojan programs are but a delivery mechanism, as stated above.
|
|
They can be implemented in a clever manner, so that they only
|
|
trigger the malicious part on a certain date, when your disk
|
|
contains certain information or whatever. However they're coded,
|
|
though, they typically affect the disk only in a destructive
|
|
manner once triggered.
|
|
|
|
A new breed of programs has the capability of not only reserving
|
|
malicious damage for a given event's occurrence, but of also
|
|
replicating itself as well.
|
|
|
|
This is what people refer to when they mention the term "Virus
|
|
Program".
|
|
|
|
Typically, a virus will spread itself by replicating a portion of
|
|
itself onto another program. Later, when that normally safe
|
|
program is run it will, in part, execute a set of instructions
|
|
which will infect other programs and then potentially, trigger
|
|
the Trojan portion of the program contained within the virus.
|
|
|
|
The danger of the virus program is twofold. First, it contains a
|
|
Trojan which will cause damage to your hard disk. The second
|
|
danger is the reason why everyone is busy building bomb shelters.
|
|
This danger is that the virus program will infect other programs
|
|
and they in turn will infect other programs and so forth. Since
|
|
it can also infect programs on your floppy disks, you could
|
|
unknowingly infect other machines! Pretty dangerous stuff,
|
|
alright!
|
|
|
|
Kenneth van Wyck, one of the computer folks over at Lehigh
|
|
University, first brought a particular virus to the attention of
|
|
the computer community. This virus infects a program, which
|
|
every MS-DOS computer must have, called COMMAND.COM. This is the
|
|
Command Line Interpreter and is the interface between your
|
|
keyboard and the MS-DOS operating system itself. Whatever you
|
|
type at the C: prompt will be interpreted by it.
|
|
|
|
Well, the virus subverts this intended function, causing the
|
|
infection of neighboring COMMAND.COMs before continuing with
|
|
normal functionality of the command you typed. After a certain
|
|
number of "infections", the Trojan aspect of the program goes
|
|
off, causing you to lose data.
|
|
|
|
The programmer was clever. But still a worm. And still
|
|
deserving of contempt instead of respect. Think of what good
|
|
purposes the programmer could have put his or her talents to
|
|
instead of creating this damage. And consider what this
|
|
programmer must do, in covering up what they've done. They
|
|
certainly can't tell anyone what they've accomplished.
|
|
Justifiable homicide comes to mind, but since the worms they must
|
|
|
|
hang around are probably as disreputable as they are, they must
|
|
hold their little creation a secret.
|
|
|
|
A pity. Hopefully, the worm is losing sleep. Or getting a sore
|
|
neck looking behind them wondering which of their "friends" are
|
|
gonna turn them in for the reward I list towards the end of this
|
|
document.
|
|
|
|
The Challenge to the Worm
|
|
=========================
|
|
|
|
When I first released a program to try to thwart their demented
|
|
little efforts, I published this letter in the archive (still in
|
|
the FLU_SHOT+ archive of which this is a part of). What I say in
|
|
it still holds:
|
|
|
|
As for the designer of the virus program: most
|
|
likely an impotent adolescent, incapable of
|
|
normal social relationships, and attempting to
|
|
prove their own worth to themselves through
|
|
these type of terrorist attacks.
|
|
|
|
Never succeeding in that task (or in any
|
|
other), since they have no worth, they will one
|
|
day take a look at themselves and what they've
|
|
done in their past, and kill themselves in
|
|
disgust. This is a Good Thing, since it saves
|
|
the taxpayers' money which normally would be
|
|
wasted on therapy and treatment of this
|
|
miscreant.
|
|
|
|
If they *really* want a challenge, they'll try
|
|
to destroy *my* hard disk on my BBS, instead of
|
|
the disk of some innocent person. I challenge
|
|
them to upload a virus or other Trojan horse to
|
|
my BBS that I can't disarm. It is doubtful the
|
|
challenge will be taken: the profile of such a
|
|
person prohibits them from attacking those who
|
|
can fight back. Alas, having a go with this
|
|
lowlife would be amusing for the five minutes
|
|
it takes to disarm whatever they invent.
|
|
|
|
Go ahead, you good-for-nothing little
|
|
slimebucket: make *my* day!
|
|
|
|
|
|
Alas, somebody out there opted to do the cowardly thing and to
|
|
use the FLUSHOT programs as a vehicle for wrecking still more
|
|
destruction on people like you. The FLUSHOT3 program was
|
|
redistributed along with a companion program to aid you in
|
|
reading the documentation. It was renamed FLUSHOT4. And the
|
|
reader program was turned into a Trojan itself.
|
|
|
|
I guess the programmer involved was too cowardly to take me up on
|
|
my offer and prefers to hurt people not capable of fighting back.
|
|
I should have known that, I suppose, but I don't normally think
|
|
of people who attack innocents. Normally, I think of people to
|
|
respect, not people to pity, certainly not people who must cause
|
|
such damage in order to "get off".
|
|
|
|
They are below contempt, obviously, and can do little to help
|
|
themselves out of the mire they live in.
|
|
|
|
Still, a worm is a worm.
|
|
|
|
|
|
Insensed by what he saw as the narrow, biggoted attitude of the author, our
|
|
young man, then twenty four years old, decided to write a program which would
|
|
infect other other computer programs and more than that. One which would with
|
|
each infection change its form so as to avoid detection by Flu Shot and other
|
|
virus scanners. At christmas 1993, Pathogen was completed. One month later
|
|
SMEG 0.1 was included and the first SMEG virus hit the computer world.
|
|
|
|
In Febuary 1994 Black Baron, as the author was calling himself, released a
|
|
subsequent computer virus. Queeg. This time he updated the polymorphic engine
|
|
(SMEG) into version 0.2.
|
|
|
|
Shortly aftwerwards the Thunderbyte anti-virus software underwent a major new
|
|
release, with verion 6.20 which in fairness detects 96% of SMEG version 0.1
|
|
and version 0.2 infections. Unfortunately, the author's of Thunderbyte suffer
|
|
from the same arrogance as Mr Greenberg. They have widely boasted that their
|
|
new virus scanner can detect any polymorphic viruses. Needless to say this is
|
|
seen as a challenge by Black Baron. And being an Englishman, he can't resist a
|
|
challenge. It is not surprising to learn then, that as I write this in June
|
|
1994 Black Baron is just finishing off SMEG version 0.3 which is completely
|
|
undetectable by any current virus scanner, including Thunderbyte release 6.20.
|
|
|
|
I ask myself when is this is all going to end? Perhaps when computer users
|
|
become sufficiently educated to be able to use the equipment at their
|
|
disposal. Perhaps when computers stop attracting social inadequates, but whom
|
|
I am refering to the arrogant members of the anti-virus lobby as well as the
|
|
nefarious virus authors. But what of the Black Baron? What is he? Is he a
|
|
malicious criminal? A computer terrorist? A social inadequate trying to
|
|
reassure himself of his own inadequacies through destroying computer data? I
|
|
don't belive so. I have spoken to Black Baron on a number of occassions. He is
|
|
happy to discuss his work, and, at my request, he has even released a document
|
|
detailing the design of SMEG. He doesn't feed on the panic and fear that SMEG
|
|
viruses such as Pathogen and Queeg cause. Rather he revels in the
|
|
embarrasement and panic which his software causes the arrogant anti-virus
|
|
writers.
|
|
|
|
It is quite questionable whether Black Baron was sensible in taking this
|
|
course of action. It does appear that he has adopted a "I'll show you"
|
|
attitude. But it is equally obvious that the real villian is the person who
|
|
caused the trouble in the first place, Mr Greenberg and his arrogant and
|
|
biggoted view. You still don't believe me? Okay, as a finale let me say this.
|
|
Black Baron knows that I write anti-virus software. He knew this before he
|
|
gave me an interview. And knowing that I write anti-virus software he provided
|
|
me with the source code of Pathogen, Queeg and SMEG so that I might improve my
|
|
anti-virus software. He even supplied me with software which creats safe SMEG
|
|
encrypted programs for testing purposes. These are not the actions of a mad
|
|
man. These are the actions of a man who just wants to be respected for what he
|
|
is. A damn hot programmer.
|
|
|
|
After talking with him, I understand the Black Baron. I feel sorry for him as
|
|
well. He is a highly gifted individual who has not been given a chance by
|
|
computer society. So he has made his own chance. We all need recognition.
|
|
Mainly through employment, but we as thinking machines must receive
|
|
recognition for our abilities. Otherwise we sink into melancholy and
|
|
paranoida. Black Baron has received his recognition. We, the computer society
|
|
are responsible for the creation of Pathogen, Queeg, SMEG and all the other
|
|
computer viruses. We have no one to blame but ourselves. It is our desire to
|
|
keep the computer fraternity a closed club which has alienated so many of our
|
|
colleagues. By rubbing their noses in it, so to speak, we have begged for
|
|
trouble, and like the inhabitants of Troy, we have received it.
|
|
|
|
Matthew Probert
|
|
Servile Software
|