6202 lines
200 KiB
Plaintext
6202 lines
200 KiB
Plaintext
|
|
COMPUTER VIRUS EPIDEMIC
|
|
1987-1991
|
|
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART ONE
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition since the
|
|
outbreak in November 1987 through March
|
|
1988.)
|
|
|
|
"VIRUS" INFECTS COMMODORE COMPUTERS
|
|
|
|
(Nov. 20)
|
|
A "virus" has been infecting
|
|
Commodore's Amiga computers, and what
|
|
was once considered an innocent bit of
|
|
hacking has turned into a disaster for
|
|
some users.
|
|
The "virus" is a secret modification
|
|
to the boot block, an area on many disks
|
|
using operating system facilities of the
|
|
Amiga. In addition to its transparent
|
|
purpose --- starting the operating
|
|
system -- the virus contains code that
|
|
can infect other disks. Once a virus
|
|
infected disk is used on a computer, the
|
|
computer's memory becomes a breeding
|
|
ground and all other bootable disks that
|
|
find their way to that computer will
|
|
eventually become infected. Any exchange
|
|
of diskettes with another computer then
|
|
infects the new computer.
|
|
Although the original intention of the
|
|
virus apparently was benign, it may have
|
|
spread to thousands of Amiga computers
|
|
and disrupted their normal operations.
|
|
Since some commercial software
|
|
developers use coded information in the
|
|
boot block of their distribution disks,
|
|
the virus can inadvertently damage these
|
|
disks and render the software useless.
|
|
Knowledgeable users say the virus was
|
|
meant to be a high-tech joke that
|
|
displayed a message after it had
|
|
completely infiltrated a user's disks
|
|
library.
|
|
According to Amiga technical support
|
|
personnel, the only sure way for users
|
|
to keep the virus out of their systems
|
|
is to avoid warm starting the computer.
|
|
It should always be powered down first.
|
|
--
|
|
|
|
|
|
VIRUS MOVES TO IBM COMPUTERS
|
|
|
|
(Dec. 7)
|
|
On the heels of the Amiga virus,
|
|
reported recently in Online Today, a new
|
|
apparently less benign virus has been
|
|
making the rounds of IBM personal
|
|
computers. The IBM-related virus was
|
|
first noted at Lehigh University where,
|
|
last week, a representative in the User
|
|
Services section reported its discovery
|
|
by student consultants.
|
|
As with other similar viruses, this
|
|
one is spread by means of an infected
|
|
system file. In this case, a hacked
|
|
version of IBM's COMMAND.COM processor
|
|
is the host that harbors the virus.
|
|
Once infected, the host PC will then
|
|
infect the first four computers with
|
|
which it comes in contact. In all cases,
|
|
the virus is spread through an illegally
|
|
modified version of the IBM command
|
|
processor.
|
|
Once the host has infected four other
|
|
computers, the host virus is reported to
|
|
purposely destroy the boot tracks and
|
|
allocation tables for all disks and
|
|
diskettes that are online to the host
|
|
computer. The action renders the disks
|
|
completely unreadable, even when
|
|
reconstructs are attempted with popular
|
|
disk repair software.
|
|
The consultant at Lehigh University
|
|
who first alerted general users to the
|
|
virus says that it can be detected by
|
|
examining the date on the COMMAND.COM
|
|
file. A recent date would suggest that
|
|
the file had been illegally modified.
|
|
--
|
|
|
|
|
|
CHRISTMAS GREETINGS MESSAGE TIES UP
|
|
IBM'S ELECTRONIC MAIL SYSTEM
|
|
|
|
(Dec. 12)
|
|
IBM nearly lost its Christmas spirit
|
|
yesterday. It seems that a digital
|
|
Christmas card sent through its
|
|
electronic mail system jammed computers
|
|
at plants across the United States for
|
|
up to 90 minutes.
|
|
The Associated Press quotes IBM
|
|
spokesman Joseph Dahm as saying the
|
|
incident caused no permanent damage, but
|
|
forced the company to turn off links
|
|
between computer terminals for a while.
|
|
AP says, "Curious employees who read
|
|
the message discovered an illustration
|
|
of a Christmas tree with 'Holiday
|
|
Greetings' superimposed on it. A caption
|
|
advised, 'Don't browse it, it's more fun
|
|
to run it.' Once a person opened the
|
|
computer message on their screen, it
|
|
rarely accepted a command to stop the
|
|
message from unfolding on the screen. As
|
|
a result, several people shut off their
|
|
computers and lost reports or mail that
|
|
had not previously been filed."
|
|
Apparently the message also
|
|
automatically duplicated itself and was
|
|
sent to other workstations.
|
|
Online plants in Texas and New York
|
|
were affected, Dahm said. Meanwhile,
|
|
sources said that other facilities in
|
|
Charlotte, N.C.; Lexington, Ky.;
|
|
California and Europe also received the
|
|
message.
|
|
Federal agents even may investigate
|
|
the incident, the wire service says,
|
|
since the message apparently crossed
|
|
state lines.
|
|
--
|
|
|
|
|
|
|
|
COMPUTER VIRUS THREATENS HEBREW
|
|
UNIVERSITY'S EXTENSIVE SYSTEM
|
|
|
|
(Jan. 8)
|
|
In Jerusalem, Hebrew University
|
|
computer specialists are fighting a
|
|
deadline to conquer a digital "virus"
|
|
that threatens to wipe out the
|
|
university's system on the first Friday
|
|
the 13th of the year. That would be May
|
|
13.
|
|
Associated Press writer Dan Izenberg
|
|
says the experts are working on a
|
|
two-step "immune" and "unvirus" program
|
|
that could knock down the vandalized
|
|
area of the system.
|
|
"Viruses" are the latest in computer
|
|
vandalism, carrying trojan horses and
|
|
logic bombs to a new level, because the
|
|
destructiveness is passed from one
|
|
infected system to another. Izenberg
|
|
quotes senior university programmer
|
|
Yisrael Radai as saying that other
|
|
institutions and individual computers in
|
|
Israel already have been contaminated.
|
|
"In fact," writes the wire service,
|
|
"anyone using a contaminated computer
|
|
disk in an IBM or IBM-compatible
|
|
computer was a potential victim."
|
|
Radai says the virus was devised and
|
|
introduced several months ago by "an
|
|
evidently mentally ill person who wanted
|
|
to wield power over others and didn't
|
|
care how he did it."
|
|
AP describes the situation this way:
|
|
"The saboteur inserted the virus into
|
|
the computer's memory and the computer
|
|
then infected all disk files exposed to
|
|
it. Those disk files then contaminated
|
|
healthy computers and disks in an
|
|
electronic version of a contagious
|
|
cold."
|
|
Apparently, the intruder wanted to
|
|
wipe out the files by Friday, May 13,
|
|
but may have gotten impatient, because
|
|
he then had his virus order contaminated
|
|
programs to slow down on Fridays and on
|
|
the 13th day of each month.
|
|
Radai thinks that was the culprit's
|
|
first mistake, because it allowed
|
|
researchers to notice the pattern and
|
|
set about finding the reason why.
|
|
"Another clue," says AP, "was derived
|
|
from a flaw in the virus itself. Instead
|
|
of infecting each program or data file
|
|
once, the malignant orders copied
|
|
themselves over and over, consuming
|
|
increasing amounts of memory space. Last
|
|
week, experts found the virus and
|
|
developed an antidote to diagnose and
|
|
treat it."
|
|
Of viruses in general, computer expert
|
|
Shai Bushinsky told AP, "It might do to
|
|
computers what AIDS has done to sex. The
|
|
current free flow of information will
|
|
stop. Everyone will be very careful who
|
|
they come into contact with and with
|
|
whom they share their information."
|
|
--
|
|
|
|
|
|
TAMPA COMPUTERISTS FIGHT VIRUS
|
|
|
|
(Jan. 10)
|
|
Tampa, Fla., computerists say they are
|
|
fighting a digital "virus" that sounds
|
|
as if it may be the same crank program
|
|
now plaguing a university in Jerusalem.
|
|
As reported earlier, Hebrew University
|
|
computer specialists are contending with
|
|
a virus program that threatens to wipe
|
|
out the university's system on the first
|
|
Friday the 13th of the year -- May 13.
|
|
The Jerusalem team is working on a
|
|
two-step "immune" and "unvirus" program
|
|
that could knock down the vandalized
|
|
area of the system.
|
|
Meanwhile, members of the Tampa Amiga
|
|
User's Group now tell United Press
|
|
International that they, too, are
|
|
fighting a computer virus, and UPI
|
|
quotes one expert as saying a version of
|
|
that vandalizing program also is
|
|
designed to begin destroying files on
|
|
May 13.
|
|
Computer viruses are self-propagating
|
|
programs that spread from one machine to
|
|
another and from one disk to another, a
|
|
sort of new generation of more
|
|
destructive trojan horses and logic
|
|
bombs.
|
|
"It kinda creeps up on you," president
|
|
Jeff White of the Amiga group told the
|
|
wire service, adding that the group's
|
|
membership was infiltrated by the
|
|
program.
|
|
UPI reports, "Experts don't yet know
|
|
what, if any, damage the virus can cause
|
|
to the disks or programs. Similar
|
|
problems have erased programs and
|
|
information. ... White said the program
|
|
spread itself to more than 20 of his
|
|
floppy disks before he discovered it.
|
|
But by then, the program had spread to
|
|
the disks of many of the club's members
|
|
via its regular disk-of-the-month
|
|
distribution."
|
|
White said he doesn't know how the bug
|
|
got to Tampa, but suspects it came from
|
|
West Germany on a disk from an overseas
|
|
user group.
|
|
"White said the program works
|
|
invisibly," says UPI. "When the computer
|
|
is turned on, the program stores itself
|
|
in the machine's main memory and then
|
|
begins spreading copies of itself to new
|
|
disks used in the machine."
|
|
He added that the Tampa club members
|
|
now use a "virus-checker" program to
|
|
test disks to prevent another infection.
|
|
--
|
|
|
|
|
|
VIRUS PROGRAMS COULD HAVE USEFUL
|
|
APPLICATIONS, SAYS COLUMNIST
|
|
|
|
(Jan. 11)
|
|
Despite all the recent negative
|
|
publicity about computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another in way that
|
|
has been called the computer version of
|
|
AIDS -- a California computer columnist
|
|
says there could be a positive result.
|
|
Writing in The San Francisco Examiner,
|
|
John Markoff observes, "In the future,
|
|
distributed computing systems harnessed
|
|
by software programs that break tasks
|
|
into smaller parts and then run portions
|
|
simultaneously on multiple machines will
|
|
be commonplace. In the mid-1970s
|
|
computer researchers John Shoch and Jon
|
|
Hupp at Xerox's Palo Alto Research
|
|
Center wrote experimental virus programs
|
|
designed to harness many computers
|
|
together to work on a single task."
|
|
Markoff points out that some of the
|
|
programs in that work functioned as
|
|
"'town criers' carrying messages through
|
|
the Xerox networks; others were
|
|
diagnostic programs that continuously
|
|
monitored the health of the computers in
|
|
the networks."
|
|
Also the researchers called one of
|
|
their programs a "vampire worm" because
|
|
it hid in the network and came out only
|
|
at night to take advantage of free
|
|
computers. In the morning, it
|
|
disappeared again, freeing the machines
|
|
for human users.
|
|
For now, nonetheless, most viruses --
|
|
particularly in the personal computing
|
|
world -- are viewed as destructive
|
|
higher forms of trojan horses and logic
|
|
bombs.
|
|
Markoff traces the first virus to the
|
|
military ARPAnet in 1970. On that
|
|
system, which links the university,
|
|
military and corporate computers,
|
|
someone let loose a program called
|
|
"creeper."
|
|
Notes the paper, "It crawled through
|
|
the network, springing up on computer
|
|
terminals with the message, 'I'm the
|
|
creeper, catch me if you can!' In
|
|
response, another programmer wrote a
|
|
second virus, called 'reaper' which also
|
|
jumped through the network detecting and
|
|
'killing' creepers."
|
|
Markoff also pointed out that Bell
|
|
Labs scientist Ken Thompson, winner of
|
|
the prestigious Turing Award, recently
|
|
discussed how he created a virus in the
|
|
lab to imbed in AT&T's Unix operating
|
|
system, which he and colleague Dennis
|
|
Ritchie designed.
|
|
In a paper, Thompson noted how he had
|
|
embedded a hidden "trapdoor" in the Unix
|
|
log-on module each time it created a new
|
|
version of the operating system. The
|
|
trapdoor altered the log-on mechanism so
|
|
that Unix would recognize a password
|
|
known only to Thompson.
|
|
Thompson and Ritchie say the Unix
|
|
virus never escaped Bell Labs.
|
|
--
|
|
|
|
|
|
SUBSCRIBER, SYSOP BLOCK POSSIBLE "VIRUS"
|
|
IN APPLE HYPERCARD FORUM
|
|
|
|
(Feb. 8)
|
|
Quick reactions by a subscriber and a
|
|
veteran forum administrator have blocked
|
|
a possible computer "virus" program that
|
|
was uploaded over the weekend to
|
|
CompuServe's new Hypercard Forum.
|
|
The suspicious entry was an Apple
|
|
Hypercard "stack" file called
|
|
"NEWAPP.STK," which was uploaded Friday
|
|
to the forum's Data Library 9,
|
|
"HyperMagazines." It was online for
|
|
about 24 hours before it was caught.
|
|
Subscriber Glenn McPherson was the
|
|
first to blow the whistle. Saturday
|
|
night McPherson posted a message saying
|
|
that when he ran the application, the
|
|
file altered his Macintosh's systems
|
|
file. "I don't know why it did this," he
|
|
wrote, "but no stack should touch my
|
|
system file."
|
|
Neil Shapiro, chief forum
|
|
administrator of the Micronetworked
|
|
Apple Users Group (MAUG), quickly
|
|
investigated and removed the suspicious
|
|
file.
|
|
In a bulletin to the membership,
|
|
Shapiro warned those who already had
|
|
downloaded NEWAPP.STK that the stack
|
|
would alter the system files with
|
|
unknown results. He also warned against
|
|
using system files from any disk that
|
|
was run while the NEWAPP.STK's modified
|
|
system was in effect.
|
|
Said Shapiro, "If you run NEWAPP.STK,
|
|
it will modify the system on the disk it
|
|
is on so that the system's INITs contain
|
|
an INIT labeled 'DR.' Then, if you use
|
|
another system with the DR-infected
|
|
system as your boot system, the new
|
|
system will also contain the
|
|
self-propagating 'DR' INIT Resource.
|
|
While it is possible to, apparently,
|
|
'cut' this resource from infected
|
|
systems with the Resource Editor, the
|
|
only sure course of action is to trash
|
|
any system file that has come in contact
|
|
with this stack."
|
|
It was not immediately known if the
|
|
system alternations were deliberately or
|
|
accidentally programmed into NEWAPP.STK.
|
|
Shapiro notes the file's uploader has
|
|
been locked off the entire system and
|
|
that "he will be contacted by CompuServe
|
|
and/or myself."
|
|
Computer "viruses" -- self-
|
|
propagating programs that infect system
|
|
files and then spread to other disks --
|
|
have been in the news for the past six
|
|
months. To- date, most of their targets
|
|
have been regional computer users
|
|
groups, private and semi-public networks
|
|
and stand-along bulletin board systems.
|
|
This apparently is the first report of a
|
|
virus-like program on a national
|
|
consumer information service.
|
|
Shapiro says in his bulletin that in
|
|
eight years of the various Apple forums'
|
|
operation, this is the only such
|
|
occurrence.
|
|
"While I, of course, cannot say it
|
|
will be the last, I still have just as
|
|
much confidence as always in the fact
|
|
that 99.99999999% of the Mac community
|
|
are quite trustworthy and that there is
|
|
no real need to fear downloads," he
|
|
wrote.
|
|
Shapiro also urged his membership, "If
|
|
you have not used (NEWAPP.STK) yet, do
|
|
not! If you have uploaded it to other
|
|
BBS or network systems, please
|
|
immediately advise the sysops there of
|
|
the problem. If you have placed it on a
|
|
club disk, please be certain to remove
|
|
it from that disk before distribution
|
|
and -- if it has been run from the
|
|
'Master' disk already -- don't just
|
|
remove it, but trash the system."
|
|
Subscriber McPherson indicates the
|
|
suspect file already has spread to other
|
|
systems. His forum note says he found
|
|
the same stack program also in a
|
|
software library on the General
|
|
Electric's GEnie network.
|
|
--
|
|
|
|
|
|
|
|
DOD TRIES TO PROTECT ITS COMPUTERS FROM
|
|
ELECTRONIC VIRUS
|
|
|
|
(Feb. 9)
|
|
Just as a medical virus can spread
|
|
rapidly, so does the deadly computer
|
|
virus seem to be making the rounds.
|
|
In an effort to inoculate itself
|
|
against an outbreak, the Department of
|
|
Defense has taken steps to prevent the
|
|
electronic sabotage from affecting its
|
|
computers, reports Government Computer
|
|
News.
|
|
The computer viruses are self-
|
|
propagating programs that are designed
|
|
to spread automatically from one
|
|
computer to another and from one disk to
|
|
another, totally disrupting normal
|
|
operations.
|
|
As reported in Online Today, such
|
|
viruses have already struck computer
|
|
systems at Hebrew University in
|
|
Jerusalem and IBM Corp.'s regional
|
|
offices in Tampa, Fla.
|
|
"It can spread through computer
|
|
networks in the same way it spreads
|
|
through computers," said DOD spokeswoman
|
|
Sherry Hanson. "The major problem areas
|
|
are denial of service and compromising
|
|
data integrity." In addition to basic
|
|
security measures, computer scientists
|
|
at the National Security Agency are
|
|
installing programming tools and
|
|
hardware devices to prevent the
|
|
infiltration of virus programs. Hanson
|
|
told GCN that DOD is also using
|
|
specialized ROM devices and intrusion
|
|
detectors. The virus only comprises a
|
|
few lines of programming code and is
|
|
easy to develop with few traces.
|
|
After IBM was infiltrated last
|
|
December with an innocent- looking
|
|
Christmas message that kept duplicating
|
|
itself many times over and substantially
|
|
slowed the company's massive message
|
|
system, specialists installed a filter
|
|
program to monitor the system and
|
|
protect against further intrusion.
|
|
According to GCN, executable programs
|
|
can't be transferred from one computer
|
|
to another within IBM's network.
|
|
Even personal computer users are
|
|
worried, since the virus remains hidden
|
|
in a computer's main memory. For
|
|
instance, almost the entire membership
|
|
of a Florida Commodore Amiga users group
|
|
was infected by a virus before it was
|
|
discovered.
|
|
The president of the group said he
|
|
believed the virus originated in Europe
|
|
on a disk of programs the group received
|
|
from an overseas source. The club now
|
|
has a checker program to check disks for
|
|
viruses before they are used.
|
|
Al Gengler, a member of the Amiga
|
|
group, compared the virus to AIDS.
|
|
"You've got to watch who you compute
|
|
with now," he said.
|
|
--Cathryn Conroy
|
|
|
|
|
|
EXPERTS SEES TWO SCENARIOS FOR THE
|
|
COMPUTER "VIRUS" PROBLEM
|
|
|
|
(Feb. 9)
|
|
Don Parker, who heads the information
|
|
security program for the Menlo Park,
|
|
Calif., SRI International, has been
|
|
studying the problem of computer
|
|
"viruses" and now says he see two
|
|
possible directions in the future.
|
|
Speaking with Pamela Nakaso of the
|
|
Reuter Financial News Service, Parker
|
|
said his scenarios are:
|
|
-:- One, that viruses will be too
|
|
difficult to design and use for
|
|
infiltration, and that interest in using
|
|
them as "weapons" will die away.
|
|
-:- Or, two, viruses will increase in
|
|
destructiveness as more sophisticated
|
|
saboteurs use them to destroy the public
|
|
domain software resources available.
|
|
Nakaso also quotes editor Harold
|
|
Highland of the magazine Computers and
|
|
Security as saying that "hysteria" over
|
|
the few documented incidents may fuel
|
|
even more viruses, which are defined as
|
|
self-propagating files that usually
|
|
damage a computer's systems files and
|
|
then spread to other disks.
|
|
Highland pointed out that in a recent
|
|
Australian virus case among Amiga
|
|
computers, one tabloid newspaper
|
|
reported the incident with a headline
|
|
that spanned the entire cover, reading,
|
|
"Terror Strikes in the DP Industry."
|
|
Parker told Reuter, "The vulnerability
|
|
is growing at the same rate as the
|
|
number of computers and number of
|
|
communications with computers."
|
|
Nakaso writes, "Parker estimates that
|
|
of the 2,000 cases of documented
|
|
computer crime he has compiled at SRI,
|
|
about 20 to 30 have been virus attacks.
|
|
There is no question, however, the
|
|
reported incidents are rising, and they
|
|
are expanding beyond personal computers
|
|
to mainframes and other networks."
|
|
--
|
|
|
|
|
|
|
|
COMPUTER VIRUS CALLED FRAUD
|
|
|
|
(Feb. 10)
|
|
Computer viruses may be frauds.
|
|
Although lots of people are talking
|
|
about computerdoms latest illicit fad,
|
|
to date, no one has produced a copy of a
|
|
living breathing virus. Now, a
|
|
University of Utah expert on urban
|
|
legends thinks that the dreaded virus
|
|
may be have become the high tech version
|
|
of the bogey man.
|
|
Professor Jan Harold Brunvand has
|
|
written three books about urban legends
|
|
and he seems to think that the virus is
|
|
just the latest incarnation in a long
|
|
line of legends. Brunvand, and others,
|
|
have pointed out that there are striking
|
|
similarities among reports of the virus
|
|
and legends such as the cat in the
|
|
microwave oven. For one thing, there are
|
|
lots of reported sightings but no
|
|
concrete evidence. And urban legends
|
|
always seem to appear and affect those
|
|
things about which urban dwellers are
|
|
just coming to terms with: shopping
|
|
malls and microwave ovens in the 70's,
|
|
computers in the 80's.
|
|
In today's society, a berserk computer
|
|
that destroys its owner's data certainly
|
|
qualifies as the stuff about which
|
|
legends are made. Even the way in which
|
|
the deed is accomplished has mystical
|
|
qualities: a computer wizard works
|
|
strange magic with the secret
|
|
programming codes of a computer
|
|
operating system.
|
|
Brunvand, a computer owner himself,
|
|
says that although viruses could be
|
|
created, he has found absolutely no
|
|
evidence to support claims about their
|
|
existence.
|
|
--
|
|
|
|
|
|
|
|
HYPERCARD VIRUS JUDGED "HARMLESS"
|
|
|
|
(Feb. 12)
|
|
Administrators of a CompuServe forum
|
|
supporting the Apple Hypercard
|
|
technology have confirmed that a file
|
|
uploaded to their data libraries last
|
|
weekend did indeed contain a so-called
|
|
computer "virus."
|
|
However, they also have determined the
|
|
program apparently was harmless, meant
|
|
only to display a surprise message from
|
|
a Canadian computer magazine called
|
|
MacMag.
|
|
As reported earlier this week, forum
|
|
administrator Neil Shapiro of the
|
|
Micronetworked Apple Users Groups (MAUG)
|
|
removed the suspicious entry, a
|
|
Hypercard "stack" file called
|
|
"NEWAPP.STK," after a forum member
|
|
reported that the file apparently
|
|
altered his Macintosh's system files.
|
|
Computer "viruses," a hot topic in the
|
|
general press these days, have been
|
|
defined as self-propagating programs
|
|
that alter system files and then spread
|
|
themselves to other disks.
|
|
Since removing the file last weekend,
|
|
the Apple administrators have been
|
|
examining the file and now Shapiro says
|
|
it apparently was designed merely to
|
|
display a message from MacMag on March
|
|
2.
|
|
On the HyperForum message board (G
|
|
APPHYPER), Shapiro reports, "Billy
|
|
Steinberg was able to reverse engineer
|
|
(disassemble) the INIT that the virus
|
|
places into system files. The good news
|
|
is that the virus is harmless. But it
|
|
*is* a computer virus."
|
|
Shapiro says that if the downloaded
|
|
file remained in the user's system, then
|
|
on March 2, the screen would display:
|
|
"Richard Brandnow, publisher of
|
|
MacMag, and its entire staff would like
|
|
to take this opportunity to convey their
|
|
universal message of peace to all
|
|
Macintosh users around the world."
|
|
Apparently the file is so designed
|
|
that after March 2 it removes itself
|
|
from the user's system.
|
|
Shapiro notes that, while this file
|
|
apparently is harmless, it still raises
|
|
the question of the propriety of
|
|
database entries that quietly alter a
|
|
user's system files.
|
|
Shapiro said he has spoken to
|
|
publisher Brandnow. "It was not his
|
|
intention to place it in a HyperCard
|
|
stack nor to have it on (CompuServe),"
|
|
Shapiro writes. "What he did do was to
|
|
develop the INIT in December and 'left'
|
|
it on their (MacMag's) own machines with
|
|
the hope that 'it would spread.'"
|
|
Subsequently, someone else apparently
|
|
captured the file, added it to his
|
|
"stack" and uploaded to the CompuServe
|
|
forum and other information services.
|
|
While Brandnow maintains the
|
|
system-altering INIT file was harmless,
|
|
Shapiro says he's concerned about what
|
|
the NEWAPP.STK incident could represent.
|
|
"While the INIT itself is
|
|
non-destructive," Shapiro wrote, "I
|
|
believe it was at least irresponsible
|
|
for MacMag to have perpetrated this type
|
|
of problem and to have caused the
|
|
confusion that they did. I also fear
|
|
that this could give other people ideas
|
|
on less peaceful uses of such a virus.
|
|
"I believe that MacMag has opened here
|
|
a Pandora's Box of problems which will
|
|
haunt our community for years. I hope I
|
|
am wrong."
|
|
--
|
|
|
|
|
|
PUBLISHER DEFENDS HIS "VIRUS" PROGRAM AS
|
|
"GOOD FOR COMMUNITY"
|
|
|
|
(Feb. 13)
|
|
The publisher of Canadian computer
|
|
magazine MacMag contends the computer
|
|
"virus" program his staff initiated
|
|
recently was not only harmless but was
|
|
"good for the Macintosh community."
|
|
Says 24-year-old Richard Brandow, "If
|
|
other people do nasty things (with virus
|
|
programs), it is their responsibility.
|
|
You can't blame Einstein for Hiroshima."
|
|
Speaking by phone with reporter Don
|
|
Clark of The San Francisco Chronicle,
|
|
Brandow maintained his magazine's virus
|
|
program, which spread through the Apple
|
|
Macintosh community this week on this
|
|
continent and apparently reached Europe,
|
|
was intended to do nothing more than
|
|
display a "peaceful" message on Mac
|
|
screens on March 2, the first
|
|
anniversary of the introduction of the
|
|
Apple Mac II.
|
|
Of the so-called "virus" technology,
|
|
Brandow said, "This message is very good
|
|
for the Macintosh community."
|
|
The controversy centered around an
|
|
Apple Hypercard "stack" file called
|
|
"NEWAPP.STK" that was uploaded to
|
|
various public domain databases around
|
|
the country, including the data library
|
|
of CompuServe's HyperForum (G APPHYPER).
|
|
When subscribers discovered that the
|
|
file quietly altered their Mac's system
|
|
files when it was executed, a warning
|
|
was posted and forum administrator Neil
|
|
Shapiro immediately removed the data
|
|
library entry. Only after the forum's
|
|
sysops had disassembled the suspect file
|
|
could it be determined that NEWAPP.STK's
|
|
only apparent function was to display a
|
|
March 2 greeting from Brandow and the
|
|
MacMag staff.
|
|
HyperForum members now have been
|
|
informed that the file, while indeed a
|
|
"virus," apparently is harmless.
|
|
However, Shapiro contends MacMag
|
|
staffers were "at least irresponsible
|
|
... to have perpetrated this type of
|
|
problem and to have caused the confusion
|
|
that they did."
|
|
Shapiro is quoted in The Chronicle as
|
|
adding, "This is very similar to someone
|
|
breaking into your home and writing a
|
|
message of good will in red lipstick on
|
|
your wall. It is a violation of the
|
|
right of private property... Our
|
|
computers are machines that belong to us
|
|
and other people should remain out of
|
|
them."
|
|
On the other side of the argument,
|
|
Brandow told the paper, "The idea behind
|
|
all this is to promote peaceful methods
|
|
of communication between individuals
|
|
using harmless ways."
|
|
Montreal-based MacMag, with a
|
|
circulation of 40,000, is Canada's only
|
|
Macintosh magazine. Brandow also heads a
|
|
1,250-member Mac user group, which he
|
|
says is Canada's largest.
|
|
Brandow told Clark that programmers
|
|
worked more than a year on the virus,
|
|
adding that it was inspired by two
|
|
groups, known as "The Neoists" and "The
|
|
Church of the SubGenius." (He said the
|
|
latter was formed in Texas as a satire
|
|
on fundamentalist religion and inspired
|
|
a 1983 book.)
|
|
As noted here earlier, the MacMag
|
|
virus also reached beyond CompuServe to
|
|
other information services and private
|
|
bulletin board systems. For instance,
|
|
The Chronicle quotes General Manager
|
|
Bill Louden of General Electric's GEnie
|
|
as saying that about 200 users
|
|
downloaded the file from that
|
|
information service before it was
|
|
discovered and removed early Monday.
|
|
Meanwhile, Shapiro told Clark that only
|
|
about 40 of CompuServe's subscribers
|
|
retrieved the file before it was removed
|
|
early Sunday.
|
|
The Chronicle says that Mac devotees
|
|
in the Bay Area were "stunned" by news
|
|
of the virus, but not all were upset.
|
|
For example, Apple wizard Andy
|
|
Hertzfeld, a co-designer of the original
|
|
Mac, told the paper, "As far as I'm
|
|
concerned, it doesn't have any malicious
|
|
intent and is just some people having
|
|
fun. I don't see why people are so
|
|
uptight."
|
|
Meanwhile, a spokeswoman for Apple at
|
|
company headquarters in Cupertino,
|
|
Calif., said the company is searching
|
|
for details of the virus and could not
|
|
comment on it at present.
|
|
--
|
|
|
|
|
|
|
|
TWO FIRMS OFFER TO "INOCULATE" US
|
|
AGAINST THE COMPUTER "VIRUSES"
|
|
|
|
(March 4)
|
|
The debate continues over whether
|
|
computer "viruses" are real or just the
|
|
latest urban legend, but at least two
|
|
companies are hoping that we don't want
|
|
to take any changes.
|
|
Independent of each other, the firms
|
|
this week both claimed to have the first
|
|
commercial software to "inoculate"
|
|
systems against those reported rogue
|
|
programs that damage data and systems
|
|
files.
|
|
One of the companies, Lasertrieve Inc.
|
|
of Metuchen, N.J., introduced its
|
|
VirALARM product during Microsoft
|
|
Corp.'s CD-ROM conference in Seattle.
|
|
In addition, in Stockholm, a Swedish
|
|
company called Secure Transmission AB
|
|
(Sectra) today announced a similar
|
|
anti-virus program called TCELL, after a
|
|
counterpart in human biology.
|
|
A Lasertrieve statement contends that
|
|
previous anti-viral software utilities
|
|
-- mostly offered in the public domain
|
|
-- work by drawing attention to the
|
|
virus's attempted alterations of system
|
|
files, noting a change of file size, or
|
|
monitoring the dates of program changes.
|
|
However, the New Jersey firm contends,
|
|
this approach makes such programs
|
|
"easily fooled by sophisticated
|
|
viruses."
|
|
Lasertrieve says its VirALARM contains
|
|
a program designed to protect another
|
|
program, creating a software "barrier."
|
|
According to the statement, before
|
|
anyone can use the protected program,
|
|
VirALARM checks to determine whether the
|
|
program has been altered since it was
|
|
inoculated. If there has been any
|
|
change, the software then blocks use of
|
|
the altered program, notifies the user
|
|
and suggests a backup copy of the
|
|
program be substituted.
|
|
Meanwhile, Bo-Goran Arfwidsson,
|
|
marketing director of the Swedish
|
|
company, told Bengt Ljung of United
|
|
Press International that its TCELL
|
|
"vaccine" gives a database a partial
|
|
outside protection, sounds an alarm if a
|
|
computer virus appears inside a database
|
|
and identifies the infected file so it
|
|
can be isolated. The contaminated part
|
|
then can be replaced with a backup file.
|
|
Sectra spokesman Torben Kronander said
|
|
that TCELL has been "tested for a year
|
|
now and there is no question that it
|
|
works," adding that since early 1987 the
|
|
software has functioned on computers of
|
|
major Swedish manufacturing companies.
|
|
Arfwidsson declined to name those
|
|
companies for security purposes.
|
|
Kronander said TCELL simply made the
|
|
task of creating a virus so complicated
|
|
that only vast computer systems would be
|
|
able to carry it out. "We've effectively
|
|
removed the hacker type of attack, and
|
|
these have been the problem. It will
|
|
take the resources of a major software
|
|
producer or a country to produce a virus
|
|
in the future."
|
|
UPI says Sectra is a 10-year-old
|
|
research company with 19 employees in
|
|
Linkoping in central Sweden, closely
|
|
tied to the city's Institute of
|
|
Technology.
|
|
--
|
|
|
|
|
|
|
|
"VIRUS" SPREADS TO COMMERCIAL PROGRAM;
|
|
LEGAL ACTION CONSIDERED
|
|
|
|
(March 16)
|
|
That so-called "benign virus" that
|
|
stirred the Apple Macintosh community
|
|
earlier this year when it cropped up in
|
|
a public domain file in forums on
|
|
CompuServe and other information
|
|
services now apparently has invaded a
|
|
commercial program called FreeHand.
|
|
The publisher, Seattle's Aldus Corp.,
|
|
says it had to recall or rework some
|
|
5,000 FreeHand packages once the virus
|
|
was discovered and now is considering
|
|
legal action against those who admitted
|
|
writing the self- propagating program.
|
|
Meanwhile, other major software
|
|
companies reportedly are worried that
|
|
the virus may have affected some of
|
|
their products as well.
|
|
At the heart of the controversy is a
|
|
"peace message" that Canadian Richard
|
|
Brandow, publisher of Montreal's MacMag
|
|
magazine, acknowledged writing. As
|
|
reported here earlier, that file was
|
|
designed to simply pop up on Mac screens
|
|
around the world on March 2 to celebrate
|
|
the first anniversary of the release of
|
|
the Macintosh II. However, many Mac
|
|
users reacted angrily when they learned
|
|
that the file quietly had altered their
|
|
systems files in order to make the
|
|
surprise message possible.
|
|
Now the virus has re-emerged, this
|
|
time in FreeHand, a new Mac program
|
|
Aldus developed. Aldus spokeswoman Laury
|
|
Bryant told Associated Press writer
|
|
George Tibbits that Brandow's message
|
|
flashed when the program was loaded in
|
|
the computer.
|
|
Bryant added that, while it "was a
|
|
very benign incident," Aldus officials
|
|
are angry and "are talking with our
|
|
attorneys to understand what our legal
|
|
rights are in this instance.... We feel
|
|
that Richard Brandow's actions deserve
|
|
to be condemned by every member of the
|
|
Macintosh community."
|
|
This may be the first instance of a
|
|
so-called "virus" infecting commercial
|
|
software.
|
|
Tibbits says the Brandow virus
|
|
apparently inadvertently spread to the
|
|
Aldus program through a Chicago
|
|
subcontractor called MacroMind Inc.
|
|
MacroMind President Marc Canter told
|
|
AP that the virus appears to have been
|
|
in software he obtained from Brandow
|
|
which included a game program called
|
|
"Mr. Potato Head," a version of the
|
|
popular toy.
|
|
Canter said that, unaware of the
|
|
digital infection, he ran the game
|
|
program once, then later used the same
|
|
computer to work on a disk to teach Mac
|
|
owners how to use FreeHand. That disk,
|
|
eventually sent to Aldus, became
|
|
infected. Then it inadvertently was
|
|
copied onto disks sold to customers and
|
|
infected their computers, Canter said.
|
|
Upset with Brandow, Canter says he
|
|
also is considering legal action. For
|
|
his part, Brandow says he met Canter,
|
|
but denied giving him the software.
|
|
The whole incident apparently has some
|
|
at other companies worried because they
|
|
also use Canter's services. Tibbits says
|
|
that among MacroMind's clients are
|
|
Microsoft, Ashton-Tate, Lotus
|
|
Development Corp. and Apple Computers.
|
|
A-T has not commented, but officials at
|
|
Microsoft, Apple and Lotus all told AP
|
|
that none of their software was
|
|
infected.
|
|
Meanwhile, Brandow told Tibbits that,
|
|
besides calling for world peace, the
|
|
virus message was meant to discourage
|
|
software piracy and to encourage
|
|
computer users to buy original copies.
|
|
The full message read: "Richard
|
|
Brandow, the publisher of MacMag, and
|
|
its entire staff would like to take this
|
|
opportunity to convey their universal
|
|
message of peace to all Macintosh users
|
|
around the world." Beneath that was a
|
|
picture of a globe.
|
|
Brandow said that originally he
|
|
expected people making unauthorized
|
|
copies of programs on the machine would
|
|
spread the virus in the Montreal area
|
|
and possibly a few other areas of Canada
|
|
and the United States. However, he said
|
|
he was shocked later to find that, after
|
|
the virus program began to appear in the
|
|
databases of online information
|
|
services, an estimated 350,000 people in
|
|
North America and Europe saw the message
|
|
pop up on their computers on March 2.
|
|
--
|
|
|
|
|
|
|
|
Last page !m
|
|
|
|
Online Today OLT-2039
|
|
|
|
COMPUTER VIRUS EPIDEMIC
|
|
|
|
1 Backgrounder, Part I
|
|
2 Backgrounder, Part II
|
|
3 Backgrounder, Part III
|
|
4 Backgrounder, Part IV
|
|
5 Backgrounder, Part V
|
|
6 Backgrounder, Part VI
|
|
|
|
Enter choice !2
|
|
|
|
Online Today OLT-3125
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART TWO
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition from April
|
|
through November 1988.)
|
|
|
|
|
|
Press <CR> for more !s
|
|
|
|
|
|
THREAT OF "VIRUS" BLOWN OUT OF
|
|
PROPORTION, NORTON AND SYSOPS SAY
|
|
|
|
(April 10)
|
|
The threat of so-called computer
|
|
"viruses" has been vastly overrated,
|
|
according to software guru Peter Norton
|
|
and two CompuServe forum administrators.
|
|
"We're dealing with an urban myth,"
|
|
Norton told Insight magazine. "It's like
|
|
the story of alligators in the sewers of
|
|
New York. Everyone knows about them, but
|
|
no one's ever seen them. Typically,
|
|
these stories come up every three to
|
|
five years."
|
|
Don Watkins, administrator of
|
|
CompuServe's IBM Users Network forums
|
|
(GO IBMNET) also told the general
|
|
interest magazine that he's more
|
|
concerned about being hit by a meteor
|
|
than a computer virus.
|
|
"In five years," Watson said, "I've
|
|
seen only one program that was designed
|
|
to do intentional damage. That was about
|
|
three years ago, and it wasn't very
|
|
sophisticated.
|
|
"I have never spoken to anyone who
|
|
personally, firsthand, has ever seen or
|
|
experienced a program like this," Watson
|
|
added, "and my job keeps me in touch
|
|
with tens of thousands of people."
|
|
CompuServe forum administrators check
|
|
each piece of user-contributed software
|
|
before posting it in data libraries for
|
|
general distribution.
|
|
The alleged virus problem received
|
|
widespread attention in early March when
|
|
an unauthorized message was placed onto
|
|
Freehand, a commercial software product
|
|
for the Apple Macintosh published by
|
|
Aldus Corp. Earlier, the same message
|
|
circulated in several information
|
|
services and was uploaded to
|
|
CompuServe's Hyper Forum, a forum
|
|
devoted to the Hypertext technology that
|
|
is part of the Micronetworked Apple
|
|
Users Groups (GO MAUG).
|
|
The message read "Richard Brandow,
|
|
publisher of MacMag, would like to take
|
|
this opportunity to convey a universal
|
|
message of peace to all Macintosh
|
|
users." It then erased itself without
|
|
doing any harm.
|
|
Of the situation, Neil Shapiro, MAUG's
|
|
chief sysop, said, "The whole problem
|
|
has been completely hyped out of
|
|
proportion."
|
|
--Daniel Janal
|
|
|
|
|
|
COMPUTER VIRUS NEWSLETTER DEBUTS
|
|
|
|
(April 13)
|
|
If you want to follow all the latest
|
|
news on insipid computer viruses, you
|
|
might be interested in the debut of
|
|
"Computer Virology," a newsletter
|
|
devoted to identifying and analyzing
|
|
those annoying computer diseases.
|
|
Produced by Director Technologies
|
|
Inc., the developers of Disk Defender, a
|
|
hardware device that write protects PC
|
|
hard disks, the newsletter will be
|
|
published monthly. Topics will include
|
|
developments for protection against the
|
|
viruses, precautions and procedures to
|
|
follow to insure that terrorists not let
|
|
loose this rampant epidemic.
|
|
"The latest strain of computer viruses
|
|
presently causing serious damage at
|
|
university labs, scientific research
|
|
facilities, hospitals and business
|
|
organizations worldwide, has created a
|
|
very real concern for the future of
|
|
having free access to the tremendous
|
|
amounts of information that are now
|
|
readily available for unlimited use,"
|
|
said Dennis Director, president of
|
|
Director Technologies.
|
|
"The potential dangers of such viruses
|
|
is that they can be used not only as a
|
|
means to facilitate malicious pranks in
|
|
the home computer area, but also pose a
|
|
real `terrorist' threat to academic
|
|
computing labs, scientific research
|
|
projects and business. Data loss can
|
|
cost hundreds of thousands of dollars in
|
|
real money, as well as in wasted
|
|
man-hours."
|
|
The newsletter is distributed free of
|
|
charge. For information or to subscribe,
|
|
contact Director Technologies Inc., 906
|
|
University Pl., Evanston, IL 60201.
|
|
312/491-2334.
|
|
|
|
|
|
SIR-TECH UNVEILS ANTI-VIRUS
|
|
|
|
(April 14)
|
|
Sir-tech Software Inc., the
|
|
Ogdensburg, N.Y., firm best known for
|
|
its recreational programs such as the
|
|
acclaimed "Wizardry" series of adventure
|
|
games, now has released a free program
|
|
called "Interferon, the Magic Bullet"
|
|
that it says is meant to "halt the
|
|
devastation of computer virus."
|
|
A company statement reports that
|
|
Robert Woodhead, 29-year-old director of
|
|
Sir-tech's Ithaca, N.Y., development
|
|
center, designed the Apple Macintosh
|
|
program to "detect and destroy the
|
|
highly-publicized computer virus which
|
|
threatens the integrity of the world's
|
|
computer systems."
|
|
Sir-tech says the program will be
|
|
offered free for downloading from
|
|
related services on CompuServe and
|
|
GEnie. In addition, it is available by
|
|
mailing a diskette with a
|
|
self-addressed, stamped envelope to
|
|
Sir-tech, 10 Spruce Lane, Ithaca, N.Y.
|
|
14850.
|
|
While the program itself is free,
|
|
Woodhead asks for donations to a fund
|
|
established to buy computer equipment
|
|
for visually impaired users. A notice in
|
|
the software gives details on the fund.
|
|
Woodhead said he has worked since
|
|
early this year to come up with
|
|
Interferon, named for the antiviral
|
|
treatment for cancer. "Just as a virus
|
|
leaves clues in a human body, the
|
|
computer virus is detectable if users
|
|
know what to look for," Woodhead said.
|
|
The Interferon program recognizes
|
|
changes that computer viruses make as
|
|
they spread their infection and will
|
|
indicate that there is something amiss,
|
|
the statement said. "The infection can
|
|
be cured by deleting the diseased
|
|
files," it added. "As new viruses are
|
|
discovered, Interferon will be updated
|
|
for instant detection."
|
|
--
|
|
|
|
|
|
|
|
NEW VIRUS PLAGUES MACINTOSHES AT NASA
|
|
AND APPLE
|
|
|
|
(April 18)
|
|
Apple Macintosh computers at the
|
|
National Aeronautics and Space
|
|
Administration and at Apple Computer as
|
|
well as other business offices around
|
|
the country have caught a new computer
|
|
virus, reports Newsday.
|
|
The latest high-tech plague is under
|
|
investigation by Apple and federal
|
|
authorities.
|
|
During the past three weeks, Apple has
|
|
been receiving reports of a virus called
|
|
Scores. Although it has not been known
|
|
to erase any data, it can cause
|
|
malfunctions in printing and accessing
|
|
files and can cause system crashes,
|
|
Cynthia Macon of Apple Computer told
|
|
Newsday.
|
|
Two hundred of the 400 Macintosh
|
|
computers at the Washington, D.C.
|
|
offices of NASA have been infected.
|
|
Many of them are connected to local area
|
|
networks and are spreading the virus.
|
|
"This particular virus does not attack
|
|
data. We have no record indicating
|
|
anyone lost anything important," said
|
|
Charles Redmond, a NASA spokesman.
|
|
Newsday notes that the Scores virus
|
|
can be detected by the altered symbols
|
|
that appear in Scrapbook and Note Pad,
|
|
two Macintosh files. Instead of the Mac
|
|
logo, users see a symbol that looks like
|
|
a dog-eared piece of paper. Two days
|
|
after the virus is transmitted, it is
|
|
activated and begins to randomly infect
|
|
applications, such as word processing
|
|
and spreadsheet programs.
|
|
EDS Corp. of Dallas, Texas was also
|
|
infected with the Scores virus, but
|
|
managed to stop its spread.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
FRIDAY THE 13TH "VIRUS" FIZZLES
|
|
|
|
(May 14)
|
|
Good morning, computerdom! It's
|
|
Saturday the 14th and we're all still
|
|
here. At least, we all SEEM to still be
|
|
here, though some are saying it's too
|
|
early to tell for sure.
|
|
Yesterday, the first Friday the 13th
|
|
of the year, was widely reported to be
|
|
the target date for the denotation of a
|
|
computer virus called "Black Friday"
|
|
which was first discovered in the
|
|
computers of the Hebrew University in
|
|
Jerusalem late last year. The virus,
|
|
which was reported to have spread from
|
|
Jerusalem to computers around the world,
|
|
was said to be designed to destroy
|
|
computer files on May 13.
|
|
However, no early reports of damage
|
|
have surfaced. Computer experts in
|
|
Jerusalem told Associated Press writer
|
|
Karin Laub that the so-called virus was
|
|
undone because most computer users were
|
|
alerted in time. Hebrew University
|
|
researchers detected the virus on Dec.
|
|
24 because of a flaw in its design,
|
|
according to senior programmer Yisrael
|
|
Radai.
|
|
Nonetheless, a few experts are saying
|
|
that we aren't out of the woods yet.
|
|
For instance, Donn Parker of the SRI
|
|
International research firm in Menlo
|
|
Park, Calif., told The Washington Post
|
|
this morning that he hadn't heard of any
|
|
virus-related damage, "but we have been
|
|
holding our breath. I think it will be a
|
|
dud, but we won't know until next week,
|
|
and only then if people whose computers
|
|
go down talk about it."
|
|
Some software companies tackled the
|
|
virus scare. AP reports that the Iris
|
|
software publisher of Tel Aviv developed
|
|
an anti-virus program for the Israeli
|
|
computing community and sold 4,000
|
|
copies before yesterday. President Ofer
|
|
Ahituv estimated that 30 percent of his
|
|
6,000 customers, most of them
|
|
businesses, had been infected by the
|
|
Black Friday virus.
|
|
Meanwhile, some are saying the
|
|
apparent fizzle of the virus is what
|
|
they expected all along.
|
|
"Viruses are like the bogyman," said
|
|
Byron C. Howes, a computer systems
|
|
manager at the University of North
|
|
Carolina at Chapel Hill. Speaking with
|
|
AP, he compared programmers who believe
|
|
in viruses to "people who set little
|
|
bowls of milk outside our doors to feed
|
|
the dwarfs."
|
|
Barry B. Cooper, owner of Commercial
|
|
Software in Raleigh, N.C., agreed. "I
|
|
just think that the whole thing is a
|
|
joke," like the prediction by medieval
|
|
seer Nostradamus of a major earthquake
|
|
on May 8, 1988. "That didn't come true,
|
|
and this won't come true."
|
|
--
|
|
|
|
|
|
R.I. NEWSPAPER DISLODGES VIRUS
|
|
|
|
(May 16)
|
|
The Providence, R.I., Journal-Bulletin
|
|
says it worked for the past week and a
|
|
half to stamp out a "virus" that
|
|
infected an in-house personal computer
|
|
network used by reporters and editors,
|
|
but not before the virus destroyed one
|
|
reporter's data and infected scores of
|
|
floppy disks.
|
|
Writing in The Journal, Jeffrey L.
|
|
Hiday said the virus was "a well-known,
|
|
highly sophisticated variation called
|
|
the 'brain' virus, which was created by
|
|
two brothers who run a computer store in
|
|
Lahore, Pakistan."
|
|
Variations of the virus, he noted,
|
|
have been discovered at companies and
|
|
colleges across the country, including,
|
|
last week, Bowie State College in
|
|
Maryland, where it destroyed five
|
|
students' disks. Online Today reported
|
|
on April 23 that a similar
|
|
Pakistan-based virus infected a student
|
|
system used at Miami University in Ohio,
|
|
threatening to wipe out term papers
|
|
stored there.
|
|
Apparently this is the first time a
|
|
virus has invaded a US newspaper's
|
|
system.
|
|
Hiday said The Journal contacted one
|
|
of the Pakistan brothers by phone, who
|
|
said he created this particular virus
|
|
merely to keep track of software he
|
|
wrote and sold, adding that he did not
|
|
know how it got to the United States.
|
|
However, Hiday added, "US computer
|
|
programming experts ... believe the
|
|
Pakistanis developed the virus with
|
|
malicious intent. The original version
|
|
may be relatively harmless, they point
|
|
out, but its elegance lends itself to
|
|
alterations by other programmers that
|
|
would make it more destructive."
|
|
The newspaper says it discovered the
|
|
virus on May 6 when a message popped up
|
|
on computer screens reading, "Welcome to
|
|
the Dungeon. ... Beware of this VIRUS.
|
|
Contact us for vaccination." The message
|
|
included a 1986 copyright date, two
|
|
names (Basit and Amjad), a company
|
|
(Brain Computer Services), an address
|
|
(730 Nizam Block Allama Iqbal in Lahore,
|
|
Pakistan) and three phone numbers.
|
|
Journal-Bulletin systems engineer
|
|
Peter Scheidler told Hiday, "I was sort
|
|
of shocked. I never thought I'd see a
|
|
virus. That's something you read about."
|
|
The virus infected only the PC
|
|
network; neither the paper's Atex
|
|
news-editing system nor its IBM
|
|
mainframe that supports other
|
|
departments were affected.
|
|
Hiday says the newspaper now is taking
|
|
steps to protect itself against another
|
|
virus attacks. It has tightened
|
|
dissemination of new software and
|
|
discussed installing "anti-virus"
|
|
devices. In addition, computer users
|
|
have been warned not to use "foreign"
|
|
software, and reporters have been
|
|
instructed to turn their computers off
|
|
and then on again before inserting
|
|
floppy disks.
|
|
--
|
|
|
|
|
|
EPA MACINTOSHES RECOVER FROM VIRUS
|
|
|
|
(May 18)
|
|
Although Apple Macintosh computers at
|
|
the Environmental Protection Agency were
|
|
recently plagued with a virus, all of
|
|
them seem to be on the mend now.
|
|
According to Government Computer News,
|
|
the computers were vaccinated with Virus
|
|
Rx, a free program issued by Apple
|
|
Computer Inc. to help users determine if
|
|
their hard disks have been infected.
|
|
Apple has begun an educational campaign
|
|
to promote "safe computing practices,"
|
|
Apple spokeswoman Cynthia Macon told
|
|
GCN.
|
|
Virus Rx is available on CompuServe in
|
|
the Apple Developers Forum (GO APPDEV)
|
|
in Data Library 8 under the name
|
|
VIRUS.SIT.
|
|
Macon said the best long-term response
|
|
to viruses "is to make users aware of
|
|
steps they can take to protect
|
|
themselves." These include backing up
|
|
data files, knowing the source of
|
|
programs and write-protecting master
|
|
disks. Other steps include booting from
|
|
a floppy disk and running all programs
|
|
from floppies rather than installing and
|
|
running them from the hard disk.
|
|
EPA is having some trouble with
|
|
reinfection. Since up to 20 people may
|
|
use one Macintosh, someone may
|
|
unknowingly insert a virus-plagued disk
|
|
into a clean machine. "It's like mono.
|
|
You just never get rid of it," said
|
|
Leslie Blumenthal, a Unisys Corp.
|
|
contract employee at EPA.
|
|
FBI agents in Washington, D.C. and San
|
|
Jose, Calif. are investigating the
|
|
spread of the Macintosh virus, notes
|
|
GCN.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
CONGRESS CONSIDERS VIRUS PROBLEMS
|
|
|
|
(May 19)
|
|
Computer viruses have come to the
|
|
attention of Congress and legislators
|
|
would like to be assured that US defense
|
|
computers are safe from the replicating
|
|
little bugs. Although defense systems
|
|
can't be reached simply by telephoning
|
|
them, a virus could be contracted
|
|
through an infected disk containing
|
|
non-essential information.
|
|
The Defense Authorization Bill for FY
|
|
1989 is likely to direct the Defense
|
|
Department (DoD) to report on its
|
|
methods for handling potential viral
|
|
infections. Congress also wants to know
|
|
what DoD has done about safeguarding
|
|
military computers. They'd like some
|
|
assurance that the Defense Department
|
|
also has considered situations where a
|
|
primary contractor's computer could be
|
|
infected and subsequently endanger DoD's
|
|
own computers.
|
|
Anticipating future hearings,
|
|
Congressional staffers are soliciting
|
|
comments from knowledgeable users as to
|
|
what the report to Congress should
|
|
cover. Interested parties should forward
|
|
their comments to Mr. Herb Lin, House
|
|
Armed Services Committee, 2120 Rayburn
|
|
House Office Building, Washington DC
|
|
20515. Further information is available
|
|
by calling 202/225-7740. All comments
|
|
will be kept in confidence.
|
|
--
|
|
|
|
|
|
TEXAN STANDS TRIAL FOR ALLEGEDLY
|
|
INFECTING SYSTEM WITH "VIRUS"
|
|
|
|
(May 24)
|
|
In Fort Worth, Texas, a 39-year-old
|
|
programmer is to stand trial July 11 on
|
|
felony charges that he intentionally
|
|
infected an ex-employer's system with a
|
|
computer "virus." If convicted, he faces
|
|
up to 10 years in prison.
|
|
The man, Donald Gene Burleson,
|
|
apparently will be the first person ever
|
|
tried under the state's tougher computer
|
|
sabotage law, which took effect Sept. 1,
|
|
1985.
|
|
Dan Malone of the Dallas Morning News
|
|
broke the story this morning, reporting
|
|
on indictments that accuse Burleson of
|
|
executing programs "designed to
|
|
interfere with the normal use of the
|
|
computer" and of acts "that resulted in
|
|
records being deleted" from the systems
|
|
of USPA and IRA Co., a Fort Worth-based
|
|
national securities and brokerage.
|
|
The paper quoted police as saying the
|
|
electronic interference was a "massive
|
|
deletion" of more than 168,000 records
|
|
of sales commissions for employees of
|
|
the company, where Burleson once worked
|
|
as a computer security officer.
|
|
Burleson currently is free on a $3,000
|
|
bonding pending the trial.
|
|
Davis McCown, chief of the Tarrant
|
|
County district attorney's economic
|
|
crimes division, said of the alleged
|
|
virus, "You can see it, but you can't
|
|
see what it does -- just like a human
|
|
virus. It had the ability to multiply
|
|
and move around and was designed to
|
|
change its name so it wouldn't be
|
|
detected."
|
|
McCown also told Malone he wanted to
|
|
make sure "that this type of criminal
|
|
understands that we have the ability to
|
|
make these type of cases; that it's not
|
|
so sophisticated or complicated that
|
|
it's above the law."
|
|
Company officials first noticed a
|
|
problem on Sept. 21, 1985. Says the
|
|
Dallas newspaper, "Further investigation
|
|
revealed that an intruder had entered
|
|
the building at night and used a
|
|
'back-door password' to gain access to
|
|
the computer. ... Once inside, the
|
|
saboteur covered his tracks by erasing
|
|
computer logs that would have followed
|
|
his activity, police said. With his
|
|
access to the computer complete, the
|
|
intruder manually deleted the records."
|
|
Authorities say that only a few of the
|
|
200 workers in the USPA home office --
|
|
including Burleson -- had access and the
|
|
knowledge needed to sabotage the system.
|
|
Earlier USPA was awarded $12,000 by a
|
|
jury in a civil lawsuit filed against
|
|
Burleson.
|
|
--
|
|
|
|
|
|
FBI CALLED TO PROBE VIRUS CASE
|
|
|
|
(July 4)
|
|
The FBI has been called in by NASA
|
|
officials to investigate an alleged
|
|
computer virus that has destroyed data
|
|
on its personal computers and those of
|
|
several other government agencies.
|
|
The New York Times reported this
|
|
morning that the rogue program --
|
|
apparently the so- called "Scores" virus
|
|
that surfaced last April -- was designed
|
|
to sabotage data at Dallas' Electronic
|
|
Data Systems. The paper said the virus
|
|
did little damage to the Texas company
|
|
but did wreak havoc on thousands of PCs
|
|
nationwide.
|
|
The Times quoted NASA officials as
|
|
saying the FBI was called in because,
|
|
even though damage to government data
|
|
was limited, files were destroyed,
|
|
projects delayed and hundreds of hours
|
|
were spent tracking the culprit at
|
|
various government agencies, including
|
|
NASA, the Environmental Protection
|
|
Agency, the National Oceanic and
|
|
Atmospheric Administration and the US
|
|
Sentencing Commission.
|
|
NASA says it doesn't know how the
|
|
program, which damaged files from
|
|
January to May, spread from the Texas
|
|
EDS firm to PC networks nor whether the
|
|
virus was deliberately or accidentally
|
|
introduced at government agencies.
|
|
Meanwhile, the Times quoted experts as
|
|
saying that at least 40 so-called
|
|
"viruses" now have been identified in
|
|
the United States, defining a virus as a
|
|
program that conceals its presence on a
|
|
disk and replicates itself repeatedly
|
|
onto other disks and into the memory of
|
|
computers.
|
|
As reported here in April, the Scores
|
|
virus was blamed for infecting hundreds
|
|
of Apple Macintosh computers at NASA and
|
|
other facilities in Washington, Maryland
|
|
and Florida.
|
|
The Times says the spread of the virus
|
|
was exacerbated when private contractors
|
|
in Washington and North Carolina
|
|
inadvertently sold dozens of computers
|
|
carrying the virus to government
|
|
agencies. The virus spread for as long
|
|
as two months and infected networks of
|
|
personal computers before it was
|
|
discovered.
|
|
--
|
|
|
|
|
|
|
|
NEW MEXICO BBS SUES OVER VIRUS
|
|
|
|
(Aug. 17)
|
|
The operator of a New Mexico computer
|
|
bulletin board system has filed what may
|
|
be the first federal suit against a
|
|
person accused of uploading a computer
|
|
"virus."
|
|
William A. Christison, sysop of the
|
|
Santa Fe Message BBS, alleges in his
|
|
suit that a man named Michael Dagg
|
|
visited his board in the early hours of
|
|
last May 4 and "knowingly and
|
|
intentionally" uploaded a
|
|
digitally-infected file called
|
|
"BBSMON.COM."
|
|
The suit says Christison "checked the
|
|
program before releasing it to the
|
|
public and discovered that it was a
|
|
'Trojan Horse'; i.e., it appeared to be
|
|
a normal program but it contained hidden
|
|
commands which caused the program to
|
|
vandalize Plaintiff's system, erasing
|
|
the operating system and damaging the
|
|
file allocation tables, making the files
|
|
and programs stored in the computer
|
|
unusable."
|
|
Christison says that the defendant
|
|
re-visited the BBS nine times between
|
|
May 5 and May 12, sometimes logging in
|
|
under a pseudonym. "Several of these
|
|
times," the suit says, "he sent in
|
|
messages and on May 7, 1988, he
|
|
knowingly and intentionally sent in by
|
|
modem a program of the same name,
|
|
BBSMON.COM, as the original 'Trojan
|
|
Horse' computer program."
|
|
Through attorney Ann Yalman,
|
|
Christison asks the court to grant
|
|
$1,000 for each Trojan Horse violation
|
|
and to enjoin the defendant "from
|
|
sending 'Trojan Horses' or 'viruses' or
|
|
other vandalizing programs to Plaintiff
|
|
or anyone else."
|
|
A copy of the Santa Fe Message's suit
|
|
has been uploaded to CompuServe's IBM
|
|
Communications Forum. To see it, visit
|
|
the forum by entering GO IBMCOM at any
|
|
prompt. The ASCII file is VIRUS.CHG in
|
|
forum library 0.
|
|
Also, you can reach Christison BBS
|
|
directly with a modem call to
|
|
505/988-5867.
|
|
--
|
|
|
|
|
|
|
|
VIRUS FIGHTERS FIGHT EACH OTHER
|
|
|
|
(Aug. 31)
|
|
Two groups that mean to protect us in
|
|
the fight against so-called computer
|
|
"viruses" seem to be spending rather a
|
|
lot of their energies fighting each
|
|
other.
|
|
"I personally know most of the people
|
|
in this industry and I have never seen
|
|
this kind of animosity," Brian Camenker
|
|
of the Boston Computer Society tells
|
|
business writer Peter Coy.
|
|
The bickering grew louder on Monday in
|
|
page-one article in MIS Week trade
|
|
newspaper in which each side accused the
|
|
other of using sloppy techniques and
|
|
manipulating the testing process for its
|
|
own purposes.
|
|
Says Coy, "The intensity of the debate
|
|
has left some software developers
|
|
disgusted with the whole business."
|
|
The argument, which centers around
|
|
fair evaluation anti-virus "vaccine"
|
|
software, pits the 2- month-old Computer
|
|
Virus Industry Association led by John
|
|
McAfee, president of InterPath Corp. of
|
|
Santa Clara, Calif., against what Coy
|
|
terms "a loose collection of other
|
|
computer experts" led by consultant Jon
|
|
R. David of Tappan and editor Harold
|
|
Highland of Computers & Security
|
|
magazine.
|
|
"Customers and producers agree on the
|
|
need for an independent panel of experts
|
|
to review the (vaccine) software," Coy
|
|
comments. "The question splitting the
|
|
industry is who should be in charge."
|
|
CVIA is pulling together an
|
|
independent university testing panel
|
|
made up of representatives of Pace
|
|
University, Adelphi University and Sarah
|
|
Lawrence College and headed by John
|
|
Cordani, who teaches computer science at
|
|
Adelphi and Pace. However, David and
|
|
Highland say these people don't have the
|
|
necessary credentials and that McAfee's
|
|
InterPath products will have an
|
|
advantage in the testing because McAfee
|
|
invented a virus simulator that will be
|
|
used as a testing mechanism.
|
|
Meanwhile, Highland says he's getting
|
|
funding from his publisher, Elsevier
|
|
Advanced Technology Publications, for
|
|
his own review of anti-viral software,
|
|
but adds he isn't interested in
|
|
operating an ongoing review board.
|
|
--
|
|
|
|
|
|
|
|
VIRUS TRIAL BEGINS IN FORT WORTH
|
|
|
|
(Sept. 7)
|
|
A 40-year-old Texas programmer has
|
|
gone on trial this week, accused of
|
|
using a "virus" to sabotage thousands of
|
|
computer records at his former
|
|
employer's business.
|
|
If convicted in what is believed to be
|
|
the nation's first virus-related
|
|
criminal trial, Donald G. Burleson faces
|
|
up to 10 years in jail and a $5,000
|
|
fine.
|
|
Reporting from the state criminal
|
|
district court in Fort Worth, Texas, The
|
|
Associated Press notes Burleson was
|
|
indicted on charges of burglary and
|
|
harmful access to a computer in
|
|
connection with damage to data at USPA &
|
|
IRA Co. securities firm two days after
|
|
he was fired. The trial is expected to
|
|
last about two weeks.
|
|
USPA, which earlier was awarded
|
|
$12,000 in a civil suit against
|
|
Burleson, alleges the defendant went
|
|
into its offices one night and planted a
|
|
virus in its computer records that, says
|
|
AP, "would wipe out sales commissions
|
|
records every month. The virus was
|
|
discovered two days later, after it had
|
|
eliminated 168,000 records."
|
|
--
|
|
|
|
|
|
VIRUS ATTACKS JAPANESE NETWORK
|
|
|
|
(Sept. 14)
|
|
Japan's largest computer network --
|
|
NEC Corp.'s 45,000- subscriber PC-VAN
|
|
service -- has been infected by a
|
|
computer "virus."
|
|
McGraw-Hill News quotes a NEC
|
|
spokesman as saying that over the past
|
|
two weeks 13 different PC- VAN users
|
|
have reported virus incidents.
|
|
Subscribers' user IDs and passwords
|
|
"were apparently stolen by the virus
|
|
planter when the members accessed one of
|
|
the service's electronic bulletin
|
|
boards," MH says. "The intruder then
|
|
used the information to access other
|
|
services of the system and charged the
|
|
access fees to the password holders."
|
|
NEC, which says it has not yet been
|
|
able to identify the virus planter, gave
|
|
the 13 subscribers new user IDs and
|
|
passwords to check the proliferation of
|
|
the virus.
|
|
--
|
|
|
|
|
|
JURY CONVICTS PROGRAMMER OF VIRUS
|
|
|
|
(Sept. 20)
|
|
After deliberating six hours, a Fort
|
|
Worth, Texas, jury late yesterday
|
|
convicted a 40-year-old programmer of
|
|
planting a "virus" to wipe out 168,000
|
|
computer records in revenge for being
|
|
fired by an insurance firm.
|
|
Donald Gene Burleson is believed to be
|
|
the first person convicted under Texas's
|
|
3-year-old computer sabotage law. The
|
|
trial, which started Sept. 6, also was
|
|
among the first of its kind in the
|
|
nation, Judge John Bradshaw told the
|
|
Tarrant County jury after receiving its
|
|
verdict.
|
|
The Associated Press says jurors now
|
|
are to return to State District Court to
|
|
determine the sentence.
|
|
Burleson, an Irving, Texas, resident,
|
|
was found guilty of harmful access to a
|
|
computer, a third-degree felony with a
|
|
maximum penalty of 10 years in prison
|
|
and a $5,000 fine. However, as a
|
|
first-time offender, Burleson also is
|
|
eligible for probation.
|
|
As reported here earlier, Burleson was
|
|
alleged to have planted a rogue program
|
|
in computers used to store records at
|
|
USPA and IRA Co., a Fort Worth insurance
|
|
and brokerage firm.
|
|
During the trial, prosecutor Davis
|
|
McCown told the jury the virus was
|
|
programmed like a time bomb and was
|
|
activated Sept. 21, 1985, two days after
|
|
Burleson was fired as a programmer at
|
|
the firm because of alleged personality
|
|
conflicts with other employees.
|
|
AP quoted McCown as saying, "There
|
|
were a series of programs built into the
|
|
system as early as Labor Day (1985).
|
|
Once he got fired, those programs went
|
|
off."
|
|
McCown added the virus was discovered
|
|
two days later after it had eliminated
|
|
168,000 payroll records, holding up
|
|
paychecks to employees for more than a
|
|
month.
|
|
Expert witnesses also testified in the
|
|
three-week trial that the virus was
|
|
entered in the system via Burleson's
|
|
terminal by someone who used Burleson's
|
|
personal access code.
|
|
However, the defense said Burleson was
|
|
set up by someone else using his
|
|
terminal and code. Says AP, "Burleson's
|
|
attorneys attempted to prove he was
|
|
vacationing in another part of the state
|
|
with his son on the dates in early
|
|
September when the rogue programs were
|
|
entered into the system. But prosecutors
|
|
presented records showing that Burleson
|
|
was at work and his son was attending
|
|
school on those dates."
|
|
The Fort Worth Star-Telegram reports
|
|
that also during the trial, Duane
|
|
Benson, a USPA & IRA senior programmer
|
|
analyst, testified the automated virus
|
|
series, which was designed to repeat
|
|
itself periodically until it destroyed
|
|
all the records in the system, never was
|
|
automatically activated. Instead, Benson
|
|
said, someone manually set one of the
|
|
programs in motion Sept. 21, 1985,
|
|
deleting the records, then covering his
|
|
or her tracks by deleting the program.
|
|
Prosecutor McCown says data damage in
|
|
the system could have amounted to
|
|
hundreds of thousands of dollars had the
|
|
virus continued undetected.
|
|
As reported here earlier, Burleson
|
|
also has lost a civil case to USPA in
|
|
connection with the incident. That jury
|
|
ordered him to pay his former employers
|
|
$12,000.
|
|
Following the yesterday's verdict,
|
|
McCown told Star-Telegram reporter
|
|
Martha Deller, "This proves (virus
|
|
damage) is not an unprosecutable
|
|
offense. It may be hard to put a case
|
|
together, but it's not impossible."
|
|
--
|
|
|
|
|
|
UNIVERSITY PROFESSORS ATTACK COMPUTER
|
|
VIRUSES
|
|
|
|
(Sept. 30)
|
|
Because they have not been given
|
|
access to the National Security Agency's
|
|
anti-virus research, several university-
|
|
based computer experts are planning to
|
|
begin their own testing and validating
|
|
of software defenses against computer
|
|
viruses, reports Government Computer
|
|
News.
|
|
Led by John Cordani, assistant
|
|
professor of information systems at
|
|
Adelphi University, the results will be
|
|
made public, unlike those being
|
|
researched by NSA. The work being done
|
|
by the Department of Defense is too
|
|
classified for use by the general
|
|
computer community.
|
|
GCN notes that computer viruses are
|
|
hard-to-detect programs that secretly
|
|
replicate themselves in computer
|
|
systems, sometimes causing major damage.
|
|
Cordani and five other academics will
|
|
establish secure laboratories to study
|
|
viruses in three New York colleges:
|
|
Adelphi University, Pace University and
|
|
Sarah Lawrence College. The lab will
|
|
test anti-virus software developed by
|
|
companies that are members of the
|
|
Computer Virus Industry Association, a
|
|
consortium of anti-virus defense
|
|
developers.
|
|
The group will then publish what it is
|
|
calling "consumer reports" in the media
|
|
and on electronic bulletin board
|
|
systems. Once sufficient research is
|
|
completed, more general grading systems
|
|
will be applied, said Cordani. In
|
|
addition, the lab will use viruses sent
|
|
to them by the CVIA to develop
|
|
classification algorithms to aid in
|
|
describing a virus' actions and effects.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
SECOND VIRUS FOUND AT ALDUS CORP.
|
|
|
|
(Oct. 21)
|
|
For the second time this year, a
|
|
computer "virus" has been found in a
|
|
commercial program produced by Seattle's
|
|
Aldus Corp. The infection was found in
|
|
the latest version of the FreeHand
|
|
drawing software, the same software that
|
|
was invaded by a different virus last
|
|
March.
|
|
An Aldus official told The Associated
|
|
Press the company was able to prevent
|
|
the virus's spread to programs for sale
|
|
to the public, but that an entire
|
|
computer network within Aldus'
|
|
headquarters has been infected.
|
|
The virus was found in a version of
|
|
the Apple Macintosh software that was
|
|
sent to specific users to be tested
|
|
before going to market. One of the
|
|
testers discovered the virus, dubbed
|
|
"nVir," and two days later, Aldus
|
|
realized the virus was in its own
|
|
in-house network.
|
|
Said Aldus spokeswoman Jane Dauber,
|
|
"We don't know where it came from. That
|
|
is the nature of the virus. You can't
|
|
really track it."
|
|
AP says Aldus officials said the new
|
|
virus has remained dormant so far, a
|
|
tiny program that merely attaches itself
|
|
to other programs.
|
|
"We don't know why," Dauber said. "We
|
|
don't know what invokes this virus. With
|
|
some of them, you have to launch the
|
|
program a certain number of times," for
|
|
the virus to activate.
|
|
The company told the wire service
|
|
that, while it does not know where the
|
|
virus originated, reports are that it
|
|
apparently has infected at least one
|
|
unidentified East Coast university's
|
|
computers.
|
|
Another Aldus spokeswoman, Laury
|
|
Bryant, added, "You just can't always
|
|
stop these things from coming in the
|
|
door. But what we have done is to set up
|
|
systems which eliminate them before they
|
|
are actually in full version,
|
|
shrink-wrap software and stop them from
|
|
going out the door."
|
|
Last March, in what was apparently the
|
|
first instance of an infection in
|
|
commercial software, a virus called the
|
|
"March 2 peace message" was found in
|
|
some FreeHand programs. The invasion
|
|
caused Aldus to recall or rework
|
|
thousands of packages of the new
|
|
software.
|
|
--
|
|
|
|
|
|
|
|
MAN SENTENCED IN NATION'S FIRST
|
|
VIRUS-RELATED CRIMINAL COURT CASE
|
|
|
|
(Oct. 23)
|
|
Donald Gene Burleson, the first person
|
|
ever convicted of using a computer
|
|
"virus" to sabotage data, has been
|
|
sentenced to seven years' probation and
|
|
ordered to pay back nearly $12,000 to
|
|
his former employer.
|
|
The 40-year-old Irving, Texas, man's
|
|
attorney told United Press International
|
|
he will appeal the sentenced handed down
|
|
late Friday by District Judge John
|
|
Bradshaw in Fort Worth, Texas.
|
|
As reported earlier, Burleson was
|
|
convicted Sept. 19 of the third-degree
|
|
felony, the first conviction under the
|
|
new Texas state computer sabotage law.
|
|
He was accused of infecting the
|
|
computers of USPA & IRA, a Fort Worth
|
|
insurance and securities firm a few days
|
|
after his firing Sept. 18, 1985.
|
|
Burleson could have received two to 10
|
|
years in prison and a fine up to $5,000
|
|
under the 1985 law. As a first-time
|
|
offender, however, he was eligible for
|
|
probation.
|
|
As reported during last month's trial,
|
|
a few days after Burleson's firing in
|
|
1985, company officials discovered that
|
|
168,000 records of sales commissions had
|
|
been deleted from their system.
|
|
Burleson testified that he was more
|
|
than 300 miles away from Fort Worth on
|
|
Sept. 2 and Sept. 3 when the virus was
|
|
created. However, UPI notes that
|
|
evidence showed that his son was not
|
|
traveling with him as he said but in
|
|
school, and that a credit card receipt
|
|
Burleson said proved he was in Rusk on
|
|
Sept. 3 turned out to be from 1987.
|
|
Associated Press writer Mark Godich
|
|
quoted Burleson's lawyer, Jack Beech, as
|
|
saying he had asked for five years'
|
|
probation for his client, and
|
|
restitution not to exceed $2,500.
|
|
Godich also observed that the
|
|
Burleson's conviction and sentencing
|
|
"could pave the way for similar
|
|
prosecutions of people who use viruses."
|
|
Chairman John McAfee of the Computer
|
|
Virus Industry Association in Santa,
|
|
Clara, Calif., told AP the Texas case
|
|
was precedent-setting and that it's rare
|
|
that people who spread computer viruses
|
|
are caught. He added his organization
|
|
had documented about 250,000 cases of
|
|
sabotage by computer virus.
|
|
--
|
|
|
|
|
|
BRAIN VIRUS HITS HONG KONG
|
|
|
|
(Oct. 30)
|
|
According to Computing Australia, a
|
|
major financial operation in Hong Kong
|
|
was infected with a version of the
|
|
"Brain" virus. This is the first
|
|
reported infection of a commercial
|
|
business in the East.
|
|
Business International, a major
|
|
financial consulting firm in Hong Kong,
|
|
is believed not to have suffered any
|
|
major damage. A company spokeswoman
|
|
played down the appearance of the virus
|
|
and said that no data had been lost.
|
|
The "brain" virus has been reported as
|
|
a highly sophisticated piece of
|
|
programming that was created by two men
|
|
in Lahore, Pakistan who run the Brain
|
|
Computer Services company. It's last
|
|
reported appearance in the US was during
|
|
May when it popped up at the Providence,
|
|
R.I., Journal- Bulletin newspaper.
|
|
--
|
|
|
|
|
|
60 COMPUTER FIRMS SET VIRUS GOALS
|
|
|
|
(Nov. 2)
|
|
Some 60 computer companies have
|
|
organized a group to set guidelines that
|
|
they say should increase reliability of
|
|
computers and protect the systems from
|
|
so-called "viruses."
|
|
The Reuter Financial News Service says
|
|
that among firms taking part in the
|
|
movement are Microsoft Corp., 3Com Inc.,
|
|
Banyan Systems and Novell Inc. At the
|
|
same time, though, declining to join the
|
|
efforts are such big guys as IBM and
|
|
Digital Equipment Corp.
|
|
Reuter reports, "The companies said
|
|
the measures would promote competition
|
|
while allowing them to cooperate in
|
|
making computers more reliable and less
|
|
vulnerable to viruses."
|
|
However, the firms apparently have
|
|
shied away from specific proposals,
|
|
instead issuing broad recommendations
|
|
that leave it up to each company to
|
|
develop the technology needed to prevent
|
|
the spread of viruses, Reuter said.
|
|
--
|
|
|
|
|
|
|
|
Last page !m
|
|
|
|
Online Today OLT-2039
|
|
|
|
COMPUTER VIRUS EPIDEMIC
|
|
|
|
1 Backgrounder, Part I
|
|
2 Backgrounder, Part II
|
|
3 Backgrounder, Part III
|
|
4 Backgrounder, Part IV
|
|
5 Backgrounder, Part V
|
|
6 Backgrounder, Part VI
|
|
|
|
Enter choice !3
|
|
|
|
Online Today OLT-1005
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART THREE
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition beginning in
|
|
November 1988.)
|
|
|
|
|
|
Press <CR> for more !s
|
|
|
|
|
|
NEW LAN LABORATORY GROUP OFFERS
|
|
SUGGESTIONS FOR VIRUS PREVENTION
|
|
|
|
(Nov. 7)
|
|
Just a week or so before thousands of
|
|
networked computers across the country
|
|
were struck by a rapid virus, some 60
|
|
computer companies endorsed a set of
|
|
virus-prevention guidelines drafted by
|
|
the National LAN Laboratory.
|
|
The Reston, Va., group, devoted to
|
|
local area networks, hopes its tips can
|
|
prevent and control future viruses and
|
|
worm program intrusions.
|
|
Speaking with business writer Peter
|
|
Coy of The Associated Press, LAN Lab
|
|
spokesman Delbert Jones said, "The key
|
|
issue is that with proper precautions,
|
|
one can continue to live a normal
|
|
existence. ... "It's very much like the
|
|
AIDS virus: The best solution is
|
|
precaution."
|
|
Here, according to AP, are the
|
|
suggestions by the LAN Lab group:
|
|
1. All software should be purchased
|
|
from known, reputable sources.
|
|
2. Purchased software should be in its
|
|
original shrink wrap or sealed disk
|
|
containers when received.
|
|
3. Back-up copies should be made as
|
|
soon as the software package is opened.
|
|
Back-ups should be stored off-site.
|
|
4. All software should be reviewed
|
|
carefully by a system manager before it
|
|
is installed on a network.
|
|
6. New software should be quarantined
|
|
on an isolated computer. This testing
|
|
will greatly reduce the risk of system
|
|
virus contamination.
|
|
7. A back-up of all system software
|
|
and data should be made at least once a
|
|
month, with the back-up copy stored for
|
|
at least one year before re-use. This
|
|
will allow restoration of a system that
|
|
has been contaminated by a
|
|
"time-released" virus. A plan that
|
|
includes "grandfathered" rotation of
|
|
back-up copies will reduce risk even
|
|
further.
|
|
8. System administrators should
|
|
restrict access to system programs and
|
|
data on a "need-to-use" basis. This
|
|
isolates problems, protects critical
|
|
applications, and aids problem
|
|
diagnosis.
|
|
9. All programs on a system should be
|
|
checked regularly for program length
|
|
changes. Any program-length deviations
|
|
could be evidence of tampering, or virus
|
|
infiltration.
|
|
10. Many shared or free programs are
|
|
invaluable. However, these are the prime
|
|
entry point for viruses. Skeptical
|
|
review of such programs is prudent.
|
|
Also, extended quarantine is essential
|
|
before these programs are introduced to
|
|
a computer system.
|
|
11. Any software that exhibits
|
|
symptoms of possible virus contamination
|
|
should be removed immediately. System
|
|
managers should develop plans for quick
|
|
removal of all copies of a suspect
|
|
program, and immediate backup of all
|
|
related data. These plans should be made
|
|
known to all users, and tested and
|
|
reviewed periodically.
|
|
--
|
|
|
|
|
|
|
|
"BRAIN VIRUS" APPEARS IN HOUSTON
|
|
|
|
(Nov. 9)
|
|
A version of the so-called "Brain
|
|
virus," a rogue program believed to have
|
|
originated in Pakistan, now has cropped
|
|
up in computers used by University of
|
|
Houston business students. Texas
|
|
officials say that the virus, while a
|
|
nuisance, has posed no real problem.
|
|
University research director Michael
|
|
Walters told The Associated Press, "It
|
|
probably hasn't cost us much, except a
|
|
few days of people-time to clean up
|
|
these disks, but it probably cost the
|
|
students a good bit of frustration."
|
|
Some students report they have lost
|
|
data, but Walters told the wire service
|
|
he knows of no one who has lost an
|
|
entire term paper or other large
|
|
quantity of work. Nonetheless, reports
|
|
still were coming in from students late
|
|
yesterday.
|
|
This version of the Brain virus, which
|
|
last spring was traced to a computer
|
|
store in Lahore, Pakistan, announced
|
|
itself at the university early last week
|
|
on the screen of one of the 150 PCs the
|
|
business department has for students and
|
|
faculty. Walters said the virus hasn't
|
|
spread to the school's larger computers.
|
|
AP quotes Walters as saying the virus
|
|
flashed this message (with these
|
|
misspellings) to students who tried to
|
|
use infected programs:
|
|
"Welcome to the dungeon. Copyright
|
|
1968 Brain & Amjads, PVT, LTD. Virus
|
|
shoe record V9.0. Dedicated to the
|
|
dynamic memory of millions of virus who
|
|
are no longer with us today -- Thank
|
|
Goodness. BEWARE OF THE VIRUS. This
|
|
program is catching. Program follows
|
|
after these messeges."
|
|
The original "Brain" virus -- which
|
|
appeared in May at colleges and
|
|
businesses along the East Coast and in
|
|
the computers of The Providence, R.I.,
|
|
Journal-Bulletin newspaper -- flashed
|
|
the "Welcome to the Dungeon" message,
|
|
but added "Contact us for vaccination."
|
|
It also gave names, an address and a
|
|
phone number of two brothers who run a
|
|
Lahore, Pakistan, computer store.
|
|
Walters said the Houston version of
|
|
the virus says nothing about any
|
|
vaccine, and the "V9.0" in its message
|
|
suggests it may be a modified version.
|
|
Before this, the most recent sighting
|
|
of the "Brain" virus was at Business
|
|
International, a Hong Kong financial
|
|
operation. It was thought to be the
|
|
first reported digital infection of a
|
|
commercial business in the East. The
|
|
firm is believed not to have suffered
|
|
any major damage.
|
|
--
|
|
|
|
|
|
|
|
UNIX EXPERT SAYS VIRUS "PANIC"
|
|
UNNECESSARY, BLAMES BAD PLANNING
|
|
|
|
(Nov. 10)
|
|
An expert on the Unix operating system
|
|
says that much of last week's "panic"
|
|
over the virus that brought down some
|
|
6,000 networked computers was caused by
|
|
poor management technique.
|
|
In a statement from his Rescue,
|
|
Calif., offices, newsletter editor Bruce
|
|
Hunter said, "Most of the damage was
|
|
done by the organizations themselves,
|
|
not the virus."
|
|
Hunter, who edits Root, a bimonthly
|
|
Unix administration and management
|
|
journal published by InfoPro Systems,
|
|
observed that more than 50,000 users
|
|
were reportedly cut off at a single site
|
|
due to last week's virus, and that more
|
|
than a million people are believed to
|
|
have been directly affected.
|
|
However, Hunter said, "By dropping
|
|
network connections, administrators were
|
|
ensuring that the virus was winning.
|
|
Good communications and information
|
|
sharing between administrators is what
|
|
helped people on the network find and
|
|
implement a solution to the virus
|
|
quickly."
|
|
Hunter, who also is an author and
|
|
mainframe Unix system manager, said that
|
|
one job of an administrator is to keep
|
|
all system resources available to users,
|
|
and another is to "go around searching
|
|
for possible trouble."
|
|
He said the most important lesson
|
|
learned from last week's virus was that
|
|
a definite plan is imperative to avoid
|
|
inappropriate reactions.
|
|
Hunter made these suggestions to
|
|
managers:
|
|
-:- Develop a set of scenarios and
|
|
responses for future virus attacks as
|
|
well as physical disasters.
|
|
-:- Keep a printed list of system
|
|
administrators at all company sites.
|
|
-:- Establish a central point of
|
|
information.
|
|
-:- Coordinate an emergency response
|
|
task force of key personnel.
|
|
-:- Keep current off-site backups of
|
|
all data.
|
|
-:- Perform regular security audits.
|
|
--
|
|
|
|
|
|
|
|
MICHIGAN WEIGHS ANTI-VIRUS LAW
|
|
|
|
(Nov. 15)
|
|
Michigan lawmakers soon will consider
|
|
a proposed state law that would impose
|
|
felony penalties against anyone
|
|
convicted of creating or spreading
|
|
computer "viruses."
|
|
Sponsoring the bill, Republican Sen.
|
|
Vern Ehlers told United Press
|
|
International, "Because this is a new
|
|
type of crime, it is essential we
|
|
address it directly with a law that
|
|
deals with the unique nature of
|
|
computers."
|
|
Citing this month's virus attack on
|
|
military and research computers linked
|
|
by ARPANET and other networks, Ehlers
|
|
added, "The country recently saw how
|
|
quickly a virus can spread through
|
|
network users. The Defense Department
|
|
and its contractors were extremely
|
|
fortunate that the virus was relatively
|
|
harmless."
|
|
The senator said his bill, still being
|
|
drafted, is expected to include
|
|
provisions making it a felony for anyone
|
|
to deliberately introduce a virus into a
|
|
computer system.
|
|
UPI notes Ehlers is a physicist with a
|
|
Ph.D who has 30 years' experience with
|
|
computers.
|
|
--
|
|
|
|
|
|
|
|
VIRUS STRIKES CALIF. MACINTOSHES
|
|
|
|
(Nov. 15)
|
|
Students at Southern California
|
|
universities were being warned today of
|
|
a rapidly spreading West German virus
|
|
that reportedly is disrupting functions
|
|
of Apple Macintosh computers.
|
|
"In general, this thing is spreading
|
|
like mad," Chris Sales, computer center
|
|
consultant at California State
|
|
University at Northridge, told The
|
|
Associated Press. "It originated in West
|
|
Germany, found its way to UCLA and in a
|
|
short time infected us here."
|
|
AP quotes school officials as saying
|
|
that at least a dozen Macs at the
|
|
suburban San Fernando Valley campus have
|
|
been infected since the virus first
|
|
cropped up last week. Cal State says the
|
|
virus apparently does not erase data,
|
|
but that it does stall the computers and
|
|
removal requires hours of reprogramming.
|
|
The wire service said students' disks
|
|
are "being tested for the virus" before
|
|
they can rent a Mac at the university
|
|
bookstore.
|
|
--
|
|
|
|
|
|
|
|
COMPUTER SECURITY EXPERT OFFERS TIPS
|
|
|
|
(Nov. 15)
|
|
The need to protect against computer
|
|
viruses has heralded the end of the
|
|
user-friendly computer era, says one
|
|
security expert.
|
|
According to Government Computer News,
|
|
Sanford Sherizen, president of Data
|
|
Security Systems Inc. of Natick, Mass.
|
|
said the objective now is to make
|
|
software bullet-proof, not accessible.
|
|
He said that since the advent of
|
|
computers in offices, managers have been
|
|
faced with the conflicting needs of
|
|
protecting the data versus producing it.
|
|
Data must be accessible to those who
|
|
need it and yet at the same time secure
|
|
from those who can alter, delete,
|
|
destroy, disclose or steal it or steal
|
|
computer hardware.
|
|
Sherizen told GCN reporter Richard A.
|
|
Danca that non- technical managers can
|
|
contribute to computer security as
|
|
advocates and facilitators. Users must
|
|
learn that security is a part of their
|
|
jobs.
|
|
He predicted that security managers
|
|
will soon use biometric security
|
|
measures such as comparing retinal blood
|
|
vessels or fingerprints. Needless to
|
|
say, such techniques raise complicated
|
|
issues of civil liberties and privacy.
|
|
Sherizen said that all information
|
|
deserves protection.
|
|
--Cathryn Conroy
|
|
|
|
|
|
|
|
VIRUS THREAT SAID EXAGGERATED
|
|
|
|
(Nov. 16)
|
|
Because of the latest reports of
|
|
attacks by computer "viruses," some in
|
|
the industry are ready to blame such
|
|
rogue programs for anything that goes
|
|
wrong.
|
|
However, expert Charles Wood told a
|
|
15th annual computer security conference
|
|
in Miami Beach, Fla., this week, "Out of
|
|
over 1,400 complaints to the Software
|
|
Service Bureau this year, in only 2
|
|
percent of the cases was an electronic
|
|
virus the cause of the problem. People
|
|
are jumping to the conclusion that
|
|
whenever a system slows down, it's a
|
|
virus that's responsible."
|
|
The Associated Press reports that Wood
|
|
and other panelists cautioned that
|
|
computer-dependent companies should
|
|
focus more on the day-to-day breakdowns
|
|
caused by human error than on viruses.
|
|
President Steve Irwin of LeeMah
|
|
Datacom Security Corp. told the
|
|
conference that this month's virus
|
|
assault on networked computers on the
|
|
ARPANET system "could be a cheap
|
|
lesson."
|
|
Said Irwin, "We were lucky because it
|
|
was not a real malicious attempt ... If
|
|
(the virus' author) had ordered the
|
|
programs to be erased, the loss could
|
|
have gone into billions, lots of
|
|
zeroes."
|
|
AP quoted Wood as adding, "The virus
|
|
is the hot topic right now, but actually
|
|
the real important subject is disaster
|
|
recovery planning. But that's not as
|
|
glamorous as the viruses."
|
|
--
|
|
|
|
|
|
|
|
SPA FORMS GROUP TO KNOCK DOWN RUMORS
|
|
ABOUT COMPUTER VIRUSES
|
|
|
|
(Nov. 17)
|
|
Upset over wild rumors about the
|
|
destructiveness of computer viruses, the
|
|
Software Publisher Association has
|
|
formed a special interest group to
|
|
address computer security.
|
|
In a statement released today at the
|
|
Comdex trade show in Las Vegas, SPA says
|
|
its new Software Security SIG will help
|
|
distribute information and serve as
|
|
liaison for software publishers,
|
|
industry analysts and consultants.
|
|
McGraw-Hill News quotes SPA member
|
|
Ross Greenberg, president of Software
|
|
Concepts Design, as saying, "Recent
|
|
unsubstantiated statements regarding the
|
|
actual damage caused by viruses...has
|
|
caused more of a public fervor than
|
|
served as a public service."
|
|
At the SIG's organizational meeting,
|
|
several companies discussed setting
|
|
standards on how to educate the public
|
|
regarding viruses and various anti-viral
|
|
products now being advertised.
|
|
--
|
|
|
|
|
|
|
|
FEDERAL COMPUTERS AT RISK
|
|
|
|
(Nov. 22)
|
|
Many federal computer systems are
|
|
vulnerable to viruses and other security
|
|
problems because of inadequate controls
|
|
on the design and operation, reports The
|
|
Washington Post of a report issued by
|
|
the General Accounting Office.
|
|
GAO warned that the planned computer
|
|
expansion (some $17 billion will be
|
|
spent by Uncle Sam in 1989) could only
|
|
increase security risks since the
|
|
computer growth will be so rapid. It
|
|
advised that particular attention be
|
|
paid to security concerns, especially in
|
|
the early phases of system development.
|
|
"Recent instances of security breaches
|
|
in automated information systems have
|
|
resulted in the loss of assets,
|
|
compromise of program objectives and
|
|
leaks of sensitive information," said
|
|
the report, which is part of series
|
|
prepared by GAO for the incoming Bush
|
|
administration on national problems it
|
|
views as critical.
|
|
The Post notes that some computer
|
|
experts said that the government's
|
|
security woes are no worse than those
|
|
that affect corporate or university
|
|
systems.
|
|
GAO cited specific cases where
|
|
government computer security had been
|
|
breached:
|
|
-:-A clerk used a computer processing
|
|
system to embezzle more than $800,000;
|
|
-:-employees prepared fraudulent
|
|
documents for a tax processing system
|
|
and had the refunds sent to themselves
|
|
and others;
|
|
-:-about 30 employees obtained illicit
|
|
access to computer files and made
|
|
unauthorized disclosures of highly
|
|
sensitive information;
|
|
-:-several federal agencies have been
|
|
the victims of computer viruses that
|
|
have destroyed software and data.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
VIRUS THREAT ANALYZED BY EXPERTS
|
|
|
|
(Nov. 23)
|
|
The Computer Virus Industry
|
|
Association reports there have been 300
|
|
recorded "events" of computer virus
|
|
attacks on some 48,000 computers during
|
|
the past eight months.
|
|
John McAfee, chairman of the
|
|
association, told The Washington Post
|
|
that 97 percent of those incidents
|
|
involved personal computers. He says he
|
|
considers them to be more vulnerable
|
|
than larger systems because people
|
|
frequently stick their disks into other
|
|
people's computers to share data or
|
|
software or just to use another's
|
|
printer.
|
|
Sharing data is not considered a risky
|
|
proposition; sharing software is another
|
|
matter, since viruses attach themselves
|
|
to programs. And once infected, that
|
|
program can spread the virus to other
|
|
programs and computers.
|
|
McAfee told The Post his group has
|
|
counted some 30 strains of viruses that
|
|
affect PCs, some of which are quite
|
|
innocuous while others have potentially
|
|
disastrous consequences. Some viruses
|
|
act immediately; others sit like time
|
|
bombs waiting to go off at a set time.
|
|
But the experts warn users to not
|
|
become hysterical over the threat of
|
|
viruses. Peter Norton, author of the
|
|
popular Norton Utility programs, likens
|
|
viruses to "urban myths, like alligators
|
|
in the New York sewers."
|
|
The CVIA says that just four percent
|
|
of the cases reported to it have
|
|
actually be verified as real viruses.
|
|
Most are software bugs, system errors or
|
|
similar problems, notes The Post.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
FBI PROBES INTERNET INTRUSION
|
|
|
|
(Nov. 24)
|
|
Although the so-called virus "attack"
|
|
that affected a number of national
|
|
computer networks has been characterized
|
|
as unintentional, the Federal Bureau of
|
|
Investigation is apparently gathering
|
|
information to support criminal
|
|
sanctions against the virus' developer.
|
|
The FBI's authority to pursue such an
|
|
investigation stems from the Computer
|
|
Fraud and Abuse Act of 1986 --
|
|
legislation that criminalizes
|
|
unauthorized access to a computer system
|
|
being operated for the use of the
|
|
federal government.
|
|
The network intrusion on November 3,
|
|
affected a number of computers at
|
|
federal installations including those at
|
|
the Lawrence Livermore National
|
|
Laboratory in San Francisco and the NASA
|
|
Ames Research Center in Mountain View,
|
|
Calif.
|
|
Reportedly, the FBI Case Agent has
|
|
asked the Defense Data Network (DDN)
|
|
Project Management Office "to collect
|
|
the names of organizations and Points of
|
|
Contact (names and phone numbers) that
|
|
were hit by the Virus." Those who wish
|
|
to submit information will be contacted
|
|
by their local FBI Field Office.
|
|
Additional information is available
|
|
from the DDN security office at
|
|
703/285-5206.
|
|
--
|
|
|
|
|
|
|
|
|
|
"CORE WARS" CREATOR URGES VIRUS CONTROL
|
|
CENTERS TO BE SET UP
|
|
|
|
(Nov. 25)
|
|
A Canadian professor and computer
|
|
columnist with Scientific American says
|
|
that governments ought to set up centers
|
|
for "computer virus control" patterned
|
|
after the Centers for Disease Control.
|
|
Alexander Dewdney, professor of
|
|
computer science at the University of
|
|
Western Ontario, told reporter Stephen
|
|
Strauss of The Toronto Globe and Mail
|
|
that the centers could isolate, identify
|
|
and then develop antidotes for
|
|
self-replicating viruses.
|
|
Dewdney became famous a few years ago
|
|
by writing in Scientific American about
|
|
how the principle of computer viruses
|
|
could be turned into a game he called
|
|
"Core Wars."
|
|
Strauss writes, "Under Dewdney's plan,
|
|
an organization knowing or suspecting
|
|
its system of being infected by a virus
|
|
would send a copy of all or part of its
|
|
main operating program to the center.
|
|
There, the contaminated program would be
|
|
routed to a special 'clean room' portion
|
|
of the center's computer memory where it
|
|
would not be able to attack anything
|
|
else. Virus experts would then examine
|
|
the program to determine what kind of
|
|
bug was let loose... Once the viral type
|
|
was determined, countermeasures could be
|
|
put into effect."
|
|
Dewdney suggests this last step could
|
|
be either a program counteracting the
|
|
original virus or one which made the
|
|
invading virus destroy all copies of
|
|
itself.
|
|
"People," he said, "could expect that
|
|
within 24 hours some kind of remedy
|
|
would be in place."
|
|
--
|
|
|
|
|
|
|
|
GOVERNMENT RESPONDS TO RECENT VIRUS
|
|
ATTACKS
|
|
|
|
(Nov. 25)
|
|
Federal computer security officials
|
|
are scrambling to prevent further
|
|
attacks by computer viruses on
|
|
government systems.
|
|
According to Government Computer News,
|
|
top officials from both the
|
|
military-based National Security Agency
|
|
and the civilian-based National
|
|
Institute of Standards and Technology
|
|
are working together to develop
|
|
solutions to threat.
|
|
One idea that is being considered,
|
|
according to Stuart Katzke, NIST
|
|
computer security chief, is the
|
|
formation of a federal center for
|
|
anti-virus effort that would be operated
|
|
jointly by NIST and NSA.
|
|
He told GCN that the center would
|
|
include a clearinghouse that would
|
|
collect and disseminate information
|
|
about threats, such as flaws in
|
|
operating systems as well as solutions.
|
|
In addition, it would help organize
|
|
responses to emergencies by quickly
|
|
warning users of new threats and
|
|
defenses against them. Katzke explained
|
|
that those who have solutions to a
|
|
threat could transmit their answers
|
|
through the center to threatened users.
|
|
A database of experts would be created
|
|
to speed response to immediate threats.
|
|
The center would also develop means of
|
|
correcting flaws in software, such as
|
|
trapdoors in operating systems. Vendors
|
|
would even be asked to develop and field
|
|
solutions, notes GCN.
|
|
The only stumbling block is funding
|
|
and personnel for the center.
|
|
Katzke did emphasize that viruses are
|
|
actually less of a threat than poor
|
|
security that allows abusers to access
|
|
systems. Excellent technical anti-virus
|
|
defenses are of no use at all if
|
|
management does not maintain proper
|
|
control of the computer system, he told
|
|
GCN.
|
|
Congress is expected to respond to the
|
|
recent outbreak of virus attacks. One
|
|
bill that died in the 100th Congress,
|
|
The Computer Virus Eradication Act of
|
|
1988, will be reintroduced by Rep. Wally
|
|
Herger (R-Calif.).
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
LINK BETWEEN ARPANET AND MILITARY SYSTEM
|
|
CUT BECAUSE OF INTRUDER
|
|
|
|
(Dec. 1)
|
|
Apparently because of an unknown
|
|
computer intruder, the Pentagon this
|
|
week cut links between its unclassified
|
|
military network called Milnet and
|
|
Arpanet, the national academic and
|
|
corporate network.
|
|
The link reportedly was cut at 10 p.m.
|
|
Monday and was expected to be restored
|
|
sometime today.
|
|
According to The New York Times this
|
|
morning, Pentagon officials are saying
|
|
officially that the move was due to
|
|
technical difficulties. However, The
|
|
Times quoted several unidentified
|
|
security experts as saying the
|
|
connection was broken after a recent
|
|
intrusion into several computers
|
|
operated by defense contractors and the
|
|
military.
|
|
The Times said the Defense Department
|
|
apparently acted after a computer at the
|
|
Mitre Corp., a Bedford, Mass., think
|
|
tank, was illegally entered several
|
|
times over the past month. Officials at
|
|
several US and Canadian universities
|
|
said the intruder used their computers
|
|
to reach Mitre's.
|
|
A Mitre spokeswoman confirmed that one
|
|
of the firm's computers had indeed been
|
|
entered, but said the systems involved
|
|
had not handled any classified or
|
|
sensitive information and that the
|
|
problem was fixed within hours of
|
|
detection.
|
|
Seven computer gateways link Milnet to
|
|
Arpanet.
|
|
Arpanet is the same network that was
|
|
stymied for 36 hours a month ago by a
|
|
so-called virus allegedly created by
|
|
Cornell University graduate student
|
|
Robert Morris Jr., 23, of Arnold, Md.
|
|
The Times quoted its experts as
|
|
speculating that the Pentagon may have
|
|
kept the connection between Milnet and
|
|
Arpanet severed while it tried to rid
|
|
the system of a security flaw.
|
|
Speaking of Morris, two Harvard
|
|
University computer experts, graduate
|
|
student Paul Graham and programmer
|
|
Andrew H. Suddeth, appeared yesterday
|
|
before a federal grand jury in Syracuse,
|
|
N.Y., which is investigating the virus
|
|
incident.
|
|
Suddeth said earlier that Morris
|
|
called him in a panic for help in
|
|
getting out a message to other computer
|
|
operators after he reportedly realized
|
|
what the virus was doing.
|
|
The Associated Press says a third
|
|
person subpoenaed -- Mark Friedell, an
|
|
associate professor of computer science
|
|
-- was excused from testifying because
|
|
he told prosecutors he knew nothing
|
|
about the allegations of Morris'
|
|
involvement with the virus.
|
|
Morris has not been subpoenaed to
|
|
appear before the grand jury, lawyer
|
|
Thomas Guidoboni of Washington, D.C.,
|
|
told the Syracuse Herald-Journal.
|
|
Says AP, "Guidoboni so far has advised
|
|
Morris not to talk with anyone about the
|
|
virus, including FBI agents. But the
|
|
lawyer said an agreement may soon be
|
|
reached in which an interview with
|
|
agents would be arranged."
|
|
--
|
|
|
|
|
|
|
|
CONGRESS TO PROBE VIRUS
|
|
|
|
(Dec. 4)
|
|
The Internet "WORM", previously
|
|
characterized as a virus, has caught the
|
|
attention of federal legislators. Two
|
|
congressional committees plan to
|
|
schedule hearings on the purported
|
|
actions of a 23-year-old Cornell
|
|
University student said to be
|
|
responsible for inserting the WORM
|
|
program into a national computer
|
|
communications network.
|
|
The House Science, Space and
|
|
Technology Committee and the Crime
|
|
Subcommittee of the House Judiciary
|
|
Committee are planning hearings on the
|
|
Internet WORM when the new 101st
|
|
Congress meets. Representative Robert
|
|
Roe (D-N.J.) and Rep. William Hughes
|
|
(D-N.J.), the respective chairmen of the
|
|
two legislative groups, are apparently
|
|
concerned that even more serious
|
|
pitfalls await computers used in the
|
|
federal government. Rep. Hughes is
|
|
well-known in computer security circles
|
|
and has been instrumental in introducing
|
|
computer-related legislation.
|
|
Both chairman are said to be concerned
|
|
about the vulnerability of federal
|
|
computers to intrusions either planned
|
|
or accidental. Committee hearing dates
|
|
will probably be scheduled soon after
|
|
the new congress convenes on January 9.
|
|
--
|
|
|
|
|
|
|
|
PENTAGON FORMS VIRUS "SWAT TEAM"
|
|
|
|
(Dec. 7)
|
|
The Pentagon is bringing together some
|
|
100 unidentified computer experts from
|
|
across the country to act as a kind of
|
|
"SWAT team" to respond to
|
|
self-replicating "virus" programs that
|
|
might threaten US defense computers.
|
|
Called CERT (the Computer Emergency
|
|
Response Team), the group includes
|
|
technical experts, site managers,
|
|
government officers, industry contacts,
|
|
executives and representatives from
|
|
investigative agencies.
|
|
United Press International quotes a
|
|
Pentagon statement as saying the
|
|
experts' knowledge will be called upon
|
|
when needed; otherwise, they will go
|
|
about their usual jobs.
|
|
CERT is to be coordinated from the
|
|
Software Engineering Institute at
|
|
Pittsburgh's Carnegie Mellon University,
|
|
where a six-member staff already is in
|
|
place, UPI says.
|
|
A Pentagon spokeswoman characterized
|
|
the group as "sort of a SWAT team" that
|
|
will respond to security threats such as
|
|
the virus that thwarted Arpanet
|
|
computers for some 36 hours on Nov. 2
|
|
and 3.
|
|
The government says CERT will assist
|
|
researchers in responding to emergencies
|
|
and will be able to rapidly establish
|
|
communications with experts working to
|
|
solve the problems, with affected
|
|
computer users and with government
|
|
authorities.
|
|
--
|
|
|
|
|
|
|
|
NIST AND NSA JOIN IN VIRUS DEFENSE PLAN
|
|
|
|
(Dec. 12)
|
|
The National Security Agency and the
|
|
National Institute of Standards and
|
|
Technology have developed 11 possible
|
|
courses of action in a plan to fight the
|
|
recurrence of computer viruses on
|
|
federal computer systems, reports
|
|
Government Computer News.
|
|
Although many details of the plans are
|
|
incomplete, sources told GCN that some
|
|
of the ideas include establishment of an
|
|
anti-virus coordination center for the
|
|
federal government where problems would
|
|
be reported and jointly supported by NSA
|
|
and NIST. The center might actually
|
|
evolve into a national command center
|
|
that would also support commercial
|
|
networks. GCN notes that staff experts
|
|
would carry beepers so they could be
|
|
summoned around the clock for immediate
|
|
response to a virus attack.
|
|
Other plans called for the development
|
|
of standard virus analysis tools to aid
|
|
in the disassembly and study of viruses
|
|
as well as the establishment of a
|
|
response team from the government,
|
|
industry and academia with the
|
|
specialized skills to analyze viruses
|
|
and develop defenses.
|
|
GCN notes that the group also
|
|
recommended that a network of experts be
|
|
maintained to ensure access to their
|
|
specialized skills in a crisis. The
|
|
establishment of an emergency broadcast
|
|
network to disseminate attack warnings
|
|
and virus defenses was also suggested.
|
|
Anti-virus defenses could be broadcast
|
|
over telephone lines by phones using
|
|
recorded messages.
|
|
Other recommendations include better
|
|
training for operators, improved back-up
|
|
procedures to prevent viruses from being
|
|
copied to secure backup disks and
|
|
greater participation of law enforcement
|
|
agencies in emergencies.
|
|
All the recommendations could be
|
|
implemented under the Computer Security
|
|
Act, which gives NIST authority to
|
|
oversee security for civilian computer
|
|
systems.
|
|
Before the plan can be implemented
|
|
formally, however, NIST and NSA
|
|
officials must approve it, money must be
|
|
allocated and personnel must be hired.
|
|
--Cathryn Conroy
|
|
|
|
|
|
|
|
SOVIETS FIGHT COMPUTER VIRUSES
|
|
|
|
(Dec. 19)
|
|
The Soviet Union says it has contended
|
|
with its first computer virus, one that
|
|
may have stemmed from a computer studies
|
|
"summer camp" there attended earlier
|
|
this year by Soviet and foreign
|
|
children.
|
|
Computer specialist Sergei Abramov of
|
|
the USSR Academy of Sciences told Radio
|
|
Moscow yesterday that the virus was
|
|
found last August at the academy's
|
|
Institute of Program Systems. He said
|
|
the virus invaded systems in at least
|
|
five government-run institutions, but
|
|
that scientists now have developed a way
|
|
to detect known viruses and to prevent
|
|
serious damage.
|
|
Charles Mitchell of United Press
|
|
International quoted Abramov as saying
|
|
the virus, dubbed DOS-62, infected 80
|
|
computers at the academy before it was
|
|
brought under control 18 hours later.
|
|
Abramov believes the virus was
|
|
introduced when Soviet students used the
|
|
institute's computers to copy infected
|
|
application programs and games for
|
|
personal computers.
|
|
Of the computer summer camp, Abramov
|
|
did not say from which countries the
|
|
foreign students came, but added, "Here
|
|
in the Soviet Union there was not a
|
|
single instance of a computer virus
|
|
attack until August of this year but now
|
|
at least two different viruses have been
|
|
encountered by five different
|
|
institutions."
|
|
He did not identify the five
|
|
institutions, nor did he say whether
|
|
viruses had infected any Soviet
|
|
computers connected to Western European
|
|
databases.
|
|
Mitchell also quoted Abramov as saying
|
|
that concern about viruses caused Soviet
|
|
scientists to place a high priority on
|
|
finding a defense for what he said were
|
|
the 15 known digital virus strains in
|
|
the world. He said he headed the team
|
|
that found such a shield.
|
|
"This protective system has no
|
|
counterpart in the world," Abramov said,
|
|
adding that details remain a state
|
|
secret but that the defense, known
|
|
formally as PC-Shield, has been tested
|
|
on IBM computers in the Soviet Union.
|
|
"The system provides early warning of
|
|
an attack by practically any virus known
|
|
in the world," he said. "It has a
|
|
two-tiered system of protection. The
|
|
first tier warns the user of an attack
|
|
enabling him to stop the computer. The
|
|
second tier assures the detection of any
|
|
virus still unknown as well as known and
|
|
prevents it from spreading."
|
|
UPI also quoted Radio Moscow as saying
|
|
that earlier this year an unidentified
|
|
programer at the Gorky Automobile Works
|
|
on the Volga river was charged with
|
|
deliberately using a virus to shut down
|
|
an assembly line in a dispute over work
|
|
conditions. The broadcast said the man
|
|
was convicted under Article 206, the
|
|
so-called Hooliganism law, which
|
|
provides for a jail term of up to six
|
|
years for "violating public order in a
|
|
coarse manner and expressing a clear
|
|
disrespect toward society."
|
|
--
|
|
|
|
|
|
|
|
ANOTHER COMMERCIAL PROGRAM SAID TO BE
|
|
INFECTED BY "NVIR" VIRUS
|
|
|
|
(Dec. 20)
|
|
For the third time this year, a
|
|
commercial software package has been
|
|
infected by a computer virus. This time
|
|
the rogue program -- apparently another
|
|
version of the so-called "nVir" virus --
|
|
has shown up on a compact disk.
|
|
Business writer Peter Coy of The
|
|
Associated Press says the virus was
|
|
found in seven programs on the second
|
|
edition of a CD-ROM called MegaROM,
|
|
which is sold for the Apple Macintosh
|
|
community by Quantum Leap Technology
|
|
Inc. of Coral Gables, Fla.
|
|
Coy says the infection, which was
|
|
detected with virus- screening programs,
|
|
apparently occurred when the disk was
|
|
being prepared for duplication at Nimbus
|
|
Records in Charlottesville, Va. The
|
|
virus, which does not appear to be
|
|
dangerous, was spotted after about 400
|
|
copies of the disk had been shipped, he
|
|
says.
|
|
John Sands, technical operations
|
|
manager of Nimbus' CD- ROM division,
|
|
told the wire service the virus came
|
|
from a piece of software residing on a
|
|
hard disk for Macintosh computers that
|
|
was manufactured by CMS Enhancements
|
|
Inc. of Tustin, Calif. Sands faulted CMS
|
|
for not alerting Nimbus and its other
|
|
disk drive customers about the virus
|
|
threat.
|
|
In response, CMS President Jim
|
|
Farooque told Coy that as of yesterday
|
|
afternoon he hadn't been able to verify
|
|
that the virus had indeed come from his
|
|
company. Conceding that some of his
|
|
employees previously had told people at
|
|
Nimbus that the virus had come on a CMS
|
|
floppy disk used to prepare the hard
|
|
disk for receiving data, Farooque said,
|
|
"It's possible that ... they are
|
|
communicating back and forth information
|
|
that may or may not be true."
|
|
He added the company voluntarily was
|
|
helping people get rid of the viruses
|
|
without admitting responsibility for
|
|
them.
|
|
Quantum Leap President Robert Burr
|
|
told Coy his firm was alerted to the
|
|
virus on Dec. 9 and began notifying
|
|
recipients of the infected MegaRom disks
|
|
last week. The infected disks are
|
|
imprinted with a green decorative
|
|
pattern, while the new disks that are
|
|
virus-free have a blue pattern.
|
|
Coy also noted, "Almost half of the
|
|
infected disks were shipped to members
|
|
of the computer press for review. The
|
|
disks are filled with programs, known as
|
|
shareware or freeware, that are
|
|
available for free from places such as
|
|
computer bulletin boards."
|
|
The nVir virus first appeared in
|
|
another commercial program -- Aldus
|
|
Corp.'s FreeHand drawing software for
|
|
the Mac -- last October. Until now,
|
|
Aldus was the only commercial software
|
|
firm to publicly report a virus problem.
|
|
Last March, an earlier version of
|
|
FreeHand was infected by different
|
|
virus.
|
|
--
|
|
|
|
|
|
VIRUSES TEST COMPUTER CRIME LAWS
|
|
|
|
(Dec. 20)
|
|
The perpetration of computer viruses
|
|
is a punishable crime that is generally,
|
|
although not specifically, addressed by
|
|
a number of federal and state criminal
|
|
statues. Despite this, law enforcement
|
|
officials are finding that successful
|
|
prosecutions tend to decrease
|
|
dramatically as the sophistication of
|
|
the misdeed increases, reports the Los
|
|
Angeles Times.
|
|
"There are a lot of hairy evidence
|
|
questions with computer crimes," said
|
|
Jack Bologna, head of the International
|
|
Association of Computer Crime
|
|
Investigators. "Documentation today is
|
|
different than when you had a complete
|
|
paper trail. It is now possible to cause
|
|
a computer crime in which you destroy
|
|
all the evidence."
|
|
Traditionally, computer thieves have
|
|
been tried under ordinary grand theft
|
|
and fraud sections of state criminal
|
|
codes, but since 1984 (a year after the
|
|
debut of the movie "War Games"), the
|
|
laws have been changing to keep up with
|
|
the state of technology. Now, 48 states
|
|
and the federal government have specific
|
|
laws governing against computer crime.
|
|
Statistics show that an overwhelming
|
|
majority of cases that reach a judge
|
|
result in convictions, according to the
|
|
National Center for Computer Crime Data.
|
|
But most of the crimes are never
|
|
prosecuted because of lack of sufficient
|
|
evidence or because the victims, usually
|
|
large corporations, are too embarrassed
|
|
to notify authorities. But to date,
|
|
there have been no prosecutions of
|
|
computer viruses, which first emerged
|
|
about 18 months ago.
|
|
Even the notorious case of Robert T.
|
|
Morris Jr., the 23- year-old Cornell
|
|
University graduate student suspected of
|
|
creating the virus that madly replicated
|
|
across the vast network of military and
|
|
university computers this fall, has not
|
|
yet been prosecuted. The Times notes
|
|
that the FBI is now studying four
|
|
federal criminal statutes to determine
|
|
whether it should prosecute Morris.
|
|
Authorities concede the case is fraught
|
|
with legal problems, meaning it is
|
|
possible he will never be prosecuted.
|
|
--Cathryn Conroy
|
|
|
|
|
|
|
|
Online Today OLT-1512
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART FOUR
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition beginning in
|
|
January 1989.)
|
|
|
|
VIRUS STRIKES UNIVERSITY OF OKLA.
|
|
|
|
(Jan. 11)
|
|
Officials at the University of
|
|
Oklahoma in Norman, Okla., blame a
|
|
computer virus for ruining several
|
|
students' papers and shutting down
|
|
terminals and printers in a student lab
|
|
at the university library.
|
|
Manager Donald Hudson of Bizzell
|
|
Memorial Library told The Associated
|
|
Press that officials have purged the
|
|
library computers of the virus. He said
|
|
the library also has set up extra
|
|
computers at its lab entrance to inspect
|
|
students' programs for viruses before
|
|
they are used on other computers.
|
|
The wire service said the library's
|
|
virus probably got into a computer
|
|
through a student's disk, but the
|
|
student may not have known the virus was
|
|
there. Hudson said the library's
|
|
computers are not linked to any
|
|
off-campus systems. However, the
|
|
computers are connected through
|
|
printers, which he said allowed the
|
|
virus to spread.
|
|
--
|
|
|
|
|
|
"FRIDAY THE 13TH" VIRUS STRIKES
|
|
|
|
(Jan. 13)
|
|
Data files and programs on personal
|
|
computers throughout Britain apparently
|
|
were destroyed today by what was termed
|
|
a "Friday the 13th" computer virus.
|
|
Alan Solomon, managing director of S
|
|
and S Enterprises, a British data
|
|
recovery center, told The Associated
|
|
Press that hundreds of users of IBM and
|
|
compatible PCs reported the virus, which
|
|
he said might be a new species.
|
|
Solomon, who also is chairman of an
|
|
IBM users group, told the wire service
|
|
that phone lines to the center were busy
|
|
with calls for help from businesses and
|
|
individuals whose computers were struck
|
|
by the virus.
|
|
"It has been frisky," he said, "and
|
|
hundreds of people, including a large
|
|
firm with over 400 computers, have
|
|
telephoned with their problems."
|
|
S and S hopes to figure out how the
|
|
virus operates and then attempt to
|
|
disable it. "The important thing is not
|
|
to panic and start trying to delete
|
|
everything in a bid to remove the
|
|
virus," Solomon said. "It is just a
|
|
pesky nuisance and is causing a lot of
|
|
problems today."
|
|
--
|
|
|
|
|
|
"FRIDAY THE 13TH" VIRUS MAY BE NEW
|
|
VERSION OF ONE FROM ISRAEL
|
|
|
|
(Jan. 14)
|
|
Investigators think the "Friday the
|
|
13th" virus that struck Britain
|
|
yesterday might be a new version of the
|
|
one that stymied computers at the Hebrew
|
|
University in Jerusalem on another
|
|
Friday the 13th last May.
|
|
As reported here yesterday (GO
|
|
OLT-308), hundreds of British IBM PCs
|
|
and compatibles were struck by the
|
|
virus, which garbled data and deleted
|
|
files.
|
|
Jonathan Randal of The Washington Post
|
|
Foreign Service reports the program is
|
|
being called the "1,813" variety,
|
|
because of the number of unwanted bytes
|
|
it adds to infected software.
|
|
He says the specialists are convinced
|
|
the program "is the brainchild of a
|
|
mischievous -- and undetected --
|
|
computer hacker at Hebrew University."
|
|
Alan Solomon, who runs the IBM
|
|
Personal Computer User Group near
|
|
London, told the Post wire service that
|
|
1,813 was relatively benign, "very
|
|
minor, just a nuisance or a practical
|
|
joke."
|
|
Solomon said he and other specialists
|
|
first noted the virus in Britain several
|
|
months ago when it began infecting
|
|
computers. Solomon's group wrote
|
|
security software with it distributed
|
|
free, so, he said, the virus basically
|
|
struck only the unlucky users who didn't
|
|
take precautions.
|
|
--
|
|
|
|
|
|
|
|
LIBRARY OF CONGRESS VIRUS VICTIM
|
|
|
|
(Jan. 27)
|
|
An official with the US Library of
|
|
Congress acknowledges that the
|
|
institution was struck by a computer
|
|
virus last fall.
|
|
Speaking to a delegation of Japanese
|
|
computer specialists touring Washington,
|
|
D.C., yesterday, Glenn McLoughlin of the
|
|
library's Congressional Research Service
|
|
disclosed that a virus was spotted and
|
|
killed out of the main catalog computer
|
|
system before it could inflict any
|
|
damage to data files.
|
|
Associated Press writer Barton Reppert
|
|
quoted McLoughlin as saying, "It was
|
|
identified before it could spread or
|
|
permanently erase any data."
|
|
McLoughlin added the virus was found
|
|
after personnel logged onto computers at
|
|
the library and noticed they had
|
|
substantially less memory space to work
|
|
with than they had expected.
|
|
He said the virus apparently entered
|
|
the system through software obtained
|
|
from the University of Maryland. "We
|
|
don't know," he said, "whether it was a
|
|
student at Maryland, or whether Maryland
|
|
had gotten it from somebody else. That
|
|
was simply the latest point of departure
|
|
for the software."
|
|
Meanwhile, Reppert also quoted
|
|
computer security specialist Lance J.
|
|
Hoffman of George Washington University
|
|
as saying the world may be heading
|
|
toward a catastrophic computer failure
|
|
unless more effective measures are taken
|
|
to combat viruses.
|
|
Comparing last November's virus
|
|
assault on the Pentagon's ARPANET
|
|
network to a nuclear accident that
|
|
"could have had very disastrous
|
|
consequences for our society," Hoffman
|
|
told the visitors, "It wasn't Chernobyl
|
|
yet, it was the Three Mile Island -- it
|
|
woke a lot of people up."
|
|
Online Today has been following
|
|
reports of viruses for more than a year
|
|
now. For background files, type GO
|
|
OLT-2039 at any prompt. And for other
|
|
stories from The Associated Press, type
|
|
GO APO.
|
|
--
|
|
|
|
|
|
|
|
CHRISTMAS VIRUS FROM FRANCE?
|
|
|
|
(Jan 30)
|
|
A little noticed software worm, the
|
|
so-called Christmas Decnet virus, may
|
|
have originated from Germany or France.
|
|
Apparently released at the end of
|
|
December, the worm replicated itself
|
|
only onto Digital Equipment Corp.
|
|
computers that were connected to Decnet,
|
|
a national communications network often
|
|
accessed by DEC users.
|
|
At least one system administrator has
|
|
noticed that the worm collected
|
|
identifying information from the invaded
|
|
terminals and electronically mailed that
|
|
information to a network node in France.
|
|
The assumption is that the French node
|
|
collected the information and,
|
|
subsequently, used it to propagate the
|
|
worm throughout the network.
|
|
The so-called German connection came
|
|
about because of the way the worm
|
|
presents text information on invaded
|
|
terminals. Though written in English,
|
|
the worm message is said to contain
|
|
strong indications of Germanic language
|
|
syntax. Predictably, a German
|
|
"connection" has led to speculation that
|
|
Germany's Chaos Computer Club may have
|
|
had a role in worm's creation.
|
|
--
|
|
|
|
|
|
|
|
FEDERAL GROUP FIGHTS VIRUSES
|
|
|
|
(Feb. 3)
|
|
The Computer Emergency Response Team
|
|
(CERT) has been formed by the Department
|
|
of Defense and hopes to find volunteer
|
|
computer experts who will help federal
|
|
agencies fight computer viruses. CERT's
|
|
group of UNIX experts are expected to
|
|
help users when they encounter network
|
|
problems brought on by worms or viruses.
|
|
A temporary group that was formed last
|
|
year after Robert T. Morris Jr.
|
|
apparently let loose a bug that infected
|
|
the Department of Defense's Advanced
|
|
Project Agency network (ARPANET), will
|
|
be disbanded.
|
|
The Morris case has some confusing
|
|
aspects in that some computer groups
|
|
have accused federal prosecutors with
|
|
reacting hysterically to the ARPANET
|
|
infection. It has been pointed out that
|
|
the so-called Morris infection was not a
|
|
virus, and that evidence indicates it
|
|
was released onto the federal network
|
|
accidentally.
|
|
CERT is looking toward ARPANET members
|
|
to supply its volunteers. Among those
|
|
users are federal agencies, the Software
|
|
Engineering Institute and a number of
|
|
federally-funded learning institutions.
|
|
Additional information is available from
|
|
CERT at 412/268- 7090.
|
|
--
|
|
|
|
|
|
|
|
COMPUTER VIRUSES HOT ISSUE IN CONGRESS
|
|
|
|
(Feb. 3)
|
|
One of the hottest high-tech issues on
|
|
Capitol Hill is stemming the plague of
|
|
computer viruses.
|
|
According to Government Computer News,
|
|
Rep. Wally Herger (R-Calif.) has pledged
|
|
to reintroduce a computer virus bill
|
|
that failed to pass before the 100th
|
|
Congress adjourned this past fall. The
|
|
measure will create penalties for people
|
|
who inject viruses into computer
|
|
systems.
|
|
"Unfortunately, federal penalties for
|
|
those who plant these deadly programs do
|
|
not currently exist," said Herger. "As a
|
|
result, experts agree that there is
|
|
little reason for a hacker to even think
|
|
twice about planting a virus." (Herger
|
|
then later corrected himself saying
|
|
those who plant viruses are not hackers
|
|
but rather criminals.)
|
|
GCN notes that the bill calls for
|
|
prison sentences of up to 10 years and
|
|
extensive fines for anyone convicted of
|
|
spreading a computer virus. It would
|
|
also allow for civil suits so people and
|
|
businesses could seek reimbursement for
|
|
system damage caused by a virus attack.
|
|
If the bill is referred to the
|
|
Judiciary Committee, as is likely, it
|
|
stands a reasonable chance of passage.
|
|
Rep. Jack Brooks, a longtime technology
|
|
supporter, is the new head of that
|
|
committee and he has already stated that
|
|
the new position will not dampen his
|
|
high-tech interests.
|
|
-- Cathryn Conroy CONGRESS LOOKS AT
|
|
ANOTHER COMPUTER PROTECTION BILL
|
|
|
|
(Feb. 27)
|
|
The Computer Protection Act (HR 287)
|
|
is the latest attempt by Congress to
|
|
battle computer viruses and other forms
|
|
of sabotage on the high-tech machines.
|
|
Introduced by Rep. Tom McMillan
|
|
(D-Md.), the bill calls for a maximum of
|
|
15 years in prison with fines of
|
|
$100,000 to $250,000 for those convicted
|
|
of tampering with a computer, be it
|
|
hardware or software.
|
|
"With the proliferation of various
|
|
techniques to tamper with computers, we
|
|
need to fill the void in federal law to
|
|
deal with these criminals," said
|
|
McMillan. "This legislation will send
|
|
the clear signal that infiltrating
|
|
computers is not just a cute trick; it's
|
|
against the law."
|
|
The bill, which has been referred to
|
|
the Judiciary Committee, is written
|
|
quite broadly and is open to
|
|
interpretation.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
VIRUS CREATOR FOUND DEAD AT 39
|
|
|
|
(March 17)
|
|
A Californian who said he and one of
|
|
his students created the first computer
|
|
virus seven years ago as an experiment
|
|
has been found dead at 39 following an
|
|
apparent aneurysm of the brain.
|
|
Jim Hauser of San Luis Obispo died
|
|
Sunday night or Monday morning, the
|
|
local Deputy Coroner, Ray Connelly, told
|
|
The Associated Press.
|
|
Hauser once said he and a student
|
|
developed the first virus in 1982,
|
|
designing it to give users a "guided
|
|
tour" of an Apple II. He said that,
|
|
while his own program was harmless, he
|
|
saw the potentially destructive
|
|
capability of what he termed an
|
|
"electronic hitchhiker" that could
|
|
attach itself to programs without being
|
|
detected and sneak into private systems.
|
|
--
|
|
|
|
|
|
|
|
HOSPITAL STRUCK BY COMPUTER VIRUS
|
|
|
|
(March 22)
|
|
Data on two Apple Macintoshes used by
|
|
a Michigan hospital was altered recently
|
|
by one or more computer viruses, at
|
|
least one of which apparently traveled
|
|
into the system on a new hard disk that
|
|
the institution bought.
|
|
In its latest edition, the prestigious
|
|
New England Journal of Medicine quotes a
|
|
letter from a radiologist at William
|
|
Beaumont Hospitals in Royal Oak, Mich.,
|
|
that describes what happened when two
|
|
viruses infected computers used to store
|
|
and read nuclear scans that are taken to
|
|
diagnose patients' diseases.
|
|
The radiologist, Dr. Jack E. Juni,
|
|
said one of the viruses was relatively
|
|
benign, making copies of itself while
|
|
leaving other data alone. However, the
|
|
second virus inserted itself into
|
|
programs and directories of patient
|
|
information and made the machines
|
|
malfunction.
|
|
"No lasting harm was done by this,"
|
|
Juni wrote, because the hospital had
|
|
backups, "but there certainly was the
|
|
potential."
|
|
Science writer Daniel Q. Haney of The
|
|
Associated Press quoted Juni's letter as
|
|
saying about three-quarters of the
|
|
programs stored in the two Mac II PCs
|
|
were infected.
|
|
Haney said Juni did not know the
|
|
origin of the less harmful virus, "but
|
|
the more venal of the two apparently was
|
|
on the hard disk of one of the computers
|
|
when the hospital bought it new. ... The
|
|
virus spread from one computer to
|
|
another when a doctor used a word
|
|
processing program on both machines
|
|
while writing a medical paper."
|
|
Juni said the hard disk in question
|
|
was manufactured by CMS Enhancements of
|
|
Tustin, Calif.
|
|
CMS spokesman Ted James confirmed for
|
|
AP that a virus was inadvertently put on
|
|
600 hard disks last October.
|
|
Says Haney, "The virus had
|
|
contaminated a program used to format
|
|
the hard disks. ... It apparently got
|
|
into the company's plant on a hard disk
|
|
that had been returned for servicing.
|
|
James said that of the 600 virus-tainted
|
|
disks, 200 were shipped to dealers, and
|
|
four were sold to customers."
|
|
James also said the virus was "as
|
|
harmless as it's possible to be," that
|
|
it merely inserted a small piece of
|
|
extra computer code on hard disks but
|
|
did not reproduce or tamper with other
|
|
material on the disk. James told AP he
|
|
did not think the Michigan hospital's
|
|
problems actually were caused by that
|
|
virus.
|
|
--
|
|
|
|
|
|
|
|
|
|
MORE HOSPITALS STRUCK BY VIRUS
|
|
|
|
(March 23)
|
|
The latest computer virus attack, this
|
|
one on hospital systems, apparently was
|
|
more far- reaching than originally
|
|
thought.
|
|
As reported here, a radiologist wrote
|
|
a letter to the New England Journal of
|
|
Medicine detailing how data on two Apple
|
|
Macintoshes used by the William Beaumont
|
|
Hospital in Royal Oak, Mich., was
|
|
altered by one or more computer viruses.
|
|
At least one of the viruses, he said,
|
|
apparently traveled into the system on a
|
|
new hard disk the institution bought.
|
|
Now Science writer Rob Stein of United
|
|
Press International says the virus --
|
|
possibly another incarnation of the
|
|
so-called "nVIR" virus -- infected
|
|
computers at three Michigan hospitals
|
|
last fall. Besides the Royal Oak
|
|
facility, computers at another William
|
|
Beaumont Hospital in Troy, Mich., were
|
|
infected as were some desktop units at
|
|
the University of Michigan Medical
|
|
Center in Ann Arbor.
|
|
Stein also quoted Paul Pomes, a virus
|
|
expert at the University of Illinois in
|
|
Champaign, as saying this was the first
|
|
case he had heard of in which a virus
|
|
had disrupted a computer used for
|
|
patient care or diagnosis in a hospital.
|
|
However, he added such disruptions could
|
|
become more common as personal computers
|
|
are used more widely in hospitals.
|
|
The virus did not harm any patients
|
|
but reportedly did delay diagnoses by
|
|
shutting down computers, creating files
|
|
of non-existent patients and garbling
|
|
names on patient records, which could
|
|
have caused more serious problems.
|
|
Dr. Jack Juni, the radiology who
|
|
reported the problem in the medical
|
|
journal, said the virus "definitely did
|
|
affect care in delaying things and it
|
|
could have affected care in terms of
|
|
losing this information completely." He
|
|
added that if patient information had
|
|
been lost, the virus could have forced
|
|
doctors to repeat tests that involve
|
|
exposing patients to radiation. Phony
|
|
and garbled files could have caused a
|
|
mix-up in patient diagnosis. "This was
|
|
information we were using to base
|
|
diagnoses on," he said. "We were lucky
|
|
and caught it in time."
|
|
Juni said the virus surfaced when a
|
|
computer used to display images used to
|
|
diagnose cancer and other diseases began
|
|
to malfunction at the 250-bed Troy
|
|
hospital last August. In October, Juni
|
|
discovered a virus in the computer in
|
|
the Troy hospital. The next day, he
|
|
found the same virus in a similar
|
|
computer in the 1,200-bed Royal Oak
|
|
facility.
|
|
As noted, the virus seems to have
|
|
gotten into the systems through a new
|
|
hard disk the hospitals bought, then
|
|
spread via floppy disks.
|
|
The provider of the disk, CMS
|
|
Enhancements Inc. of Tustin, Calif.,
|
|
said it found a virus in a number of
|
|
disks, removed the virus from the disks
|
|
that had not been sent to customers and
|
|
sent replacement programs to
|
|
distributors that had received some 200
|
|
similar disks that already had been
|
|
shipped.
|
|
However, CMS spokesman Ted James
|
|
described the virus his company found as
|
|
harmless, adding he doubted it could
|
|
have caused the problems Juni described.
|
|
"It was a simple non-harmful virus,"
|
|
James told UPI, "that had been created
|
|
by a software programmer as a
|
|
demonstration of how viruses can infect
|
|
a computer."
|
|
Juni, however, maintains the version
|
|
of the virus he discovered was a mutant,
|
|
damaging version of what originally had
|
|
been written as a harmless virus known
|
|
as "nVIR." He added he also found a
|
|
second virus that apparently was
|
|
harmless. He did not know where the
|
|
second virus originated.
|
|
--
|
|
|
|
|
|
GOVERNMENT PLANS FOR ANTI-VIRUS CENTERS
|
|
|
|
(March 24)
|
|
Federal anti-virus response centers
|
|
that will provide authentic solutions to
|
|
virus attacks as they occur will be
|
|
developed by the National Institute of
|
|
Standards and Technology, reports
|
|
Government Computer News.
|
|
The centers will rely on unclassified
|
|
material throughout the federal
|
|
government and provide common services
|
|
and communication among other response
|
|
centers.
|
|
NIST will urge agencies to establish a
|
|
network of centers, each of which will
|
|
service a different use or technological
|
|
constituency. They will offer emergency
|
|
response support to users, including
|
|
problem-solving and identification of
|
|
resources. GCN notes they will also aid
|
|
in routine information sharing and help
|
|
identify problems not considered
|
|
immediately dangerous, but which can
|
|
make users or a system vulnerable to
|
|
sabotage.
|
|
A prototype center called the Computer
|
|
Emergency Response Team is already
|
|
operational at the Defense Advanced
|
|
Research Projects Agency and will serve
|
|
as a model for the others.
|
|
Although NIST and the Department of
|
|
Energy will provide start-up funds, each
|
|
agency will have to financially support
|
|
its response center.
|
|
--Cathryn Conroy
|
|
|
|
|
|
|
|
|
|
ILLINOIS STUDIES VIRUS LAW
|
|
|
|
(April 15)
|
|
The virus panic in some state
|
|
legislatures continues as anti- virus
|
|
legislation is introduced in Illinois.
|
|
Illinois House Bill 498 has been
|
|
drafted by Rep. Ellis B. Levin
|
|
(D-Chicago) to provide criminal
|
|
penalties for loosing a so-called
|
|
computer virus upon the public. The
|
|
bill is similar to one that has been
|
|
introduced in Congress.
|
|
Rep. Levin's bill provides that a
|
|
person commits "'computer tampering by
|
|
program' when he knowingly: inserts into
|
|
a computer program information or
|
|
commands which, when the program is run,
|
|
causes or is designed to cause the loss,
|
|
damage or disruption of a computer or
|
|
its data, programs or property to
|
|
another person; or provides or offers
|
|
such a program to another person."
|
|
Conviction under the legislation would
|
|
result in a felony. A second conviction
|
|
would bring harsher penalties.
|
|
Currently, the bill is awaiting a
|
|
hearing in the Illinois' House Judiciary
|
|
II Committee. It is expected that
|
|
testimony on HB 498 will be scheduled
|
|
sometime during April.
|
|
--
|
|
|
|
|
|
ERRORS, NOT CRACKERS, MAIN THREAT
|
|
|
|
(April 28)
|
|
A panel of computer security experts
|
|
has concluded that careless users pose a
|
|
greater threat than malicious saboteurs
|
|
to corporate and government computer
|
|
networks.
|
|
Citing the well-publicized allegations
|
|
that Cornell University graduate student
|
|
Robert T. Morris Jr. created a worm
|
|
program last November that swept through
|
|
some 6,000 networked systems, Robert H.
|
|
Courtney Jr. commented, "It was a
|
|
network that no one attempted to
|
|
secure."
|
|
According to business writer Heather
|
|
Clancy of United Press International,
|
|
Courtney, president of Robert Courtney
|
|
Inc. computer security firm, said the
|
|
openness of Internet was the primary
|
|
reason it was popular among computer
|
|
crackers, some of whom are less talented
|
|
or more careless than others.
|
|
"People making mistakes are going to
|
|
remain our single biggest security
|
|
problems," he said. "Crooks can never,
|
|
ever catch up."
|
|
Sharing the panel discussion in New
|
|
York, Dennis D. Steinauer, a computer
|
|
scientist with the National Institute
|
|
for Standards and Technologies, added
|
|
that network users should not rely only
|
|
on technological solutions for security
|
|
breaks.
|
|
"Not everyone needs all security
|
|
products and mechanisms out there," he
|
|
said. "The market is not as large as it
|
|
is for networking equipment in general."
|
|
He added that a standard set of program
|
|
guidelines, applicable to all types of
|
|
networks, should be created to prevent
|
|
mishaps. "There has been a tremendous
|
|
amount of work in computer (operating)
|
|
standards. The same thing is now
|
|
happening in security."
|
|
Fellow panelist Leslie Forman, AT&T's
|
|
division manager for the data systems
|
|
group, said companies can insure against
|
|
possible security problems by training
|
|
employees how to use computers properly
|
|
and tracking users to make sure they
|
|
aren't making potentially destructive
|
|
errors. "It's not a single home run that
|
|
is going to produce security in a
|
|
network," she said. "It's a lot of
|
|
little bunts."
|
|
--
|
|
|
|
|
|
EXPERTS TESTIFY ON COMPUTER CRIME
|
|
|
|
(May 16)
|
|
Electronic "burglar alarms" are needed
|
|
to protect US military and civilian
|
|
computer systems, Clifford Stoll, an
|
|
astronomer at the Harvard- Smithsonian
|
|
Center for Astrophysics, told a Senate
|
|
Judiciary subcommittee hearing on
|
|
computer crimes, reports United Press
|
|
International.
|
|
Stoll was the alert scientist who
|
|
detected a 75-cent accounting error in
|
|
August 1986 in a computer program at
|
|
Lawrence Berkeley Laboratory that led
|
|
him to discover a nationwide computer
|
|
system had been electronically invaded
|
|
by West Germans.
|
|
"This was a thief stealing information
|
|
from our country," he said. "It deeply
|
|
bothers me that there are reprobates who
|
|
say, `I will steal anything I can and
|
|
sell it to whoever I want to.' It opened
|
|
my eyes."
|
|
Following his discovery, Stoll was so
|
|
immersed in monitoring the illegal
|
|
activity that he was unable to do any
|
|
astronomy work for a year.
|
|
"People kind of look at this as a
|
|
prank," Stoll said. "It's kind of funny
|
|
on the one hand. But it's people's work
|
|
that's getting wiped out."
|
|
The West German computer criminals,
|
|
who were later determined to have been
|
|
working for Soviet intelligence,
|
|
searched the US computer network for
|
|
information on the Strategic Defense
|
|
Initiative, the North American Defense
|
|
Command and the US KH-11 spy satellite.
|
|
They also withdrew information from
|
|
military computers in Alabama and
|
|
California, although no classified
|
|
information was on any of the computer
|
|
systems.
|
|
William Sessions, FBI director, also
|
|
appeared before the Senate subcommittee
|
|
and said the bureau is setting up a team
|
|
to concentrate on the problem.
|
|
He explained that computer crimes are
|
|
among "the most elusive to investigate"
|
|
since they are often "invisible." The
|
|
FBI has trained more than 500 agents in
|
|
this area.
|
|
UPI notes that Sessions agreed to
|
|
submit his recommendations to Sen.
|
|
Patrick Leahy (D-Vt.), the subcommittee
|
|
chairman, for new laws that could be
|
|
used to protect sensitive computer
|
|
networks from viruses. Currently, there
|
|
are no federal laws barring computer
|
|
viruses.
|
|
The FBI is working with other federal
|
|
agencies to assess the threat of such
|
|
crimes to business and national
|
|
security.
|
|
William Bayes, assistant FBI director,
|
|
told the senators he likens a computer
|
|
to a house with locks on the door. He
|
|
explained that he has placed a burglar
|
|
alarm on his computer at Berkeley,
|
|
programming it to phone him when someone
|
|
tries to enter it. He said more
|
|
computer burglar alarms may be needed.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
MASS. CONSIDERS NEW INTRUSION LAW
|
|
|
|
(May 21)
|
|
In Boston, a state senator has offered
|
|
a bill that would make it a violation of
|
|
Massachusetts law to enter a computer
|
|
without authorization. It also would
|
|
level penalties against those caught
|
|
planting so-called computer "viruses."
|
|
Sen. William Keating, the bill's
|
|
sponsor, told The Associated Press his
|
|
measure considers this new category of
|
|
crime to be analogous to breaking into a
|
|
building.
|
|
"It's an attempt," Keating added, "to
|
|
put on the statutes a law that would
|
|
penalize people for destruction or
|
|
deliberate modification or interference
|
|
with computer properties. It clarifies
|
|
the criminal nature of the wrongdoing
|
|
and, I think, in that sense serves as a
|
|
deterrent and makes clear that this kind
|
|
of behavior is criminal activity."
|
|
The senator credits a constituent,
|
|
Elissa Royal, with the idea for the
|
|
bill. Royal, whose background is in
|
|
hospital administration, told AP, "I
|
|
heard about (computer) viruses on the
|
|
news. My first thought was the clinical
|
|
pathology program. Our doctors would
|
|
look at it and make all these decisions
|
|
without looking at the hard copy. I
|
|
thought, what if some malevolent, bright
|
|
little hacker got into the system and
|
|
changed the information? How many people
|
|
would be injured or die?"
|
|
Keating's bill would increase
|
|
penalties depending on whether the
|
|
attacker merely entered a computer,
|
|
interfered with its operations or
|
|
destroyed data. In the most serious
|
|
case, a person found guilty of knowingly
|
|
releasing a virus would be subject to a
|
|
maximum of 10 years in prison or a
|
|
$25,000 fine.
|
|
AP says the bill is pending in
|
|
committee, as staff members are refining
|
|
its language to carefully define the
|
|
term "virus."
|
|
--
|
|
|
|
|
|
COMPUTER VACCINE MARKET THRIVES ON USER
|
|
FEAR
|
|
|
|
(May 23)
|
|
The computer protection market is
|
|
thriving. The reason? Fear. Fear of the
|
|
spread of computer viruses and worms has
|
|
caused a boom in products that are
|
|
designed to protect unwitting users from
|
|
the hazards of high- tech diseases.
|
|
According to the Dallas Morning News,
|
|
there is a surging cottage industry
|
|
devoted to creating "flu shots" and
|
|
"vaccines" in the form of software and
|
|
hardware; however, many of these cures
|
|
are nothing more than placebos.
|
|
"There's a protection racket springing
|
|
up," said Laura A. DiDio, senior editor
|
|
of Network World, the trade publication
|
|
that sponsored a recent executive
|
|
roundtable conference in Dallas on
|
|
"Network Terrorism."
|
|
Last year alone, American businesses
|
|
lost a whopping $555.5 million, 930
|
|
years of human endeavor and 15 years of
|
|
computer time from unauthorized access
|
|
to computers, according to statistics
|
|
released by the National Center for
|
|
computer Crime Data in Los Angeles,
|
|
Calif.
|
|
The most difficult systems to protect
|
|
against viruses are computer networks
|
|
since they distribute computing power
|
|
throughout an organization. Despite the
|
|
threat, sales are thriving. Market
|
|
Intelligence Research says sales of
|
|
personal computing networking equipment
|
|
grew 50 percent last year and are
|
|
expected to grow another 41 percent this
|
|
year to $929.5 million.
|
|
Meanwhile, the Computer Virus Industry
|
|
Association says that the number of
|
|
computer devices infected by viruses in
|
|
a given month grew last year from about
|
|
1,000 in January to nearly 20,000 in
|
|
November and remained above 15,000 in
|
|
December.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
PENDING COMPUTER LAWS CRITICIZED
|
|
|
|
(June 18)
|
|
Computer attorney Jonathan Wallace
|
|
says that the virus hysteria still
|
|
hasn't quieted down and that legislation
|
|
that will be reintroduced in Congress
|
|
this year is vague and poorly drafted.
|
|
Noting that at least one state, New
|
|
York, is also considering similar
|
|
legislation, Wallace says that
|
|
legislators may have overlooked existing
|
|
laws that apply to "software weapons."
|
|
In a newsletter sent out to clients,
|
|
Wallace notes that both the Electronic
|
|
Communications Privacy Act (ECPA) and
|
|
the Computer Fraud and Abuse Act (CFAA)
|
|
cover the vast majority of software
|
|
crimes.
|
|
Wallace points out that both the ECPA
|
|
and the CFAA already impose criminal
|
|
penalties on illegal actions. Even the
|
|
Senate Judiciary Committee has refutted
|
|
the idea that more federal laws are
|
|
needed. "Why don't we give existing laws
|
|
a chance to work, before rushing off to
|
|
create new ones," Wallace asks.
|
|
Wallace is the editor of Computer Law
|
|
Letter and is an Assistant System
|
|
Administrator on CompuServe's Legal
|
|
Forum (GO LAWSIG).
|
|
--
|
|
|
|
|
|
NEW VIRUS HITS THAI COMPUTERS
|
|
|
|
(June 27)
|
|
A newspaper in Bangkok is reporting
|
|
that a new computer virus, said to be
|
|
the most destructive yet discovered, has
|
|
struck computer systems in Thailand.
|
|
According to the Newsbytes News
|
|
Service, computer security specialist
|
|
John Dehaven has told The Bangkok Post,
|
|
"This is a very subtle virus that can
|
|
lay dormant, literally, for years."
|
|
The wire service says that two Thai
|
|
banks and several faculties at
|
|
Chulalongkorn University were hit by the
|
|
rogue program -- called the "Israeli
|
|
virus," because it was first detected
|
|
there -- at the beginning of last month.
|
|
Newsbytes says the infection spreads
|
|
quickly through any computer once it is
|
|
activated.
|
|
--
|
|
|
|
|
|
|
|
CONGRESS STUDIES COMPUTER VIRUSES
|
|
|
|
(July 21)
|
|
The Congress is taking a hard look at
|
|
a new report that says major computer
|
|
networks remain vulnerable to computer
|
|
viruses that are capable of crippling
|
|
communications and stopping the nation's
|
|
telecommunications infrastructure dead
|
|
in its tracks.
|
|
Rep. Edward Markey (D-Mass.), chairman
|
|
of the House telecommunications
|
|
subcommittee, told a hearing earlier
|
|
this week that federal legislation may
|
|
be needed to ease the threats posed by
|
|
computer viruses.
|
|
"The risk and fear of computer-based
|
|
sabotage must be reduced to an
|
|
acceptable level before we can
|
|
reasonably expect our national networks
|
|
to accomplish the purposes for which
|
|
they were created," Markey said during a
|
|
hearing Wednesday on the new
|
|
congressional study.
|
|
"We must develop policies that ensure
|
|
(network's) secure operation and the
|
|
individuals' rights to privacy as
|
|
computer network technologies and
|
|
applications proliferate," he added.
|
|
The report by the General Accounting
|
|
Office examined last year's virus attack
|
|
that shut down the massive Internet
|
|
system, which links 60,000 university,
|
|
government and industry research
|
|
computers.
|
|
The GAO found that Internet and other
|
|
similar systems remain open to attack
|
|
with much more serious results than the
|
|
temporary shutdown experienced by
|
|
Internet.
|
|
The GAO warned that the Internet
|
|
virus, a "worm" which recopied itself
|
|
until it exhausted all of the systems
|
|
available memory, was relatively mild
|
|
compared to other more destructive
|
|
viruses.
|
|
"A few changes to the virus program
|
|
could have resulted in widespread damage
|
|
and compromise," the GAO report said.
|
|
"With a slightly enhanced program, the
|
|
virus could have erased files on
|
|
infected computers or remained
|
|
undetected for weeks, surreptitiously
|
|
changing information on computer files,"
|
|
the report continued.
|
|
The GAO recommended the president's
|
|
science advisor and the Office of
|
|
Science and Technology Policy should
|
|
take the lead in developing new security
|
|
for Internet.
|
|
In addition, the report said Congress
|
|
should consider changes to the Computer
|
|
Fraud and Abuse Act of 1986, or the Wire
|
|
Fraud Act, to make it easier to bring
|
|
charges against computer saboteurs.
|
|
Joining in sounding the alarm at the
|
|
hearing was John Landry, executive vice
|
|
president of Cullinet Software of
|
|
Westwood, Mass., who spoke on behalf of
|
|
ADAPSO.
|
|
"The range of threats posed by
|
|
viruses, worms and their kin is limited
|
|
only by the destructive imagination of
|
|
their authors," Landry said. "Existing
|
|
computer security systems often provide
|
|
only minimal protection against a
|
|
determined attack."
|
|
Landry agreed the Internet attack
|
|
could have been much worse. He said
|
|
viruses have been found that can modify
|
|
data and corrupt information in
|
|
computers by means as simple as moving
|
|
decimal points one place to the left or
|
|
right.
|
|
One recently discovered virus, he
|
|
said, can increase disk access speed,
|
|
resulting in the wearing out of disk
|
|
drives. They also have been linked to
|
|
"embezzlement, fraud, industrial
|
|
espionage and, more recently,
|
|
international political espionage," he
|
|
said.
|
|
"Virus attacks can be life
|
|
threatening," Landry said, citing a
|
|
recent attack on a computer used to
|
|
control a medical experiment. "The risk
|
|
of loss of life resulting from
|
|
infections of airline traffic control or
|
|
nuclear plant monitoring systems is
|
|
easily imaginable," he said.
|
|
Landry said ADAPSO endorses the
|
|
congressional drive toward tightening
|
|
existing law to ensure that computer
|
|
viruses are covered along with other
|
|
computer abuses.
|
|
--J. Scott Orr
|
|
|
|
|
|
|
|
GLOSSARY OF VIRUS-RELATED TERMS
|
|
|
|
(July 21)
|
|
Until last year's computer virus
|
|
attack on the massive Internet network
|
|
made headlines, computer sabotage
|
|
attracted little attention outside
|
|
computer and telecommunications circles.
|
|
Today "computer virus" has become a
|
|
blanket term covering a wide range of
|
|
software threats.
|
|
ADAPSO, the computer software and
|
|
services industry association, believes
|
|
the term has been thrown around a little
|
|
too loosely. Here, then, is ADAPSO's
|
|
computer virus glossary:
|
|
-:- COMPUTER VIRUS, a computer program
|
|
that attaches itself to a legitimate,
|
|
executable program, then reproduces
|
|
itself when the program is run.
|
|
-:- TROJAN HORSE, a piece of
|
|
unauthorized code hidden within a
|
|
legitimate program that, like a virus,
|
|
may execute immediately or be linked to
|
|
a certain time or event. A trojan horse,
|
|
however, does not self-replicate.
|
|
-:- WORM, an infection that enters a
|
|
computer system, typically through a
|
|
security loophole, and searches for idle
|
|
computer memory. As in the Internet
|
|
case, the worm recopies itself to use up
|
|
available memory.
|
|
-:- TRAPDOOR, a program written to
|
|
provide future access to computer
|
|
systems. These are typical entryways for
|
|
worms.
|
|
-:- TIME BOMB, a set of computer
|
|
instructions entered into a system or
|
|
piece of software that are designed to
|
|
go off at a predetermined time. April
|
|
Fool's Day and Friday the 13th have been
|
|
popular times for time bomb's to go off.
|
|
-:- LOGIC BOMB, similar to a time
|
|
bomb, but linked instead to a certain
|
|
event, such as the execution of a
|
|
particular sequence of commands.
|
|
-:- CHAOS CLUB, a West German
|
|
organization that some have alleged was
|
|
formed to wreak havoc on computer
|
|
systems through the use of viruses and
|
|
their kin.
|
|
--J. Scott Orr
|
|
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART FIVE
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition beginning on
|
|
July 31, 1989, the first time word was
|
|
received of the so-called "Datacrime" or
|
|
"Columbus Day virus.")
|
|
|
|
|
|
RESEARCHER UNCOVERS OCT. 12 VIRUS
|
|
|
|
(July 31)
|
|
An official with a British firm that
|
|
markets anti-virus software says the
|
|
company has uncovered a new virus called
|
|
"Datacrime" is set to attack MS-DOS
|
|
systems starting Oct. 12.
|
|
Dr. Jan Hruska of Sophos UK tells
|
|
Computergram International the virus
|
|
apparently appends itself to .COM
|
|
(command) files on MS-DOS systems.
|
|
"Operating on a trigger mechanism," CI
|
|
says, "the virus reformats track 0 of
|
|
the hard disk on or after Oct. 12. It
|
|
has no year check and so will remain
|
|
active from Oct. 12 onwards destroying
|
|
or losing programs and data."
|
|
Hruska told the publication this is a
|
|
relatively new virus and that its
|
|
encrypted form reveals its name
|
|
("Datacrime") and its date of release,
|
|
last March 1.
|
|
Sophos markets a program called
|
|
Vaccine version 4 designed to detect
|
|
known viruses.
|
|
--
|
|
|
|
|
|
|
|
NIST FORMS COMPUTER SECURITY NETWORK
|
|
|
|
(Aug. 3)
|
|
The National Institute of Standards
|
|
and Technology is working with other
|
|
federal agencies to establish a
|
|
government-wide information network on
|
|
security incidents and issues, reports
|
|
Government Computer News.
|
|
Organized by NIST's Computer Security
|
|
Division, the network would supply the
|
|
latest information to agencies on
|
|
security threats, develop a program to
|
|
report and assess security incidents as
|
|
well as offer assistance.
|
|
Dennis Steinauer, evaluation group
|
|
manager of the Computer Security
|
|
Division, said the plan is a response to
|
|
the communications problems federal
|
|
agencies suffered during last November's
|
|
worm attack on Internet by Cornell
|
|
University graduate student Robert T.
|
|
Morris Jr.
|
|
In addition to NIST, the departments
|
|
of Energy, Justice and Transportation as
|
|
well as the National Science Foundation
|
|
and NASA are participating in the
|
|
project, which calls for each agency to
|
|
organize a security incident response
|
|
and resource center.
|
|
NIST's network would connect the
|
|
centers electronically, allowing them to
|
|
communicate with one another. Steinauer
|
|
said he wants to set up a master
|
|
database of contacts, phone numbers and
|
|
fax numbers to ensure communications.
|
|
One aspect of the plan calls for each
|
|
center to become expert in some specific
|
|
area of the technology, such as personal
|
|
computers, local area networks or
|
|
multiuser hosts.
|
|
"The answer is not some monolithic,
|
|
centralized command center for
|
|
government," Steinauer told GCN.
|
|
"Problems occur in specific user or
|
|
technology communities, and we see the
|
|
solutions evolving where the reaction is
|
|
by people who know the user community
|
|
and the environment."
|
|
He explained that the Computer
|
|
Security Act has helped increase
|
|
security awareness within the
|
|
government, but the emergence of
|
|
computer viruses, worms and other
|
|
sophisticated threats has demonstrated
|
|
the need for more advanced security
|
|
tools.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
AUSTRALIAN CHARGED WITH CRACKING
|
|
|
|
(Aug. 14)
|
|
Australia is reporting its first
|
|
computer cracking arrest. A Melbourne
|
|
student is charged with computer
|
|
trespass and attempted criminal damage.
|
|
Authorities allege 32-year-old Deon
|
|
Barylak was seen loading a personal
|
|
computer with a disk that was later
|
|
found to possess a computer virus.
|
|
"Fortunately, it was stopped before it
|
|
could spread, which is why the charge
|
|
was only attempted criminal damage,"
|
|
senior detective Maurice Lynn told Gavin
|
|
Atkins for a report in Newsbytes News
|
|
Service.
|
|
The wire service said Barylak could
|
|
face a maximum of 100 years' jail and a
|
|
fine.
|
|
Also police expect to make further
|
|
arrests in connection with the case.
|
|
Authorities said Barylak also faces
|
|
charges of possessing computer equipment
|
|
allegedly stolen from a community
|
|
center.
|
|
--
|
|
|
|
|
|
INTERNET VIRUS BACK?
|
|
|
|
(Sept. 4)
|
|
Apparently, neither the threat of
|
|
criminal sanctions nor the hazards of
|
|
investigation by the FBI is enough to
|
|
keep the Internet computer
|
|
communications network secure from
|
|
intrusion. The Department of Defense
|
|
agency responsible for monitoring
|
|
Internet security has issued a warning
|
|
that unauthorized system activity
|
|
recently has been detected at a number
|
|
of sites.
|
|
The Computer Emergency Response Team
|
|
(CERT) says that the activity has been
|
|
evident for some months and that
|
|
security on some networked computers may
|
|
have been compromised. In a warning
|
|
broadcast to the Internet, CERT says
|
|
that the problem is spreading.
|
|
Internet first came to general
|
|
attention when a came to much of the
|
|
computing communities attention when a
|
|
23-year-old Cornell University student
|
|
was said to be responsible for inserting
|
|
a software "worm" into the network. The
|
|
Department of Defense's Advanced Project
|
|
Agency network (ARPANET) also was
|
|
infected and CERT was formed to
|
|
safeguard networks used or accessed by
|
|
DoD emplyees and contractors.
|
|
In its warning about recent
|
|
intrusions, CERT says that several
|
|
computers have had their network
|
|
communications programs replaced with
|
|
hacked versions that surreptitiously
|
|
capture passwords used on remote
|
|
systems.
|
|
"It appears that access has been
|
|
gained to many of the machines which
|
|
have appeared in some of these session
|
|
logs," says a broadcast CERT warning.
|
|
"As a first step, frequent telnet
|
|
[communications program] users should
|
|
change their passwords immediately.
|
|
While there is no cause for panic, there
|
|
are a number of things that system
|
|
administrators can do to detect whether
|
|
the security on their machines has been
|
|
compromised using this approach and to
|
|
tighten security on their systems where
|
|
necessary."
|
|
CERT went on to suggest a number of
|
|
steps that could be taken to verify the
|
|
authenticity of existing programs on any
|
|
individual UNIX computer. Among those
|
|
was a suggestion to reload programs from
|
|
original installation media.
|
|
--
|
|
|
|
|
|
AIR FORCE WARNS ITS BASES OF POSSIBLE
|
|
"COLUMBUS DAY VIRUS"
|
|
|
|
(Sept. 10)
|
|
The US Air Force has warned its bases
|
|
across the country about a possible
|
|
computer virus reportedly set to strike
|
|
MS-DOS systems Oct. 12.
|
|
Warning of the so-called "Columbus Day
|
|
virus" was issued by the Air Force
|
|
Communications Command at Scott Air
|
|
Force Base, Ill., at the request of the
|
|
Office of Special Investigations.
|
|
OSI spokesman Sgt. Mike Grinnell in
|
|
Washington, D.C., told David Tortorano
|
|
of United Press International the
|
|
advisory was issued so computer
|
|
operators could guard against the
|
|
alleged virus. "We're warning the
|
|
military about this," Grinnell said,
|
|
"but anybody that uses MS-DOS systems
|
|
can be affected."
|
|
As reported here July 31, Dr. Jan
|
|
Hruska, an official with a British firm
|
|
called Sophos UK, which markets
|
|
anti-virus software, said his company
|
|
had uncovered a new virus called
|
|
"Datacrime." Hruska told Computergram
|
|
International at the time that the virus
|
|
apparently appends itself to .COM
|
|
(command) files on MS-DOS systems.
|
|
Said CI, "Operating on a trigger
|
|
mechanism, the virus reformats track 0
|
|
of the hard disk on or after Oct. 12. It
|
|
has no year check and so will remain
|
|
active from Oct. 12 onwards destroying
|
|
or losing programs and data." Hruska
|
|
told the publication this was a
|
|
relatively new virus and that its
|
|
encrypted form revealed its name
|
|
("Datacrime") and its date of release,
|
|
last March 1.
|
|
Meanwhile, Air Force spokeswoman Lynn
|
|
Helmintoller at Hurlburt Field near Fort
|
|
Walton Beach, Fla., told UPI that
|
|
computer operators there had been
|
|
directed to begin making backup copies
|
|
of files on floppy disks just in case.
|
|
She said the warning was received at the
|
|
base Aug. 28.
|
|
Staff Sgt. Carl Shogren, in charge of
|
|
the small computer technology center at
|
|
Hurlburt, told Tortorano no classified
|
|
data would be affected by the possible
|
|
virus attack because the disks used for
|
|
classified work are different from those
|
|
that might be struck.
|
|
UPI quoted officials at Scott Air
|
|
Force Base as saying the warning was
|
|
sent to every base with a communications
|
|
command unit, but that they did not know
|
|
how many bases were involved.
|
|
--
|
|
|
|
|
|
COMPUTER VIRUSES PLAGUE CONGRESS
|
|
|
|
(Sept. 11)
|
|
Although Congress recently passed the
|
|
Computer Security Act to force federal
|
|
agencies to guard against high-tech
|
|
break- ins and computer viruses, the
|
|
legislators may soon realize they made a
|
|
costly mistake. The law applies to all
|
|
federal agencies -- except Congress
|
|
itself. And according to Government
|
|
Computer News, Capitol Hill has been the
|
|
victim of several recent virus attacks.
|
|
One virus, for instance, emerged about
|
|
a year ago in the Apple Macintosh
|
|
computers of several House offices
|
|
causing unexplained system crashes. A
|
|
steep bill of some $100,000 was incurred
|
|
before experts were confident the
|
|
plague, now known as Scores, was
|
|
stopped. However, it does still lurk in
|
|
the depths of the computers, notes GCN,
|
|
causing occasional malfunctions.
|
|
Dave Gaydos, Congress' computer
|
|
security manager, says the sources of
|
|
many viruses may never be known, since
|
|
some 10,000 programmers are capable of
|
|
producing them.
|
|
Capitol Hill legislators and staff
|
|
members are only now becoming aware of
|
|
the potential danger of viruses as more
|
|
offices are exploring ways to connect
|
|
with online database services and with
|
|
each other through local area networks.
|
|
GCN reports that last February, a
|
|
California congressional office was the
|
|
victim of a virus, caught while using a
|
|
so-called vaccine program meant to
|
|
detect intruders into the system.
|
|
"I used to laugh about viruses," said
|
|
Dewayne Basnett, a systems specialist on
|
|
Capitol Hill. "But now when you ask me
|
|
about them, I get very angry. I think
|
|
of all the time and effort expended to
|
|
repair the damage they do."
|
|
According to GCN, many of the 3,000
|
|
House employees with computers are
|
|
ignorant of the risks and unable to take
|
|
basic precautions. Although various
|
|
computer specialists are trying to
|
|
inform Hill users of computer security
|
|
issues and offer training sessions,
|
|
there is no broad support from the
|
|
legislators themselves for such actions.
|
|
"We are working to alert people to the
|
|
dangers," said Gaydos, "but it may take
|
|
an incident like a destructive virus to
|
|
move [Congress] to take precautions."
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
VIRUS HITS AUSTRALIA
|
|
|
|
(Sept. 12)
|
|
Australian authorities are said to be
|
|
confused about the origin of a supposed
|
|
computer virus that has been making the
|
|
rounds of computer installations in the
|
|
South Pacific. An Australian newspaper,
|
|
The Dominion, says that sensitive data
|
|
in Defense Department computers has been
|
|
destroyed by the virus.
|
|
Dubbed the Marijuana virus because of
|
|
the pro-drug message that is displayed
|
|
before any data is erased, it is thought
|
|
that the misbehaving bug originated in
|
|
New Zealand. Some have even suggested
|
|
that the program was purposely
|
|
introduced into Australian Defense
|
|
computers by agents of New Zealand, a
|
|
contention that a Defense Department
|
|
spokesman branded as "irresponsible."
|
|
The two South Pacific nations have had
|
|
strong disagreements about defense
|
|
matters, including recent joint
|
|
maneuvers in the area by Australian and
|
|
US forces.
|
|
A more likely explanation for the
|
|
intrusion into Defense computers is the
|
|
likelihood that Australian security
|
|
specialists were examining the virus
|
|
when they inadvertently released it into
|
|
their own security system. The Marijuana
|
|
virus is known to have been infecting
|
|
computers in the country for at least
|
|
three months and its only known
|
|
appearance in government computers
|
|
occurred in a Defense sub-department
|
|
responsible for the investigation and
|
|
prevention of computer viruses.
|
|
--
|
|
|
|
|
|
|
|
VIRUS THREAT ABSURDLY OVERBLOWN, SAY
|
|
EXPERTS
|
|
|
|
(Sept. 18)
|
|
The so-called "Columbus Day Virus"
|
|
purportedly set to destructively attack
|
|
MS-DOS computers on Oct. 13 has computer
|
|
users -- including the US military --
|
|
scampering to protect their machines.
|
|
But according to The Washington Post,
|
|
the threat is absurdly overblown with
|
|
less than 10 verified sightings of the
|
|
virus in a country with tens of millions
|
|
of computers.
|
|
"At this point, the panic seems to
|
|
have been more destructive than any
|
|
virus itself," said Kenneth R. Van Wyk,
|
|
a security specialist at Carnegie-Mellon
|
|
University's Software Engineering
|
|
Institute, who has been taking some 20
|
|
phone calls daily from callers seeking
|
|
advice on the subject.
|
|
Bill Vance, director of secure systems
|
|
for IBM Corp., told The Post, "If it was
|
|
out there in any number, it would be
|
|
spreading and be more noticeable."
|
|
He predicted Oct. 13 is not likely to
|
|
be "a major event."
|
|
As reported in Online Today, this
|
|
latest virus goes by several names,
|
|
including Datacrime, Friday the 13th and
|
|
Columbus Day. It lies dormant and
|
|
unnoticed in the computer until Oct. 13
|
|
and then activates when the user turns
|
|
on the machine. Appending itself to .COM
|
|
(command) files, the virus will
|
|
apparently reformats track 0 of the hard
|
|
disk.
|
|
The Post notes that the federal
|
|
government views viruses as a grave
|
|
threat to the nation's information
|
|
systems and has set in motion special
|
|
programs to guard computers against them
|
|
and to punish those who introduce them.
|
|
Centel Federal Systems in Reston, Va.,
|
|
a subsidiary of Centel Corp. of Chicago,
|
|
is taking the threat seriously,
|
|
operating a toll-free hotline staff by
|
|
six full-time staff members. More than
|
|
1,000 calls have already been received.
|
|
Tom Patterson, senior analyst for
|
|
Centel's security operations, began
|
|
working on the virus five weeks ago
|
|
after receiving a tip from an
|
|
acquaintance in Europe. He said he has
|
|
dissected a version of it and found it
|
|
can penetrate a number of software
|
|
products designed to keep viruses out.
|
|
Patterson told The Post that he found
|
|
the virus on one of the machines of a
|
|
Centel client. "The virus is out there.
|
|
It's real," he said.
|
|
Of course, where there's trouble,
|
|
there's also a way to make money. "The
|
|
more panicked people get," said Jude
|
|
Franklin, general manager of Planning
|
|
Research Corp.'s technology division,
|
|
"the more people who have solutions are
|
|
going to make money."
|
|
For $25 Centel is selling software
|
|
that searches for the virus. Patterson
|
|
said, however, the company is losing
|
|
money on the product and that the fee
|
|
only covers the cost of the disk,
|
|
shipping and handling. "I'm not trying
|
|
to hype this," he said. "I'm working
|
|
20-hour days to get the word out."
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
SICK SOFTWARE INFECTS 100 HOSPITALS
|
|
NATIONWIDE
|
|
|
|
(Sept. 20)
|
|
When a hospital bookkeeping computer
|
|
program could not figure out yesterday's
|
|
date, some 100 hospitals around the
|
|
country were forced to abandon their
|
|
computers and turn to pen and paper for
|
|
major bookkeeping and patient admissions
|
|
functions, reports The Washington Post.
|
|
Although there was no permanent loss
|
|
of data or threat to treatment of
|
|
patients, the hospital accounting
|
|
departments found themselves at the
|
|
mercy of a software bug that caused
|
|
major disruptions in the usual methods
|
|
of doing business.
|
|
The incident affected hospitals using
|
|
a program provided by Shared Medical
|
|
Systems Corp. of Pennsylvania. The firm
|
|
stores and processes information for
|
|
hospitals on its own mainframe computers
|
|
and provides software that is used on
|
|
IBM Corp. equipment.
|
|
According to The Post, the program
|
|
allows hospitals to automate the
|
|
ordering and reporting of laboratory
|
|
tests, but a glitch in the software
|
|
would not recognize the date Sept. 19,
|
|
1989 and "went into a loop" refusing to
|
|
function properly, explained A. Scott
|
|
Holmes, spokesman for Shared Medical
|
|
Systems.
|
|
The firm dubbed the bug a "birth
|
|
defect" as opposed to a "virus," since
|
|
it was an accidental fault put into the
|
|
program in its early days that later
|
|
threatened the system's health.
|
|
At the affected hospitals around the
|
|
country, patients were admitted with pen
|
|
and paper applications. Hospital
|
|
administrators admitted the process was
|
|
slower and caused some delay in
|
|
admissions, but patient care was never
|
|
compromised.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
ARMY TO BEGIN VIRUS RESEARCH
|
|
|
|
(Sept. 21)
|
|
Viruses seem to be on the mind of
|
|
virtually every department administrator
|
|
in the federal government, and the US
|
|
Army is no exception. The Department of
|
|
the Army says it will begin funding for
|
|
basic research to safeguard against the
|
|
presence of computer viruses in
|
|
computerized weapons systems.
|
|
The Army says it will fund three
|
|
primary areas of research: computer
|
|
security, virus detection and the
|
|
development of anti-viral products.
|
|
Research awards will be made to US
|
|
businesses who are eligible to
|
|
participate in the Small Business
|
|
Innovation Research (SBIR) program.
|
|
The Army program, scheduled to begin
|
|
in fiscal year 1990, is at least
|
|
partially the result of Congressional
|
|
pressure. For some months,
|
|
Congressional staffers have been
|
|
soliciting comments about viruses and
|
|
their potential effect on the readiness
|
|
of the US defense computers.
|
|
Small businesses who would like to bid
|
|
on the viral research project may obtain
|
|
a copy of Program Solicitation 90.1 from
|
|
the Defense Technical Information Center
|
|
at 800/368-5211.
|
|
--
|
|
|
|
|
|
|
|
SO-CALLED "DATACRIME" VIRUS REPORTED ON
|
|
DANISH POSTGIRO NET
|
|
|
|
(Sept. 22)
|
|
The so-called "Datacrime" virus, said
|
|
to be aimed at MS-DOS system next month,
|
|
reportedly has turned up on the Danish
|
|
Postgiro network, a system of 260
|
|
personal computers described as the
|
|
largest such network in Scandinavia.
|
|
Computergram International, the
|
|
British newsletter that first reported
|
|
the existence of the Datacrime virus
|
|
back in July, says, ""Twenty specialists
|
|
are now having to check 200,000 floppy
|
|
disks to make sure that they are free
|
|
from the virus."
|
|
Datacrime is said to attach itself to
|
|
the MS-DOS .COM files and reformats
|
|
track zero of the hard disk, effectively
|
|
erasing it. However, as reported, some
|
|
experts are saying the threat of the
|
|
virus is absurdly overblown, that there
|
|
have been fewer than 10 verified
|
|
sightings of the virus in a country with
|
|
tens of millions of computers.
|
|
--
|
|
|
|
|
|
|
|
In a rare move, IBM says it is
|
|
releasing a program to check for
|
|
personal computer viruses in response,
|
|
in part, to customer worries about a
|
|
possible attack next week from the
|
|
so-called "Datacrime" virus.
|
|
"Up until the recent press hype, our
|
|
customers had not expressed any
|
|
tremendous interest (in viruses) over
|
|
and above what we already do in terms of
|
|
security products and awareness," Art
|
|
Gilbert, IBM's manager of secure systems
|
|
industry support, told business writer
|
|
Peter Coy of The Associated Press.
|
|
However, reports of a "Datacrime"
|
|
virus, rumored to be set to strike
|
|
MS-DOS systems, have caused what Coy
|
|
describes as "widespread alarm," even as
|
|
many experts say the virus is rare and a
|
|
relatively small number of PCs are
|
|
likely to be harmed.
|
|
IBM says it is releasing its Virus
|
|
Scanning Program for MS-DOS systems that
|
|
can spot three strains of the Datacrime
|
|
virus as well as more common viruses
|
|
that go by names such as the Jerusalem,
|
|
Lehigh, Bouncing Ball, Cascade and
|
|
Brain.
|
|
The $35 program is available directly
|
|
from IBM or from dealers, marketing
|
|
representatives and remarketers and,
|
|
according to Gilbert, will detect but
|
|
not eradicate viruses. Gilbert added
|
|
that installing a virus checker is not a
|
|
substitute for safe-computing practices
|
|
such as making backup copies of programs
|
|
and data and being cautious about
|
|
software of unknown origin.
|
|
Meanwhile, virus experts speaking with
|
|
Coy generally praised IBM's actions.
|
|
"It's about time one of the big boys
|
|
realized what a problem this is and did
|
|
something about it," said Ross
|
|
Greenberg, a New York consultant and
|
|
author of Flu-Shot Plus. "To date, all
|
|
the anti-virus activity is being done by
|
|
the mom and pops out there."
|
|
In addition, Pamela Kane, president of
|
|
Panda Systems in Wilmington, Del., and
|
|
author of a new book, "Virus
|
|
Protection," called the move "a very
|
|
important and responsible step."
|
|
As noted, experts are differing widely
|
|
over whether there is truly a threat
|
|
from the Datacrime virus. The alleged
|
|
virus -- also dubbed The Columbus Day
|
|
virus, because it reportedly is timed to
|
|
begin working on and after Oct. 12 --
|
|
supposedly cripples MS-DOS- based hard
|
|
disks by wiping out the directory's
|
|
partition table and file allocation
|
|
table.
|
|
Besides the IBM virus scanning
|
|
software, a number of public domain and
|
|
shareware efforts have been contributed
|
|
online, collected on CompuServe by the
|
|
IBM Systems/Utilities Forum (GO IBMSYS).
|
|
For more details, visit the forum, see
|
|
Library 0 and BROwse files with the
|
|
keyword of VIRUS (as in BRO/KEY:VIRUS).
|
|
--
|
|
|
|
|
|
|
|
DUTCH COMPUTERISTS FEAR 'DATACRIME'
|
|
VIRUS
|
|
|
|
(Oct. 7)
|
|
The "Datacrime"/Columbus Day virus,
|
|
which is being widely down-played in the
|
|
US, may be much more common in the
|
|
Netherlands. A Dutch newspaper reported
|
|
this week the virus had spread to 10
|
|
percent of the personal computers there.
|
|
"Those figures are possibly inflated,"
|
|
police spokesman Rob Brons of the Hague
|
|
told The Associated Press. Nonetheless,
|
|
police are doing brisk business with an
|
|
antidote to fight the alleged virus.
|
|
Brons said his department has sold
|
|
"hundreds" of $2.35 floppy disks with a
|
|
program that purportedly detects and
|
|
destroys the virus.
|
|
As reported, Datacrime has been
|
|
described as a virus set to destroy data
|
|
in MS-DOS systems on or after Oct. 12.
|
|
AP notes that in the US there have been
|
|
fewer than a dozen confirmed sightings
|
|
of the dormant virus by experts who
|
|
disassembled it.
|
|
The wire service also quotes Joe
|
|
Hirst, a British expert on viruses, as
|
|
saying some now believe the virus was
|
|
created by an unidentified Austrian
|
|
computerist. He added that as far as he
|
|
knew the Netherlands was the only
|
|
European country in which the virus had
|
|
been spotted.
|
|
--
|
|
|
|
|
|
|
|
|
|
BY JOVE, THAT'S IT! DATACRIME VIRUS IS
|
|
THE VIKINGS' REVENGE
|
|
|
|
(Oct. 10)
|
|
Computergram International has a
|
|
tongue-in-cheek theory on the origin of
|
|
that nasty Datacrime virus which is said
|
|
to be poised to strike MS-DOS computers
|
|
this week.
|
|
"The latest," the British computer
|
|
journal reports in today's edition, "is
|
|
that it may have been planted by a
|
|
Norwegian: the theory is that as it is
|
|
set to destroy data on Columbus Day a
|
|
diehard Norwegian, convinced that the
|
|
Vikings discovered the American
|
|
continent first, is taking revenge."
|
|
Nonetheless, the newsletter adds,
|
|
"Computergram prefers the idea that it
|
|
is all the work of the Sioux."
|
|
--
|
|
|
|
|
|
|
|
AT&T AND IBM WARN STAFF ABOUT DATACRIME
|
|
VIRUS
|
|
|
|
(Oct. 11)
|
|
Although industry experts say the
|
|
so-called Datacrime virus set to invade
|
|
MS-DOS systems on Friday, Oct. 13 is not
|
|
that great a threat, major corporations
|
|
are taking it quite seriously.
|
|
According to Reuter, several companies
|
|
are advising their employees to protect
|
|
their computer systems.
|
|
AT&T Co. and IBM Corp. have issued
|
|
internal memos warning staff members
|
|
about the virus.
|
|
"We are taking the virus threat
|
|
seriously," said an AT&T Bell
|
|
Laboratories spokesman.
|
|
AT&T has specifically asked employees
|
|
not use software from unknown sources
|
|
and to back up data, while IBM has
|
|
instructed staff members to use the
|
|
company's anti-viral software introduced
|
|
last week and to make copies of their
|
|
data.
|
|
"It's very, very rare but very
|
|
destructive," said Russell Brand, chief
|
|
technical advisor at Lawrence Livermore
|
|
Laboratories in Livermore, Calif.
|
|
Brand has examined the virus in an
|
|
infected computer and says that unlike
|
|
most viruses that allow the data to be
|
|
put back together, Datacrime has the
|
|
ability to wipe out a complete hard
|
|
disk.
|
|
Brand told Reuter that there are about
|
|
77 different viruses in circulation now.
|
|
"People are worried about viruses,
|
|
especially those that rely on their
|
|
PCs," said Michael Riemer, executive
|
|
vice president of Foundationware Inc., a
|
|
consulting firm in Cleveland. "But what
|
|
viruses have done is forced people to
|
|
look at security and system management
|
|
in place."
|
|
Mike Odawa, president of the Software
|
|
Development Council, told Reuter that he
|
|
does not anticipate any big problems
|
|
caused by Datacrime. "I think Friday
|
|
the 13th will come and everyone will be
|
|
disappointed by it," he said.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
GOVERNMENT EMPLOYEES WARNED ABOUT
|
|
DATACRIME VIRUS
|
|
|
|
(Oct. 11)
|
|
The National Institute of Standards
|
|
and Technology is warning federal
|
|
agencies to be on guard against the
|
|
Datacrime virus, supposedly set to
|
|
attack MS-DOS computers this week.
|
|
According to Government Computer News,
|
|
NIST has issued the first governmentwide
|
|
guide on computer viruses in an attempt
|
|
to make security an integral part of any
|
|
computer course and to include computer
|
|
viruses in agencies' risk analyses and
|
|
contingency plans.
|
|
"With the widespread use of personal
|
|
computers that lack effective security
|
|
mechanisms, it is relatively easy for
|
|
knowledgeable users to author malicious
|
|
software and then dupe unsuspecting
|
|
users into copying it," says the guide,
|
|
which is titled Computer Viruses and
|
|
Related Threats: A Management Guide.
|
|
Ronald Shoupe, automation group leader
|
|
for NASA's Goddard Space Flight Center,
|
|
told GCN he found a virus contamination
|
|
that strongly resembles Datacrime. The
|
|
virus was on a machine Shoupe keeps
|
|
separated from others for virus
|
|
detection. He said the nature of the
|
|
virus is a mystery to him, since it
|
|
activates by itself.
|
|
"I've never seen anything that
|
|
triggered by itself. I don't know of a
|
|
way for a file to self-activate unless
|
|
it perhaps does something to the boot
|
|
track," he explained.
|
|
Shoupe said this was the only
|
|
occurrence of the Datacrime virus in
|
|
government computers of which he is
|
|
aware. "We're watching but treating it
|
|
as a rumor rather than a fact. We've
|
|
alerted the computer security officers.
|
|
We're trying not to broadcast this too
|
|
much," he admitted.
|
|
Richard Carr, computer security
|
|
program manager for NASA, said alerting
|
|
users to the danger only serves to
|
|
spread more rumors and give would-be
|
|
vandals ideas they might not otherwise
|
|
have.
|
|
"If we publicize some of the unfounded
|
|
rumors, some of the crazies out there
|
|
might try to make this a self-fulfilling
|
|
prophecy. We can't let these people
|
|
know what protective measures we have.
|
|
It's a tough call to make," said Carr.
|
|
He admitted that the ramifications of
|
|
a computer virus attack at NASA would be
|
|
enormous. One concern is the upcoming
|
|
launch of the next space shuttle early
|
|
next week.
|
|
NIST officials are urging government
|
|
employees to back up their hard disks
|
|
and consider using virus detection
|
|
utilities.
|
|
-- Cathryn Conroy
|
|
|
|
|
|
|
|
ANTI-VIRUS PUBLISHER GIVES TIPS FOR
|
|
VIRUS DETECTION AND REMOVAL
|
|
|
|
(Oct. 11)
|
|
You say you've done nothing special to
|
|
protect your computer and now the news
|
|
media keeps saying the viruses are
|
|
coming (...The Viruses Are Coming!) So,
|
|
what now?
|
|
Don't panic, says Cleveland- based
|
|
FoundationWare Inc., developer of the
|
|
Certus anti-virus security system.
|
|
You're probably going to come through it
|
|
just fine.
|
|
Saying the computing community needs
|
|
to meet the "current virus hysteria from
|
|
a calm, logical and pragmatic business
|
|
perspective," FoundationWare released an
|
|
extensive statement today that provides
|
|
specific tips for detecting and removing
|
|
the so- called Datacrime and Friday the
|
|
13th viruses, alleged to be set to
|
|
activate in MS-DOS computers starting
|
|
tomorrow.
|
|
But also FoundationWare urged
|
|
computerists not to over-react to the
|
|
current virus fears.
|
|
"The truth is that viruses are not as
|
|
common as widely believed," the
|
|
statement said. "If you have not already
|
|
taken action to protect yourself ... do
|
|
not worry about them now. Prepare
|
|
yourself and your employees should one
|
|
of your machines go down by having (data
|
|
only) backups available."
|
|
The software publisher also criticized
|
|
one-time, "quick fix" search programs
|
|
that look for blocks of code known to be
|
|
part of a specific virus, saying such
|
|
programs have inherently limited
|
|
capabilities.
|
|
"It's like buying a home security
|
|
system that protects against blond-hair
|
|
blue-eyed people," said FoundationWare
|
|
Vice President Michael Riemer, who is
|
|
also chairman of the Software Publishers
|
|
Association's security special interest
|
|
group. "You won't be protected if a
|
|
bald, brown-eyed person breaks into your
|
|
house."
|
|
Riemer suggested the computing public
|
|
needs to begin addressing viruses by
|
|
taking "a more global perspective,"
|
|
adding that such an approach would
|
|
include:
|
|
|
|
1. Regular data back-up.
|
|
2. Not backing-up data and programs on
|
|
the same diskettes.
|
|
3. Educating users on the threat of
|
|
malicious software.
|
|
4. Determining and implementing
|
|
appropriate integrity checking, security
|
|
and management mechanisms.
|
|
|
|
Regarding the Datacrime and Friday
|
|
the 13th viruses, the FoundationWare
|
|
report suggested that users look for
|
|
unexplained increases in file size, "a
|
|
telltale sign of most virus infections."
|
|
The company also noted the users could
|
|
determine if a disk has been infected by
|
|
using the MS-DOS DEBUG utility to scan
|
|
executable files in the following
|
|
manner:
|
|
|
|
A. For the Datacrime virus (also
|
|
called "Columbus Day" virus), use DEBUG
|
|
to scan .COM files for the Hexadecimal
|
|
codes EB00B4OECD21B4, AND/OR,
|
|
00568DB43005CD21. If the codes are
|
|
present, the system is infected, the
|
|
company said.
|
|
B. For the Friday the 13th Virus (also
|
|
called the Israeli virus), use DEBUG to
|
|
scan .EXE and .COM files for the
|
|
Hexadecimal codes 2EFF0E1F00,
|
|
E992000000, AND/OR 7355524956.
|
|
|
|
The company also made a number of
|
|
suggestions for removing viruses,
|
|
(though it acknowledged the methods
|
|
aren't foolproof nor recommended as "a
|
|
complete solution" for fighting these or
|
|
future viruses). The suggestions are:
|
|
-:- Never attempt to remove or isolate
|
|
a virus from a currently active
|
|
computer. Instead, boot from a clean
|
|
original and write-protected DOS floppy
|
|
disk.
|
|
-:- On a local area network, first
|
|
check network operating system files on
|
|
local drives before logging onto the
|
|
network. Isolate LAN/PCs, so that there
|
|
are no active users beside you.
|
|
-:- If you think you have the Friday
|
|
the 13th or Datacrime virus (which are
|
|
keyed to specific days), give yourself
|
|
some extra time before they activate by
|
|
simply changing your system time/date to
|
|
an earlier date, such as January 15,
|
|
1989.
|
|
-:- To create a clean system, boot
|
|
your computer from an original,
|
|
write-protected DOS floppy disk and run
|
|
your backup program (from your original
|
|
write-protected floppy source) and
|
|
back-up only your data (not your
|
|
programs). Perform a low-level and DOS
|
|
FORMAT using programs from the original
|
|
write- protected distribution disks (not
|
|
from your hard disk), then reinstall the
|
|
software from original write-protected
|
|
disks and restore the "data-only"
|
|
backup.
|
|
-:- If you isolate a virus which is
|
|
present in your system's boot track or
|
|
partition table (this will not be either
|
|
the Datacrime or Jerusalem virus), you
|
|
have other options. You should boot from
|
|
a write-protected original DOS floppy
|
|
disk and run a disk utility program that
|
|
can replace the partition table. (Note:
|
|
be sure the operator is very familiar
|
|
with such a program before using it).
|
|
-:- If you believe that a virus is in
|
|
the boot track (IO.SYS, MSDOS.SYS) or
|
|
the operating system (COMMAND.COM), you
|
|
can take still other measures. Boot from
|
|
a write-protected original DOS floppy
|
|
disk and run the "SYS C:" command from
|
|
the clean floppy disk which then
|
|
replaces IO.SYS and MSDOS.SYS files. You
|
|
should then type "DEL COMMAND.COM" and
|
|
replace it with a clean copy of
|
|
COMMAND.COM from the A: drive.
|
|
Finally, speaking of viruses in
|
|
general, the FoundationWare statement
|
|
notes that if you suspect your system is
|
|
infected, you should delete all
|
|
suspected files (that is, all .EXE and
|
|
.COM program files) and those found to
|
|
contain a virus and then replace the
|
|
questionable software with "trusted
|
|
copies" from the original
|
|
write-protected distribution disks.
|
|
Also, the report notes, "It has been
|
|
suggested that using standard DOS DEL,
|
|
ERASE or COPY may in some instances not
|
|
be enough to remove the infected program
|
|
(though for these two viruses DELETE and
|
|
ERASE are adequate). It is recommended
|
|
that you use a program which actually
|
|
writes over (the) program area to
|
|
completely eradicate infected files."
|
|
--
|
|
|
|
|
|
|
|
VIRUSES STRIKE IN EUROPE
|
|
|
|
(Oct. 13)
|
|
As many predicted all along, the
|
|
computer viruses that struck today on
|
|
this Friday the 13th didn't mean the end
|
|
of computing as we know it. Still, the
|
|
day also was not completely free of
|
|
system vandalism caused by the rogue
|
|
programs.
|
|
While confirmed virus attacks appear
|
|
to have been few and minor in the United
|
|
States, more serious incidents occurred
|
|
in Europe, with virus-related computer
|
|
problems reported in Great Britain, the
|
|
Netherlands, Portugal, France and
|
|
Switzerland.
|
|
As noted earlier, the computing
|
|
community was bracing itself for a
|
|
double-whammy of virus assaults this
|
|
week, from the so-called
|
|
Datacrime/Columbus Day virus starting
|
|
yesterday and from the Friday the
|
|
13th/Jerusalem virus today.
|
|
In the US, at least one CompuServe
|
|
subscriber reported a virus incident.
|
|
Writing on the message board of the IBM
|
|
Systems/Utilities Forum (GO IBMSYS), Tom
|
|
Ohlson told his fellow forum members
|
|
that a friend of his in Staten Island,
|
|
N.Y., had used a copy of an anti- virus
|
|
program called SCAN40, downloaded
|
|
earlier from the forum, to locate the
|
|
Datacrime virus. Ohlson said the friend
|
|
had traced the virus to a copy of a game
|
|
program that was passed around on a
|
|
floppy disk.
|
|
Elsewhere in New York, security
|
|
specialist Ross M. Greenberg, creator of
|
|
Flu-Shot Plus and Virex-PC anti-viral
|
|
software, told The Associated Press that
|
|
by midmorning he had received seven
|
|
reports of virus strikes since midnight,
|
|
but that only one was the Columbus Day
|
|
virus.
|
|
Greenberg reported that a dozen PCs at
|
|
Columbia University in New York City
|
|
were affected, but that the university
|
|
had made backup files, so the virus was
|
|
merely an inconvenience.
|
|
The other six virus reports concerned
|
|
what he called the "PLO virus," an older
|
|
virus designed to erase programs every
|
|
Friday the 13th. Greenberg said earlier
|
|
the PLO virus was far more widespread
|
|
and likely would cause more trouble
|
|
today than newer viruses.
|
|
Meanwhile, in Urbana, Ill., Michael
|
|
Harper, a staff person at the University
|
|
of Illinois' Micro Resource Center, told
|
|
United Press International a virus was
|
|
detected in some of the campus's 1,000
|
|
terminals, but that the university was
|
|
able to treat the computers before it
|
|
did any damage. "We're definitely
|
|
breathing easier," Harper said.
|
|
He said a virus was introduced on
|
|
campus by a piece of software used for
|
|
inputting scientific data. The
|
|
university now has a installed an
|
|
anti-virus warning program.
|
|
|
|
And now, from assorted wire
|
|
dispatches, here are virus incidents
|
|
reported elsewhere in the world today:
|
|
|
|
-:- Great Britain:
|
|
|
|
In perhaps the worst virus assault
|
|
of the day, computers at London's Royal
|
|
National Institution for the Blind were
|
|
infected by what experts are saying was
|
|
a previously known virus.
|
|
"We found that most of our program
|
|
files are gone," Corri Barrett of the
|
|
institute told reporters. "Every time we
|
|
try to look at a new program file it
|
|
vanishes in front of our eyes. It's
|
|
horrendous. Months and months of work
|
|
has been wiped out here."
|
|
Barrett told a BBC-TV interviewer the
|
|
virus might have contaminated disks
|
|
distributed to blind clients and that
|
|
their systems had been infected.
|
|
|
|
-:- The Netherlands:
|
|
|
|
In the Netherlands, where the first
|
|
alert of the so-called Datacrime virus
|
|
was given last summer, a unit set up to
|
|
hunt viruses said it had been flooded
|
|
with telephone calls from panicked users
|
|
today. Many told the officials they had
|
|
"lost everything, all their data stored
|
|
in memory and all their programs,"
|
|
according to a spokesman.
|
|
At the social affairs ministry, a
|
|
spokesman said yesterday the Datacrime
|
|
virus had been isolated and destroyed
|
|
"on several occasions" in recent days.
|
|
Also, Amsterdam university managed to
|
|
kill the Datacrime virus in time to save
|
|
its data, an official told Dutch
|
|
television yesterday.
|
|
In addition, the "Jerusalem" virus,
|
|
detected four times in the microcomputer
|
|
network of the Dutch rail company, was
|
|
rooted out before today, when it was
|
|
still dormant, a spokesman said.
|
|
|
|
-:- Portugal:
|
|
|
|
In Lisbon, at least two infected
|
|
computers flashed ominous warning
|
|
messages across their screens,
|
|
triggering panic among users.
|
|
The first, the "Friday the 13th"
|
|
virus, cropped up in the computer system
|
|
of a bank. The second, said to be of a
|
|
strain dubbed "Pakistan," attacked
|
|
computers at a medium-size company. In
|
|
both cases, the viruses were
|
|
neutralized, a spokesman for a
|
|
Portuguese computer association said.
|
|
|
|
-:- France:
|
|
|
|
Daniel Dutil, in charge of a special
|
|
unit set up to search and destroy the
|
|
viruses, said that fewer than one
|
|
percent of that nation's PCs were
|
|
contaminated, adding, "It's a normal
|
|
situation, if you take into account that
|
|
viruses are always found in computer
|
|
programs."
|
|
Dutil said some 2,000 computer
|
|
programs had come under the harsh
|
|
scrutiny of his unit, dubbed the
|
|
anti-viral platform, since it opened its
|
|
campaign to wipe out the viruses on
|
|
Tuesday. He said that whenever viruses
|
|
were programmed to awaken from their
|
|
dormant state and activate themselves on
|
|
symbolic dates such as January 1, April
|
|
1 or July 14, there was usually only
|
|
"slight virus activity similar to that
|
|
observed today."
|
|
Meanwhile, Guy Hervier, an
|
|
administration official at the
|
|
University of Nice in southern France,
|
|
said yesterday a virus scheduled to
|
|
activate today was discovered in the
|
|
university's computer lab in June but
|
|
was easily detected and destroyed.
|
|
|
|
-:- Switzerland:
|
|
|
|
Bernhard Schmid, head of the federal
|
|
personal computer team, said several
|
|
dozen of the government's 3,500 personal
|
|
computers were found to have been
|
|
carrying a virus. However, experts
|
|
managed to cancel and reprogram all
|
|
infected systems. He said infected
|
|
programs had been found in a wide range
|
|
of administrative branches.
|
|
--
|
|
|
|
|
|
VIRUS EXPERTS CITE PREPAREDNESS,
|
|
EXAGGERATION, BUSINESS SILENCE
|
|
|
|
(Oct. 14)
|
|
On the morning after, some computer
|
|
experts today were saying yesterday's
|
|
reported low incidence of virus assaults
|
|
was due to the exaggeration of the
|
|
threat all along, while others were
|
|
crediting the computing community's
|
|
preparedness due to early warnings.
|
|
Meanwhile, another observer said the
|
|
number of virus attacks actually may
|
|
have been greater than we realize,
|
|
because many corporate users are
|
|
reluctant to publicize computer security
|
|
violations at their businesses.
|
|
Wes Thomas, editor of a new electronic
|
|
newsletter called Virus Alert, told The
|
|
Associated Press his group received 50
|
|
unconfirmed reports of virus outbreaks
|
|
worldwide and that a headquarters was
|
|
set up in San Francisco to study the
|
|
cases.
|
|
"There's a lot of false positives,"
|
|
Thomas said. "We are attempting to form
|
|
a center for disease control for
|
|
computer viruses so we can centralize
|
|
information and find out what's going
|
|
on." Thomas said he helped spread the
|
|
word about the so- called Columbus Day
|
|
or Datacrime virus after attending an
|
|
August meeting in Amsterdam where the
|
|
rogue program was discussed.
|
|
Actually, most of the reported virus
|
|
attacks over the past two days seemed to
|
|
have been the work, not of Datacrime,
|
|
but of the older Friday the 13th or
|
|
Jerusalem virus that was first
|
|
discovered at Hebrew University in
|
|
December 1987.
|
|
Experts disagree, but one report is
|
|
that there now are about 30 different
|
|
computer virus strains making the
|
|
rounds.
|
|
Fred Cohen, an independent researcher
|
|
in Pittsburgh who is credited with
|
|
exposing the first computer virus in
|
|
1983, told AP he believes this week's
|
|
outbreaks were kept down because
|
|
computer users took proper precautions.
|
|
"Everybody was looking for it."
|
|
However, Cohen also cautioned, "This
|
|
is a long-term sort of threat. It's like
|
|
biological warfare."
|
|
Speaking with the Reuter Financial
|
|
News Service, John McAfee, chairman of
|
|
the Computer Virus Industry Association,
|
|
said he saw no rise yesterday in
|
|
reported computer virus problems, which
|
|
he said usually number 30 to 40 a day.
|
|
Elsewhere, Winn Schwartau, president
|
|
of American Computer Security Industries
|
|
Inc., told Reuter he had been informed
|
|
of 25 outbreaks of the Friday the 13th
|
|
version this week at organizations
|
|
ranging from universities to banks.
|
|
"It's not Armageddon -- it's not going
|
|
to all come at once crashing down around
|
|
us," he said, but he added the impact
|
|
actually could last for months as new
|
|
strains develop.
|
|
He said the customer base of his
|
|
company, which was started five years
|
|
ago, has increased 50 to 100 times in
|
|
the past 30 days because of fear of the
|
|
viruses after rumors began spreading in
|
|
late August.
|
|
He also said accurate virus reports
|
|
are difficult to gauge, because most
|
|
companies consider the damage to be
|
|
confidential information.
|
|
"Major corporations don't want the
|
|
publicity," Schwartau said.
|
|
--
|
|
|
|
|
|
ONLINE TODAY'S BACKGROUNDER: COMPUTER
|
|
"VIRUS," PART SIX
|
|
|
|
(Editor's note: Computer "viruses" --
|
|
self-propagating programs that spread
|
|
from one machine to another and from one
|
|
disk to another -- have been very much
|
|
in the news. This file contains
|
|
virus-related stories carried by Online
|
|
Today's electronic edition beginning in
|
|
late October 1989.)
|
|
|
|
|
|
VIRUS DESTROYS DATA IN TOKYO
|
|
|
|
(Oct. 30)
|
|
An official at the University of Tokyo
|
|
has confirmed a computer virus has
|
|
caused at least minor damage to some
|
|
research information at the school.
|
|
A representative of the university's
|
|
Ocean Research Institute has told The
|
|
Associated Press the virus was detected
|
|
earlier this month in four or five of
|
|
the center's 100 computers, but was
|
|
believed to have first infected the
|
|
computers last month.
|
|
The official who requested anonymity
|
|
told the wire service the virus was
|
|
found only in personal computers being
|
|
used by researchers, and not major
|
|
computer systems, adding the damage was
|
|
not serious.
|
|
The source declined to give further
|
|
details, but AP says the Japan
|
|
Broadcasting Corp. has reported a virus
|
|
also had been found in computers at the
|
|
university's Earthquake Research
|
|
Institute. That report said the virus
|
|
was the most sophisticated yet detected
|
|
in Japan, where the problem is not
|
|
widespread.
|
|
--
|
|
|
|
|
|
|
|
10 PERCENT OF CHINESE COMPUTERS STRUCK
|
|
BY VIRUSES, NEWSPAPER SAYS
|
|
|
|
(Nov. 5)
|
|
A newspaper in Beijing reports 10
|
|
percent of China's some 300,000
|
|
computers have been struck by computer
|
|
viruses.
|
|
The Xinhua Chinese news service quotes
|
|
a report yesterday in the China Daily as
|
|
saying three types of viruses have been
|
|
found so far, called "small ball,"
|
|
"marijuana" and "the shell." The paper
|
|
says universities and statistical
|
|
bureaus have been particularly hard hit
|
|
by the viruses.
|
|
Reporting on a computer security
|
|
conference in the southwest city of
|
|
Kunming, the English-language daily
|
|
quoted Yang Zhihui, deputy chief of the
|
|
Ministry of Public Security's computer
|
|
security department, as saying, "We have
|
|
already worked out some vaccination and
|
|
sterilization programs for the virus."
|
|
Yang said the wide variety of
|
|
computers in use in China -- both
|
|
foreign and domestic -- makes it hard
|
|
for a sweeping sterilization campaign to
|
|
be carried out.
|
|
The newspaper said the estimate that
|
|
one in 10 Chinese system have been virus
|
|
victims was reached by the Ministry of
|
|
Public Security following a survey last
|
|
August. The paper did not say how many,
|
|
if any, computers in China were struck
|
|
by the well- publicized "Friday the
|
|
13th"/"Datacrime" viruses last month.
|
|
However, regarding the "small ball"
|
|
virus -- which reportedly was found in
|
|
statistical bureaus in 21 provincial,
|
|
municipal and regional offices -- the
|
|
paper gave this description of an
|
|
attack:
|
|
"A computer was doing its word
|
|
processing, the cursor blinking brightly
|
|
on the screen. Suddenly, a jumping white
|
|
ball appeared. Then a second one and a
|
|
third. Slowly the screen was full of
|
|
them. Operation stopped." The paper said
|
|
the "small ball" virus can slow down or
|
|
halt computer operation, but it does not
|
|
appear to affect memory.
|
|
--
|
|
|
|
|
|
CONGRESS URGED TO BE CAUTIOUS IN
|
|
WEIGHING ANTI-VIRUS/WORM LAWS
|
|
|
|
(Nov. 8)
|
|
The president of the Computer and
|
|
Business Equipment Manufacturers
|
|
Association says Congress should be
|
|
cautious in making laws to fight
|
|
computer viruses, because, "Like the
|
|
swine flu vaccine of the 1970s, these
|
|
anti-virus bills could end up doing more
|
|
harm than good."
|
|
In remarks prepared for a hearing of
|
|
the House Judiciary subcommittee on
|
|
criminal justice, John L. Pickitt added,
|
|
"Outlawing some of the programming
|
|
techniques used to create computer
|
|
viruses might prevent the use of similar
|
|
programs for beneficial purposes,
|
|
including countering a virus."
|
|
Associated Press writer Barton Reppert
|
|
notes Pickitt, whose Washington-based
|
|
trade association represents companies
|
|
with combined sales of more than $230
|
|
billion, aimed his criticism at three
|
|
anti-virus bills, including those
|
|
sponsored by Reps. Wally Herger,
|
|
R-Calif., C. Thomas McMillen, D-Md., and
|
|
Edward J. Markey, D-Mass.
|
|
"The same sharing techniques which
|
|
make computer networks vulnerable to
|
|
virus attack can also be responsible for
|
|
breakthroughs in electronics and
|
|
telecommunications technology," Pickitt
|
|
said. "While Congress may wish to clean
|
|
up some of the language in the current
|
|
laws ... we urge Congress to act
|
|
cautiously in considering new criminal
|
|
statutes to deal with computer viruses."
|
|
Of bills currently under
|
|
consideration, Reppert observed:
|
|
-:- Herger's measure would impose
|
|
penalties of up to 20 years in prison on
|
|
people convicted of "interfering with
|
|
the operations of computers through the
|
|
use of programs containing hidden
|
|
commands that can cause harm."
|
|
-:- The McMillen bill seeks to punish
|
|
anyone who "willfully and knowingly
|
|
sabotages the proper operation of a
|
|
computer hardware system or the
|
|
associated software."
|
|
-:- Markey's proposal is to make the
|
|
introduction of a virus into an
|
|
interstate electronic network a federal
|
|
crime.
|
|
--
|
|
|
|
|
|
|
|
CONGRESS HEARS TESTIMONY ON THE COST OF
|
|
VIRUS ATTACKS
|
|
|
|
(Nov. 9)
|
|
A computer security official with the
|
|
EDP Auditors Association has estimated
|
|
for Congress that "hundreds of
|
|
thousands" of computer virus attacks
|
|
have occurred in recent years on the
|
|
systems of American corporations and the
|
|
government.
|
|
However, most attacks go unreported,
|
|
said specialist Carolyn Conn, "because
|
|
there is not a high expectation of
|
|
successful prosecution." Also, she said,
|
|
"Organizations do not want to publicize
|
|
their vulnerabilities when seemingly
|
|
there is little or no benefit" from
|
|
public disclosure.
|
|
Associated Press writer Barton
|
|
Reppert, covering Conn's appearance
|
|
yesterday afternoon before the House
|
|
Judiciary subcommittee on criminal
|
|
justice, quoted her as testifying that
|
|
the costs of viruses are "staggering."
|
|
Said Conn, "Viruses have cost
|
|
corporations, government agencies and
|
|
educational institutions millions of
|
|
dollars to prevent, detect and recover
|
|
from computer virus attacks."
|
|
Conn, whose Illinois-based EDP
|
|
Auditors Association represents some
|
|
9,000 electronic data processing
|
|
professionals across the country, made
|
|
her estimate of the number of virus
|
|
attacks in response to questions by the
|
|
congressional subcommittee.
|
|
Reppert reports the panel chairman,
|
|
Rep. Charles E. Schumer, D-N.Y., asked
|
|
her for a estimate of the overall number
|
|
of virus attacks that have occurred in
|
|
recent years. "Is it tens, is it
|
|
hundreds, is it thousands?" he asked.
|
|
Ms. Conn replied, "I think probably in
|
|
the hundreds of thousands."
|
|
--
|
|
|
|
|
|
|
|
BAR ASSOCIATION FEARS LOOPHOLES IN
|
|
EXISTING VIRUS/WORM LAWS
|
|
|
|
(Nov. 13)
|
|
The chairman of the American Bar
|
|
Association's task force on computer
|
|
crime has told a House subcommittee he
|
|
is concerned about loopholes in existing
|
|
laws that cover computer viruses, worms
|
|
and similar rogue programs.
|
|
"There are clearly some types of
|
|
computer virus activity that would be
|
|
beyond the terms of the current
|
|
statute," Joseph B. Tompkins Jr.
|
|
testified recently before the House
|
|
Judiciary subcommittee on criminal
|
|
justice.
|
|
Associated Press writer Barton Reppert
|
|
reports Tompkins and other witnesses
|
|
posed several questions about activities
|
|
that they said might fall through the
|
|
cracks of ambiguous federal laws, such
|
|
as:
|
|
-:- If a renegade programmer sends a
|
|
program containing a hidden virus to a
|
|
computer bulletin board system, can he
|
|
or she then be prosecuted for harm that
|
|
results when other BBS users transfer
|
|
the software into their own systems?
|
|
-:- Can virus/worm authors be
|
|
successfully prosecuted if they claim
|
|
they really didn't have any malicious
|
|
intent, but instead were merely trying
|
|
to pull off an innocent prank or aiming
|
|
to demonstrate existing weaknesses in
|
|
security?
|
|
Witnesses said that under current
|
|
federal law, the answer to both
|
|
questions is "maybe."
|
|
Tompkins said the Computer Fraud and
|
|
Abuse Act of 1986 -- which makes it a
|
|
federal crime to "intentionally access a
|
|
federal interest computer without
|
|
authorization and alter, destroy or
|
|
damage information in such computer or
|
|
prevent authorized access to such
|
|
computer if such conduct causes the loss
|
|
of $1,000 or more during any one-year
|
|
period" -- is not clear enough.
|
|
For instance, he testified, "The
|
|
statute does not in clear terms cover
|
|
the intentional implantation of a
|
|
computer virus in a computer which one
|
|
is authorized to access, even if the
|
|
perpetrator clearly intended harm or the
|
|
virus in fact caused significant harm."
|
|
He said the law also has been attacked
|
|
as unconstitutionally vague. "While
|
|
these arguments are probably overstated,
|
|
clarifying the statute might prevent
|
|
such arguments from being raised and
|
|
might encourage prosecutors to make more
|
|
frequent use of the statute," Tompkins
|
|
said.
|
|
--
|
|
|
|
|
|
|
|
|
|
`CONDOMS' FOR DISKS MAKE GAG GIFT
|
|
|
|
(Nov. 27)
|
|
In Christmases past, gag gifts for
|
|
computerists have ranged from chocolate
|
|
disks to empty "vaporware" packages.
|
|
This year.... well... A Fremont, Neb.,
|
|
firm called Tekservices Inc. has
|
|
announced "Safedisk," a product
|
|
described as a "poly floppy disk
|
|
condom."
|
|
The Associated Press notes word of
|
|
Safedisk spread recently after TV
|
|
talk-show host Arsenio Hall tittered
|
|
about it on his late- night program.
|
|
Stephen Nabity -- the 33-year- old
|
|
"Dr. Safedisk" -- told AP he got the
|
|
idea while watching a news broadcast
|
|
about a predicted outbreak of computer
|
|
viruses earlier this autumn.
|
|
"It came to me that people should
|
|
practice safe whatever-they-do," Nabity
|
|
said. "A lot of computer viruses were
|
|
going around."
|
|
He acknowledged his product doesn't
|
|
actually protect against viruses, but he
|
|
hopes that, at $7.95, it will be
|
|
considered a possible stocking-stuffer
|
|
for computer buffs.
|
|
--
|
|
|
|
|
|
|
|
|
|
COMPANY OFFERS VIRUS INSURANCE
|
|
|
|
(Dec. 2)
|
|
Allstate Insurance Co. may be the
|
|
first insurer to reimburse customers who
|
|
encounter the destruction of programs
|
|
and data caused by computer viruses.
|
|
Currently, the company offers
|
|
inexpensive riders to its homeowners and
|
|
renters insurance to cover other types
|
|
of damage to personal computers.
|
|
The new virus coverage is included at
|
|
no additional cost for customers who
|
|
currently have in effect a Standard
|
|
Electronic Data Protection Policy. The
|
|
data protection policy was originally
|
|
designed for owners of small
|
|
businesses.
|
|
Though existing virus protection
|
|
insurance carries a $100,000 limit,
|
|
higher amounts are available at an
|
|
additional cost. No claims have yet
|
|
been filed on any of the policies
|
|
currently in force.
|
|
Until recently, Safeware was the only
|
|
mass-market insurer with a large base of
|
|
policies issued to owners of personal
|
|
computers. The company specializes in
|
|
insuring computer equipment against
|
|
theft, natural disasters and accidental
|
|
damage. It does not pay for damages
|
|
caused by electrical problems or
|
|
viruses.
|
|
--
|
|
|
|
|
|
|
|
BRITISH GROUP WARNS OF POSSIBLE TROJAN
|
|
HORSE IN AIDS INFO DISK
|
|
|
|
(Dec. 13)
|
|
In London, the chairman of a PC users
|
|
group is warning computer users to avoid
|
|
a mailed floppy disk that purports to
|
|
give information about AIDS. He says the
|
|
disk might contain a "Trojan horse"
|
|
sabotage program.
|
|
Speaking with The Associated Press,
|
|
Dr. Alan Solomon, who leads the IBM
|
|
Personal Computer Users Group, said
|
|
several thousand of the disks -- called
|
|
"The AIDS Information Introductory
|
|
Diskette" -- have been mailed to
|
|
computer users.
|
|
Solomon, who also heads a British
|
|
company called S and S which specializes
|
|
in the examination of computer viruses,
|
|
said users' addresses may have been
|
|
taken from computer magazines. He said
|
|
the full effect of the suspected Trojan
|
|
horse program are not yet known.
|
|
He told AP he received one of the
|
|
disks in the mail on Monday bearing a
|
|
Panama postal box address. He said he
|
|
feared more could arrive in the mail
|
|
this week.
|
|
Said Solomon, "There is no urgent
|
|
panic in the short term but if (the
|
|
disk) has already been installed I would
|
|
advise (computer users) to seek urgent
|
|
help because it is a nasty thing." He
|
|
commented that few experienced computer
|
|
users would risk installing an
|
|
unsolicited disk without first checking
|
|
it, but that some less experienced users
|
|
might.
|
|
AP says a letter accompanying the disk
|
|
asks for payment of $189 for one type of
|
|
license and $378 for another.
|
|
--
|
|
|
|
|
|
VANDALIZED AIDS INFORMATION DISK WORRIES
|
|
COMPUTERISTS WORLDWIDE
|
|
|
|
(Dec. 14)
|
|
Word out of London of an apparently
|
|
vandalized computer diskette has caused
|
|
concerns among AIDS researchers around
|
|
the world and now has prompted one
|
|
computer virus expert to call the
|
|
incident a "well-orchestrated and
|
|
undeniably well-financed terrorist act."
|
|
As reported here, Chairman Alan
|
|
Solomon of London's IBM Personal
|
|
Computer Users Group was first to sound
|
|
a warning to computer users to avoid a
|
|
mailed floppy disk called "The AIDS
|
|
Information Introductory Diskette,"
|
|
because, he said, the software might
|
|
contain a "Trojan horse" sabotage
|
|
program that destroys data.
|
|
Since that announcement, there have
|
|
been these developments, according to
|
|
The Associated Press in Britain and in
|
|
the US:
|
|
-:- London's Scotland Yard issued a
|
|
warning to banks, hospitals,
|
|
universities and other institutions to
|
|
be on guard against the disk.
|
|
Investigators there say the disks have
|
|
destroyed information in at least 10
|
|
computers.
|
|
-:- Among those reported to have
|
|
received the disks are the London Stock
|
|
Exchange, British Telecommunications
|
|
PLC, which runs most of the nation's
|
|
phone network, the Midland Bank, Lloyds
|
|
Bank, the Australia and New Zealand Bank
|
|
in London, as well as universities,
|
|
hospitals and public health
|
|
laboratories.
|
|
-:- The British newspaper The Guardian
|
|
reports computer systems in hospitals
|
|
are among those damaged. It said the
|
|
disks also turned up in California,
|
|
Belgium and Zimbabwe but gave no
|
|
details.
|
|
-:- The British domestic news agency
|
|
Press Association quotes an unnamed
|
|
Health Education Authority spokesman as
|
|
saying a contact in Norway also received
|
|
a disk.
|
|
-:- In the US, the Rand Corp., which
|
|
has 15 people working on acquired immune
|
|
deficiency syndrome research, has warned
|
|
its employees. Ann Shoben, a spokeswoman
|
|
for the Santa Monica, Calif., research
|
|
firm, told AP, "We're safe. We have not
|
|
been hit. The concern is for others that
|
|
use personal computers and those who
|
|
work on AIDS research might pick up this
|
|
program and have their databases
|
|
destroyed."
|
|
-:- Also in the US, Chase Manhattan
|
|
Bank reportedly was one of the first to
|
|
report problems with the software.
|
|
As reported yesterday, several
|
|
thousand disks were believed to have
|
|
been mailed to London area computer
|
|
users. Officials there say users'
|
|
addresses may have been taken from
|
|
computer magazines. Now the UK police
|
|
say many of the disks were mailed in
|
|
London's South Kensington district.
|
|
A letter accompanying the disk asks
|
|
for payment of $189 for one type of
|
|
license and $378 for another. The letter
|
|
warns that if the money is not paid, the
|
|
sender will use program mechanisms to
|
|
stop a computer functioning normally.
|
|
Also, the program carries this ominous
|
|
advisory: "Warning: Do not use these
|
|
programs unless you are prepared to pay
|
|
for them."
|
|
Joe Hirst, former technical editor of
|
|
Virus Bulletin and a consultant on
|
|
computer software, told AP's Michael
|
|
West in London there are two programs on
|
|
the disk.
|
|
"The first," Hirst said, "is an
|
|
installation program and the second is a
|
|
questionnaire on the risk of AIDS which
|
|
will not run unless it is installed on a
|
|
hard disk. It then prints off an invoice
|
|
for a company in Panama, but the damage
|
|
has already been done by the
|
|
installation."
|
|
Apparently, that Panama company is
|
|
bogus. The London Guardian newspaper
|
|
quotes the letter as saying the money
|
|
demanded should be sent to "PC Cyborg
|
|
Corporation" at a box number in Panama.
|
|
However, neither the corporation nor the
|
|
box number -- 87-17-44 -- exists.
|
|
(The Guardian adds that the American
|
|
computer software company called Cyborg
|
|
Systems and its British subsidiary sent
|
|
warnings to customers yesterday that it
|
|
was not involved in this incident.)
|
|
AP's West said computer companies in
|
|
UK believe addresses for receiving the
|
|
disks were obtained from PC Business
|
|
World, a British weekly trade paper on
|
|
computing. Police say PC Business World
|
|
sold its 700-name mailing list in good
|
|
faith to someone claiming he wanted to
|
|
publicize the export of computers to
|
|
Nigeria.
|
|
Another London newspaper, The
|
|
Independent, reports the list was bought
|
|
for about $1,300 by a Kenyan businessman
|
|
identified as "E. Ketema."
|
|
Says the paper, "Mr. Ketema had taken
|
|
out a short-term subscription with The
|
|
Business Center in New Bond Street,
|
|
London, to receive mail and telephone
|
|
messages on his behalf while he was in
|
|
the country from Oct. 31 to Nov. 30. He
|
|
described himself as an accountant, but
|
|
the center does not know his first name,
|
|
nor does it have a forwarding address."
|
|
Meanwhile, in the US, the Rand Corp.
|
|
said it warned its employees of the disk
|
|
after receiving an advisory from
|
|
computer virus expert John McAfee.
|
|
McAfee, chairman of the Computer Virus
|
|
Industry Association of Santa Clara,
|
|
Calif., told AP writer Louinn Lota it is
|
|
unusual for his group to issue such a
|
|
blanket warning against a particular
|
|
disk, but because he has received calls
|
|
from PC users around the world, he
|
|
believes the threat is real.
|
|
"This is not a hoax," McAfee said.
|
|
"This is not a simple case of a hacker
|
|
in a back bedroom somewhere. It is a
|
|
well orchestrated and undeniably well
|
|
financed terrorist act. Few groups or
|
|
individuals can afford to waste hundreds
|
|
of thousands of dollars to bring harm to
|
|
a party and bring nothing in return."
|
|
He said he believes the topic of AIDS
|
|
was used by the creator of the damaging
|
|
program because many computer users are
|
|
likely curious about the disease. People
|
|
are encouraged to use the disk because
|
|
it is advertised as being able to
|
|
predict the chances a person has of
|
|
contracting AIDS, he said.
|
|
"Unlike an accounting program," McAfee
|
|
added, "this is a subject everyone is
|
|
aware of and virtually all people will
|
|
want to learn more about risks of having
|
|
AIDS."
|
|
--
|
|
|
|
|
|
|
|
MICROCOM BUYS ANTI-VIRUS COMPANY
|
|
|
|
(Dec. 26)
|
|
For undisclosed terms, software
|
|
publisher Microcom Inc. has acquired HJC
|
|
Software Inc., a Durham, N.C., firm that
|
|
markets programs for detecting and
|
|
eliminating viruses in Apple Macintosh
|
|
systems.
|
|
In a statement from Norwood, Mass.,
|
|
Microcom says the virus software product
|
|
line -- called Virex -- will be
|
|
integrated with its own Carbon Copy Plus
|
|
and Relay Gold communications packages.
|
|
Microcom President/CEO James M. Dow
|
|
said the Virex products "are a key
|
|
addition to our strategy of providing
|
|
comprehensive network administration and
|
|
management tools for the end user."
|
|
Dow noted that because of the large
|
|
number of users sharing files, PCs and
|
|
their networks "have been especially
|
|
vulnerable to viruses." He said the
|
|
Virex product line "will substantially
|
|
reduce the likelihood of catastrophic
|
|
failure for many PC and PC network
|
|
users."
|
|
--
|
|
|
|
|
|
From 1990 files:
|
|
|
|
NEWSBYTES COMPUTER HIT BY VIRUS
|
|
|
|
(Jan. 2)
|
|
Newsbytes News Service reports the
|
|
Apple Macintosh SE/30 used at its San
|
|
Francisco headquarters was infected just
|
|
before Christmas by what the editor
|
|
describes as one of the faster-
|
|
spreading computer viruses on record,
|
|
called WDEF A and WDEF B.
|
|
"Before the problem was pinpointed,"
|
|
editor Wendy Woods reports, "the virus
|
|
had spread to every unlocked floppy disk
|
|
and hard disk in use."
|
|
Woods quotes John Norstad of
|
|
Northwestern University as saying the
|
|
virus that struck Newsbytes was
|
|
discovered in early December by
|
|
programmers in Belgium. Since then, he
|
|
said, it has spread throughout the US in
|
|
the past few weeks and now is reported
|
|
at "virtually every major university."
|
|
The WDEF virus is said to cause Mac
|
|
windows to close, icons to fail to
|
|
appear, files to be listed as "locked,"
|
|
system error messages to flash on the
|
|
screen and applications to crash and
|
|
sometimes causes the computer to fail to
|
|
start at all.
|
|
Norstad -- author of Disinfectant, a
|
|
free program that combats the virus --
|
|
told Newsbytes that WDEF infects the
|
|
invisible Desktop files used by the
|
|
Mac's Finder. It does not infect
|
|
applications, document files or other
|
|
system files.
|
|
"Unlike the other viruses," Woods
|
|
reported, "it is not spread through the
|
|
sharing of applications, but rather
|
|
through the sharing and distribution of
|
|
disks, usually floppy disks."
|
|
Norstad says the virus can be removed
|
|
easily: hold down the option and command
|
|
keys until the complete desktop has
|
|
appeared on screen; this procedure
|
|
rebuilds the desktop and eradicates the
|
|
virus, he said. Also, his free
|
|
Disinfectant 1.5 now is appearing in the
|
|
libraries of most major Macintosh
|
|
services online.
|
|
According to Norstad, the virus
|
|
doesn't intentionally do damage, but it
|
|
can cause performance problems on
|
|
Appleshare networks with Appleshare
|
|
servers.
|
|
Newsbytes said there have been at
|
|
least two reports that WDEF can damage
|
|
disks. "The virus is known to create
|
|
havoc at the Desktop level of a
|
|
computer," the wire service said, "but
|
|
also causes crashes when a file is saved
|
|
under Multifinder. It causes problems
|
|
with the proper display of font styles,
|
|
the outline style in particular. When an
|
|
infected disk is loaded into a Mac IIci
|
|
or Portable, the computer will crash."
|
|
|
|
|
|
|
|
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|