962 lines
48 KiB
Plaintext
962 lines
48 KiB
Plaintext
|
||
|
||
Computer underground Digest Wed June 16 1993 Volume 5 : Issue 44
|
||
ISSN 1004-044X
|
||
|
||
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
|
||
Archivist: Brendan Kehoe
|
||
Shadow-Archivists: Dan Carosone / Paul Southworth
|
||
Ralph Sims / Jyrki Kuoppala
|
||
Ian Dickinson
|
||
Copy Editor: Etaoin Shrdlu, Seniur
|
||
|
||
CONTENTS, #5.44 (June 16 1993)
|
||
File 1--Interview with a Virus Writer (Gray Area Excerpt)
|
||
|
||
Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
|
||
available at no cost electronically from tk0jut2@mvs.cso.niu.edu. The
|
||
editors may be contacted by voice (815-753-6430), fax (815-753-6302)
|
||
or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL
|
||
60115.
|
||
|
||
Issues of CuD can also be found in the Usenet comp.society.cu-digest
|
||
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
|
||
LAWSIG, and DL0 and DL12 of TELECOM; on GEnie in the PF*NPC RT
|
||
libraries and in the VIRUS/SECURITY library; from America Online in
|
||
the PC Telecom forum under "computing newsletters;"
|
||
On Delphi in the General Discussion database of the Internet SIG;
|
||
on the PC-EXEC BBS at (414) 789-4210; and on: Rune Stone BBS (IIRG
|
||
WHQ) 203-832-8441 NUP:Conspiracy
|
||
CuD is also available via Fidonet File Request from 1:11/70; unlisted
|
||
nodes and points welcome.
|
||
EUROPE: from the ComNet in LUXEMBOURG BBS (++352) 466893;
|
||
In ITALY: Bits against the Empire BBS: +39-461-980493
|
||
|
||
ANONYMOUS FTP SITES:
|
||
UNITED STATES: ftp.eff.org (192.88.144.4) in /pub/cud
|
||
uglymouse.css.itd.umich.edu (141.211.182.53) in /pub/CuD/cud
|
||
halcyon.com( 202.135.191.2) in /pub/mirror/cud
|
||
AUSTRALIA: ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
|
||
EUROPE: nic.funet.fi in pub/doc/cud. (Finland)
|
||
ftp.warwick.ac.uk in pub/cud (United Kingdom)
|
||
|
||
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
||
information among computerists and to the presentation and debate of
|
||
diverse views. CuD material may be reprinted for non-profit as long
|
||
as the source is cited. Authors hold a presumptive copyright, and
|
||
they should be contacted for reprint permission. It is assumed that
|
||
non-personal mail to the moderators may be reprinted unless otherwise
|
||
specified. Readers are encouraged to submit reasoned articles
|
||
relating to computer culture and communication. Articles are
|
||
preferred to short responses. Please avoid quoting previous posts
|
||
unless absolutely necessary.
|
||
|
||
DISCLAIMER: The views represented herein do not necessarily represent
|
||
the views of the moderators. Digest contributors assume all
|
||
responsibility for ensuring that articles submitted do not
|
||
violate copyright protections.
|
||
|
||
----------------------------------------------------------------------
|
||
|
||
Date: 16 Jun 93 22:22:43 CDT
|
||
From: GRAY AREAS <grayarea@well.sf.ca.us>
|
||
Subject: File 1--Interview with a Virus Writer (Gray Area Excerpt)
|
||
|
||
((MODERATORS' NOTE: The following reprint from GRAY AREAS (Issue #3,
|
||
1993) is an edited summary of an interview with a writer of computer
|
||
viruses. The summary constitutes less than 20 percent of the entire
|
||
interview, so considerable detail has been omitted. We apologize if
|
||
we inadvertently over-truncated parts of the discussion for space
|
||
constraints.
|
||
|
||
GRAY AREAS is a new hard-copy magazine (see CuD 4.65 for a review)
|
||
that improves with each issue. Each issue addresses topics in "cutting
|
||
edge" culture, including technology, art, music, and leisure. The
|
||
current issue (#3) includes an interview with controversial musician
|
||
G.G. Allin. Netta Gilboa impresses us as one of the most competent
|
||
interviewers on the 'Zine scene, and does for print media what Mike
|
||
Wallace and Barbara Walters do for television: She brings incisive
|
||
questions to bear on her topic and elicits uncompromising information
|
||
(in the Wallace tradition) while never losing sight of the subjects'
|
||
humanity (in the Walters tradition). In our view, it's definitely
|
||
something worth looking at.
|
||
|
||
A one year (four issue) subscription is available for $18 from Gray
|
||
Areas, Inc. / P.O. Box 808 / Broomall, PA (19008-008). More
|
||
information can be obtained from grayarea@well.sf.ca.us))
|
||
|
||
NOTE: THE FOLLOWING COPYRIGHT MATERIAL MAY NOT BE SEPARATELY
|
||
RE-DISTRIBUTED OR CITED WITHOUT EXPLICIT PERMISSION FROM GRAY AREAS
|
||
|
||
+++++
|
||
|
||
GETTING GRAY WITH URNST KOUCH, COMPUTER VIRUS WRITER
|
||
By Netta Gilboa
|
||
|
||
Many people will dismiss Urnst before they hear what he has to say.
|
||
Others will hear what they want to instead of what he actually said.
|
||
Those of you who are willing to listen to his reasoning will find the
|
||
complex subject of viruses simplified and demystified. Viruses may
|
||
never again seem as scary.
|
||
|
||
I was surprised to learn writing and exchanging viruses is not
|
||
illegal. I was surprised to learn virus writers (for the most part)
|
||
look down on pirate files and pirate computer BBSs. I also learned
|
||
about several new viruses before the anti-virus community did which
|
||
seemed strange to me since it was their full time job and just one of
|
||
many stories to me.
|
||
|
||
Whatever you think about Urnst's actions, you'll probably agree with
|
||
him that viruses are here to stay with new ones being created every
|
||
day. There's material here for everyone. Whether your main interest is
|
||
in how to avoid getting stung by a virus, learning how to write one,
|
||
or in understanding people who do this for fun, read on.
|
||
|
||
We're certainly interested in your reactions, pro and con. Did you get
|
||
hit by a virus that was more than a minor inconvenience? Did your
|
||
opinion about viruses change at all as a result of reading this? Would
|
||
you like to hear from other, more malicious virus writers and/or from
|
||
the experts who defeat these viruses? We'll print as much of your
|
||
mail as we can. Viruses are surely as gray a topic as topics get...
|
||
|
||
Gray Areas: What is a computer virus?
|
||
|
||
Urnst Kouch: A computer virus, in simplest terms, is a small program
|
||
that must generally have two features associated with it. It has to
|
||
be able to find another executable program, so it has to have a search
|
||
mechanism, and it has to be able to duplicate itself and attach itself
|
||
to a program. So that the next time that program is executed, the
|
||
virus executes first. You can think of it as a very small piece of
|
||
code that when executed like any program goes out and attaches itself
|
||
to another program on your computer such as your word processor. When
|
||
you next fire up your word processor, the virus will execute first
|
||
because it has placed an instruction at the beginning of your program.
|
||
There are many more primitive forms of viruses which don't bother
|
||
preserving the integrity of your original program. When they are
|
||
executed the first time, they go out and search for another program
|
||
and they just write themselves down on top of it. They don't care
|
||
about preserving the functionality of the program that they've found.
|
||
They essentially just destroy the portion that they have taken up
|
||
residence in, and then the next time you would execute your word
|
||
processor, it has been infected by this virus, called an overwriting
|
||
virus. The virus will then execute again and then look for another
|
||
program and your word processor won't execute because it's been
|
||
destroyed. You will get a cryptic error message which generally is
|
||
generated by the virus.
|
||
|
||
GA: Oops!
|
||
|
||
UK: Oops, usually there is an oops message in there. This is something
|
||
people notice right away. Oh, it's not working. Occasionally, some
|
||
virus programmers get a little more clever and put a little message in
|
||
the virus so the virus when it's done finding other programs to infect
|
||
prints a message to the screen that says out of memory or some other
|
||
DOS error message.
|
||
|
||
GA: Any particular reason you chose the handle Urnst Kouch?
|
||
|
||
UK: No. (Laughs) Just a name.
|
||
|
||
GA: So in other words, it is not someone's name from history or
|
||
anything?
|
||
|
||
UK: No. I got tired of seeing the same names. I've seen so many Count
|
||
Zeros and Kilgore Trouts.
|
||
|
||
GA: So it was an attempt to be unusual?
|
||
|
||
UK: I don't know if it was an attempt to be unusual. It was just a
|
||
name that popped into my head. If you really want to know where it
|
||
came from, there used to be a jeans or a sneakers commercial. It said
|
||
life is short so play hard, so I just thought, oh well, there's a
|
||
great commercial, change it to what most Americans wish it would be,
|
||
life is short, lay on the couch. So, that's how the Kouch came about.
|
||
Now I needed something to go in front of that. I thought Kouch
|
||
sounded vaguely dramatic. Urnst is kind of German. That's where it
|
||
came from, just a name. People could almost think that it's a real
|
||
name, normally. Stretching.
|
||
|
||
GA: What demographics about yourself can you share with our readers?
|
||
|
||
UK: I'm about 35. I have a Ph.D. in chemistry.
|
||
|
||
GA: How did you personally get interested in viruses?
|
||
|
||
UK: Well, part of it came out of 1992 when the general media began
|
||
covering Michelangelo in such a hysterical panic. I smelled a rat.
|
||
This seemed absurd so, knowing something about computers, I started
|
||
researching. I eventually wound up writing on it. During my course of
|
||
research I wanted to dig up some viruses so that I could have a look
|
||
see for myself and, of course, the people in the anti-virus
|
||
communities did not turn out to be very forthcoming when I asked for a
|
||
few samples of viruses.
|
||
|
||
GA: They don't even seem to want to answer theoretical questions.
|
||
|
||
UK: No, they don't even like to do that. So I just went out and
|
||
assumed that there was probably a lot of virus code lying around in
|
||
underground channels. And this was the case. This leads to a kind of
|
||
leveraging effect whereby once you accumulate certain things and start
|
||
talking about them, then the more respected avenues begin to open up
|
||
for you and the anti-virus researchers take you seriously which is
|
||
kind of hypocritical, but it's the way things are. To get access to
|
||
some of the virus archives on underground sites, you have to come up
|
||
with an original virus that they don't already have. You can either go
|
||
out and try and find one, which isn't that hard, or you can write one
|
||
yourself and upload it. So that's what I did. It's not hard to write a
|
||
virus, and I somehow found a copy of the Mutation Engine which I
|
||
thought was interesting.
|
||
|
||
GA: You should explain what that is, especially for people who don't
|
||
own computers.
|
||
|
||
UK: The Mutation Engine was briefly mentioned around the time of
|
||
Michelangelo as a product by a Bulgarian programmer known as The Dark
|
||
Avenger. He's famous in the virus community, well-known to anti-virus
|
||
people too. He's written a series of viruses which have found their
|
||
way into the West and he's known for trying to make challenging codes.
|
||
I guess that would be the best way to express it. Then last year he
|
||
uploaded something called Mutation Engine which was a segment of code
|
||
which provided any virus that included it with variable encryption.
|
||
Now when I am saying variable encryption, some viruses use encryption.
|
||
All encryption does is when the virus is done doing it's thing,
|
||
finding a file to infect, it will copy itself into that file at this
|
||
point, and will encrypt its instructions so that it looks like a hunk
|
||
of nonsense attached to the end of the file. The only part of the
|
||
virus that remains constant is the decryptor which the encryption
|
||
routine adds. The decryptor is the portion that the virus needs to
|
||
ungarble all the instructions.
|
||
|
||
When the infected file is executed, the decryptor is the first thing
|
||
to begin to work in it. Now, if you hide suspicious messages in your
|
||
virus, when someone is looking at a suspected infected program under a
|
||
file viewer which are pretty common tools in utility programs, you
|
||
don't want a dead giveaway like, "Ha, Ha, I've got you or f--- you
|
||
lamer," sorry for my French but we will be blunt. That's what's in a
|
||
lot of stupidly written viruses. And so a simple encryption routine
|
||
allows you to hide those kinds of things.
|
||
|
||
How the Mutation Engine differs is that it provides variable
|
||
decryption that has a complex mechanism in which it changes the scheme
|
||
of encryption so every time the virus copies itself it adds a
|
||
different decryptor on a random basis. The decryptor will change the
|
||
content of its instructions; it could change in size, this makes
|
||
finding a constant set of instructions impossible because it's
|
||
constant. It is a very sophisticated piece of programming and in
|
||
comparison to the viruses that it's used in, it is much larger: about
|
||
2,000 bytes in size, where most viruses are about 200 or 300 bytes in
|
||
size. Mutation Engine viruses benefit from this variable encryption
|
||
since scanners, at the time of its release, could not detect viruses
|
||
using it. Some still do have some difficulty doing that because a
|
||
whole different approach to virus scanning had to be programmed into
|
||
the utilities that the manufacturers were making. Now they had to be
|
||
able to disassemble the infected file, looking for sets of
|
||
instructions, characteristic of the decryptor that the Mutation Engine
|
||
used. Without getting too technical, you can use statistical methods
|
||
to do this. If you load it into a symbolic debugger and step through
|
||
it, you can see that the decryptor follows a pattern. It always
|
||
changes every generation, but there is always a constant pattern going
|
||
on there.
|
||
|
||
Good programmers can see this and program that into their software so
|
||
that the pattern characteristic of the Mutation Engine code can be
|
||
flagged. Then we know that the Mutation Engine is there. It was blown
|
||
out of proportion because it has a sexy name. The significance I think
|
||
of the Mutation Engine is the inspiration it has provided for virus
|
||
programmers worldwide.
|
||
|
||
GA: So, basically, you have been involved and interested in this for
|
||
about a year?
|
||
|
||
UK: Yeah. To get access to virus libraries you had to upload an
|
||
original virus and the first one that I came up with was Crypt Lab
|
||
virus which was a hack. I uploaded it to a couple of virus exchange
|
||
BBSs in this country and then got access to their virus libraries.
|
||
From there it is simple to start building. My library just kind of
|
||
snowballed. It's a mistake to think that virus exchanges are a threat
|
||
and run by geniuses. That's just not always the case, although some
|
||
are.
|
||
|
||
GA: How would you define your role presently in the virus world?
|
||
|
||
UK: Just someone who publishes them in an electronic newsletter which
|
||
looks at the virus community just as it would look at the anti-virus
|
||
community. There are no other publications that just look at both
|
||
sides of the coin rather squarely, provide real technical as well as
|
||
general information. It covers a broad spectrum of the computer
|
||
reading audience. Someone who is almost completely computer
|
||
illiterate can at least recognize some things in the Crypt Newsletter,
|
||
but not everything. That's it. As a functional part of that I have
|
||
to continue to provide semi-interesting code samples that actually
|
||
work as well as other things. I think it gets boring really, really
|
||
fast, if you're just in the processor pumping out viruses. That's the
|
||
hard part. The interesting part for me is actually putting in the
|
||
other things: the analysis, the news, the commentary and that kind of
|
||
stuff.
|
||
|
||
GA: Do you want to mention that you are running a BBS (computer
|
||
bulletin board)?
|
||
|
||
UK: Yeah, sure. Call anytime. It exists for people to come and get the
|
||
Crypt Newsletter if they are interested in finding it without going
|
||
through the usual hassles of underground channels like the cool, elite
|
||
bulletin board systems. The underground world has become very
|
||
exclusive. In a sense it is cliquey, and if you are not associated
|
||
with the right people you don't get entrance. It seems to be totally
|
||
opposite of what the computer underground started out as, but this is
|
||
what it is now. So if you don't want to go to your local pirate BBS
|
||
where they stock it, and get through their new user voting screen
|
||
whereby a like-minded bunch of buddies decide if a complete stranger
|
||
that they've never heard of before should get entrance to this
|
||
exclusive domain; if you don't want to put up with that fuss or have
|
||
to come up with some virus before you get it; on my BBS, you just get
|
||
it. Which is how you should get it everywhere, but I can't control
|
||
that, I can't care about it that much. You don't have to be cool to
|
||
get it.
|
||
|
||
GA: What skills are required to write a virus?
|
||
|
||
UK: Almost none. It's a myth that you have to be a programming genius
|
||
to write a virus at this point. That may have been true when the idea
|
||
was novel. It certainly hasn't been true for the last two or three
|
||
years. There's so much source code lying about that anyone with a
|
||
passing knowledge of the computer and a little bit of determination, a
|
||
desire to do it, can take a stab at hacking an existing virus. This is
|
||
rather common when coming up with an original virus which can be
|
||
cobbled together with segments of or ideas from others. Writing one
|
||
from scratch is the hardest way to do it.
|
||
|
||
GA: Aren't they all written in programming languages?
|
||
|
||
UK: Assembly mostly. By far most viruses are written in assembly
|
||
language.
|
||
|
||
GA: So you have to understand what assembly language is?
|
||
|
||
UK: Yes, you have to know assembly language, be able to recognize
|
||
assembly language code and have a general understanding of what
|
||
assembly language instructions do. You have to be able to recognize
|
||
within a sample of code what the instructions are doing, so that you
|
||
can follow the virus. In that sense you do have to immerse yourself
|
||
in assembly language coding. But it's not as hard as one would
|
||
believe. There are good books, and there's plenty of virus source code
|
||
around, so with books in hand and looking at virus code in a dedicated
|
||
fashion, you can get the hang of what is going on rather quickly.
|
||
Viruses all share a commonality, there's just not a lot of variability
|
||
there in terms of what they do.
|
||
|
||
Some people write viruses in higher languages like C or Pascal. Those
|
||
are few and far between because it is difficult to make the virus
|
||
agile enough in those languages for them to function efficiently on a
|
||
machine. A virus has to be small and quick to do the best job. It is
|
||
difficult to do that with languages like C and Pascal simply because
|
||
there is a great deal of overhead involved in the languages when they
|
||
are compiled. If you look at a program that is written in C to do a
|
||
certain function on a computer and then you look at a program that is
|
||
written in assembly, the assembly program would be much, much smaller
|
||
than the program written in C. C is conversely a language that is
|
||
easier for people to understand because it is closer to English.
|
||
Whereas assembly language just has a bunch of, at first, what would
|
||
appear cryptic instructions.
|
||
|
||
GA: But it is basically the type thing that anybody with a degree in
|
||
computer science can do?
|
||
|
||
UK: Oh, I would think so, certainly. I don't even think you need a
|
||
degree in computer science. I think fifteen year old kids who are
|
||
really into computers can write viruses.
|
||
|
||
GA: And I bet they do.
|
||
|
||
UK: I'm sure they do.
|
||
|
||
GA: So how many viruses have you made and which ones are they?
|
||
|
||
UK: I don't know all of them. Well, there was the Encroacher. That was
|
||
in one of the Newsletters. That was a Mutation virus that attacks
|
||
Central Point Software's anti-virus program. There might have been
|
||
three variants to that. There was the Insufficient virus which is
|
||
another Mutation Engine companion virus. You know what a companion
|
||
virus is?
|
||
|
||
GA: No.
|
||
|
||
UK: Most viruses function by attaching, we are talking about file
|
||
infecting viruses purely here, and most of them attach themselves to
|
||
those files. Companion viruses are spawning viruses. A spawning virus
|
||
or a companion virus will look for a program on your computer that is
|
||
an .EXE and it will make a duplicate of itself. Then it will rename
|
||
itself as that program except the extension will be .COM. Because of
|
||
the rules of DOS, when you call a certain program which might be your
|
||
word processor or something like that, DOS will execute a .COM file
|
||
before it will execute an .EXE file. Well, the virus just simply
|
||
renamed itself, made a copy of itself, renamed as your word processor.
|
||
The virus will execute first and then it will hand off to the word
|
||
processor program or the infected target program, and things will
|
||
function normally and the virus will, if it is a direct acting run
|
||
time virus, it will go off and search for another program to infect.
|
||
If it is a resident virus it will now be installed in memory and it
|
||
won't have actually changed the infected file at all, so anti-virus
|
||
software that checks for changes made in files won't detect a
|
||
companion virus unless it is smart enough to look for identical file
|
||
names. Very few anti-virus software programs do that.
|
||
|
||
GA: Certainly when you wrote that one, they probably didn't!
|
||
|
||
UK: I believe they still don't. Companion virus infections can be
|
||
easily removed and the machine restored to total health, simply by
|
||
looking for all the small .COM file duplicates that reside next to .EXE's
|
||
and deleting them. The virus creates these files as hidden
|
||
system read only files. So if you do a simple directory, uneducated
|
||
people won't see them. They are going to be hidden like the system
|
||
files in your root directory. You won't see them when you do a
|
||
directory search. You have to change the attributes on them to see
|
||
them so that they are not hidden and read only, or else you have to
|
||
have some kind of file manager like X-Tree or PC Tools that
|
||
automatically lets you see even the hidden files on your system. It is
|
||
a minor annoyance but it does a little bit of stealthiness there.
|
||
Almost all companion viruses create themselves hidden files.
|
||
Eventually some people start to notice because they start losing disk
|
||
space, the disk is filling up with hidden files which are the virus.
|
||
|
||
GA: Then there was the Crypt Lab virus, right?
|
||
|
||
UK: Yeah.
|
||
|
||
GA: And that was recently mentioned in Discover magazine?
|
||
|
||
UK: Yes, that was at the end of the article. I got the Virus Creation
|
||
Laboratory, and I spent a lot of time going through it and creating
|
||
some variants to that just to see what it could do. One of those was
|
||
Diarrhea.
|
||
|
||
Anyway, if you execute the virus, there are three forms to that virus.
|
||
One will infect all files until it can't find anymore files to infect.
|
||
It will put on a display that says, "Eat My Diarrhea," which I think
|
||
it is one of his favorite phrases. Another variant of the virus goes
|
||
about doing it's business and while it is infecting other files, it
|
||
drops a small program onto files. That does not infect. This destroys
|
||
those programs, essentially creating what I call zombies. The zombies
|
||
merely display the neon "Eat My Diarrhea - GG Allin and the Texas
|
||
Nazis," in neon color. As soon as you run one of those things you know
|
||
you've been the victim of a prank or something like that. So that's
|
||
what the Diarrhea viruses do. They are created with the Virus Creation
|
||
Laboratory.
|
||
|
||
And then there was another virus creation type tool that's been
|
||
produced by the members of Phalcon/Skism virus programming group.
|
||
There was the virus I made using code from the Virus Creation
|
||
Laboratory and the Phalcon/Skism Mass Production Coder I think it's
|
||
called. That was called the Mimic virus. And the Mimic virus came in a
|
||
couple of flavors. It was a file infecting virus which created a mimic
|
||
of the Jerusalem virus. The screen is characteristic of Jerusalem.
|
||
|
||
Another one I created was the Den Zuk Mimic. With the original Den
|
||
Zuk, when the person does the three finger salute (hitting
|
||
control-alt-delete keys at the same time) to reboot the computer, this
|
||
graphic comes up on the screen and shows Den Zuk. It's kind of a nice
|
||
graphic too I must admit. I like that. I put that into Den Zuk Mimic
|
||
to make programs show that graphic.
|
||
|
||
GA: I thought there was some other virus.
|
||
|
||
UK: Is it recent? In a recent issue of the newsletter?
|
||
|
||
GA: No, I'm getting it from the VSUM listing. There were four viruses
|
||
in the December 1992 issue that listed "Kouch."
|
||
|
||
UK: I tend to be only really familiar with the recent ones that have
|
||
been published. Maybe it will come to me.
|
||
|
||
GA: What's so exciting about viruses and source codes?
|
||
|
||
UK: I like the word "interesting" more.
|
||
|
||
GA: Okay.
|
||
|
||
UK: Well, particularly interesting because of the misinformation that
|
||
goes around concerning the viruses. There's a great deal of it.
|
||
There's a great deal of mystery that shrouds. I don't think there's a
|
||
lot of mystery associated with viruses. Viruses, in my opinion, are
|
||
rather trivial programs that, once you're thoroughly cognizant of what
|
||
a virus can and can't do, become more like a pest if you ever run into
|
||
one. You should be able to get rid of it rather quickly in your
|
||
machine. And it might interest you to know that one of the anti-virus
|
||
software programs in its own virus database in that program displays
|
||
the severity of damage that viruses can do. Fully 95 percent of the
|
||
viruses listed in that database, are characterized as trivial. It
|
||
takes three minutes to reset the machine to proper working order. And
|
||
that's fairly accurate, I think, and that's not something that's
|
||
common knowledge. People think it's a major catastrophe when they are
|
||
hit by a virus. I do not take seriously claims of people being set
|
||
back for hours. If they are completely ignorant of a virus, yes. But
|
||
someone in the department or in the household knows about viruses. No,
|
||
that's just an exaggeration. So viruses are interesting to me because
|
||
of that. Because of the great variations in opinions that surround
|
||
them.
|
||
|
||
GA: And also the myths.
|
||
|
||
UK: The myths on them and the controversies associated with a virus.
|
||
When anyone speaks up about viruses.
|
||
|
||
GA: That's becoming very interesting to me.
|
||
|
||
UK: Politically incorrect terms. There's always been a great deal of
|
||
controversy surrounding this. And so for this reason alone, viruses to
|
||
me are interesting. For example, on Prodigy it is okay for dozens of
|
||
people to advertise adult bulletin boards, with gigs of pornographic
|
||
files available for download. These are not expunged from the Prodigy
|
||
computer club as inappropriate. However, if anyone posted a note on
|
||
Prodigy saying they want to find a virus, can someone help them locate
|
||
a virus, that is immediately spiked. Why is that? I'm not sure. But
|
||
it's interesting.
|
||
|
||
GA: I've had a lot of trouble getting in touch with the Virus-L
|
||
Newsletter from the WELL.
|
||
|
||
UK: The Virus-L publication is pretty much dogma. I've seen it a lot,
|
||
I've never thought very highly of it. There are bright people that
|
||
contribute to it. It is not particularly useful.
|
||
|
||
GA: Well, it is a major place that people who don't know anything
|
||
about viruses go to turn to when they think they've been hit.
|
||
|
||
UK: Well, they won't find out a lot from that publication. (Laughs)
|
||
People only talk about viruses in general terms.
|
||
|
||
GA: I asked several people to contribute questions. The number one
|
||
question people had for you was what gratification or satisfaction do
|
||
you get from this?
|
||
|
||
UK: Well, I enjoy publishing the Crypt Newsletter. It's a challenge to
|
||
make it interesting to a lot of different people and I enjoy the
|
||
response that comes in. Some of the people that I've met through it
|
||
have been rewarding. I don't meet a lot of stumps. I wouldn't continue
|
||
to do it if there was absolutely no response and people didn't show
|
||
some curiosity and the desire to see more of it. I want to give them
|
||
more for their trouble, so that makes it an evolving thing. You want
|
||
to see if you can top yourself and make it more interesting. There is
|
||
a great need for this kind of look at viruses. I don't think you can
|
||
get that from Virus-L to be quite honest with you.
|
||
|
||
GA: Or from anything else.
|
||
|
||
UK: You'll get it from some other underground publications, of course.
|
||
They are hard to find. Some people are turned off by the smoke and
|
||
brimstone they come packaged with. My newsletter is a little bit
|
||
different than trying to be so blatantly sociopathic. And I'm sure
|
||
there are people who read it and think that I am a sociopath. I don't
|
||
think I am, I think that's clear in the newsletter.
|
||
|
||
GA: I think most people who think you are a sociopath wouldn't read
|
||
it.
|
||
|
||
UK: Probably. They would read it once and then toss it. I really like
|
||
the work of Mark Ludwig. The Little Black Book of Computer Viruses, to
|
||
me, was extremely interesting. It was the first book that I was able
|
||
to get ahold of on computer viruses that had any good information in
|
||
it and he's continued to do that kind of thing.
|
||
|
||
GA: Right, he has a new edition coming out and a newsletter which
|
||
prints virus code.
|
||
|
||
UK: And, so, why is that interesting? Well, he explains why viruses
|
||
are interesting for a number of reasons. Part of it because of the
|
||
controversy that the concepts brings up. In a way, I think studying
|
||
viruses gives you a good understanding of the computer on a really low
|
||
level basis, and that's worthwhile. For some people that makes the
|
||
computer much more enjoyable as they start to unlock some of its
|
||
secrets or understand what is actually going on inside it a little
|
||
better. Viruses are kind of an indirect way of getting at that
|
||
information. Maybe you're bored in your computer class listening to
|
||
the dogma of understanding the operating system of the PC, but maybe
|
||
you are interested in computer viruses because you like the concept
|
||
associated with practical jokes and want to start to look at computer
|
||
viruses a little more. You become more curious, it becomes more
|
||
involved and now you are starting to get a better grasp of what
|
||
someone is trying to teach you in the computer course at the same
|
||
time. It is an indirect method, it's not an obvious way, but I think
|
||
that it does happen.
|
||
|
||
GA: Nowhere Man.
|
||
|
||
UK: Nowhere Man. He's an interesting individual. He spends a lot of
|
||
time programming different things.
|
||
|
||
GA: So basically there is a social aspect to this too.
|
||
|
||
UK: Yeah, yeah. Talking to different people around the country,
|
||
through the computer and meeting different people, getting their
|
||
ideas. They're interesting people.
|
||
|
||
GA: How much of your time does this take up in an average week?
|
||
|
||
UK: It depends. I tend to do a lot of it late at night. I think it's
|
||
hard to say. Right now I'm spending more time on the BBS than I have
|
||
on the Crypt Newsletter.
|
||
|
||
GA: And regardless of what the BBS was about there's just maintenance
|
||
that takes time every week.
|
||
|
||
UK: Yeah. I'm uncomfortable with quantifying things, so, as much time
|
||
as it takes to do it right.
|
||
|
||
GA: About how many groups are there in the virus world? Active and
|
||
inactive.
|
||
|
||
UK: There's Phalcon/SKISM, NuKe, there's YAM. There was Rabid. They
|
||
supposedly disbanded, but I got a virus the other day that said Rabid
|
||
lives again, so maybe they do. The virus doesn't work. (Laughs) You
|
||
know what I mean. It's hard for me to tell. There was a British group
|
||
called ARCV. The Association of Really Cruel Viruses, that's what it's
|
||
called. And they pumped out a bunch of viruses over the summer and the
|
||
fall. Their leader was busted by the authorities in England for a
|
||
phone fraud related kind of thing. So I have no idea of what the
|
||
status of that is. They certainly made quite a few viruses. They have
|
||
one resident virus that they subsequently modified quite a bit and
|
||
they have a model of a direct action virus which they've also
|
||
modified.
|
||
|
||
GA: So about a half a dozen groups more or less?
|
||
|
||
UK: Yeah, but I'm sure there are smaller groups that I haven't
|
||
mentioned here.
|
||
|
||
GA: And individuals?
|
||
|
||
UK: And individuals. I think that the lone virus programmers are
|
||
actually more common than the groups because the groups are never as
|
||
monolithic or as united in anything as they're portrayed. They are
|
||
just a couple of individuals who have a loose association with each
|
||
other. Like NuKe. One of the members of NuKe, Rock Steady, is French
|
||
Canadian. Nowhere Man is from the Midwest. They may talk a lot but
|
||
obviously they are separated by geographic locations. So how tight can
|
||
that organization be? And then NuKe has a division in Australia and
|
||
some people there who run the BBSs and do virus programming in
|
||
Australia. There's a Scandinavian group, I forgot about them, called
|
||
Demoralized Youth who apparently created the Hitler virus which I
|
||
included in the Crypt Newsletter. And they produced things like the
|
||
PC Byte Bandit which you see on a lot of bulletin boards.
|
||
|
||
GA: Do such groups exist for other computer types like Mac, and Atari?
|
||
|
||
UK: Well, that's a good question. I know there are a lot of Commodore
|
||
viruses but I don't know if they are groups or the infrastructure is
|
||
quite the same. As for Mac, I would think probably not because you
|
||
know there aren't many Macintosh viruses.
|
||
|
||
GA: Are any of those differences between the computer types worth
|
||
noting? Like is there a reason why there are fewer Mac viruses, does
|
||
it have something to do with their operating system?
|
||
|
||
UK: Yeah, the operating system on a Macintosh is less open, for the
|
||
simplest explanation, than the IBM PC, therefore fewer people are
|
||
writing programs that will operate as viruses will on it. It's a more
|
||
cryptic system shall we say.
|
||
|
||
GA: Do some of these groups that you are aware of try to make money or
|
||
is all this being done for free?
|
||
|
||
UK: Well, Aristotle is the sysop of the Black Axis Virus Exchange.
|
||
He's the fellow who informally put together, who is formally the head
|
||
of what is known as the Vx, like in Rx. It's a loose network of virus
|
||
exchanges around this country, about twenty, maybe a little less than
|
||
that now. He has a really large collection of viruses, something like
|
||
over 2,500. 600 samples of source codes, there's lots of duplications
|
||
in there, so he's packaged it up rather neatly and gotten the word out
|
||
in almost formal advertisements that he will sell his collection for a
|
||
lump sum. I forget what it is. Somewhere between $100-250 dollars. He
|
||
tells me he's gotten 40 takers. So there you have someone who is
|
||
trying to sell the viruses for money. I've seen advertisements to
|
||
this effect on other virus exchange bulletin board systems. Others
|
||
would like to sell their virus collections, depending on what the
|
||
market will bear, I guess.
|
||
|
||
GA: How big would you estimate that the virus community is? Can you
|
||
estimate the total number of virus exchange boards or the total number
|
||
of users?
|
||
|
||
UK: I can't identify the number of users. I can make a rough estimate
|
||
of the virus exchange boards. At least 20.
|
||
|
||
GA: In the whole world?
|
||
|
||
UK: No, in this country. What do you mean by virus exchange? We've got
|
||
to set some rules here. Let's count all the ones that specialize in
|
||
this, that have collections of over 1,000 viruses. I'd say at least 20
|
||
BBSs.
|
||
|
||
....................
|
||
|
||
GA: My interest in this comes from the Michelangelo scare, which of
|
||
course we are taking in retrospect with a grain of salt, but they
|
||
reported that the people in other countries such as India or wherever,
|
||
had so little access to U.S. anti-virus programming. In some of those
|
||
countries they don't sell anything legally to remove viruses. So if
|
||
they were hit by something, they don't even know where to go to get
|
||
something that will clear it up.
|
||
|
||
UK: You don't need anti-virus software to get rid of something like
|
||
Michelangelo or Stoned. You can do it with undocumented commands. If
|
||
you've talked to someone who does know something about viruses, and
|
||
you didn't have anti-virus software, you could use that and dispatch
|
||
something like Michelangelo and Stoned rather quickly.
|
||
|
||
GA: So you think the reports about problems in other countries are
|
||
over exaggerated?
|
||
|
||
UK: Well, there's an article which analyzes the media coverage of
|
||
|
||
....................
|
||
|
||
Michelangelo and I think that really puts it into perspective. It
|
||
really shows the people that tried to actually come up with hard data
|
||
after March 6. They just weren't able to come up with anything that I
|
||
consider serious data. I remember them coming up with things like
|
||
South Africa was reportedly hard hit. Says who? You know what I mean.
|
||
You know how journalists work. They get on the telephone for like five
|
||
minutes with someone in South Africa and the guy says we've been hit
|
||
by a thousand. How does he know? And there was one that was even
|
||
funnier. I think it was some military computer in Uruguay or Paraguay.
|
||
|
||
The virus does exist but I just don't think that it was common. I got
|
||
one call from some kid and he's concerned he might have that virus
|
||
because he's had floppy disks that are dying right and left on him.
|
||
Well, I said, "Do you have any anti-virus software?" I'm trying to
|
||
help him over the phone. He says "No." I said, "Do you use bulletin
|
||
board systems?" He says "Yes." "Alright, what you want to do is call
|
||
up one of these and get some anti-virus program and download it and
|
||
copy it immediately to a right-protected floppy disk. Without doing
|
||
anything else and once you've got it on there, execute it until it is
|
||
all laid out on a diskette for you and then write protect that and
|
||
then put it in your floppy drive and scan your hard drive." So that's
|
||
what he did and he found out he had the Disk Killer virus, completely
|
||
a bird of a different feather. Actually, it is more annoying. It is a
|
||
boot sector infector like Michelangelo but once you discover it, you
|
||
usually don't have much time left before it activates. It has a very
|
||
short activation period after it has been first placed on a disk and
|
||
then it encrypts the information on a disk which essentially makes it
|
||
useless to you. So he removed it, but it wasn't Michelangelo, he had a
|
||
different virus. So where were all the Michelangelo infections? Were
|
||
there any? I think it was vastly overstated.
|
||
|
||
....................
|
||
|
||
GA: You mentioned before that people who work for software
|
||
corporations write viruses.
|
||
|
||
UK: And they program viruses or collect. There just doesn't seem to be
|
||
any motivation to them other than that they are what I call stamp
|
||
collectors. They just like to have a large collection of viruses, like
|
||
people have large collections of baseball cards. That's a big thing,
|
||
baseball card collecting. Why do people want a huge collection of
|
||
baseball cards? I don't know. But I have a large collection of
|
||
viruses. So, there's that collecting thing and that's not the same
|
||
motivation as other people who write viruses. And then there's a
|
||
mischief maker, a hell raiser, an angry young man kind of guy. He
|
||
wants to put his mark on the world and have revenge on his school or
|
||
something like that and maybe he's going to write a virus. I just
|
||
don't think that there's any common denominator. Trying to write it
|
||
off to one segment of the population is idiotic. Quite frankly, you
|
||
can talk about different segments of virus programmers. To judge them
|
||
all based upon one set of rules, disgruntled and angry at the world,
|
||
is just absurd.
|
||
|
||
GA: The media does portray that whole image at the Bulgarian virus
|
||
factories.
|
||
|
||
UK: Another sexy story.
|
||
|
||
GA: Why Bulgaria? You are basically saying it's lots of other places
|
||
too and that's just a myth?
|
||
|
||
UK: Well, there are a lot of viruses that came out of Bulgaria. You
|
||
can't discount that fact. There were Bulgarian virus programmers and
|
||
there is The Dark Avenger and you don't want to minimize that, but
|
||
that's not the whole spectrum of it. Maybe they are more serious and
|
||
dedicated or they were for a time. But, no, Germany has virus writers,
|
||
Poland has virus writers.
|
||
|
||
GA: Right, Canada.
|
||
|
||
UK: There are callers to my BBS from Lisbon, South Africa, Canada. I
|
||
would assume anywhere there are computers, there are virus
|
||
programmers.
|
||
|
||
GA: And any place there are disks, there are collectors.
|
||
|
||
UK: That's right. I mean Scandinavia, India, Thailand have virus
|
||
programmers. I would be hard pressed to think of a place that doesn't.
|
||
|
||
....................
|
||
|
||
GA: We kind of touched on this before, but how can people best protect
|
||
themselves from viruses?
|
||
|
||
UK: I would say that since virus code and viruses are going to be with
|
||
us just as long as computers are going to be with us and if you are
|
||
really concerned about it, then you should try to find out some of the
|
||
basics of virus behavior so you can rule out a lot of things that
|
||
aren't going to affect you. You've got to know that a virus is
|
||
dependent upon an executable program to spread on your machine. You
|
||
must execute it first. Knowing that, any executable program that comes
|
||
into your machine then becomes, if we are not talking about boot
|
||
sector infectors here, a possible virus candidate and I would just say
|
||
that you should get a perfunctory anti-virus scanner. Find the
|
||
cheapest one you can. A lot of companies are now letting the scanner
|
||
portion of their software go for free. Don't get a lousy scanner. You
|
||
are going to have to do some reading. I can't make it easy for you.
|
||
I'm not going to make product recommendations, obviously, but you can
|
||
get some for extremely cheap if not free.
|
||
|
||
GA: So you recommend that people have something?
|
||
|
||
UK: Yeah, at this point. If you want the least amount of work
|
||
involved, get a cheap scanner or an almost free scanner if you can,
|
||
and by doing a little reading you will find out what the best product
|
||
is. You are just going to have to go a little deeper than the glossy
|
||
magazines. Be a good consumer, okay. The chances that you are going to
|
||
come across a very clever and totally new virus which is going to
|
||
become resident upon your machine and stay invisible for a long period
|
||
of time, are exceedingly rare, and I just don't think that you should
|
||
concern yourself with that. I have just never been victimized by
|
||
anything. I'm more educated so I don't worry about it. I take some
|
||
precaution but nothing like some. So get yourself a cheap scanner if
|
||
you feel you must have something, and as you go along in your
|
||
computing, try to get a good idea of what viruses do. Ignore the hype
|
||
associated with them. Most viruses are not 100% transparent. They will
|
||
misbehave in a manner that is repeatable. So if you have something on
|
||
your machine that's going wrong and it seems to be random, it's
|
||
probably not a virus because viruses are made out of discreet
|
||
instructions, and they are going to do the same thing. The problem
|
||
will repeat itself. So either you have buggy software that is
|
||
repeating the same bug or you could have a virus.
|
||
|
||
If you are going in harm's way, where you might have to worry about
|
||
possibly getting a virus infection; like if you are an obsessive,
|
||
compulsive downloader, if you use places or services that have a lot
|
||
of public flow of disks in and out, if you buy a lot of retail
|
||
software from someone that you suspect is rewrapping software that has
|
||
been used in someone else's home already, there's a possibility that
|
||
you could occasionally become infected, but still it's just not real
|
||
common. For boot sector infectors, try to keep those diskettes from
|
||
staying in the slot on the A drive at night after you turn your
|
||
computer off. If you did that and then your computer starts behaving
|
||
weirdly, then you might worry.
|
||
|
||
....................
|
||
|
||
GA: You also mentioned the virus that attacks Central Point's
|
||
software. If you don't have Central Point that virus isn't going to do
|
||
anything.
|
||
|
||
UK: Yeah, right, so what? And then you program to attack something
|
||
that presupposes a level of technical understanding which may not be
|
||
in your average disgruntled employee. You've got to have someone who
|
||
has an ax to grind for a long time to think of a really finely crafted
|
||
virus to destroy something. There are one or two viruses like the Dark
|
||
Avenger which are extremely destructive on business systems.
|
||
|
||
GA: What's the scoop with the Proto-T virus?
|
||
|
||
UK: Oh, that's just a joke. This happens periodically on the networks,
|
||
and I first noticed it on the Fidonet. Some prankster or a group of
|
||
pranksters uploaded this completely bogus story about an unknown virus
|
||
hidden in the archives of one of the numerous PKZip hacks and it was
|
||
like science fiction, it described things which were impossible for
|
||
viruses.
|
||
|
||
GA: Destroying the video card was one.
|
||
|
||
UK: That's an old one, or writing itself to video memory is completely
|
||
nonsensical because the virus would crash almost immediately. Just
|
||
from what I know of how people react on the networks, I knew that
|
||
there would be hundreds of people beginning to think that there was
|
||
some credence to it. This spread all around the world.
|
||
|
||
GA: Well, with Michelangelo, the news traveled. In 24 hours everybody
|
||
knew about Proto-T.
|
||
|
||
UK: I was just about ready to publish an issue of the Crypt Newsletter
|
||
so I had a generic resident virus that I was including in it. I
|
||
thought I would just customize it and have Proto-T as the name. I
|
||
figured that people would not read the documentation. The real story
|
||
is that this was just a name. These Proto-T pranksters came up,
|
||
whoever they are, with this stupid Proto-T story; we might as well
|
||
give them something to go along with it. It spread, it really spread.
|
||
I saw people on Prodigy, some of the hackers that show up on there,
|
||
saying that they swore they had copies of source code of Proto-T from
|
||
some virus programming newsletter, which means to me that they
|
||
stripped the code right out of the Newsletter almost immediately, and
|
||
didn't even bother to read the note that came with it. It didn't even
|
||
come close to imitating fictitious achievements of the real Proto-T
|
||
which were flatly impossible anyway. And it just spread all around.
|
||
|
||
....................
|
||
|
||
GA: What about YAM (Youngsters Against McAfee), the name is used
|
||
against McAfee so it kind of implies...
|
||
|
||
UK: You ought to look at their stuff! They spelled McAfee wrong a
|
||
couple of times. I don't know, I just don't know. What can I tell you.
|
||
I wouldn't have chosen that name but I can understand perhaps why they
|
||
might have. For a long time, the thing was to elude Scan. I noticed
|
||
this early on. It was an achievement to create a virus that Scan
|
||
couldn't catch. Actually it is not much of an achievement.
|
||
|
||
GA: No, it only lasts a month or two at most until they get a copy.
|
||
|
||
UK: What's the point? Why is McAfee a whipping boy? He just happens to
|
||
be better at public relations than the rest of the anti-virus people.
|
||
|
||
GA: That's one reason, and the other reason is that because his is
|
||
shareware and so many more people have it then the other ones.
|
||
|
||
UK: Well, it's not just shareware. There are quite a few of his
|
||
products that are cross-licensed as retail software. He's got a really
|
||
big stake in anti-virus software. He's also the best at dealing with
|
||
the reporters like during the Michelangelo scare.
|
||
|
||
GA: Early viruses used to attack institutions with power, now they
|
||
seem to mostly affect individuals. Do you think that's true and, if
|
||
so, why the change?
|
||
|
||
UK: What institutions with power?
|
||
|
||
GA: Colleges and corporations.
|
||
|
||
UK: No, I think colleges are still pretty vulnerable, don't you? They
|
||
are always going to have computer labs, where people can bring stuff
|
||
in indiscriminately. That really hasn't changed and maybe it has
|
||
moved a little more to the individuals because computers have moved
|
||
more into the homes of individuals.
|
||
|
||
GA: That's true.
|
||
|
||
UK: So, before high end PCs were the domain of a small or a medium
|
||
size business with one or two individuals who knew how to use them as
|
||
the selected employees. Now the computer has become more of a
|
||
household appliance, still not totally widespread, of course, but
|
||
moving more and more into the household where people can use it as a
|
||
glorified typewriter.
|
||
|
||
GA: Anything that you would recommend to people who would want to read
|
||
more, learn more?
|
||
|
||
UK: I'll give them my sole plug for Mark Ludwig's book on computer
|
||
viruses. It is not an evening's read. You get a lot out of that
|
||
especially if you come back to it. It impresses upon you the idea of
|
||
learning something about assembly language programming, which after
|
||
you look at it a couple of times starts to make some sense to you
|
||
whether you become an assembly language programmer or not. Probably
|
||
not. Springer-Verlag has an academic text on computer viruses but it
|
||
costs about $40, probably not something the average person is seeking
|
||
to get a hold of.
|
||
|
||
------------------------------
|
||
|
||
End of Computer Underground Digest #5.44
|
||
************************************
|
||
|
||
|