VIRUS-L Digest Friday, 27 Oct 1989 Volume 2 : Issue 225 VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc., and sent to VIRUS-L@IBM1.CC.LEHIGH.EDU (that's LEHIIBM1.BITNET for BITNET folks). Information on accessing anti-virus, document, and back-issue archives is distributed periodically on the list. Administrative mail (comments, suggestions, and so forth) should be sent to me at: krvw@SEI.CMU.EDU. - Ken van Wyk Today's Topics: A lesson involving 'CRACKERS' (APPLE II) Virus infection in commercial package (PC) How to get start to be an anti-virus worker for Mac? re: Jerusalem virus infects boot sector ? No! (PC) "THIS_1S_NEXT" virus? (PC) re: Jerusalem virus infects boot sector ? No! (PC) Imbeded virus detection A new virus from Iceland (PC) --------------------------------------------------------------------------- Date: Thu, 26 Oct 89 18:43:55 +0000 From: ZDEE699@ELM.CC.KCL.AC.UK Subject: A lesson involving 'CRACKERS' (APPLE II) This message is being sent to both RISKS and VIRUS lists. Apologies to those who receive both digests. I was well shocked in finding-out that there was actually a virus running on the Apple II family of computers ! Where could the LODE RUNNER virus have infected such a small machine, with no integrated hard disk, and the possibility of rebooting the machine quickly by using a simple sequence of control codes ? (open-apple-ctrl- reset ). In FRANCE, of course ! The Apple II did very well in France. It is very widely used over there. This success, like in the U.S.A., triggered a large market for pirated copies of programs. I have been an Apple II owner since 1982. It is absolutely amazing how many copies of programs went around since that time. I guess that virtually every program for this type of computer was available as a pirated copy in France. This is because of the following: 1. There are laws about unlawful software copying, but they are very hard to enforce. In addition to that, it is extremely difficult to find the originators of the software. ie: The "top" pirates are well hidden, and if the police was to catch every person who copies a program, then they'd probably have to prosecute virtually *any* computer user ! 2. Most software was copied and "exchanged" against other software, a bit like a one to one swap. Commercial pirate factories were discovered in Lyons a few years ago. There, the programs were deprotected, copied, and then protected again, and sold to customers for a fraction of the price. The pirates were arrested and heavily fined (and given a prison sentence). SOME SORT OF COMPETITION There were many independent groups of pirates. The average age was 16-22 years old. All of them were experts at Apple II's Disk Operating System. The most "advanced" of these "crackers" were the CCB. CCB for "Clean Crack Band". From the number of programs that they have cracked, they seemed to spend their days and nights cracking games and software. Some French magazines and newspapers wrote articles and interviews with them. They even went on national French TV. Of course, they were in hiding; a bit like drug dealers, really. The quality of their "work" was unbelievable. The program was as good as new, only it had their name in the presentation page. Often, they added pretty graphics, and additional options in some cases. In fact, it looked as though they had completely re-written the program entirely. At the end of 1985, I think, they renamed themselves, the SHC, "Solex Hack Band". (A Solex used to be a cheap moped at the time) They hacked a few French Computers by using dial lines; they did one "Hacking" direct, on TV, showing the journalists how vulnerable computers were. Since that time, I don't know what happened to them. OTHER GROUPS There are a lot of other groups of pirates around France. The CCB were based in Paris (according to the press), and the two most famous members of this group called themselves: Aldo Reset, and Laurent Rueil. Other groups include: - - Johnny Diskette: this name was used by many anonymous pirates who had formed some kind of club in Paris, where they had competitions (!) on who would be the fastest to unprotect a disk. - - BCG (Baby Crack Gang): funny name. They seemed to like Karateka games. - - CES (Cracking Elite Software): They added features to games from time to time. - - Chip Select and the Softman: These pirates went as far as including a digitised picture of themselves wearing dark glasses and saying: "I am Chip Select". A Certain Eric IRQ (Interrupt Request) was also part of this group. - - Mister Z (Geneva): These were Swiss pirates, but for some reason, they were sending copies to French crackers, telling them to change the title page that they had made-up. It was some kind of competition of: "We can protect this program; can you unprotect it ?" - - MAC (Marseilles Association of Crackers): group based in Marseilles. - - P.Avenue Nice: and this one is in Nice... These groups deprotect the software. Once deprotected, it can be copied very easily using a normal copy program. Most copying goes-on in large computer centres, where machines can be used free of charge. There is no supervision there, and no control on what goes-on. Somes places are popular just because it is such an easy way to get hold of any program for no charge (well... just the cost of a diskette). Since 1987, though, the shops are more careful since they could be held responsible for what happens on their machines. HIDDEN INFO If you use a track/sector disassembler, you can see the information on the tracks of the disk displayed as ASCII characters. Often crackers would converse between themselves in this way. Software is copied through a string of intermediaries, and the messages can therefore be passed this way. It is impossible to know if there is some hidden information on the disk if it is not analysed by using a track/sector disassembler. It is therefore very easy to hide other programs within the disk, whether they are games, or even viruses ! IN CONCLUSION So in fact, considering the level of expertise that these crackers have, it would be very easy for them to hide a virus within a floppy disk, which would be triggered by the actual program. I am talking here about the APPLE II computer, but I am sure that other computers (including PC's) have their "expert" crackers, who no doubt, would be very happy to write viruses/worms/trojan horses/time bombs etc. Why do they do it ? My idea is that they do it for "fame", just to see other people talk about "their" virus. Any suggestions ? Olivier Crepin-Leblond, Computer Systems & Electronics, Electrical & Electronic Eng., King's College London Disclaimer: My own views. Any comments/flames/congratulations welcome ! ------------------------------ Date: Thu, 26 Oct 89 16:42:57 -0400 From: TENCATI@NSSDCA.GSFC.NASA.GOV (SPAN Security Manager (301)286-5223) Subject: Virus infection in commercial package (PC) AI32 October 23, 1989 FROM: AI32/Fred A. Rodrigue SUBJECT: Personal Computer Virus Attention: Personnel responsible for personal computers. Kennedy Space Center (KSC) has discovered a virus in a commercially purchased software package, Unlock Masterkey. The HELP.COM file contained the 648 virus, also known as the Vienna virus, Austrian virus, DOS-68 virus and the One-in-Eight virus. Fortunately, the virus was not active because there was no "jump" to the malicious code. The virus was discovered by Lockheed Space Operations Company, a KSC contractor, using a commercially available virus detection program. The infected diskette was marketed by a company, Transec Systems, Inc., that has gone out of business. PCEasy, Inc., Unlock Masterkey's developer, learned of the virus several months ago and notified its customers. PCEasy, Inc., has no knowledge of Transec Systems, Inc., customers. Additional information is available from Mark Mason, EX-INF, Kennedy Space Center, FL 32899, (407)-867-7293, FTS 823-7293. In case of an incident, contact AI32, Fred Rodrigue, 544-2843 or Bob Keasling, 544-1223. original signed by Fred A. Rodrigue Automated Information Security Coordinator ------------------------------ Date: 24 Oct 89 20:36:35 +0000 From: wcpl_ltd@uhura.cc.rochester.edu (Wing Leung) Subject: How to get start to be an anti-virus worker for Mac? I've been reading this news group for quite a while and I am very interested to become an anti-virus worker. I do have the basic antiviral programs like disinfectant, but I'd like to know more about virus from the lower level. I have Fedit and Resedit. Can anyone recommend me to a good reference to get start with? Basically I am focusing on Mac. Thanks in advance. Peter-- _ _ ____ ____ _ * Internet: wcpl_ltd@uhura.cc.rochester.edu (/ / // / // ) (/ * BITNET : WCPL_LTD@UORDBV / / / // //___/ _/ * DecNet : UORHEP::PETER /_/_/ //__/ // _/\___/ * UUCP : ...rochester!uhura!wcpl_ltd ------------------------------ Date: 27 Oct 89 00:00:00 +0000 From: "David.M..Chess" Subject: re: Jerusalem virus infects boot sector ? No! (PC) No, the only viruses I've ever heard called "Jerusalem" infect only COM and EXE files. So either what you were reading just contains an error (happens to all of us!), or they're using the name "Jerusalem" to describe some other virus (not a good idea...). DC ------------------------------ Date: Thu, 26 Oct 89 16:24:01 -0500 From: Dave Boddie Subject: "THIS_1S_NEXT" virus? (PC) I need to find some quick information from anyone who knows what type of virus replaces your harddisk label with the above subject line. I have just notice this to appear on the label, and I have no idea what it (the perpetrator) will do, or when it will do its little job. VIRUSCAN v4.2 will not locate any virus on this machine. By the way, can I get a copy of the new version of 'SCAN from someone??? Dave Boddie Computer Operator Remote4 Lab University of Arkansas, Fayetteville ------------------------------ Date: 27 Oct 89 00:00:00 +0000 From: "David.M..Chess" Subject: re: Jerusalem virus infects boot sector ? No! (PC) I wrote to Jan T. about this, and he confirms that the "Jerusalem" does *not* infect boot sectors. His officially-distributed list of virus signatures doesn't say that it does, so what you were reading was probably a version that someone else had modified by inserting wrong information. Message from Jan follows. (Note that the "Virscan" program that he's talking about is *not* the IBM Virus Scanning Program, but another program whose executable is also called VIRSCAN...) " I would appreciate if you could explain that the list that is distributed via " the "Software Distribution Network" on FIDONET is a *verified* list of virus " signatures that has been extensively tested by a number of people. The list " contains a notice not to distribute modified copies of the original file. " For those without access to other networks, the latest fresh copy of the " VIRSCAN.DAT file is available on any of the "SDN" nodes in FIDONET within 24 " hours after the master copy on 2:512/10.0 is refreshed. The file is usually " available as VIRUSSIG.ZIP or VIRUSSIG.PAK " Anything that is not directly pulled off a "SDN" node is probably not the " original...... " " There were several modified versions of the file going round with the wrong " information and 1 version of the file rendered the Virscan program useless " because of the info being in the wrong format, pointing to EXE instead of COM " files, etcetera. " " ------------------------------ Date: Fri, 27 Oct 89 11:51:19 -0400 From: Bob McCabe Subject: Imbeded virus detection As a consultant who writes software for the PC I am worried about the possibility of my programs getting infected and becoming vectors by which viri are spread. In particular I am developing an application that will be hand carried from site to site to gather data by a number of users. If this program were to get infected it could cause wide spread loss of data to an important research project, not to mention other programs and data on affected systems. I am looking at including a check to see if there has been any change in the EXE files. Failure on such a check would cause the program to disable it's self and report a possible infection. While working out the algorithm for this check it struck me that it should be possible to work out a scheme by which any program could check itself at load time for infection. In order to avoid programs using identical checks that a virus writter could get around, the algorithm would include some form of encryption parameter that could be 'customized' in each program. Presently, I am working on a system of prime number coding in which the CRC check of the EXE file is compared with a encoded CRC. The coding of the CRC would be done with a large prime number, chosen at random from a table. If written in assemblier this scheme would not slow down load time by that much. I have not had much time to persue this but hope to get back to it next month. I would welcome any comments, criticisms and suggestions. ======================================================================== BITNET : PSYMCCAB@VM.UOGUELPH.CA Bob McCabe CoSy : bmccabe Computer Consultant Phone : (519) 821-8982 University of Guelph Guelph, Ont. Canada ========================================================================= ------------------------------ Date: Fri, 27 Oct 89 17:08:16 +0000 From: Fridrik Skulason Subject: A new virus from Iceland (PC) New virus - first report...... I have just obtained a copy of a new virus, which seems to be of Icelandic origin, at least a text string inside the virus contains the message "Ghostballs, Product of Iceland" The virus is a combination of the Vienna virus and the Ping-Pong virus. It infects .COM files, just like "Vienna", but at the same time it tries to place a copy of Ping-Pong on the boot sector in drive A: This copy of Ping-Pong has, however, been heavily patched. Actually it can not be called a virus, since it does not replicate - large parts of the code have been replaced with NOP instructions. The "Vienna" part seems to have been only slightly modified, but I have not yet had time to disassemble it. Infected files grow by 2351 bytes. This virus was discovered when a person I had given an utility to remove the Ping-Pong virus called back to complain that it did not work, the virus would simply reappear on all diskettes, even if he booted from a "clean" diskette. The reason was that most of his .COM files on the hard disk had been infected. One final note - the patched Ping-Pong virus seems based on the '286 variant reported recently. ------------------------------ End of VIRUS-L Digest ********************* Downloaded From P-80 International Information Systems 304-744-2253