--------------------------------------------------------------------------------
INTERVIEW WITH MASUD KHAFIR / TRIDENT / THE NETHERLANDS
--------------------------------------------------------------------------------
Give me a short description of who you are!
- I am Masud Khafir, virus writer.
Age: twenty-something.
Country: The Netherlands
That's about all that I want to reveal about my identity.
From where did you get your handle, Masud Khafir?
- 'Masud' is a common name in the middle east. I chose that name in the
spring of 1991, when the kurdish rebellion in iraq was active. Their
leader was Masud Barzani. There are more rebel leaders with that name:
Masud Rajavi, leader of the Iranian Mujahedin e Khalq and Ahmad Shah
Masud, one of the Afghan rebel leaders. 'Khafir' is a word I once
found in the dictionary. It's arab and is a rude word for non-muslims.
In the south-african language it's 'kaffir' and means 'nigger'. In
Holland it is 'kaffer' and is used for calling someone an idiot. I
found it a funny word, because of its strange history.
When did you discovered the world of computers?
- A long time ago. My first computer was a C-64. That was about 10
years ago. But I have even programmed before that time.
How long have you been active in the scene?
- Like I said, I started in the spring of 1991. That's allmost 3
years now.
How did you came into the virus business?
- It started when I got a virus from a friend. I dissasembled that
virus and after that I was wondering if I could write one myself.
In the same time I started reading the virus areas on fidonet and
there I read about Todor Todorov's Virus eXchange BBS. I was very
curious about that and so I called it a few times. That's how I got
into the scene.
Positive/negative aspects of the scene?
- I think that the attitude towards the AV community is sometimes a bit
too hostile. I see it more like a chessgame, they are our opponents,
but we don't have to be enemies. Many of them are just nice people.
But of course the same is true for the other side. Some of them just
hate us. What I also don't like is the negative image of the scene,
that adolescent rebellious attitude and creating an image of oneself
as evil and dangerous. But that's just my personal opinion. This
also means that I don't like destructive viruses.
Have you been involved in any other group than Trident?
- No.
Who started/created Trident?
- It was started by John Tardy.
What's the groups goal?
- I think the main goal is to keep in touch with each other. There's not
a big cooperation on writing viruses. Everybody does its own things.
How many people are you?
- About between 5 and 10.
Do all of them program, if not, what's the others job?
- It's mainly a programmers group. But there are some non-writers
affiliated with the group.
How is Trident (currently) organzied?
- There is no real organisation. It's mainly a group of friends.
Have you got any contacts with other virus-groups/programmers?
- Some of us have contacts with others. At this moment we can have
access to Nuke-net.
Can anyone ask for membership, or are you a "private" group?
- I guess we are more or less a private group. There have been new
members in the past. In that case we just all agreed. At this moment
we don't feel to expand.
You've programmed aloth of polymorphic things, and one of them is the
Trident Polymorphic Engine, what comments have you recieved about it?
- Well, various. I have not had that many personal responses, as I am
not too easy to reach. But it has got quite some attention in the
virus/antivirus world. It's also one of the things that made the
name Trident known in the scene.
Will you continue to "upgrade" it, or is it a finished project?
- TPE is now finished. The first versions all had some bugs. I thought
that version 1.3 would be the last one, but that one still had a small
bug. Version 1.4 seems to be okay, as far as I know now. Besides, I
don't think I would want to put out a new version again, anymore.
How many strains/mutations can it produce?
- I have no idea. Enough, I think. The most important thing is that the
decryptors can not be found with wildcard scanstrings. That's the main
idea behind polymorphism. In version 1.4 I also enhanced the way in
which it encrypts, because this was a weak point.
Even thought polymorphic engine's are a great thing, not many people
seems to use them? You have any theorie why they don't?
- I think most people just want to make their own things, rather than
use someone else's products. And maybe because antivirus writers have
been quite succesful in finding ways to detect them.
Which is the best polymorphic engine around today?
- It's hard to say. I've seen several of them but I haven't done a real
close study on any of them. Each of them has its strong and weak
points, I think. Of course there are not only the engines, but also
a lot of other polymorphic viruses, like V2P*, Maltese Amoeba,
Uruguay, etc. TPE started this way too. Some of these viruses are
just as advanced as the engines. But none of those engines and viruses
is perfect. For every one of them the AV people have found a solution.
Have you ever thought of/are you currently releasing some sort of
electronic magazine (text/executable/hard-copy)
- Yes, we have been thinking about that. But we didn't have enough good
ideas (and are too lazy) to write enough articles. We rather write
code than text. We couldn't even agree on the title...
Are you into other things such as hacking and phreaking aswell, or
just viruses?
- I once was interrested in things like hacking etc. But I'm not
involved in that scene now.
Can you name a few viruses/engines you in person have written?
- The most known are: Gotcha, 7th son, Little Brother, Pogue,
CoffeeShop, WinVir, TPE, Cruncher, PlayGame, etc..
Which one was the hardest to write?
- Probably the first one: Gotcha. WinVir and Cruncher were quite
hard too.
Do you have any sort of company or law-enforcement who are trying
to hunt Trident down?
- Perhaps. This could be possible. Anyway, we keep cautious, because
you never know...
If so, are they a real threat or just "childish"?
- There is a new law against various computer crimes since 1 march 1993.
Writing a virus is not illegal. Distributing viruses in any way can be
illegal. The law is not very clear about this. If we as writers
exchange viruses amongst each others, that could perhaps be
interpreted as something illegal. Last year another guy in Holland
was arrested for hacking, and although he hasn't been convicted for
anything yet, the law enforcement has been quite tough on him. So
they certainly can make your life hard if they want to.
Have you ever had any trouble in the group with the result of
kicked members?
- No.
How good are Trident comparing to other groups?
- Well, I leave that to others to decide.
Do you have any couriers that spread your products around?
- We don't spread our viruses in the wild. But we do exchange them
with other people in the virus scene.
What do you think about the laws against h/p/v that has arrived
lately?
- They were inevitable. I don't know much about the laws in other
countries, but I think here they are too tough. The penalties are
too high. OK, these things we do might be naughty, but they not
crimes.
What do you think about various news-papers thinking us as nerds?
- They have used the same cliche's before for computer freaks in
general. I don't know, maybe it is true for some. At least I think
most of us are young, male, IQ>100, interested in technical stuff,
etc. But that doesn't mean that we're nerds. The people that I know
aren't.
Has the scene in any way influented on your real life?
- No, not really.
Would you feel guilty if one of your viruses made damage to a
hospital?
- Yes, I would. For that reason I don't write viruses that destroy data.
I usualy don't spread them in the wild at all. I only did that once,
when I was in a bad mood. I don't wanna cause other people trouble.
For me creating them is the most important thing. But of course I
also like it if they get some worldwide attention. That's human
nature, I guess. That's why I don't mind if AV people get them.
But I don't see a problem in giving them to VX people either,
because my experience is that viruses in the VX scene very rarely
leak out in the wild.
Do you see any differences between the scene now and a couple of
years ago (concerning the underground part ofcause)?
- The scene is growing and there are more contacts between each other.
A few years ago it was much harder to get in contact with other virus
writers.
Which virus-magazine do you think is the best avalible now-a-days?
- I think my favorite is 40hex.
Which virus-group/programmer do you admire/like?
- Of course Dark Avenger was one of the best, maybe the best. He often
introduced new techniques. I also people like Dark Angel from P/S.
But to be honest, I don't often take a deep look at other viruses
anymore these days.
Which country is the best virus-writing today (Before it was
Bulgaria, maybe changed)?
- I haven't heard anything from Bulgaria for a long time. Sometimes I
have some nostalgia for the times when Bulgaria was the virus centre
of the world. :-) Today it's probably the USA, because they're the
biggest country in the west. I think it's strange we don't hear that
much about Russia.
What do you think about these virus generators, such as VCL and PS-MPC?
- They are funny things. I like them for what they can do, for the
technical side of it.
What do you think about the people using them?
- It's nice to experiment a bit with them, but creating a virus this
way is defenitly not something to be proud of.
What do you think about people bragging over (almost) nothing and
ragging with other groups aswell?
- I think they're giving the virus scene a bad name.
What do you think about such individes as board-crashers?
- I don't know any of them, but I think it's rather lame.
Describe the perfect virus :
- One that is totally bug-free. One that is 100% compatible with all
programs and doesn't for example crash the computer is you start
Windows.
Describe the perfect viruscoder :
- One that invents new techniques. One that can defeat the anti-virus
programs.
Describe the AV-community with a few lines :
- We need them. I think every virus writer uses AV programs.
It is nice when a virus can be smarter than the current AV software,
but it would be scary if they wouldn't be able to find a solution for
it. But it's a shame that some AV people hate us.
Which AV-program do think is the best, and why?
- I like TBscan a lot, mainly for its heuristic features. And it's
fast. F-prot is best in identifying viruses and it's very user
friendly. I also like AVP from russia. Sometimes it's a bit slow,
but it is very powerful. It also has a very nice info section.
What do you think about the underground's future?
- I think it will continue to grow, but perhaps it will get less
exciting. Viruses are not as special and mysterious anymore as
they were before.
Do you know/heard of any new technics coming in the near future?
- No, I wish I knew...
Any advice to people who want's to learn the basic of virus-writing?
- Take a good look at other viruses and sources. Try to understand
their weak and their strong points. Test your stuff before you give
it away, because it's a shame to have dozens of bug-fix updates for
the same virus. Do it for the fun of it, and not to cause other
people trouble. And try to be original.
