Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA04599; Wed, 20 Jun 90 17:34:59 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA07247; Wed, 20 Jun 90 17:34:57 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA23615; Wed, 20 Jun 90 17:34:45 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa23689; 20 Jun 90 16:31 BST From: Anthony Appleyard To: DAVIDF@cs.heriot-watt.ac.uk Date: Wed, 20 Jun 90 16:38:32 BST Message-Id: <$TGWGCZNQBTVT at UMPA> Subject: Virus-L vol 0 issue #1107 Virus-L Digest Mon, 7 Nov 88, Volume 0 : Issue #1107 Today's Topics The INTERNET/MILNET virus administravia Forwarded request for statistics on Internet Virus forwarded comments on Internet virus from W.H. Murray Re: Virus on the Arpanet Networks Trojan vote counting? forwarded comments on media coverage from J.D. Abolins Who is ** no subject, date = Mon, 7 Nov 88 16:24:45 EST Computer Virus Association nVIR virus Re: CHECKUP 1.8 CHECKUP 1.8 for the IBM Please! ** no subject, date = Mon, 7 Nov 88 14:11:16 CST ** no subject, date = Mon, 7 Nov 88 17:29:54 CST Re: About the virus notices Re: Please! Re: MILNET/ARPANET Virus ------------------------------ Date: Mon, 7 Nov 88 09:25:33 +0200 From: Omer Zak Subject: The INTERNET/MILNET virus Here are my 0.03NS (approx. $0.02) about defense against this virus (or bacterium or worm, whatever it is) and similar virii in the future. It is said that the British JANET is immune against this virus (not sure) because it uses somewhat different protocols. Also, IBM mainframes, CRAY, and non-UNIX operating systems were spared from this virus, although in principle a more sophisticated virus can be written to infect everything (the idea of having it copy over a source program and compile it on the target computer is VERY clever indeed). The way to make it very difficult for this virus (and similar) to spread even if it compiles source code in-situ is to make each link in each network run a different protocol| And make it impossible to guess what exact protocol is being used in each link. It may be a thing like changing the order of fields in packets, different command names and the like. Make it a bit harder to port programs and shell scripts from one system to another, by contriving some system-specific command names (users may be asked to run an 'incoming translation' program on scripts which they accept from other systems, before the scripts can be run on their own systems; the 'incoming translation' program should have a different name in each system, and not be easy to locate). In short, make it difficult for a virus to figure out how to send files to the next computer yet keep them alive. --- Omer "Be accessible to deaf persons via the phone. Make sure you have a Bell 103 compatible modem at your home." -------------------- Date: Mon, 7 Nov 88 08:10:20 EST From: Ken van Wyk Subject: administravia First of all, I'd like to thank everyone who sent in useful information about the recent Internet Virus. I'd also like to point out, as someone mentioned, that we did get a lot of duplication during the "storm". In particular, the RISKS digest articles were sent to the list at least 4 or 5 times! That's senseless and it only clogs peoples' mailboxes. Also, messages like "how do I get off of this list?" should be sent directly to me, the list owner. Things obviously got rather hectic on Friday and over the weekend; let's please try to remain sane, even in circumstances like that. Thanks in advance! On another note, I'd like to hear (privately) from people who found that the information on the Internet Virus that they received via VIRUS-L was useful in containing the virus at their site(s). It's primarily a personal interest matter, and I'll summarize to the list after I've received some responses. So, people who run BSD 4.3 machines that were infected by this virus, please send me a one-liner (or whatever you want) just saying whether or not you found the information on VIRUS-L useful. Thanks. Ken Kenneth R. van Wyk Calvin: (hammer hammer hammer ...) User Services Senior Consultant Mom: Calvin, what are you DOING to the Lehigh University Computing Center coffee table?! Internet: Calvin: Is this some sort of trick BITNET: question? -------------------- Date: Mon, 7 Nov 88 09:21:53 EST From: "Kenneth R. van Wyk" Subject: Forwarded request for statistics on Internet Virus The following request was forwarded to me; please respond directly to the sender, Cliff Stoll : Date: Sun, 6 Nov 88 05:34:47 PST From: cliff@Lbl.Bitnet (Cliff Stoll) COLLECTING ARPANET VIRUS STORIES I'm collecting information about the Nov 3 Arpanet virus, trying to determine: > How many sites were infected > How many were not > How quickly it spread SO: If you were infected, please send me a note describing your experiences. Please include: > Where are you? What type of computers? > What times were stamped on the /usr/tmp/x files? > Which of your computers were infected? All of them? Please send your anecdotes & stories, such as: > What time did you discover it? > What tipped you off? > How did you and your colleagues respond? > What would you differently? > Did you call anyone? Or did anyone call you? > Where would you turn for information next time? > When did you finally eradicate it? > Any weird wrinkles or strange effects? I'm interested in hearing from you even if you were not infected! Please pass this message on to others: I would rather have multiple responses from a site than none. Thank you very much for your time & trouble. In return, I'll mail summaries to everyone that contributes. If you'd like a copy, please include your address. Thank you very much for your time & troubles! Cliff Stoll Harvard/Smithsonian Center for Astrophysics 617/495-7147 60 Garden Street, Cambridge, MA 02138 Cliff@cfa200.harvard.edu ( or on bitnet, Cliff@lbl ) [Nov 5, '88] Kenneth R. van Wyk Calvin: (hammer hammer hammer ...) User Services Senior Consultant Mom: Calvin, what are you DOING to the Lehigh University Computing Center coffee table?! Internet: Calvin: Is this some sort of trick BITNET: question? -------------------- Date: Mon, 7 Nov 88 09:28:56 EST From: "Kenneth R. van Wyk" Subject: forwarded comments on Internet virus from W.H. Murray Date: Fri, 4 Nov 88 10:29 EST From: WHMurray@DOCKMASTER.ARPA Subject: Unix Virus The New York Times quotes an unidentified caller as saying "because the designer did not understand how the network worked, it [the virus] quickly copied itself thousands of times from machine to machine." The sorceror's apprentice strikes again. William Hugh Murray, Fellow, Information System Security, Ernst & Whinney 2000 National City Center Cleveland, Ohio 44114 21 Locust Avenue, Suite 2D, New Canaan, Connecticut 06840 Kenneth R. van Wyk Calvin: (hammer hammer hammer ...) User Services Senior Consultant Mom: Calvin, what are you DOING to the Lehigh University Computing Center coffee table?! Internet: Calvin: Is this some sort of trick BITNET: question? -------------------- Date: Mon, 7 Nov 88 07:34:00 EST From: "Joseph M. Beckman" [0666] (42 lines) Stoll.CCS 11/06/88 0806.7 est Sun bb Subject: Re: Virus on the Arpanet *** PLEASE DISTRIBUTE THIS NOTE WIDELY THANK YOU! *** REDISTRIBUTE THIS NOTE TO ANY PLACE YOU THINK BEST - THANX!*** COLLECTING ARPANET VIRUS STORIES I'm collecting information about the Nov 3 Arpanet virus, trying to determine: > How many sites were infected > How many were not > How quickly it spread SO: If you were infected, please send me a note describing your experiences. Please include: > Where are you? What type of computers? > What times were stamped on the /usr/tmp/x files? > Which of your computers were infected? All of them? Please send your anecdotes & stories, such as: > What time did you discover it? > What tipped you off? > How did you and your colleagues respond? > What would you differently? > Did you call anyone? Or did anyone call you? > Where would you turn for information next time? > When did you finally eradicate it? > Any weird wrinkles or strange effects? I'm interested in hearing from you even if you were not infected! Please pass this message on to others: I would rather have multiple responses from a site than none. Thank you very much for your time & trouble. In return, I'll mail summaries to everyone that contributes. If you'd like a copy, please include your address. Thank you very much for your time & troubles! Cliff Stoll Harvard/Smithsonian Center for Astrophysics 617/495-7147 60 Garden Street, Cambridge, MA 02138 lbl ) [Nov 5, '88] - -[0666]--- (pref = [0665], nref = [0667]) -------------------- Date: Mon, 7 Nov 88 14:51:10 GMT From: ZDEE676@OAK.CC.KCL.AC.UK Subject: Networks It seems the latest virus had trouble spreading across networks. Can anyone out there explain to me what networks there are and how they are connected. It seems there are many networks, many of which connect the same sites together. As this isn't strictly relevent, it maigh tbe better to directly mail me.. John Burton (King's College London) zdee676@uk.ac.kcl.cc.oak or possibly zdee676@oak.cc.kcl.ac.uk (I'm never sure which it is ) -------------------- Date: Mon, 7 Nov 88 10:02:00 EDT Comments: Warning -- RSCS tag indicates an origin of SMTPUSER@OBERLIN From: "$CAROL@OBERLIN (BITNET)" <$CAROL@OBERLIN> Subject: Trojan vote counting? The 11/7 issue of The NEW YORKER carries an article, "Counting Votes," about the lack of safeguards in such election equipment as the Votomatic system. The potential for dastardly deeds of the kind VIRUS-L discusses seems immense. | Carol Conti-Entin (216) 775-8290 | $carol@oberlin -or- pconti@oberlin (BITNET) | Academic Computing Consultant | Houck Computing Center | Oberlin College | Oberlin, OH 44074 -------------------- Date: Mon, 7 Nov 88 10:51:24 EST From: "Kenneth R. van Wyk" Subject: forwarded comments on media coverage from J.D. Abolins The following are some remarks from J.D. Abolins regarding the media coverage of the Internet Virus: Quick glimpses of media handling of the ARPANET case.... I first heard about the ARPANET case through a Cable News Network television story about the case last Thursday night. The story was some vague and appeared quite incomplete.It mentioned that a "virus" had affected a computer network linking academic and govenment computer centers accross the United States. No mention was made of the specific network. Nor was there a clear explanation of exactly what kinds of computers were affected. THe film footage kept on going back to a CRAY supercomputer array. In short, the main thing that could be derived form the story was that something had happened to amy computer systems, tying them up. The rest was obscured, mostly due to the reporters' lack of knowledge about the computer viruses and computers in general. The next report I heard was from CBS News Radio. This report had more details, but still sketchy. Then, I read the Friday New York Times article by John Markoff. While the article did not clarify how much of the actual problems were caused by the problem program acting like a virus and how much was caused by it acting as a bacterium, it was a well detailed report.(I've seen it reprinted on RISKS DIGEST. Since I have not gotten my last week's VIRUS-L LOG, I don't know if the reprint got to VIRUS-L.) I am still going through the flurry of reports and articles about the case that have appeared over the past few days. But here are a couple of other items that have appaered lately. On the NBC comedy program Saturday Night Live, Dennis Miller, the anchorman for a TV news parody, commented about computer viruses to the effect, "Remember, when you are uplinking to another computer, you are uplinking to every computer that the other computer has uplinked to." (Analogy to comments made about AIDS.) This morning, NBC's TODAY news sfeature show had a segment on the ARPANET case. The program interviewed John McAfee of the Computer Virus Association in a television link to San Francisco, Calif. Mr. AcFee estimated the losses to the case to be about $20 million spent in manhours to clean-up the affected systems. He said that if the virushad destroyed data, the damages would have been in the billions of dollars. The Computer Virus Association claims that it has counted 300 virus cases. During the interview, Mr. McAfee explained that the the "virus" was not originally intended to be harmfull. Rather, it was intended to travel slowly through the network leaving its copies as "flags" attesting to the program's spread. But a programming error resulted in the rapid replication that clogged the computer resources. When asked if there were any absolute safeguards against viruses, Mr. McAfee replied that while known cases can be effectively countered, the development of new "viruses" preclude an absolute, 100% protection scheme. Kenneth R. van Wyk Calvin: (hammer hammer hammer ...) User Services Senior Consultant Mom: Calvin, what are you DOING to the Lehigh University Computing Center coffee table?! Internet: Calvin: Is this some sort of trick BITNET: question? -------------------- Date: Mon, 7 Nov 88 14:07:21 EST From: Joe Sieczkowski Subject: Who is Who is the Computer Virus Association and who are they affiliated with. Are they just some private group? Joe -------------------- Date: Mon, 7 Nov 88 16:24:45 EST From: OJA@NCCIBM1 Quick correction: In my previous message, I rendered the network that was affected by a "virus" as ARPNET. It should be read as ARPANET. The ARPA comes from the abbreviation for Defense Advanced Research Projects Agency. (The "D" for Defense is not used.) As for the question about the Computer Virus Association, I myself am trying to find out more about it. It seems to be an association for developers of anti-viral software. From what I saw this morning, John McAfee is considered as one of its spokespeople. -------------------- Date: Mon, 7 Nov 88 17:59:00 EST From: Dimitri Vulis Subject: Computer Virus Association MIS week, vol 9, no 35 (aug 29 this year) had a first-page feature blasting the Computer Virus Industry Association and its leader John McAfee. (the later also runs the National Bulletin Board Society) There was also some negative stuff in PC WEEK. The article is pretty long; if there is sufficient interest, I'll key in a digest. By the way, this coming Friday I'm giving a talk in class about computer viri; are there any suggestions as to what I should say? -Dimitri -------------------- Date: Mon, 7 Nov 88 16:07:53 PST From: Sam Cropsey Subject: nVIR virus We recently had an attack of the nVIR virus and I need more info about it. I read an article by Mike Scanlin in MacTutor that was very helpful. However the article failed to mention what to do if the virus settled in a desk acceso y or in the Finder. If anyone has more info, please let me know. Thank you... -------------------- Date: Mon, 7 Nov 88 15:41:00 MST From: LYPOWY@UNCAMULT Subject: Re: CHECKUP 1.8 In-Reply-To: Message of 4 Nov 88 07:08 MST from "David A. Bader" Date: 4 November 1988 07:08 mst From: David A. Bader Subject: CHECKUP 1.8 A number of people have sent me flames because I did not specify what machine I was working with when I mentioned Checkup 1.8.. I apologize, it is written for an IBM Microcomputer type system. -David Bader DAB3@LEHIGH David, is this program PD or commercial?? Greg. -------------------- Date: Mon, 7 Nov 88 20:08:37 EST From: "David A. Bader" Subject: CHECKUP 1.8 for the IBM >From: LYPOWY@UNCAMULT >Subject: Re: CHECKUP 1.8 >To: "David A. Bader" >In-Reply-To: Message of 4 Nov 88 07:08 MST from "David A. Bader" >David, is this program PD or commercial?? > Greg. Greg, It is a PD program (am not sure about whether or not it is "Shareware", "Freeware", or something unique like that; but you do not need to spend money initially to acquire it.) -David Bader, DAB3@LEHIGH -------------------- Date: Mon, 7 Nov 88 09:16:53 EST From: Ben Chi Subject: Please! What's all this about virii? "Virii" is the plural of "virius." If you mean more than one virus, try "viruses" or, if you must, "viri." On the other hand, we could let virii = 2 viruses viriii = 3 viruses viriv = 4 viruses virv = 5 viruses etc. -------------------- Date: Mon, 7 Nov 88 14:11:16 CST From: C397739@UMCVMB Just a side note (ha ha oh well) on this virus from this weekend.. An astute friend of mine said that he couldn't believe the dude who wrote the virus allowed himself to be caught, which makes sense to me. If they get evidence on the person, it must surely be a frame job, right? -------------------- Date: Mon, 7 Nov 88 17:29:54 CST From: "Mark S. Zinzow" In-Reply-To: Message of Mon, 7 Nov 88 16:24:45 EST from >As for the question about the Computer Virus Association, I myself >am trying to find out more about it. It seems to be an association >for developers of anti-viral software. From what I saw this >morning,John McAfee is considered as one of its spokespeople. I'm not sure about the Computer Virus Association, but John McAfee is a sysop of the National BBS Society Homebase BBS. He also works for Interpath Corporation which sells anti-virus software. The bbs number (408-988-4004) was mentioned in an early article posted to virus-l entitled Anti-Virus Measures. I called when we were hit with brain here, and Mr. McAfee was gracious enough to break in to chat while I was leaving a note to the sysop about our problem at log off. There also seems to be another organization involved, the Interactive Communications Users Guild which I think is a SIG of the National BBS Society. He has since been most helpful in dealing with our infection. P.S. The article is available here via anonymous ftp from uxe.cso.uiuc.edu (128.174.5.54) in pc/virus/virdoc2.txt as well as from the Homebase BBS. - -----Electronic Mail----------------------------U.S. Mail-------------------- ARPA: markz@vmd.cso.uiuc.edu Mark S. Zinzow, Research Programmer BITNET: MARKZ@UIUCVMD.BITNET University of Illinois at Urbana-Champaign CSNET: markz%uiucvmd@uiuc.csnet Computing Services Office "Oh drat these computers, they are 150 Digital Computer Laboratory so naughty and complex I could 1304 West Springfield Ave. just pinch them!" Marvin Martian Urbana, IL 61801-2987 USENET/uucp: {ihnp4,convex,pur-ee,cmcl2,seismo}!uiucdcs!uiucuxc!uiucuxe!zinzow (Phone: (217) 244-1289 Office: CSOB 110) ihnp4!pyrchi/ \markz%uiucvmd -------------------- Date: Mon, 7 Nov 88 16:23:00 MST From: LYPOWY@UNCAMULT Subject: Re: About the virus notices In-Reply-To: Message of 6 Nov 88 14:42 MST from "Savior faire is everywhere!" Date: 6 November 1988 14:42 mst From: Savior faire is everywhere! Subject: About the virus notices Can we get a little organized around here? I have just received two message containing the same article from RISK. This is the second or third time thi happenned. We should just designate one person to forward all messages from RISK concerning the virus. -Santanu Sircar- I must appologize, my message APPEARED later than the rest (at least it did to me), but I sent it on wednesday or so. I guess the delay in getting messages from here in Canada down to Bethlehem (Lehigh really) is greater than from other areas. As far as Risks submissions go, I (as many of you are I am sure) am a subscriber to the Risks Digest List, and I would be willing to take on the responsibility of posting anything from Risks that I feel in some way relates to Virus-L. Greg. P.S. Risks Digests 7.69, 7.70, and 7.71 all cover the InterNet Virus in some light. -------------------- Date: Mon, 7 Nov 88 23:05:00 MST From: LYPOWY@UNCAMULT Subject: Re: Please! In-Reply-To: Message of 7 Nov 88 07:16 MST from "Ben Chi" Date: 7 November 1988 07:16 mst From: Ben Chi Subject: Please! What's all this about virii? "Virii" is the plural of "virius." If you mean more than one virus, try "viruses" or, if you must, "viri." On the other hand, we could let virii = 2 viruses viriii = 3 viruses viriv = 4 viruses virv = 5 viruses etc. (Please understand that I don't mean this to be a flame) The only proper plural form of the word virus is viruses. Virus is NOT a Latin word, and hence should not be declined like one. (In fact viri can be any one of the Genitive singular, Nominative plural, or Vocative plural forms of the noun man (vir)). Just so that we can avoid a major bagging session as has occurred on USENET in teh past. :-) Greg. -------------------- Date: Mon, 7 Nov 88 11:44:52 EST From: "Christian J. Haller" Subject: Re: MILNET/ARPANET Virus In-Reply-To: Message of Sat, 5 Nov 88 16:12:00 MST from > Greg Lypowy >P.S. Chris Haller, what have things been like at Cornell (where this >'virus' is purported to have emanated?? > >P.P.S. To You All -- Is this a true virus or could we better define it >as a worm?? - ------------------- At Cornell things were much the same as elsewhere. We were hit by the worm about 1:30 AM Thursday. From what I have heard, we were not the first ones affected, but given the cleverness of the scheme of attack that should be no surprise. The author could have launched the worm manually into one or more distant systems from here, and it would seem to have started there. Overall, about 100 Cornell computers were affected, and some are still cut off from our campus backbone net pending thorough cleanup. At that hour of the morning, the symptoms of periodic crashes and slowdowns went mostly unnoticed. Next morning, we read the NetNews that many sites were under attack, discovered we were too, and immediately disconnected Cornell from Internet and also disconnected all our subnets from one another to isolate the worm from any vulnerable systems not yet invaded. The Supercomputing Facility was back on line in about 30 minutes, once we were sure it would not be affected, and other subnets came back one by one during the day. Our EE Dept. and the Theory Center (which is the organization behind supercomputing here) got hold of the fixes for VAXen from outside sources (UCB and MIT, right?), while the Laboratory for Solid State Physics developed program fixes for Sun workstations, and the Laboratory for Plasma Studies developed a local repair procedure for Ultrix.By T with one another. As for the perpetrator, he seems to be a modern Sorcerer's Apprentice. It seems he intended no real harm, and I have heard more than one person say he did us (not Cornell, but us computer users) a big favor by showing so clearly that even a manager could understand it, that we are far from protected against such encroachments. We know no more about his motives than we have read in the newspapers. The NY Times and Washington Post have had lengthy articles, and seem to have had access to sources not yet available to Cornell or the Computer Science Department. (I.e., anonymous phone calls from his friends.) He is a nice person, we know from acquaintances: sings in the choir, for example. I suppose the Cornell administration cannot possibly let him get away without some kind of official punishment, but I for one don't think he deserves a very severe one. The cost of restitution alone would be enormous if he had to reimburse people for some fraction of the time they have spent cleaning up, not to mention discussing the matter! -Chris Haller, Technical Services, Cornell University DISCLAIMER (gee, first time I figured I needed one): these views are mine, not official positions of Cornell U. or God or lawyers. -------------------- *** end of Virus-L issue ***