|
Rumors of Worms and Trojan Horses
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
RUMORS OF WORMS AND TROJAN HORSES
Danger Lurking in the Public Domain
introduced and edited by Mike Guffey
-INTRODUCTION
There are literally thousands of free (or nearly free) programs
available in computerdom's Public Domain. Those who use them save
hundreds of dollars and thousands of hours. But many sneer at
the idea of anything worthwhile being "free". Thus personal
computing becomes divided into two camps: those who believe there
are two camps and the rest who use Public Domain software (but
sport no sense of moral superiority).
For several years now rumors have circulated about dangerous
programs which, when run, infest the innards of personal
computers like parasites. And unlike most software, these
insideous programs don't go away when the power is shut off. The
story is they invade ROMs and "eat" memory away each time
hardware is powered up.
The legends have a basis in fact. For such horrors =do= exist in
the world of mainframes. Probably first created by a bored or
disgruntled programmer, such programs have been unleashed inside
some of this country's largest computers. Generally, they are
not outwardly visible, but begin the attack like a low grade
fever. And these horrible little strings of code do damage a
little at a time, slowly building in intensity. At first, things
start going slightly awry. Ultimately, the system crashes or
must be shut down. One recent magazine article called these
creations "computer viruses". Just =how= damaging such programs
can be (or have been) has not been fully publicized. But the
facts lie on a razor's edge between science fiction and
tomorrow's headlines. They are believed to pose a serious
potential threat to national security.
Some say the first of such monsters appeared on computer bulletin
boards (BBS's) named "WORM.COM". [Remember that it is only
recently that any online descriptions began to be posted next to
program names. Some BBS's, notably CP/M based systems, still do
not offer any explanation beyond the program name or notes in the
associated message base part of the system.] And almost every
computer user group has at least one experienced member who can
tell the horrible tales of what these programs do. Actual
witnesses to the destruction or victims of the atrocities seem to
be =very= rare.
Related to the twisted thinking behind such criminal mischief is
the so-called "TWIT" phenomenon. Twits are computer vandals who
glory in breaking into and "crashing" or seriously damaging
remote computer systems. The targets range from neighborhood
BBS's to any large computers which can be accessed via phone
lines. And while such mental midgets have bee?hglorified in the
media and mis-labeled as "hackers", their very existence causes
hysteria in and amongst the non-computing public at large.
Computer security for large and small remote computer systems is
getting better at screening out or scaring off "twits". But they
still exist. There are indications that some have graduated from
incessant attempts to break into BBS's. Instead they bring forth
Trojan horses: damaging programs disguised as utilities and
mis-labled or misdocumented as new treasures of the Public
Domain.
===]#[===
The following data was recently retreived from a California BBS:
WARNING! DANGEROUS PROGRAMS
1) Warning: Someone is [or may be] trying to destroy your data.
Beware of a SUDDEN upsurge of [spurious] programs on Bulletin
Boards and in the Public Domain. These programs purport to be
useful utilities, but, in reality, are designed to sack your
system.
One has shown up as EGABTR, a program that claims to show you how
to maximize the features of IBM'S Enhanced Graphics Adapter. It
has also been spotted renamed as a new super-directory program.
It actually erases the (F)ile (A)llocation (T)ables on your hard
disk, [thereby rendering all data useless and inaccessible]. For
good measure, it asks you to put a disk in Drive A:, then another
in Drive B:. After it has erased those FATs too, it displays,
" Got You! Arf! Arf! "
Don't [casually] run any public-domain program that is not a
known quantity. Have someone you know and trust vouch for it.
ALWAYS examine it FIRST with DEBUG [or DDT or a similar
utility]. Look at all the ASCII strings and data. If there is
anything even slightly suspicious about it, [either] do a cursory
disassembly [or discard it]. [For MSDOS programs] be wary of
disk calls (INTERRUPT 13H), especially if the program has no
business writing to the disk. Run your system in Floppy only
mode with write protect tabs on the disk or junk disks in the
drives.
Speaking of Greeks bearing gifts, Aristotle said that the
unexamined life is not worth living. The unexamined program [may
not be] worth running.
- from The Editors of PC
July 23, 1985
Volume 4, Number 15
2) Making the rounds of the REMOTE BULLETIN BOARDS [is] a program
called VDIR.COM. It is a little hard to tell what the program is
suppose to do.
What it actually does is TRASH your system. It writes garbage
onto ANY disk it can find, including hard disks, and flashes up
various messages telling you what it is doing. It's a TIME BOMB:
once run, you can't be sure what will happen next because it
doesn't always do anything immediately. At a later time, though,
it can CRASH your system. Anyway, you'd do well to avoid
VDIR.COM. I expect there are a couple of harmless, perhaps even
useful, Public Domain programs floating about with the name VDIR;
and, of course, anyone warped enough to launch this kind of trap
once, can do it again. Be careful about untested "free"
software.
[paraphrased from
Computing at Chaos Manor
From the living Room
By Jerry Pournelle
BYTE Magazine, The small systems Journal]
Two other examples of this type of program:
1. STAR.EXE presents a screen of stars then copies RBBS-PC.DEF
and renames it. The caller then calls back later and d/l the
innocently named file, and he then has the SYSOP'S and all the
Users passwords.
2. SECRET.BAS This file was left on an RBBS with a message saying
that the caller got the file from a mainframe, and could not get
the file to run on his PC, and asked someone to try it out. When
it was executed, it formatted all disks on the system.
We must remember, that there are a few idiots out there who get
great pleasure from destroying other peoples' equipment.
Perverted I know, but we, the serious computer users, must take
an active part in fighting against this type of stuff, to protect
what we have. Be sure to spread this [message] to other BBS's
across the country so that as many people as possible will be
aware of what is going on.
[from
The Flint Board
Flint, Mich
(313) 736-8031]
===]#[===
-EPILOGUE
Got your attention? There is no need to hatchet your modem and
erase your communications software. While such programs can do
tremendous damage, they are, fortunately, very rare. The
following is an expansion of the countermeasures suggested
above.
A) Never, NEVER, N>E>V>E>R>! download and run Public Domain
software (the first time) on a hard disk. While many programs
are well known, it is a logical presumption that Trojan
horse-type programs may have been uploaded with the name of a
well-known utility. Or as a new version of one of your old
favorites. Download them to a blank floppy or to a disk you have
a current backup copy of.
B) Get in the habit of examining unknown software with HEX/ASCII
utilities that will reveal copyright data, documentation, program
error and prompt messages. A good choice in MSDOS is called
PATCH.COM and in CP/M there is DUMPX.COM. Even if a program is
written in protected BASIC, you may still be able to find some
useful data this way. [This is also a way to find documentation
within programs without .DOC files or descriptions.]
C) Be wary of text files suggesting patches with DEBUG or DDT
that you do not understand. ALWAYS make such modifications to a
backup copy of your .COM, .EXE, .OVR files. There are no known
examples of Trojan horses appearing this way, but...
D) Make those BBS's which screen programs before making them
available your first (but not your only) choice for acquiring new
PD software. If you cannot figure out what a program does,
=don't= upload it to some other BBS.
E) Be wary but not paranoid. Be careful but not overcautious.
Do not fan the fires of hysteria by passing along rumors of worms
and Trojan horses. Speak of what you =know=. There are alot of
good public domain programs that will do what you need. And when
you find it, pass it along.
-end-
|
|
