Virus Bulletin, March 1992
Total Page:16
File Type:pdf, Size:1020Kb
March 1992 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUSE PREVENTION, RECOGNITION AND REMOVAL Editor: Edward Wilding Technical Editor: Fridrik Skulason Editorial Advisors: Jim Bates, Bates Associates, UK, David Ferbrache, Defence Research Agency, UK, Christoph Fischer, University of Karlsruhe, Germany, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland, Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane, Barrister, UK, John Laws, Defence Research Agency, UK, David T. Lindsay, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University of Jerusalem, Israel, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue University, USA, Dr. Peter Tippett, Certus International Corporation, USA, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA. CONTENTS SUPPORT SURVEY Out-of-Hours Technical Support 14 EDITOR’S DIARY Our Man in Havana 2 BOOK REVIEWS HEADLINES 1. The Little Black Book of The Onward March of Computer Viruses 17 Michelangelo 3 2. A Pathology of Computer LETTERS 5 Viruses 18 IBM PC VIRUSES (UPDATE) 7 PRODUCT REVIEW VIRUS PREVALENCE TABLE 10 PC Armour 19 FIELD REPORT PUBLIC DOMAIN Maltese Software Under Siege 11 Stealth Bomber 22 VIRUS ANALYSIS 777 - Revenge Attacker 12 END-NOTES & NEWS 24 VIRUS BULLETIN ©1992 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /92/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. Page 2 VIRUS BULLETIN March 1992 Senor Bidot’s Lada pulled up outside PAB EXPO, the EDITOR’S DIARY exhibition hall in which indigenous software, hardware and peripherals were on display. Battered Chevrolets, Buicks, Dodges and Pontiacs are everywhere - American chassis but Our Man In Havana with Soviet engines and transmissions...the Cuban people are Stepping on to the tarmac at José Marti Airport on the very resourceful - an essential characteristic in the face of a outskirts of Havana at 11:40 pm local time, VB’s correspond- concerted and somewhat mean-spirited embargo by the US. ent soon realised that he had made a profound and easily Software in use by concerns as diverse as The Ministry for avoidable mistake - wearing an English wool suit in the Sugar Production, The Ministry for Tourism and The Ministry Caribbean is plain stupid. Exhausted after a five hour delay at for Education (MINED) was displayed with aplomb. Surpris- Madrid airport and a nine hour trans-atlantic crossing, a ingly, The Ministry of the Interior (MININT), much in shower and sleep were foremost in his mind. What the hell evidence at the Havana Libre, had shied away from displaying was an Englishman doing in Cuba? ‘It will be a gruelling fact- its own particular brands of software and hardware. There are finding mission’ he had told friends and acquaintances who ministries for everything in Cuba - the telephone directory in had subsequently advised him against this trip - ‘the most the hotel listed hundreds of state organisations and ministries. persuasive argument for visiting Castro’s republic is the total absence of MacDonald’s fast-food’ a close friend had assured The team from la Comisión Nacional de Protección de Datos him. That, indeed, was reason enough to visit. was celebrating. Quarantine procedures at the computer fair had reaped dividends: 214 PCs checked; 1110 diskettes The bus reeked of tobacco - just about everything in Cuba checked; 19 virus contaminated hard disks; 56 contaminated smells of cigars. Havana was barely discernible. Since the loss diskettes. There are 19 viruses currently afflicting Cuba, the of guaranteed Soviet oil imports, electricity and fuel have most prevalent being 1575 (Green Caterpillar), Dark Avenger, been rationed. The presidential palace, a monolithic crescent- Italian, NoInt, New Zealand and Yankee. Rarer specimens shaped building, and a huge edifice erected as a memorial to include Brain and SVC 5.00. Without doubt a successful hunt Cuba’s first national hero, José Marti, loomed large in the which called for a totty or two, and soon the white rum, 70% semi-darkness. Candles were held aloft; mourners, apparently, proof, was circulating. Ominously, 27 of the 75 infections for an army general assassinated the day before. Then on past discovered were caused by the Michelangelo virus - if it’s that the imposing University and on to the Havana Libre hotel prevalent in Cuba, thought the correspondent, then March 6th which in more decadent days had been The Havana Hilton. will be a day of reckoning worldwide. VB’s correspondent was in Cuba to speak at Informatica ’92 at La Comisión uses a mixture of detection software; the team the invitation of Cuba’s Comisión Nacional de Protección de are familiar with the offerings of Dr. Solomon and Mr. Datos, headed by the amiable and flamboyant Señor José McAfee but have also developed a suite of ‘home grown’, Bidot, and UNESCO. At this conference, effectively a tailor-made software aimed specifically at the viruses known celebration of all forms of computer applications, he was to to threaten Cuban computers. This decision is based on the speak to an audience from across Latin-America about realisation that the commercial scanners from Europe and the computers and the problems that plague them. United States are not infallible. Indeed, a version of the It became clear that Cuba, famed for its rum, sugar, and Terminator virus, believed to have been first discovered in beautiful girls, intends to develop an indigenous and formida- Cuba went undetected by SCAN, FINDVIRUS and SWEEP. ble anti-virus capability and to export that skill to other The principal components of the Cuban anti-virus armoury countries in South America. A dedicated team of specialists are: DETEC (a virus-specific scanner); LISTARC (a CRC programmers, software engineers, statisticians and lawyers is generic checker); CVP (a memory-resident virus-specific preparing to turn Cuba into a world centre of excellence for sentinel); and CVS (a detection and recovery program). In virus countermeasures. In a country of only 30,000 personal addition an excellent menu-driven virus encyclopaedia in computers, such effort might appear disproportionate - Spanish is available which contains a wealth of information however, a traditional reliance on software and hardware from about viruses and anti-virus tools and techniques. All of the the former Soviet Union and virus-infested East bloc countries software is made available free of charge on a national basis. has exposed Cuba to this threat in a quite singular way. A devastating epidemic by the Vienna-648 virus, which swept PAB EXPO was to be the site of a relatively historic event - across the island in 1988, convinced the Cuban authorities of the first-ever computer virus workshop in Latin America took the gravity of the threat. It was a privilege, therefore, to meet place there on 20th February. The delegates were instructed in Señor Alexis Rodriguez Castedo - the first Cuban to disassem- diagnostic techniques and two live viruses, Dark Avenger and ble the Vienna virus. Brain, were demonstrated by the ever-watchful and expert instructors, Señors Carvajal and Olivera. A meeting at the Questions about the origins of Cuba’s hardware are gently Palace of the Young Peoples’ Computing followed (there are deferred; program developers will be relieved to hear that lots of ‘palaces’ in Havana). Opened by Dr. Fidel Castro in there was no indication of any improper software use. 1991, these clubs are designed to make computing accessible VIRUS BULLETIN ©1992 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /92/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. March 1992 VIRUS BULLETIN Page 3 to the people. Ethics and law were the principal topics of conversation. The Young Clubs (Joven Club) extend the length HEADLINES and breadth of Cuba and computers (of which there are 1,000) are made available to all - even in the remote mountainous regions in the West of the island there are ‘mobile computers’. The Onward March of Michelangelo With such accessibility must go responsibilty - part of the The heavens have aligned in the firmaments to make March work of la Comisión Nacional de Protección de Datos is to 1992 a nerve-wracking time for PC Support people. ensure that young programmers do not stray into bad habits. Extensive media reports about the Michelangelo virus (it A leisurely drive to the Varadero beach, site of Cuba’s triggers on March 6th and trashes both hard disks and burgeoning tourist industry to which thousands of Canadians diskettes) have stimulated an international detection frenzy and Germans flock each year, marked the end of an extraordi- which should help limit the accumulative amount of destruc- nary week. Columbus’ quincentenary, the house in which tion the virus wreaks. Ernest Hemingway penned The Old Man and the Sea, a genuine Scud missile (now a harmless monument but the The virus appears to be widespread - the alarm bells started cause of some concern to President Kennedy in 1961), the ringing when the news broke that Leading Edge Products of boat in which Castro and his eighty men sailed from exile in Westboro, Massachussets had shipped 500 PCs, the fixed Mexico, the various titillations of the famous Club Tropicana disks of which were contaminated.