VIRUS-L Digest Wednesday, 7 Dec 1988 Volume 1 : Issue 36 [A date that will live in infamy...] Today's Topics: What is a Worm? Morris again seminar Was Morris the author? nVIR Strikes Again (Macintosh) Virus information files --------------------------------------------------------------------------- Date: Tue, 06 Dec 88 20:00:35 EST From: Robert Newberry Subject: What is a Worm? Hi All, Can someone please give me a good working definition of what a worm is? Rob.... P.S. Does anyone know if there is a more up to date version of the the Dirty Dozen list. ************************************************************************* * Robert Newberry * "The Tao gave birth to machine * * * language. Machine language * * University of Akron, * birth to assembler. The * * Computer Center Rm. 144d * assembler gave birth to the * * 185 Carroll Street * compiler. etc....." * * Akron, Ohio 44304 USA * * ************************************************************************* ------------------------------ Date: Tue, 6 Dec 88 08:25:00 EST From: Rajshree_Bhatt%Wayne-MTS@um.cc.umich.edu Subject: Morris again I haven't heard anything lately; so what are they going to do with poor Morris? I feel for the poor man, he seems to be a very intelligent individual who did not delibrately set out to destroy. ------------------------------ Date: Tue, 6 Dec 88 08:30:10 EST From: Rajshree_Bhatt%Wayne-MTS@um.cc.umich.edu Subject: seminar Is this a one day affair, or does it spread out? What are the topics of discussion, if any? ------------------------------ Date: Tue, 6 Dec 88 22:35:25 -0500 (EST) From: Michael Francis Polis Subject: Was Morris the author? >The code >appears quite inconsistant, ranging from highly optimized >professionally written code (e.g., the crypt function works 9 times >faster than the BSD version") to amateurish code with multiple >(unused) global variables and subroutines that never get called. >Since Morris has not made a public statement acknowledging that he was >the (sole) author of the worm, to the best of my knowledge, is it safe >to even assume that he did (all) the work? Yes, he could have easily done all the work as far as assembling the virus is concerned. At a talk held here on viruses (and worms), it was explained that researchers send code (like efficient crypt() routines) to each other quite often. So Morris could have easily gotten bits of code from various innocent collegues and patched them together. Also 9 times the speed of a BSD crypt() may not be all that fast since BSD crypt() is designed to run slowly to prevent brute force password breaking. ------------------------------ Date: Tue, 6 Dec 88 20:32 MST From: Lypowy@UNCAMULT.BITNET Subject: nVIR Strikes Again (Macintosh) I was informed today that one lab at the University of Calgary (a Macintosh lab used by Graduate Students, Professors, and Undergraduates) has been infected by nVir. One of the professors noticed his applications crashing on a regular basis, did some snooping around, and found nVir. It was apparently given to us from some guests that visited the campus after attending a Conference held by some members of the U of C faculty. The infection has not caused any loss of data, and has apparently been eradicated through the use of some program called NPW Tools or some such (has anyone else heard of this program? If so, please fill me in on it). Thought you might like to hear some good news for a change instead of another report of infection and loss of data. Greg Lypowy Research Assistant Knowledge Sciences Institute University of Calgary Calgary, Alberta CANADA ------------------------------ Date: Sat, 3 Dec 88 11:02:16 PST From: Robert Slade Subject: Virus information files There have been many recent requests for info on viri. I have announced this before, but ... well here goes. I have, and am willing to distribute, about 2 meg of info on viri and related "security breaking" programs. Note: info. I am not willing to distribute the viri themselves. The bulk of this is messages from RISKS-FORUM, INFO-IBMPC, INFO-MAC, VIRUS-L and Computers and Society. I have recently been editting them into separate subject files; FUNCTION, HISTORY, CONTACTS, OPINION, RELATED and DEFinition. *I WILL NOT MAIL 2 MEG FILES OVER THE NET!* And ubc doesn't support FTP. Send a sufficient number of disks (PC 360K/5 1/4 or 720K/3 1/2) with a self addressed *CANADIAN* stamped mailer to: Robert Slade 3118 Baird Road North Vancouver, B. C. V7K 2G6 Amongst the reports: the CHRISTMA EXEC, a report of an Apple DOS 3.3 virus from 1982, the use of intelligent terminals as "virus" vectors, Lehigh, Israeli, and BRAIN MS-DOS viri, nVIR and SCORES mac viri etc. etc. Next, history, help, etc.? ------------------------------ End of VIRUS-L Digest ********************* Downloaded From P-80 International Information Systems 304-744-2253