Newsgroups: relcom.fido.su.virus
From: Lenik Terenin <Lenik.Terenin@p0.f310.n50.z2.fidonet.org>
Subject: Computer viruses: Bulgarian connection. Part 1 of 6
Date: Wed, 5 May 1993 1:59:00 +0300

Hi, All!

К сожалению, у меня нет сейчас времени на перевод. Если найдутся желающие это
сделать - будет просто великолепно. Если нет - те, кому нужен перевод - пишите
мыло, я его выложу на несколько BBS в Москве и Питере примерно через пару
недель, о чем сообщу дополнительно (здесь или мылом).

----------8<-------------

             This article is an excerpt from the forthcoming book
             "Approaching Zero", by Paul Mungo and Bryan Clough.

               "Computer viruses: THE BULGARIAN CONNECTION",
                     Discover, February 1993, pp.54-61

The first call came in to the Help Desk of a California magazine
publisher just after 5 P.M. on Thursday, June 27, 1991. The company
has 1,500 interlinked computers spread around three buildings. The
Help Desk, part of the technical-support department, works as a
sort of troubleshooter for the entire networked system, dealing
with routine problems and helping less computer-literate staff with
their hassles.

"My computer has started making a noise," said the caller. In the
normal run of events, noises, apart from the standard beep when
starting up or the low-pitched whir of the machine's cooling
system, are not part of a computer's repertoire. A noise usually
suggests a problem.

Seconds later the Help Desk received a call from another user with
the same problem. Then the switchboard lit up. There were callers
from all over the company, all with the same complaint: their
computers were making odd noises. It might be a tune, one of the
callers added helpfully, coming from the computer's small internal
speaker. The sixth caller recognized the melody. The computers were
all playing tinny renditions of "Yankee Doodle."

To the specialists in the technical-support department, the tune
was confirmation that the company had been hit by a virus, and a
well-known one at that. The Yankee Doodle virus had first been seen
in 1989. There are a number of variants of the bug, and this
particular variant, known as Version 44, played the tune at 5 P.M.
every eight days.

The company arranged for antiviral software to be shipped overnight
by Federal Express. The publishers of the software assured the Help
Desk that they would simply need to run the program on the
computers to locate the infected files and kill the virus; the
files wouldn't be damaged and no data would be lost.

On Friday morning the technical-support stuff began the
time-consuming task of checking every computer in the company. They
discovered that 18 of their machines had been hit by the virus but
that the killer function of the software they had just bought
wouldn't work on their particular variant of Yankee Doodle. To
clean the bug out they would need to delete all infected files and
replace them.

The virus they were fighting is generally transferred by diskette.
It attaches itself to an executable file - a word-processing
program or a game, for instance. Once loaded on to a computer, it
searches out other programs to infect. It is generally harmless, in
that it never attacks data files - the ones users actually work on
- so it can't cause serious damage. Its nuisance value lies in the
time it takes to eradicate it.

To stop the virus from spreading, the company decided to shut down
its entire network: The technical-support specialists had estimated
that killing the bug and replacing the programs would take them two
or three hours at most. But by midafternoon they realized that they
had underestimated the size of the job. In the end, the technical
staff worked for four days, Friday through Monday, before they were
satisfied that all the machines were free of the virus. During that
time computers and staff were idle.

The computers worked well for the next three days. Then, at 10 A.M.
on Thursday, July 4, in a routine scan of one of the computers with
the new antiviral software, a member of a small crew working over
the holiday received a big shock: Yankee Doodle was back. The
technical specialists, called in to the offices from their homes,
discovered to their horror that this time 320 machines had been
infected. Then they asked the software maker for an explanation,
they were simply told, "You missed a spot."

The company was forced to shut down its computers, and again staff
and machinery sat idle. While the support staff searched through
every program on all 1,500 machines. There was no damage: the bug
was eradicated and the programs were reinstalled without even a
byte of data lost. But the Iack of damage disguised the virus's
real cost. By the time Yankee Doodle had been completely
eradicated, the company had suffered one week of lost production,
one week of irrecoverable business. The company never quantified
its loss, but it is estimated to run into the hundreds of thousands
of dollars - all from what was purported to be a harmless virus.

Since 1990 virus researchers have pieced together a history of
Yankee Doodle. It was first spotted in 1989 in the United Nations
offices in Vienna on a computer game called Outrun. The game is
proprietary, though unauthorized pirate copies are often passed
around on diskette. Someone, somewhere, is thought to have infected
a copy of the game, accidentally or deliberately, and the virus
began its travels, first to Vienna, then around the world, courtesy
of the United Nations. Although there are 51 known versions of the
virus, they are all based on one original prototype. And that
program, despite the virus's all-American name, was written in
Bulgaria.

In the same month that the California publishing company was trying
to eradicate Yankee Doodle, a major financial-services house on the
other side of the country was hit by another bug. This one wasn't a
joke; is was deliberately malicious.

The first symptoms appeared when one of the secretaries was unable
to print out a letter she had just entered into her computer. When
the specialist arrived, he began running tests on the affected
machine.  First he created a new document and tried printing it
out, but that didn't work. He then guessed that the word-processing
program itself was defective. He went to another computer and
copied out the list of program files used by the company, which
showed the names of the programs and their size, in bytes (or
characters). He then compared the files on the problem machine with
the list. Everything matched, except that eight of the files on the
affected computer were slightly larger than on the other. He
checked the differences, and in each case the files on the problem
machine were exactly 1,800 bytes larger.

With that information, the specialist knew immediately that the
company had been hit by a virus; he also knew it was 1,800 bytes
long and attached itself to program files. He called his
supervisor, who hurried over with a virus-detection diskette. They
inserted it in the infected computer. After five minutes a message
appeared on the screen: 83 files had-been checked and no virus had
been found. In exasperation the supervisor called the vendor of the
virus-detection program.

"It does sound like you've got a virus," the vendor agreed. "But if
it's not getting picked up by our software, then it must be a new
virus. Or a new strain of an old one."

Most virus-detection programs look for known characteristics of
familiar viruses - in other words, for a string of text or a jumble
of characters that is known to be contained within the program of a
previously discovered bug.  Such virus-detection kits are, of
course, unable to detect new or modified viruses.

At the suggestion of the vendor, the technical-support staff began
a search of one of the infected files, looking for text or
messages. Specialized software is needed to inspect the inside of a
program file; durig the inspection screen displays a jumble of
computer code. But within the code the staff saw two strings of
text: "EDDIE LIVES...SOMEWHERE IN TIME!" said the first. The second
announced: "THIS PROGRAM WAS WRITTEN IN THE CITY OF SOFIA 1988-1989
(c) DARK AVENGER."

The supervisor phoned the vendor again: "Who the hell is the Dark
Avenger?"

The short answer, the vendor explained patiently, is that no one
knows. The Dark Avenger is an enigma. Most virus writers remain
anonymous, their viruses appearing, seemingly, out of the ether,
without provenance or claimed authorship, but the Dark Avenger is
different: not only does he put his name to his viruses, he also
signals where they were written - Sofia, the capital of Bulgaria.
The Dark Avenger's viruses began seeping into the West in 1989.
They are all highly contagious and maliciously destructive.

"The virus you've been hit with is called Eddie, or sometimes the
Dark Avenger," the vendor told the increasingly worried
technical-support supervisor. "It must be a new strain or
something. That's why it wasn't picked up. Is there any other text
message, a girl's name?"

The supervisor took a closer look at the virus. "I missed it
before. There's another word here. "DIANA. P.", what does this
thing do?"

"Well, as it's a new version, the answer is I don't know. Until
we've seen a copy, it's anybody's guess."

To discover what a virus actually does, it has to be disassembled,
its operating instructions - the program - taken apart line by
line. This is a difficult and time-consuming process and can be
carried out only by specialists. In the meantime the
technical-support staff could only wait and watch as the virus
spread slowly through the company, bouncing from machine to machine
via the network cables that intertwined the company's computers.

Viruses like Eddie work by attaching a copy of themselves to an
executable file; whenever an infected program is used, the virus
springs into action. It usually has two tasks: first, to find more
files to infect; then, after it has had enough time to spread its
infection, to release its payload. It was obvious that Eddie was
spreading, so it was already performing its infection task. What
was worrisome was what its payload would prove to be.

To arrest the spread of the bug, the company decided to turn off
all its computers and wait until the virus could be cleaned out. It
was a difficult decision - it would mean downtime and lost busines
- but it was a sensible precaution. It was later discovered that
the payload in the Eddie variant is particularly malicious. When
unleashed, it takes occasional potshots at the hard disk, zapping
any data or programs it hits.

In this instance some data were irrecoverably destroyed, even
though only 60 machines were found to be infected. But in a sense
the company had been lucky: because Eddie had taken a potshot at a
secretary's word-processing program and knocked out is print
capability, it was discovered fairly early. Had it lurked
undetected for longer, it could have destroyed even more data.

The process of checking all 2,200 computers took four and a half
days, with a team of 12 people working 12 hours a day. Every
executable file on every hard disk on every machine had to be
checked. The team had special programs to help with the task, but
viruses can easily get wrapped up inside "archived" files - files
that are compressed to save computer space - where they can escape
detection. All archived files had to be expanded back to their
full size, checked, and then packed away again. That took time.
Also, all diskettes had to be checked, a nearly impossible task
given the difficulty in finding them: diskettes have a habit of
disappearing into black holes in desk drawers, in briefcases, in
storage cupboards.

After 700 hours of intensive effort, the technical-support staff
felt confident they had eliminated all traces of Eddie. Their
confidence was short-lived. Within a week Eddie was back. This time
they lost a further one and a half days' work.

After the final bout of Eddie was cleared away, executives of the
company tried to quantify how much the bug's visit had cost them -
not that any of it would be recoverable from insurance. "We lost
$500,000 of business - really lost business - not orders deferred
until we could catch up but business that had to be done there and
then or it went to a competitor," said the company's chief
financial officer. "We also lost data. That - cost us $20,000. But
what really hurt was the lost business. If we force a customer into
the hands of a competitor, he might go there again. I guess that
could cost us another $500,000."

The company tried to find out how the virus had got into its
machines in the first place. Sometimes disenchanted employees (or
ex-employees) have been kown to cause havoc deliberately on
computer systems, but it seemed unlikely in this case. The company
concluded that the infection was almost certainly accidental,
probably introduced on a diskette brought in from outside. All it
knew for certain was that some Bulgarian who called himself the
Dark Avenger had cost it $1 million.

By 1990 every one involved in computer security had become aware
that something odd was going on in that obscure Eastern European
country. Increasingly sophisticated and damaging viruses that
affected IBM-type PCs were moving into the West carried on diskette
or transferred by electronic bulletin boards, and all had one thing
in common: they had been written in Bulgaria.

Though only a few of the viruses had actually been seen "in the
wild" - that is, infecting computers - reports from Bulgaria
suggested that two new viruses were being discovered in that
country every week, By mid- 1990 there were so many reported
Bulgarian viruses that one researcher was moved to refer to the
existence of a "Bulgarian virus factory. "

The phrase stuck.

----------8<-------------

Bye,
Lenik.

--- GoldED 2.41.B0108+
 * Origin: ─══ Sky Walker BBS ══─ (2:50/310)


