[comp.sys.amiga] Repost from BITNET -- the SCA Virus

TLIMONCE@DREW.BITNET (05/27/88)

This message was recently on Bitnet's Info-Amiga discussion:
I added a note in []'s.

-------- cut here ---------
From:   BITNET%"A4422DAE@AWIUNI11" 27-MAY-1988 09:29
To:     TLIMONCE
Subj:   Virus (SCA)

Date:         Thu, 26 May 88 15:36:58 MEZ
Reply-To:     Info-Amiga List <I-AMIGA@UBVM>
Sender:       Info-Amiga List <I-AMIGA@UBVM>
From:         Konrad Neuwirth <A4422DAE@AWIUNI11>
Subject:      Virus (SCA)
To:           Tom Limoncelli <TLIMONCE@DREW>

Hi out there,

 I found something that could interest you. In the may issue of
a german computer magazine (Data Welt) there was an interview
with the guy who programmed the SCA Virus (or at least they say
so). I have translated it and here it is:

D.W.: Where did you get the idea to program a virus for the amiga?

SCA: I had read a bit about viruses in computer magazines and
already found out about it on the computer of the university. I
also knew that AmigaDOS is very similar to the VMS operating
system of the VAX computer family, where many viruses are
known. So I and another AMIGA user had a row if it was possible
to create a virus on the amiga and distribute them. I went to
work only to proof my belief.

D.W.: Where did you get the know-how from?

SCA: First I informed myself with all computer magazines about
the mechanism of a virus. With the aid of a few computer books,
I started to transfer my knowledge to the amiga.

D.W.: But how came the quick distribution of the program? Didn't
you have scruple?

SCA: The first few copies I gave a good friend of mine: this
was only thought of as a gag, as he was one of the biggest
skeptics about computer viruses. I never had the intention to
cause trouble for anyone with it. Some time later, I called my
friend and told him, how to deinstall the virus, but it was too
late. Already after a month, the first copies in the usa showed
up. The main source were illegal copies of software. I never
thought that a virus could multiply that fast. I never was aware
of the possible consequences.

D.W.: What consequences did it have for you?

SCA: Well, first i informed my friends how to get rid of the
virus. But unfortunately the inforamtion did not go around as
the virus. So i started to write virus-killers, which found the
viruses and killed them, but there already were mutations, which
my viruskiller didn't find.

D.W.: How do you think about viruses now?

SCA: I recognizedthe distribution as a evil and criminal thing
to do, that is not a gentleman's work. I only can warn all
programers about writing and ditributing a virus. Nobody gets
anything -- not even the programmer who will get famous for a time...

D.W.: Thank you for this interview.

----

The trick to kill the virus is, at least what i heared, to press
the left button while booting. The screen will become green and
the virusm will commit suicide.


[ Bogus information about the Amiga 3000 removed... I corrected him on the
bitnet.  Ah hell, I'll leave it in.  It's pretty funny. ]

About the Amiga 3000: i read that the only official word by
commodore about it was, that it will be released hopefully in
december, and it will have a 68030.

[ "Hopefully in december"  Ha!  December of what year?!  I think someone
mentioned that the designs haven't gone beyond lunch-table discussions
yet. ]

A very good virus killer is VirusX on one of the Fishdisks. If
anyone wants it, i can distribute it.

by and so long
/konrad

[  Any comments about that interview?  Does it sound real to anyone?  I
don't know if anyone could make a virus that wouldn't spread "too fast".
It is ironic that his friend doubted that one could be made, and he
doubted that it could spread quickly.  ]

A     //            Tom Limoncelli -- TLimonce@Drew.Bitnet              \
M    //   "Never trust a person that doesn't know machine language!"     \
I \\//                                                                   /\
G  XX                "Have you hugged your SO today?"                   /  \
A --------------------------------------------------------------------------
  "The above are my views, not those of Drew University or my employer"

jason@lakesys.UUCP (Jason) (05/28/88)

In article <8805271638.AA14839@jade.berkeley.edu>, TLIMONCE@DREW.BITNET writes:
> This message was recently on Bitnet's Info-Amiga discussion:
> 
>> D.W.: But how came the quick distribution of the program? Didn't
>> you have scruple?
>> 
>> SCA: The first few copies I gave a good friend of mine: this
>> was only thought of as a gag, as he was one of the biggest
>> skeptics about computer viruses. I never had the intention to
>> cause trouble for anyone with it. Some time later, I called my
>> friend and told him, how to deinstall the virus, but it was too
>> late. Already after a month, the first copies in the usa showed
[...]
> 
> [  Any comments about that interview?  Does it sound real to anyone?  I
> don't know if anyone could make a virus that wouldn't spread "too fast".
[...]
> A     //            Tom Limoncelli -- TLimonce@Drew.Bitnet              \

	Sure a virus could get started on a large scale if it was done "well"
enough. If I were him and had decided to write a virus as a gag and give it
to a friend, I would've made it so that 1) After a certain time, the virus
would commit suicide by itself, saying "Hah, I told you I could infect your
system" and 2) Limiting the number of copies the virus could make of itself,
like "When the virus copies itself, decrease the number of 'children' it can
produce in itself as well as in any copy it makes, so that after awhile, it
wouldn't be able to reproduce itself" - termination by suicide after that.

	Something like: When virus loads, decrement suicide count on disk and
in loaded copy. If 0, do suicide routine, else stay resident. When resident,
write out a copy with the decremented suicide count.

	Besides what I mentioned above, I don't see how the author could
justify distribution AT ALL... (Aside from the questionable ethics of it).

	Jason
"Not your average iconoclast"

DMasterson@cup.portal.com (05/29/88)

In message <707@lakesys.UUCP>, jason@lakesys.UUCP writes:
>[...]
>	Sure a virus could get started on a large scale if it was done "well"
>enough. If I were him and had decided to write a virus as a gag and give it
>to a friend, I would've made it so that 1) After a certain time, the virus
>would commit suicide by itself, saying "Hah, I told you I could infect your
>system" and 2) Limiting the number of copies the virus could make of itself,
>like "When the virus copies itself, decrease the number of 'children' it can
>produce in itself as well as in any copy it makes, so that after awhile, it
>wouldn't be able to reproduce itself" - termination by suicide after that.
>
Hindsight's great isn't it!  I'm not condoning what the SCA virus did, but
making the assertion that someone should have thought about this when it was
just meant as a ONE PERSON joke is a bit much -- don't you think??

>	Jason
>"Not your average iconoclast"

David Masterson
DMasterson@cup.portal.com

jason@lakesys.UUCP (Jason) (05/30/88)

In article <6018@cup.portal.com>, DMasterson@cup.portal.com writes:
> In message <707@lakesys.UUCP>, jason@lakesys.UUCP writes:
> > [Some stuff that I wrote regarding starting a virus]
> >
> Hindsight's great isn't it!  I'm not condoning what the SCA virus did, but
> making the assertion that someone should have thought about this when it was
> just meant as a ONE PERSON joke is a bit much -- don't you think??
> 
> David Masterson
> DMasterson@cup.portal.com

	I suppose that it all has to do with how aware one is of the possible
consequences. I guess it wouldn't seem that bad (as a one person joke), but
it strains my imagination as to how someone could write a destructive virus
without having any clue as to the possibilities... Generally, anyone who knows
enough about any particular system to write a virus has been using/programming
computers long enough to be aware of what a potentially dangerous thing they
are. Didn't it cross his mind that somehow it might get out?

	Btw, no, I don't think :)

	Jason
"Not your average iconoclast"