[comp.unix.wizards] Unix virus strikes Murray Hill

doug-merritt@cup.portal.com (05/14/88)

Newsflash: Virus Hits Unix at Bell Labs

Friday the 13th (today) a devastating virus hit Bell Labs at Murray Hill.
Initial reports from survivors indicate that the destruction caused
was very widespread, although limited to Sun workstations. Rumor has
it that the virus was planted by a disgruntled Sun employee in the
Sun Unix kernel. The actual amount of work lost is unknown, as is the
Murray Hill policies on frequency of disk backups.

I have no affiliation with ATT, Bell Labs, Sun, nor with biocybernetic
terrorists.
---
      Doug Merritt        ucbvax!sun.com!cup.portal.com!doug-merritt
                      or  ucbvax!eris!doug (doug@eris.berkeley.edu)
                      or  ucbvax!unisoft!certes!doug

ekrell@hector.UUCP (Eduardo Krell) (05/16/88)

Nonsense. I used our Suns on friday and nothing happened.
    
    Eduardo Krell                   AT&T Bell Laboratories, Murray Hill, NJ

    UUCP: {ihnp4,ucbvax}!ulysses!ekrell		ARPA: ekrell@ulysses.att.com

gwyn@brl-smoke.ARPA (Doug Gwyn ) (05/16/88)

In article <10291@ulysses.homer.nj.att.com> ekrell@hector (Eduardo Krell) writes:
>I used our Suns on friday and nothing happened.

Sounds like a FATAL virus, to boot.

hack@bellboy.UUCP (Greg Hackney) (05/16/88)

In <10291@ulysses.homer.nj.att.com> ekrell@hector (Eduardo Krell) writes:
>Nonsense. I used our Suns on friday and nothing happened.
>    Eduardo Krell                   AT&T Bell Laboratories, Murray Hill, NJ

Nothing ever happens at our place on Friday either. :-)
-- 
Greg

hwe@beta.UUCP (Skip Egdorf) (05/17/88)

In article <10291@ulysses.homer.nj.att.com>, ekrell@hector.UUCP (Eduardo Krell) writes:
> Nonsense. I used our Suns on friday and nothing happened.
>     
>     Eduardo Krell                   AT&T Bell Laboratories, Murray Hill, NJ

Sounds like the last time I tried to use MVS...

Who Started the Sun Friday the 13th rumor anyway??
Did anything actually happen anywhere??
Was last Friday the 13th really April the 1st??

					Skip Egdorf
					"I kept mine running"
					hwe@lanl.gov

doug-merritt@cup.portal.com (05/19/88)

Update:

1) On Friday I posted an article about viruses hitting Suns at Murray Hill;
several people at Murray Hill have since posted denials, and several
Sun employees emailed me chastisements, pointing out that unfounded
rumors like that could hurt Sun's reputation. My apologies for being
careless and irresponsible. Complaining to my system administrator was
a bit much, though, if you ask me...a certain person at Sun was *extremely*
touchy about my posting, which is interesting considering my comments
below. (FYI it usually doesn't help much; sysadmins have better things
to do with their time than to censor people on the FlameNet!)

As to what actually happened, on the one hand it appears that there
was in fact no virus/bomb activated Friday. That's why the apology.

2) On the other hand, my friend who works at Murray Hill (who misunderstood
the situation when he called me from New Jersey Friday and asked me to
post the "news") tells me that there were people there who were sufficiently
worried about a virus hitting on Friday the 13th that they backdated
their clocks for a day. (Backdating means to move the system's time
backwards so that software thinks it's a different date/time than it
really is). He doesn't know *why* they were concerned; people were
tight lipped about it.

Similarly, another friend of mine who works for Sun's Front Line Consulting
told me that their whole department was geared up for potential disaster
on Friday the 13th; they were warned something might happen two days
ahead. Again no one seems to know where the news came from; people
*there* were tight lipped about it, too.

So I find two unrelated people in two different companies on opposite
sides of the country both saying the same thing. Clearly someone,
somewhere, thought there was reason to worry, and warned both Sun *and*
Murray Hill to be careful. And furthermore did a pretty good job of
avoiding random leaks, presumably to avoid a panic (another reason to
avoid posting rumors until they're proven true! Sigh.)

So what I want to know is, why did some people at Sun and Murray Hill
think something might happen? Sounds a little like getting an anonymous
bomb threat. My friend at Murray Hill wants to know why the rest of
the world wasn't warned, also, but I'd say that's debatable...why worry
people over what might be nothing? Maybe someone started the whole thing
as a hoax. Worked as far as Sun Front Line Consulting is concerned...

BTW supposedly a system administrator my friend at Murray Hill knows
says he's going to backdate his clock on the next Friday the 13th, just
to be sure. I don't see any point in that...to me it just underscores
the importance of always backing up your systems. Any random disaster
could happen at any time, not just viruses on Friday the 13th.
   Doug
---
      Doug Merritt        ucbvax!sun.com!cup.portal.com!doug-merritt
                      or  ucbvax!eris!doug (doug@eris.berkeley.edu)
                      or  ucbvax!unisoft!certes!doug

edw@pinot.zehntel.com (Ed Wright) (05/20/88)

In article <7899@brl-smoke.ARPA= gwyn@brl.arpa (Doug Gwyn (VLD/VMB) <gwyn=) writes:
=In article <10291@ulysses.homer.nj.att.com= ekrell@hector (Eduardo Krell) writes:
==I used our Suns on friday and nothing happened.
=
=Sounds like a FATAL virus, to boot.

so tell me.........

How do you boot a virus ?


  >>>>>>  ucbvax--\                                         A dirty mind 
  >>>>>>>>   sun--->----zehntel !edw>/dev/null :-):-):-):-) is a terrible
  >>>>>>  varian--/                                         thing to waste

kennedy@asuvax.UUCP (Ralph Kennedy) (05/25/88)

In article <5624@cup.portal.com>, doug-merritt@cup.portal.com writes:
> My apologies for being  careless and irresponsible...As to what
> actually happened, on the one hand it appears that there was in fact
> no virus/bomb activated Friday. That's why the apology.

     Never mind the apology, the important thing is that the Murray
Hill Suns are OK.  You can't even imagine what a relief it is to
know that they're safe now.  I haven't slept in days, and have been
barely able to keep my food down.

     As you're probably aware, we've been having troubles with the
Phoenix Suns as well, and it's great to hear that at least the Murray
Hill Suns have resolved all of their problems.

Ralph Kennedy		       {ames,husc6,rutgers}!ncar!noao!asuvax!kennedy
Engineering Comp. Serv.   {allegra,decvax,ihnp4,oddjob}!--^
Arizona St. Univ.
Tempe, AZ  85287-5206           csnet: kennedy@asu.csnet