CRYPT NEWSLETTER 39 October-November 1996 Editor: Urnst Kouch (George Smith, Ph.D.) Media Critic: Mr. Badger (Andy Lopez) INTERNET: 70743.1711@compuserve.com crypt@sun.soci.niu.edu NOTE: Subscriptions to Crypt Newsletter can now be had for $10 US for one year. Checks and money orders to the editor at 1635 Wagner Street, Pasadena, CA 91106 along with a current electronic mail address where you wish to receive your issues of Crypt Newsletter. Who reads Crypt Newsletter: ========================== The great majority of Crypt Newsletter readers do it on company time. While there are accesses at all hours, heaviest usage and downloading of current issues occurs during U.S. business hours, beginning at around 7:30 EST and continuing to 4:40 Pacific time. Readers of Crypt Newsletter log in monthly from organizations like Loral, Lockheed, MITRE Corporation, NASA-JPL, Electronic Data Systems, Intel, Digital, CSIRO, Science Applications, Unisys, the World Bank, Fujitsu, DuPont, the Securities and Exchange Commission, FermiLab, the US Naval Undersea Warfare Center, the EPA [?!], Oak Ridge National Lab, Argonne Laboratory, Lawrence Berkeley, and many anonymous U.S. military Internet domains that refuse open telnet connections and "finger" queries. Others log in from media organizations like the BBC, The Bloomberg Business News Service, New York Times, various newspapers, The Net magazine, and The Age (a Melbourne, Australia-based newspaper), too. Crypt Newsletter articles may not be copied or reproduced in or on other media, on CD-ROM collections of data, or offered - in part or in toto - as part of any database, data survey, information or research service for pay without consent of the editor. Rates based on word count are reasonable. Queries by e-mail are welcome. 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � Contents: Crypt Newsletter #39 � 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� THIS ISSUE SHORT SPECIAL The "Joseph K" Guide to Crypt Newsletter Tech Terminology NEWS Nothin' but Good Times ahead for you? Your firm is probably doomed . . . Funny business with computer viruses at Textron Corporation The John McAfee/Computer Virus Hysteria Awards 1996 Root, hog, or die: Norton Anti-virus in catfight with McAfee The "fictive environment" of information warfare kooks at DoD PC advice columnist Lawrence Magid: Threat or menace? Colostomy Bagboy returns to civilian life in Oklahoma BOOKS Computer Virus Supertechnology 1996 -- Virus-writing for $400 (cheap) MISCELLANY Letters page Crypt Newsletter Hypertext Crypt Masthead Info Credits/Acknowledgment CRYPT NEWSLETTER'S "JOSEPH K" GUIDE: AN OCCASIONAL GLOSSARY TO TECH TERMINOLOGY "This is not a psychotic episode, it is a cleansing moment of clarity." --Howard Beal in Paddy Chayefsky's "Network" computer virus: a small replicating computer program designed to spread autonomously; or, a marketing tool used by computer security experts and anti-virus software companies; or, something indeterminate responsible for making any computer or network behave weirdly. Usage: Angered by the mystifying and increasingly nettlesome crashes of his new WIN95-equipped computer, Loy suspected a _computer virus_. content: an amorphous term encompassing material of utterly no value found on World Wide Web sites. Usage: The mouthpiece for a conglomerate of entertainment magazines, whose readership encompassed a great number of gossip-hungry simpletons, vowed his company's Web site would be _content_ rich. cybercash: a fuzzy concept glossy magazines and Internet flacks claim will make everyone -- except maybe you -- wealthy in cyberspace. Not to be confused with cash money. Usage: Wackerman dreamed of the _cybercash_ riches he would reap from the sale of his electronic story of a shy but brilliant software engineer who saves the country from destruction at the hands of international terrorists and information warriors. digerati: the celebrities of the 'Net and/or computing industry; or, Robert Reich's "symbolic analysts." [But that's another tale]. Usage: While the press releases and treatises of the _digerati_ were of less value to the average American than a plate of singing maggots, the mainstream media always loved them. electronic bogeyman: a hacker, instrument of a hacker or anonymous source portrayed in the mainstream media as a menace to society. The electronic bogeyman must always be quoted making grandiose, unverifiable, or nutty claims (e.g., opening all the automatic garage doors in Anaheim, California at precisely 2:00 pm) about feats, usually malicious, that can be performed with a computer. Usage: Reuters interviewed an _electronic bogeyman_ from Taiwan who claimed his computer virus would corrupt data on Japanese computers if that country did not immediately surrender ownership of the Daioyu Islands in the East China Sea. fictive environment: a new description for psychological operations against an enemy; or, the creation of a world of information fraud surrounding consumers, marks or targets. Usage: In the mid-Nineties, the business of a significant number of Americans armed with computers became the spinning of _fictive environments_, the aim of which was to defraud others of cash money. Golden Pizzle of Information: any authority figure accustomed to being publicized unquestioningly; or, computer experts fond of making dumbly obvious, fraudulent, indecipherable or insane statements which few dare to seriously question. Usage: Assuming the leaden mantle of _Golden Pizzle of Information_, Vice Chairman Gary Fernandes of EDS Corp. told a rapt audience, "We have technical clutter. We speak in buzzwords and acronyms." Good Times virus: A hoax believed to be true by many computer-using Americans. Usage: Modzelewski was written up by for insubordination after laughing indiscreetly at a meeting in which the esteemed network consultant passed out memos on _Good Times_. hacker: n. In this context, a young man very adept with computers and networks, possibly a pawn of Libya or North Korea. Usage: Indeed it was good the _hacker_ had been apprehended in his single apartment in Raleigh because the government feared he was only a step away from bringing down the entire system of international banking. HERF weapon: n. Always suspected but never seen, the HERF - or High Energy Radio Frequency - gun is responsible for much nettlesome corporate computer failure nationwide, according to information warriors. Usage: Dodson was relieved the computer security guru had been able to convince management that the corrupted data on the network was the work of an _HERF weapon_ attack on the corporation, not the boobytrapped pornographic bit of software he had obtained from alt.sex.watersports. information warfare: n. In this context, everything and nothing. What hackers, Libyan agents, rogue nation-states, international criminals, and pannational groups of religious fundamentalists will conduct against America in the near future. Usage: America On-Line was besieged by a series of vexing and seemingly pointless _information warfare_ attacks conducted by teenage hackers armed with AOL Hell, a program that automated the sending of scrofulous electronic messages to other customers. interactive: an adjective used to adorn computer and software products that are intrinsically worthless, unusable or both. Usage: "Our _interactive_ Web browser is the only one that can unlock the magic of the Internet, revivify your moribund sex life, order your office activities, protect your children from pedophiles, and run a Ponzi scheme on the Usenet -- all at the same time," burbled Patty Stonesi, head of Microsoft's Multimedia Division. mentufactury: A kind of pompous term for bullshitting, especially the variety associated with flacking for your information business, hardware, software or the Internet. Usage: In the mid-Nineties, _mentufactury_ became the primary export of American business resulting in a startling trade deficit disaster. meta-data: see pseudo-data paradigm: n. pattern, an example, a model. Usage: The pronouncements of Bill Gates were the _paradigm_ for the impenetrable phlogiston surrounding much of home and business computing. phlogiston: an imaginary element formerly believed to cause combustion; or, Crypt Newsletter's euphemism for what comes out of the south end of the bull; or, a primary American export commodity (see mentufactury). Usage: Not even the powerful American newsmedia could rival the Usenet in the dissemination of _phlogiston_. pseudo-data: text, test results, charts, bar graphs, numbers and statistics produced by the convergence of mentufactury and technoquack. Sometimes known as advertising. Usage: The driven and deeply neurotic marketing employees of the computer industry often tyrannized consumers with fraudulent and confusing broadcasts of _pseudo-data_ disguised as information. Reuters: an international misinformation vendor. Usage: A Reuters wire news story told of a computer virus factory discovered on the dark side of the Moon by business security consultants, Krakt & Zane. technoquack: an individual, e.g. a consultant or member of the Alvin Toffler Wehrmacht, who specializes in mentufactury; or, the speechifying of a technoquack or someone who hasn't quite become one yet. Usage: The _technoquack_ from the MIT Media Lab enjoyed annoying readers of his books with periodic declarations that Americans yearned for more advertising disguised as news, not less. "I am here to whip people, and whip them I shall." --The Whipper in Franz Kafka's "The Trial" USING THE GOOD TIMES HOAX TO DETERMINE IF YOUR COMPANY IS DOOMED In 1994, an article was distributed on on-line services and through the Internet on the menace of something called Good Times. Good Times was a cleverly worded hoax: A whale of a tale of a virus travelling in electronic mail. The hoax urgently claimed that if you received any mail with the title "Good Times," you were not to open it or your PC's disk would be pffffft, courtesy of the virus. It was nonsense but it didn't stop thousands of people from believing it. And now Good Times is the story that won't go away. Every week Crypt News sees or receives a few queries from office-computing information systems jockeys worked into a lather over the Good Times hoax. Since Good Times is patently false and many people have been working to debunk it, Crypt believes that in 1996 the hoax is a good barometer of a subtle disconnect between the use of computing technology in American business and knowledge of it. In other words, it's a barometer of corporate dysfunction. If your company is suffering from Good Times hoaxes its management and information systems staff can no longer distinguish fairy tales from reality as long as the language both are conveyed in is similar. Crypt News believes you can tell if your company is inevitably doomed depending upon the level of this dysfunction. And it has devised a test you can take to determine whether or not its time to get out before the bulkheads collapse. Get your pencil and paper, because here we go: 1. Estimate how many warning memos you receive or have received on Good Times or a hoax that's paraphrased from it. a. One a month. (This is a very bad indicator. Consider skipping to end of quiz at once.) +100 points. b. Perhaps once or twice a year. +20 points. c. More than b but less than a. +30 points. d. None. (You may wish to skip quiz; you could be in good shape.) 0 points. 2. You think that Good Times: a. Is true. I saw something in a movie that was like it once. +100 points b. Could be true. If management says this is something to look out for, then there must be something to it. +50 points c. Of course it isn't true! However when I get a message on Good Times, I pass it on to management and information systems in my company because they'll think it's true and I enjoy watching them fruitlessly scurry about. +50 points. d. It isn't true! 0 points. 3. When a Good Times warning is spread through the company, a. Management or information systems convenes a meeting and assigns a group to "research" the threat. Then nothing happens or choice "c" [below]. +100 points b. Management or information systems convenes a meeting and assigns one person to "research" the threat. "Research" means collecting gossip, apocrypha and anecdotes from the Internet or commercial on-line services. This detritus has nothing to do with the real problem. Then nothing happens, anyway. +40 points c. Workers are compelled to rush about firing up anti-virus software. In the confusion, some hard disks are erased or corrupted and the network falls over. This convinces everyone Good Times is real. +100 points d. Nothing happens. Management is already paralyzed by other matters. +30 points e. Nothing happens because everyone already knows Good Times is a hoax. 0 points 4. In computer, Internet and on-line training sessions at my company a. The instructors passed around the original Good Times hoax and believed it to be real. +120 points b. Training, what training? +50 points c. Nothing was said about Good Times. +20 points d. The Good Times scare was explained as a hoax. 0 points 5. In my company, with regards to Good Times and frightening stories concerning computing technology I believe management and/or information systems is a. Totally incompetent and the personnel never listen to anyone but sycophants. +120 points b. Incompetent but open to suggestions or outside information. +50 points c. Competent but the personnel never listen to anyone but sycophants. +50 points d. Competent and flexible. 0 points Scoring: Less than 120 points. ==================== Your firm is not doomed. However, proximity to the tripwire of 120 points may be a cause for concern. A high score in questions three or five spells trouble coming every day. 120-200 points. =============== Your firm is doomed. Management is ignorant of basic realities in computing technology, is resistant to real education and vexes employees with useless work resulting from its own ignorance. If you are in an educational system, the bureaucracy may not -- immediately -- be doomed but a majority of the students that are the product of the system are probably doomed. Special cases: If you work in a government organization, it's not doomed. More than 200 points. ==================== Special caseload of doom. Not only is the firm doomed but so are you! You are probably already suffering from stress-related illness or depression brought on by prolonged exposure to too many idiots in the workplace. RHODE ISLAND WOMAN CHARGED AS ALLEGED COMPUTER VIRUS WIELDING SABOTEUR On September 26, charges were filed against a female employee of Textron in Providence, Rhode Island, in connection with alleged infection of the company network with a computer virus. Covered in the October 1 issue of the Providence Journal-Bulletin as "Computer expert faces charge of putting virus in Textron's system," Denise M. Johnson was named in an investigation centering around charges she had sent an "e-mail message" to all users at the company and that the process corrupted the network with a virus. Quite naturally, the invocation of "e-mail virus" always raises the eyebrows of the skeptical at Crypt Newsletter. In any case, Johnson was arrested and charged with . . . what appear to be indeterminate crimes. According to the Providence-Journal, Johnson was charged with destruction of computer data, a felony. According to District Court records, she was charged with "intentional computer access" -- whatever that is. Johnson denied the accusations and attributed the arrest to a politically-motivated hatchet job instigated by the company. "I'm not a virus queen, I'm not a hacker. They're trumping up these charges," she told the Journal. Johnson said to the paper that Textron's computers had been infected with computer viruses "for months" and the system's crash was due to a "virus [that] was already in the system." According to the Journal, investigating police "said officials at . . . Textron headquarters saw [Johnson] on Sept. 17 sending the message containing the pernicious program." This caused the loss of "computer data stored [at Textron] from 11 p.m. on Sept. 16 to 2 p.m. on Sept. 17." Johnson was a computer help-desk worker alleged to unhappy with her employment at Textron. On the 17th, Johnson had a meeting with a manager in which she said she was leaving the company. At this time, she was said by authorities to have launched the virus. Bail was set at $10,000 and Johnson was subsequently released. The next court action on the case is scheduled for December 5. CONTRIBUTE A BOOK TO THE JOHN MCAFEE AWARDS 1996 AND STRIKE A BLOW FOR COMPUTER LITERACY; BE CONSIDERED A SWELL GUY, TOO Crypt Newsletter and Computer Virus Myths guru Rob Rosenberger have put their heads together to comb the media for computer virus stories that have contributed the most to computer virus misinformation and confusion in 1996. Once they've been compiled, we'll put them on display along with analyses of their impact and faults and throw the nominees open to Netizens for their votes on which are the best, or worst, depending on your point of view. Rob has puckishly named the contest the 1996 John McAfee Awards after the 1992 watershed event of Michelangelo hype that catapulted the anti-virus software developer to fame and fortune -- his former company to a dominant position in the anti-virus industry. But we want this to be an exercise in extending computer literacy and to that end we intend to give away some prizes -- namely books! Here's where you -- authors, publishers, the pure of heart and philanthropic -- come in. Contribute one book on computer security, computer viruses or reality and culture in cyberspace and we'll be forever in your debt. You'll get publicity when we mention your philanthropy and book during the nominations, voting and awards ceremony. Plus you'll have the satisfaction of knowing your book is going to be placed directly into the hands of someone in the media who needs it the most! To contribute a book, contact me or Rob Rosenberger. George Smith: crypt@sun.soci.niu.edu Rob Rosenberger: us@kumite.com On November 1 we'll publicize the nominees and the prizes so the voting can begin. Watch this space for further details. Computer Virus Myths http://www.kumite.com/myths Crypt Newsletter http://www.soci.niu.edu/~crypt Postscript: Dan Barrett and O'Reilly Associates have already donated a copy of the excellent "Bandits on the Information Superhighway." Also already in the pot are Michelle Slatalla and Joshua Quittner's "Masters of Deception: The Gang That Ruled Cyberspace" (Holt); Janet Endrijonas' "Data Security" (Prima); Stephen Cobb's "NCSA Guide to PC and LAN Security" (McGraw-Hill) and "Robert Slade's Guide to Computer Viruses" (Springer-Verlag)!!! Many thanks to the contributors of these fine books. ROOT, HOG, OR DIE: MCAFEE ASSOCIATES ACCUSES SYMANTEC OF FRAUD IN ANTI-VIRUS CATFIGHT If you've been following Crypt Newsletter you know the anti-virus industry is a mutually antagonistic, factious business where everybody wakes up hoping everybody else has failed the night before. So the recent catfight between McAfee Associates and Symantec over the performance - or lack of it - of the Norton Anti-virus is just another turd in the punchbowl of the corporate security industry. The fight started when the United Kingdom-based trade publication, Secure Computing, published a product run-off that showed the Norton Anti-virus to be a rather wretched performer in Word Macro virus detection and removal. Since Word Macro virus infections are the current bugaboo of U.S. business, this was bad news for Symantec, indeed. Then McAfee Associates cried foul. Since Symantec advertises that Norton Anti-virus removes all Word Macro viruses but a test performed by a magazine proves it flunks in this regard, advertising for the Norton Anti-virus is a fraud and should be corrected to reflect this, the company insisted. A Symantec agent (actually an agent for most of the anti-virus programs that sell reasonably well, including McAfee's SCAN) -- Norman Hirsch -- was pilloried by McAfee for publicizing his own test's results, with Symantec on top. There was a great paroxysm of garment-rending and gnashing of teeth. The parties involved danced around the fact that almost every anti-virus company, at one time or another, has let its marketing department steamroller the truth and claim its product removes or protects against all viruses, past, present and future. Since the use of this practice has been ubiquitous through the Nineties, many consumers have been conditioned to demand it as a term of service and, paradoxically, won't buy anti-virus software that doesn't make fraudulent claims about performance fabricated by sundry hired fiends in the marketing department. This necessitates the generation of consumer "tests" that certify -- in one way or another -- that various products roughly adhere to claims put forward by fraudulent advertising. On his Web site, Hirsch maintained Norton Anti-virus was victimized by Secure Computing's test. The test was slanted in favor of companies that have Computer Anti-virus Research Organization (CARO) members in their technical wings. Symantec doesn't have a pet CARO member. [1] Everyone else -- like McAfee -- did. This meant, wrote Hirsch, that Symantec doesn't have as easy access to virus samples used in testing as other developers. While there is some logic to this argument, in it's strained effort to be diplomatic it glosses over a simpler explanation based on human nature. Many CARO members either dislike or actively despise Symantec (if their gossip at anti-virus conferences is any barometer.) It would be accurate to say that some of them don't care if Symantec ever gets all the virus samples it would like. And if this is viewed as standing-in-the-way or indifference, tough. For example, Glenn Jordan -- a CARO member who maintained Ross Greenburg's VirexPC program for Datawatch and who is now employed by Dr. Solomon's, another Symantec competitor -- mentioned at one conference that Symantec tried to acquire Solomon's but the deal went sour because Gordon Eubanks, CEO of Symantec was . . . well, Crypt Newsletter won't reprint it because this is a family-oriented magazine, y'know. Anyway, in an extended press release distributed by the Business Wire service in September, McAfee Associates CEO Bill Larson thundered: "Symantec appears to have repeatedly and blatantly [misled] software consumers about the capabilities of Norton AntiVirus . . . Once again, Symantec has tried to fool customers by deliberately exaggerating the capabilities of Norton AntiVirus. We call on Gordon Eubanks, Symantec's CEO, to come clean and own up to - and correct - his company's false and misleading claims." The McAfee Associates press release insisted Symantec's advertising for the Norton Anti-virus "[was] part of a well documented and intentional international campaign designed to deliberately mislead software consumers and libel McAfee." And McAfee took aim at Norman Hirsch, claiming Symantec was publicizing a test that made its product look good, a test that was commissioned by the company and performed -- cooked is the implication -- by one of its agents. "The study upon which Symantec draws its conclusions is fraught with errors, misleading information, and questionable testing methodologies," claimed a McAfee rep. Hirsch maintained his Symantec test was valid; he, an honest broker. After all, he was an agent for many anti-virus companies -- not just Symantec and including McAfee -- right? Postscript: In related news and the "Liar, liar pants on fire!" department, Rob Rosenberger posted this piquant bit of McAfee Associates phlogiston: "Rick Kreysar -- [a] vice-president of McAfee Associates took part in a RealAudio interview [this month] with PC World Online's Brian McWilliams. Mind you, we named the Virus Hysteria Awards in honor of company founder John McAfee. VP Kreysar suffered a memory lapse during the interview: 'McAfee [Associates] has never been a company to hype viruses, and I think it is a poor trend that is happening . . . in the last year.'" Notes: ===== 1. At one time Symantec did have a number of CARO members in residence: Joe Wells and Jimmy Kuo. Wells maintains a comprehensive list of viruses in the wild; Kuo now works at McAfee Associates in anti-virus development. Symantec never likes to talk about this brain drain in the anti-virus department. ANOTHER BRIEF TALE OF INFOWAR KOOKS IN THE WESTERN WORLD The September 8-15 issue of Defense News magazine featured an article on information warfare kooks at the Pentagon and elsewhere in the western world. Coming together at the National Computer Security Association's annual InfoWar Con in Washington, DC, various political and military attaches were quoted making amusing and fantastic claims by reporter Pat Cooper. One of the best examples was given by the Australian embassy's defense attache in Washington, air vice marshal Brendan O'Loghlin. O'Loghlin was reported to say information warfare could be used to destroy enemy computers through the release or deployment of computer viruses into foreign networks. Of course, this will feed more computer virus myths on the effectiveness of trivial replicating programs as weapons. It also overlooks the problem of "blowback," or what happens when a military option imposed on an enemy blows back over friendly borders and becomes a menace at home. Indeed, the entire history of computer viruses shows their epidemiology is no respecter of diplomatic treaties, allies, or international borders. Spread of computer viruses is by practical definition uncontrollable. Does this mean a branch of the Australian military is actually thinking about writing computer viruses or procuring them as potential weapons? Hard to say. But it does raise the question why a politico-military appointee in the Australian diplomatic corps isn't censured by his home office for spouting such arrant stupidity in a high profile public forum. Another trenchant quote was provided to Cooper by Marine General John Sheehan, head man at Atlantic Command in Norfolk, VA. Sheehan said he was getting involved in information warfare because "We don't want to get our butts kicked by a bunch of long-haired 26-year-olds with earrings." And the world of infowar kooks is not without its own evolving jargon, too, where old phenomena and plans evolve into new words that make no sense but which serve to hide spoiled old wine in new bottles. One of the better terms Crypt has seen is "fictive environment." Coined by infowar kooks at the Air Force College of Aerospace Doctrine at Maxwell Air Force Base in Alabama, a "fictive environment" is one created when the U.S. military spams a bogus electronic press (or a radio or TV broadcast) release on Saddam Hussein kissing a pig into, say, the Iraqi communications network. This used to be called psychological operations but information warfare kooks have cleverly renamed it "fictive environment," perhaps to avoid being downsized when the psy-ops budget is cut. Of course, information warfare kooks in the U.S. military believe such a stunt would discredit enemy leaders in the eyes of their troops, causing foreign soldiers to march to our side -- or at least be gripped by indecision. The U.S., say the information warfare kooks, is immune to a "fictive environment" since we have an open society and no one ever gets taken in by bogus news stories delivered via computer networks or television broadcast. The skeptical reader is forgiven for wondering what planet Department of Defense information warfare kooks have been living on. SYNDICATED PC ADVICE COLUMNIST LARRY MAGID: THREAT OR MENACE? Lawrence Magid's syndicated September 9 "PC Focus" newspaper column proved once again the famous computer technology pitchman is dangerous when left to run amok handing out computer advice on viruses. Those who follow this sort of thing may recall Magid's wretched nostrums for fighting Michelangelo virus in 1992. Besides availing oneself of anti-virus software, one could activate his computer "on March 5 and leave it running until March 7" to avoid trouble. In the same piece Magid wrote computer viruses travel via bulletin board systems. "I knew something was up on the morning of August 22 . . . " wrote Magid in his September 9 treatise. However, it sure wasn't Larry. Radio station reporters were calling from around the country to ask for his advice on Hare Krishna virus, Magid wrote. The reporters were panicked by the recent hysteria drummed up over the virus. Someone had told them, said Magid, not to turn on the PC on the Hare day. Viruses cause "data files to slow down . . . others cause your disk to run out of space," he continued. Magid's consumer advice on disk space gobbling viruses qualified as genuine village idiot newspaper chatter, the type which gives computer journalists a worse rep than they deserve. Other zingers from Magid's column included such as: "I've been using computers and on-line services since 1978, and _as far as I know_ [emphasis added], I've only twice been infected by viruses . . ." "Until recently, the only likely way to get a virus was to run an infected program . . ." Magid prattled on, neatly ignoring all the commonplace boot sector infectors -- even Stoned, a boot sector infector, which he touches upon earlier in his piece -- reinforcing the conviction he had no idea what he was talking about when he sounded the alarm on Michelangelo, yet another boot sector infector, in 1992. The best part, however, was saved for last. Magid wrote he was infected with Word Prank but didn't know it until he updated his anti-virus software. Picture this for a moment: Larry Magid using his bully pulpit of syndication to millions of American readers to ask them to trust his expert advice on computer viruses after claiming he'd been infected by Word Prank for an unspecified period. Paraphrased -- using Larry Magid's computer virus advice is somewhat akin to consulting the town hooker on treatment for venereal disease. Lawrence Magid: threat or menace? COLOSTOMY BAGBOY RETURNS TO CIVILIAN LIFE IN OKLAHOMA, REFLECTS ON SIMPLE PRISON RECREATIONS Recently, Paskell "Geno" Paris called Crypt to inform readers he had returned from a two year stay in federal prison in connection with events that are well known to readers of "The Virus Creation Labs." In 1993 Paris travelled under the handle "Colostomy Bagboy" while lurking on the Fidonet as sysop of the "Oklahoma Institute of Virus Research" in Oklahoma City. While a Fidonet sysop, Paris engaged in a well-publicized public feud with Edwin Cleton, a former moderator of one of the network's "Virus Information" message feeds. As a computer virus exchange bulletin board sysop, Colostomy Bagboy edited two issues of the underground publication, Vortex. Vortex was a profane, hideously violent e-zine that mixed extreme bad taste and off-color humor with exhortations to join the author in the "stylish destruction" of the data of others found in the silicon vortex -- Paris' euphemism for the world computer network. To most users accustomed to driving slowly down the middle lane of the information highway, Vortex read as evidence that menacing electronic bogeymen lurked under every rock in cyberspace. However, like many electronic magazines from the underground it was exaggerated for effect, talking the talk and walking the walk of many such underground publications. Federal and local lawmen indicted and arrested Paris the same year. He was subsequently convicted on charges apparently unrelated to his underground persona. A fraud charge stemming from the creation or usurpation of a false identity and a forgery charge resulting from attempts to counterfeit treasury bills landed him in prison. Paris also maintained computer tampering was also part of the conviction, coming down from what he claimed was an unsuccessful attempt to access and meddle with the FBI's National Crime Information Center computer database. While serving his two year sentence, Paris said he was contacted by reporters looking for a scoop on the underground world of computer hacking. However, no stories resulted. Paris added he was allowed to be part of a computer club at one of the minimum security facilities -- a work camp -- where he was incarcerated. In addition, Paris told Crypt News fisticuffs is a common recreation in American jails. REVIEWED: COMPUTER VIRUS SUPERTECHNOLOGY 1996 - A $400 BOOK ON WRITING VIRUSES FOR WIN95 Mark Ludwig's "Computer Virus Supertechnology 1996" (American Eagle, ISBN 0-929408-16-0) radically ups the ante for those interested in learning how to write computer viruses. At $395.00 for about 200 pages, Ludwig has pitched it predominantly to repeat customers of American Eagle, would-be information warriors at Pentagon think tanks like Science Applications or MITRE Corp., the libraries of computer security organizations and a handful of uncategorizables with too much discretionary cash and time on their hands. It's an effective sales strategy and, I imagine, covers just about the entire audience for the book in the United States and a handful of other countries. In direct contrast to his $12.95 underground bestseller "The Little Black Book of Computer Viruses," Ludwig only has to sell a few hundred copies of "CVS1996" to make a substantial return on investment. Printed in a run of 500, Ludwig claims to have already sold 60 percent of the lot. By the time you are reading this review, presumably "Computer Virus Supertechnology" will be about sold out. "CVS1996" focuses on writing viruses that infect Windows95 programs. It includes on its companion diskette the first one written, called Boza/Bizatch, which was originally published by the Australian virus-writing group, VLAD. Boza never made it into general circulation. And since its publication -- despite a spurt of crazy stories about it in the mainstream media -- the current crop of virus writers, in general, have shown very little interest or ability in turning out the same hordes of trivial viruses for the new operating system as is the case with DOS. Ludwig says this is because the vast majority of virus writers write their programs as a sort of casual hobby. They lack the ability or the patience to crunch the internals of Windows 95 code to the extent required to write functional viruses for the system. It's a reasonable claim. The vast majority of virus writers are, essentially, Caspar Milquetoasts when it comes to this type of unusual "work." They tend to prefer collecting viruses or fragments of them in large numbers and mounting them as public collections on bulletin boards or Internet providers; writing aggressively menacing-sounding electronic press releases; and cobbling together hacks of any one of the thousands of DOS viruses already in existence. This could change writes Ludwig, using the following arguments. A number of relatively inexpensive books on the internals of Windows and Win95 are now in bookstores. These certainly furnish the essentials for understanding the ins-and-outs of file structures and system functions, sufficient information for virus-writers intent on the subject. Further, Ludwig points out DOS appeared in 1981 but the Pakistani Brain virus -- one of the first to garner widespread notice -- didn't show up on diskettes at an American university until the mid-Eighties. And by 1988 there were still only a small number of computer viruses written for that operating system. The current virus production glut is a phenomenon with its roots in the first half of this decade which tends to obscure the fact DOS virus development didn't happen overnight. Ludwig implies the groundwork is now there for viruses under Windows95 but it will be a different cohort of virus-writers who wind up producing them. But the meat of "CVS1996" is, of course, virus writing instruction and Ludwig walks the reader through the design of three of them for Win95. All of them are "direct action" infectors, which is to say -- as Ludwig does -- that they're effective as basic demonstrators but because of their limited strategy in file infection, not likely to be successful in the wild. The first virus, called Hillary, looks for Windows95 files with more than 500 bytes of zero fill, or contiguous empty space in them. It then writes itself to this hole and adjusts the host program so that when loaded the virus gets control first. Although workable on just about anyone's PC, it's a reluctant infector -- much like Ludwig's TIMID virus from "The Little Black Book." Another virus adds itself as a code section to hosts; the last one in the book shuffles the host's internal code around before adding itself to the final product, an effort to make the infection a little less noticeable. The bulk of the virus tutorials are spent detailing the internal structures of the average Windows 95 program and the way in which a virus has to modify them to infect the file without ruining it or crashing the machine. The final section of "CVS1996" is devoted to Robert Morris, Jr.'s Internet Worm. The Worm was unleashed on a computer in MIT's Artificial Intelligence lab in 1988. In a couple of hours it was paralyzing computers on the Internet from coast to coast. Morris confessed to it, was tried, convicted and sentenced with three years of probation, community service and a fine. Like many other discussions of the Worm, Ludwig writes the code of it is schizophrenic: routines that don't get called, either by error or in effort to throw others off. It presents "convoluted logic that seems at best illogical." Still, it was an amazing program in its effect on the Internet, Ludwig continues. And for the conspiracy-minded: "Though Morris has confessed to writing it . . . there has been lingering suspicion over the years that others were behind it, and possibly the NSA. Such allegations are, of course, unproveable." A detailed presentation of the Worm's code and function is delivered. Ludwig adds a small bit of the original is missing: "I simply could not find it anywhere." "Computer Virus Supertechnology" is one of kind. Despite years of social opprobrium, Mark Ludwig is still the only one doing these types of books regularly. The audience is entirely his. Paradoxically, other publishers offering books on computer viruses -- from the anti-virus side of things -- now call him in attempts to cajole him into selling their offerings through the American Eagle mail catalog! Finally, like the rest of American Eagle's recent offerings, "CVS1996" delivers a hefty amount of dense computer code and analysis requiring, at the very least, a passing familiarity with the subject or the patience to master a rather technical treatment in the taboo worlds of computer virus writing and publishing. Plus, there's its unique list price. These are not minor obstacles to the dilettante computer vandal. (CVS1996, American Eagle, POB 1507, Show Low, AZ 85901; ph: 1-520-367-1621) LETTERS TO THE EDITOR: THE CORY RANT ===================================== [This issue Crypt reprints a reader letter simply entitled "The Cory Rant." It is reminiscent in style of the old Mr. Badger columns in Crypt Newsletter. From 1992 until 1994 Badger regularly cursed the dumb evil of computing atrocities perpetrated on Americans until abruptly disappearing into a black hole somewhere in South Carolina. We miss you, Mr. Badger. Please come home. However, in fond remembrance of Mr. Badger's Weltschmerz, behold a credible substitute, "The Cory Rant."] Dear Crypt: I'm sure you've seen many, many jokes based on the ignorance of computer novices. For example, a customer calls PC technical support to report a defective cup holder. Actually, the cup holder is a CD-ROM tray, cup holders not being usual acessories to computers. This is true! There are actually many computer buyers who think CD-ROM trays are cup holders. And to think that Clinton is worried about gun control. Sheesh. At amusement parks you can find stylized representations of furry woodland creatures with their hands outstretched, advising patrons they "must be this tall to ride this ride." But you never see any intelligence or physical requirements on the computer boxes, do you? A big contributor to the problem is the retail arena. This is where most folks buy their first PC. The manufacturers, you see, have taken all the money away from the engineers and given it to the people in marketing. An example: Compaq computers used to carry a three year on-site service warranty. Well, because computers represent such a tiny profit margin (largely because corporate retail re-buyers are generally ignorant of computer-type affairs and wouldn't realize they were being bent over until long after being screwed by the vendor was just a distant memory), the retailers are in love with the concept of extended warranty plans. That's because they represent almost a 100 percent profit margin. According to a Compaq rep, Compaq -- among others -- shortened their warranty period to one year with only 90 days on-site service in order to grease the chute for easy sales of extended warranties. Extended warranties tack on anywhere from $40 to $300 to the price of a computer system. After all, you're probably not going to be using that same damn-hard-to-upgrade Compaq computer five years from now, so what's the point in adding a two year warranty onto a machine that's already covered for three? Acer is about to unveil a new "home PC" which, among other useless features, will be "silent" and feature a REMOTE CONTROL, for God's sake. The goal here is to make the PC fit in amongst the TVs, VCRs, microwaves [you know, the combination mind controller/organ cookers], karaoke machines, toasters and other consumer electronics claptrap. Now, I ask you, when was the last time you said to yourself: "This PC is just too damn loud! I can barely hear the ballgame over the noise of that power supply fan. That reminds me, I need to defrag the hard drive but I'm way too fuckin' lazy to walk eleven feet to the keyboard and click the proper icon. I sure wish this thing had a remote control!" The PC manufacturers these days are perpetually attempting to fill needs that have never existed in the past, do not exist in the present, and are not likely to exist in the future. Compaq already has a line of Presario PCs which have an ugly little slidebar-type display (evidently not driven by software; it looks like it's in the hardware) that pops up on the screen to show the volume and play status of the CD in the CDROM drive. This has no useful function that I can see, other than to make it look just like the primitive activity displays you see on your TV and VCR. What purpose does this serve after the closing of the sale? NONE! It may be that humans, or at least middle-class Americans, have devolved to the point where there is no solution to this. However, I'd be interested to see what would happen if the instruction and "help" files were sold separately. Most of the time, problems arise because people won't Read The Friggin' Manual and end up calling ME, yes ME, 59 times per hour to ask how they can get Microsoft Word to print in landscape orientation. However, if people actually knew they were PAYING for the documentation, that might prompt them to actually USE it, thin and useless though it often is. The Microsoft Windows 95 Resource Kit -- a book, actually -- is three and a half inches thick and sells for about $45. It contains answers. The stuff in the box with Win95 contains only a bunch of vague semi-technical platitudes carefully designed to combat the mysterious phenomenon known as Buyer's Regret. Buyer's Regret is what occurs when a sucker realizes how stupid he was to buy the shit he didn't really need or want in the first place. Damnit. I need a new job. This Saturday, I learned that Best Buy, Inc. now offers "virus eradication" as a service in its store for the low-low price of $35.00 plus $15 per half-hour labor. The mind reels. What if a customer comes to them complaining of a virus when it turns out they actually have some wretched video drivers causing crashes every three minutes? Do they get charged the $35, anyway? What happens if Best Buy employees are too monumentally stupid to successfully eradicate the virus? Or what if there is no virus but Best Buy reports there is and erases all the software on the machine because they couldn't "disinfect" it? The cruel side of me wishes he had enough expendable income to find Little Loc and have him construct something tailor-made for Best Buy's minimum-wage technicians. It would almost be worth the horrendous amount of cash to watch. After all, anyone with enough audacity to charge $30 to install a pair of memory chips or $60 to install a "multimedia kit" -- the latter translates to CD drive and sound card -- deserves the chance to actually earn their money, no? See ya, Cory Tucker RAPIER INTELLECT OF JAPANESE MAN BLUNTED BY ONSET OF TABES DORSALIS =================================================================== Crypt: How do you do? I live in Japan and I am representative of Japanese body odor problem. Do almost [sic] Westerners have body odor? I put up my posters around U.S Air Force, American school and Roppongi which is famouse [sic] for the town where are many foreigners in. So, many American young boys and girls are in trouble! Help them! Masoyuki Ohba@bekkoame.jp STILL MORE RANT =============== Crypt: Relating to your comment in Crypt 38 about the book title, "Bombing to Win" . . . You probably know this, but back in the 1960's Dr. Jose Delgado wrote and published a book called "PHYSICAL CONTROL OF THE MIND: TOWARD A PSYCHOCIVILIZED SOCIETY." (If you have a copy of this you are willing to sell, let me know.) It is my understanding that Delgado essentially proposed that remote-controlled brain implants could and should be used to turn everyone into Stepford wives and children. Delgado is the fellow who found that he could control a bull to some degree with an implant called a stimoceiver that he designed and installed himself. At any rate, it's hard to beat that title as far as I'm concerned. Cory Tucker [Crypt replies: No, Crypt has never seen such a book. However, Jose Delgado lore is better served by The Steamshovel Press and similar publications. It's Crypt's impression that there is no need for a "stimoceiver" in 1996 to Stepford-ize Americans. It's done socially by the process known as "corporate rightsizing." Organization men and women become so frightened of being made into unemployable beggars they'll do anything for approval, even to the eating of bugs during job performance reviews if this is deemed acceptable behavior. If Crypt were to look into Jose Delgado and "stimoceivers" it would be a trip too deep into the realm of crackpots. There would be no end to it. INSLAW and the OCTOPUS, Michael Riconuscioto, General Ray Stubblebine and Psi-Tech. Now you must excuse Crypt, Fletcher Prouty and E. Howard Hunt are knocking on the door. There's a HERF gun they wish to demonstrate.] READER COMMENTS ON JOHN ALEXANDER ================================= Hello Crypt: A while ago, I saw your article and was quite surprised that you have a "John Alexander Watch" type of group. Well, the fact of the matter is that John Alexander has settled in Las Vegas since early this year. He is at the National Institute of Discovery Sciences, 1515 E. Tropicana, Suite 400, Las Vegas, Nevada 89119. If you would like to know more about what's going on I would suggest that you write to him directly. I had a special occasion last March to visit him there. I asked him about whether the institute was part of Bob Bigelow's "Foundation," but he did not wish to answer that question. My impression of him is that he is a courteous gentleman, although the way he writes is very curt and seems "lifeless." But maybe that's his style. The reason I was interested in him was because of my activity with the monitoring of the so-called Deep Black Projects programs. Anyway, just wanted to give my two cents of comments. Sincerely, Norio -=The Crypt Newsletter welcomes thoughtful mail from readers at crypt@sun.soci.niu.edu. Published letters may be edited for length and clarity or anonymized to protect the naive from themselves.=- REACHING CRYPT NEWSLETTER Send software, books, subscription orders ($10.00/year) to: George Smith Crypt Newsletter 1635 Wagner St. Pasadena, CA 91106 E-mail: crypt@sun.soci.niu.edu or 70743.1711@compuserve.com CRYPT NEWSLETTER HYPERTEXT If you're reading this, you don't have it. NOTE====>Crypt Hypertext can be bought with your favorite plastic. VISA/MASTERCARD orders can be placed with COMSEC, Ltd., in Glenview, Illinois.<====NOTE Ordering by phone: 1-800-754-8214 1-847-729-3565 fax: 1-847-729-3575 Price: $30.00 + $4.00 shipping In addition, Crypt Hypertext can be registered through Compuserve's on-line SWREG service. To purchase a copy of Crypt Hypertext through your CompuServe account simply use the GO menu and enter the keyword: SWREG. You will be presented with a menu to identify your geographic location. When prompted to search the software database enter the number: # 9228 or the name CRYPT NEWSLETTER HYPERTEXT V. 1.0 and provide the requested information. You will receive a copy of Crypt Hypertext through US Mail. Operating Systems - DOS, WINDOWS Cost: $30.00 + $4.00 shipping and handling in US, Canada and Mexico. + $8.00 shipping and handling worldwide. The database contains not only Crypt Newsletter 1992 - 95 but also a great deal of additional material and unpublished notes. Where appropriate, additions have also been made to old issues and articles to provide current perspective and background. The database also contains a keyworded glossary and extensive subject index spanning the length and breadth of the newsletter. Cut and paste any information to your customized specification. In the database you'll find comprehensive stories, tutorials and news on: --the computer virus underground and virus-writers --the anti-virus industry --on-line culture and sociology --book reviews of current titles in security --annals of computer crime & computer virus spread --virus descriptions and history --walkthrough simulations, imagery and displays - aural and visual - from computer viruses and controversial virus-making software toolkits --discussion of legal issues with regard to computer viruses and related computer crime --extensive companion material for the author's book, "The Virus Creation Labs" --review of the mainstream media: the shams and scams reported as real news. Take a skeptic's look at the information highway! The Crypt Newsletter database is also extensible. Future hypertext issues, distributed through CIS forums, can easily be copied to the database's directory on your home computer and seamlessly integrated into the collection. The complete index of topics 1992 - 96 is on the Crypt News Web page: http://www.soci.niu.edu/~crypt CRYPT HYPERTEXT ORDER FORM --------------------------------------------------------- By Mail: Return this form along with your remittance to: COMSEC Ltd. 1545 Waukegan Road Suite 2 Glenview, Illinois 60025-2143 Orders: 800-754-8214 Support: 847-729-3565 Fax: 847-729-3575 Questions To: crypt@sun.soci.niu.edu 70743.1711@compuserve.com ORDER: [ ] ____ Crypt Hypertext(s) @ $30.00 each. [ ] Regular mail shipping, please add $4.00. [ ] US Priority Mail, please add $6.00. Checks and money orders must be in U.S. dollars drawn on a U.S. bank. Do Not Enclose Cash. Total enclosed . . . . . . . . . . . . . . $______________ Payment by: [] Check [] Money Order SHIP TO: Name _____________________________________________________ Address 1 ________________________________________________ Address 2 ________________________________________________ City __________________________ State/Province ___________ Zip/Postal Code ________________ Country _________________ Telephone (______)________________________________________ CRYPT ON COMPUSERVE Crypt Newsletter is now concentrated in two places on Compuserve. GO CRYPTNEWS brings the user to dedicated Crypt Newsletter message and file bases! For example, in addition to the usual issues Crypt maintains copies of electronic documents like the Federation of American Scientists' Secrecy & Government Bulletin and the recent GAO report on hacking incidents at Department of Defense. GO NCSAFORUM will bring users into the National Computer Security Association Infosec forum. This forum features a great deal of specific and general information on computer security as well as Crypt Newsletter in its attached file libraries and message bases. CRYPT NEWSLETTER WORLD WIDE WEB HOME PAGE You can visit Crypt & The Virus Creation Labs on the World Wide Web, download back issues and sample a chapter from VCL! Set your browser to: URL: http://www.soci.niu.edu/~crypt ---------------------------------------------------------------- What? You've been reading Crypt Newsletter regularly and you haven't purchased a copy of "The Virus Creation Labs"?? Well, what are you waiting for? A gold-plated personal invitation? What people are saying about THE VIRUS CREATION LABS: "Crypt Newsletter editor George C. Smith's entire book exposes an insane world where everybody claws at each others' throats -- and where even the virus writers have marketing departments. 172 pages written with an utterly cynical sense of humor . . . This book gets my highest recommendation. Required reading for anybody who claims the sky is falling in the computer world." ---Rob Rosenberger, Computer Virus Myths, October 1996 "I couldn't stop reading it . . . As hype continues to build about security on the Internet and movies like _Hackers_ ooze the real hackers into the mainstream arena, this book is definite apropos material for the time. Read it! A+" ---The Net magazine, February 1996 "[VIRUS CREATION LABS] is informative and stunningly incisive . . . " ---Secure Computing, October 1995 "George Smith . . . takes a look at the world of virus writers and anti-virus software vendors in a style similar to that of 'Cyberpunks' -- anecdotal, humorous and revealing . . . a lucid and entertaining read." ---Computer Security Journal "There are relatively few books on the 'computer underground' that provide richly descriptive commentary and analysis of personalities and culture that simultaneously grab the reader with entertaining prose. Among the classics are Cliff Stoll's 'The Cuckoo's Egg,' Katie Hafner and John Markoff's 'Cyberpunk,' and Bruce Sterling's 'The Hacker Crackdown.' Add George Smith's 'The Virus Creation Labs' to the list . . . 'Virus Creation Labs' is about viruses as M*A*S*H is about war!" ---Jim Thomas, Computer underground Digest 7.18, March 5, 1995 "THE VIRUS CREATION LABS dives into the hoopla of the Michelangelo media blitz and moves on to become an engaging, articulate, wildly angry diatribe on the world of computer virus writers . . . Expert reporting." ---McClatchy NewsWire -------------------------order form------------------------- Yes, I want my wig flipped and wish to receive a copy of George Smith's "The Virus Creation Labs: A Journey Into the Underground" (American Eagle, ISBN 0-929408-09-8). Price: $12.95/copy plus $2.50 shipping per book (add $7.50 overseas) NAME: _____________________________________________ ADDRESS: __________________________________________ CITY/STATE/ZIP: __________________________________ Payment method: ___ Master Charge ___ Money Order ___ Check ___ Visa Credit Card # ___________________________________________ Expiration date _________________________________________ Name: ____________________________ Orders can be taken by voice or fax through regular phone number and/or 1-800 number in USA. COD welcome. American Eagle: 1-800-719-4957 1-520-367-1621 POB 1507 Show Low, AZ 85901 ACKNOWLEDGMENTS =============== Rob Rosenberger, editor/webmaster of Virus Myths. Visit -- http://www.kumite.com/myths for a savage read. ------------------------------------------------------------- George Smith, Ph.D., edits the Crypt Newsletter from Pasadena, CA. copyright 1996 Crypt Newsletter. All rights reserved.