News for hackers. Stuff that matters.

A comment on The Malware Museum.

Re:The Malware Museum by luso_brazilian on Friday February 05, 2016 @06:18AM (#11040764)
Back in the days a lot of thought and ingenuity was put into making these viruses. For instance, the Friday 13th [1][2][3] virus:

* was only 419 bytes long

* infected both .COM and .EXE, increasing the size of the former by only 1813 bytes

* on infection, became memory resident (using only 2kb of memory)

* hooked itself into interrupt processing and other low level DOS services to, for instance, suppress the printing of console messages in failure cases (like trying to to infect a file on a read-only floppy disk)

* activated itself every friday 13th and deleted programs used that day

It still managed to spread itself worldwide (mostly via floppy disk sharing as the world wide web didn't exist yet) and went mainstream enough for the broadcast news to advise people not to turn on their computers on that date or to push the date one day ahead.

All that in 419 bytes, about a third of the size of this post.

[1] https://en.wikipedia.org/wiki/Jerusalem_%28computer_virus%29

[2] https://www.f-secure.com/v-descs/jerusale.shtml

[3] http://www.pandasecurity.com/mediacenter/malware/famous-viru...

[ Parent | on HN ]
Re:The Malware Museum by sillysaurus3 on Friday February 05, 2016 @07:39AM (#11040991)
about a third of the size of this post.

This was a delightful comparison. It didn't really sink in until you said that.

[ Parent | on HN ]
Re:The Malware Museum by laacz on Friday February 05, 2016 @08:22AM (#11041177)
Or three tweets, if you did not try squeezing it inside multi-byte characters.
[ Parent | on HN ]
Re:The Malware Museum by kenbellows on Friday February 05, 2016 @12:00PM (#11042713)
Somebody tweet it!
[ Parent | on HN ]
Re:The Malware Museum by sarciszewski on Friday February 05, 2016 @12:48PM (#11043146)
It's raw binary. The best way would be to base64 encode it and break it into four tweets.
[ Parent | on HN ]
Re:The Malware Museum by treve on Friday February 05, 2016 @01:18PM (#11043406)
The best way to find some other base?????? encoding that maps to unicode glyphs!
[ Parent | on HN ]
Re:The Malware Museum by JoshTriplett on Friday February 05, 2016 @02:53PM (#11044125)
https://www.npmjs.com/package/base65536
[ Parent | on HN ]
Re:The Malware Museum by whoopdedo on Friday February 05, 2016 @05:00PM (#11044974)
How about Emoji?

http://www.windytan.com/2014/10/visualizing-hex-bytes-with-u...

[ Parent | on HN ]
Re:The Malware Museum by cademetz on Friday February 05, 2016 @12:50PM (#11043163)
Hello Luso Brailian: I'm a senior writer with Wired (www.wired.com). Am putting together a small story on this. Would love to chat, if you have a second: [email protected]
[ Parent | on HN ]
Re:The Malware Museum by luso_brazilian on Friday February 05, 2016 @03:31PM (#11044382)
No problems, I'll e-mail you. My hash is 66aaeaf1850395a78696b3b6c178d49fd71bf5c3
[ Parent | on HN ]
Re:The Malware Museum by dcposch on Saturday February 06, 2016 @12:41AM (#11046712)
curious, what does that mean?
[ Parent | on HN ]
Re:The Malware Museum by tgsovlerkhgsel on Saturday February 06, 2016 @02:26AM (#11046910)
Most likely authentication. He'll e-mail the reporter and include the input that hashes to the value. This way, the reporter can be sure it's him.
[ Parent | on HN ]
Re:The Malware Museum by ntsb on Friday February 05, 2016 @06:06PM (#11045365)
> I'm a senior writer with Wired (www.wired.com). Am putting together a small story on this. Would love to chat

You must not have a full grasp of how HN operates.

If all it takes to get into a Wired article is to regurgitate information already plentifully available online, I'm pretty worried about Wired's future.

While the comment was substantive and linked to sources, this is normal for HN and nothing special.

How about you contact the guy who posted the article? He's the CRO from F-Secure, one of the research companies that was linked to as a source.

I really hope Wired doesn't start using random comments as "experts" in articles.

[ Parent | on HN ]
Re:The Malware Museum by CDokolas on Friday February 05, 2016 @08:58AM (#11041373)
I have a printout of the disassembly of that virus (in wide format fanfold) from around then. When I come across it I'll donate it to the Hellenic IT Museum...
[ Parent | on HN ]
Re:The Malware Museum by paulannesley on Friday February 05, 2016 @07:10PM (#11045728)
Here's a disassembly of a strain of that virus: http://textfiles.com/virus/jeru-b.asm
[ Parent | on HN ]
Re:The Malware Museum by 0x0 on Friday February 05, 2016 @02:19PM (#11043874)
Aren't these two statements contradictory?

  > * was only 419 bytes long
  > * infected both .COM and .EXE, 
      increasing the size of the former 
      by only 1813 bytes
[ Parent | on HN ]
Re:The Malware Museum by db48x on Friday February 05, 2016 @10:41PM (#11046445)
Compressing the payload was pretty common.
[ Parent | on HN ]
Re:The Malware Museum by CaptSpify on Friday February 05, 2016 @02:34PM (#11043975)
I know nothing about these, but is it possible it put it's code in multiple places on the .com or .exe?
[ Parent | on HN ]
Re:The Malware Museum by hartpuff on Friday February 05, 2016 @08:01AM (#11041072)
> mostly via floppy disk sharing as the world wide web didn't exist yet

Great post, but wouldn't the internet, email, BBS and other networks have been the main cause of its worldwide spread?

[ Parent | on HN ]
Re:The Malware Museum by luso_brazilian on Friday February 05, 2016 @09:11AM (#11041459)
As the initial source of infection in a certain geographical area maybe but as far as I remember most viruses (specially boot sector ones) spread through floppy disk sharing, first from people to people inside companies, from company computer to personal computer at home, from friend to friend personal computer and then from personal computer to company computer.

Much like the spread of HIV back in the late 80's and early 90's most people didn't really understand how exactly computers programs worked and didn't follow IT guidelines on how to avoid getting infected. The number of infections was naturally limited by the small number of people at risk: computer users.

But as the availability of computers and the number of useful applications increased so did the volume of infections being spread through the same bad habits: floppy sharing without protection, and by that I mean the read only lock.

And, instead of the ideal (but very hard) way to eradicate the problem (informatic prophylaxis and education for users) the industry "solved" the problem by creating the antivirus and accepting an occasional infection as something unavoidable.

Then the World Wide Web exploded, creating a frictionless media for the spread of these infections and here we are.

[ Parent | on HN ]
Re:The Malware Museum by hartpuff on Friday February 05, 2016 @12:56PM (#11043225)
Thanks. Yeah, I think I was overestimating usage of online file transfer systems at that time, and underestimating offline/business usage of PCs.
[ Parent | on HN ]
Re:The Malware Museum by sehugg on Friday February 05, 2016 @08:12AM (#11041131)
In 1987 sneakernet was way more popular than any online service. The majority of regular folks weren't online yet.
[ Parent | on HN ]
Re:The Malware Museum by tclancy on Friday February 05, 2016 @08:22AM (#11041178)
And some of us who were were still rocking a Commodore. 30+ years, still 0 infections here!
[ Parent | on HN ]
Re:The Malware Museum by digi_owl on Friday February 05, 2016 @10:15AM (#11041916)
Reminds me that Woz claimed that one reason the early Macs were so resistant to viruses was that most of the OS lived in ROM.
[ Parent | on HN ]