January 1992 saw the Self Mutating Engine (MtE) from Dark Avenger. At first, all we saw was a virus that we named Dedicated, but shortly after that, we saw the MtE. This came as an OBJ file, plus the source code for a simple virus, and instructions on how to link the OBJ file to a virus to give you a full polymorphic virus. Immediately, virus researchers set to work on detectors for it. Most companies did this in two stages. In some outfits, stage one was look at it and shudder, stage two was ignore it and hope it goes away. But at the better R&D sites, stage one was usually a detector that found between 90 and 99% of instances, and was shipped very quickly, and stage two was a detector that found 100%. At first, it was expected that there would be lots and lots of viruses using the MtE, because it was fairly easy to use this to make your virus hard to find. But the virus authors quickly realised that a scanner that detected one MtE virus, would detect all MtE viruses fairly easily. So very few virus authors have taken advantage of the engine (there are about a dozen or two viruses that use it).
This was followed by Dark Avenger’s Commander Bomber. Before CB, you could very easily predict where in the file the virus would be. Many products take advantage of this predictability to run fast; some only scan the top and tail of the file, and some just scan the one place in the file that the virus must occupy if it is there at all. Bomber transforms this, and so products either have to scan the entire file, or else they have to be more sophisticated about locating the virus.
Another virus that came out at about that time, was Starship. Starship is a fully polymorphic virus (to defeat scanners), with a few neat anti-debugging tricks, and it also aims to defeat checksummers with a very simple trick. Checksumming programs aim to detect a virus by the fact that it has to change executable code in order to replicate. Starship only infects files as they are copied from the hard disk to the floppy. So files on the hard disk never change. But the copy on the floppy disk is infected, and if you then copy that onto a new hard disk, and tell the checksummer on the new machine about this new file, the checksummer will happily accept it, and never report any changes. Starship also installs itself on the hard disk, but without changing executable code. It changes the partition data, making a new partition as the boot partition. No code is changed, but the new partition contains the virus code, and this is run before it passes control on to the original boot partition.
Probably the greatest event of 1992 was the great Michelangelo scare. One of the American anti-virus vendors forecast that five million computers would go down on March the 6th, and many other US vendors climbed on to the bandwagon. PC users went into a purchasing frenzy, as the media whipped up the hype. On March the 6th, between 5,000 and 10,000 machines went down, and naturally the US vendors that had been hyping the problem put this down to their timely and accurate warning. We’ll probably never know how many people had Michelangelo, but certainly in the days leading up to March the 6th, a lot of computers were checked for viruses. After March 6th, there were a lot of discredited experts around.
The reaction to the Michelangelo hype did a lot of damage to the credibility of people advocating sensible antivirus strategies, and outweighed any possible benefits from the gains in awareness.
In August 1992, we saw the first serious virus authoring packages. First the VCL (Virus Creation Laboratory) from Nowhere Man, and then Dark Angel’s Phalcon/Skism Mass-Produced Code Generator. These packages made it possible for anyone who could use a computer, to write a virus. Within twelve months, dozens of viruses had been created using these tools.
Towards the end of 1992, a new virus writing group called ARCV (Association of Really Cruel Viruses) had appeared in England – within a couple of months, the Computer Crime Unit of New Scotland Yard had tracked them down and arrested them. ARCV flourished for about three months, during which they wrote a few dozen viruses and attracted a few members.
Another happening of 1992, was the appearance of people selling (or trying to sell) virus collections. To be more precise, these were collections of files, some of which were viruses, and many of which were assorted harmless files. In America, John Buchanan offered his collection of a few thousand files for $100 per copy, and in Europe, The Virus Clinic offered various options from #25. The Virus Clinic was raided by the Computer Crime Unit; John Buchanan is [?] still offering viruses for sale.
Towards the end of 1992, the US Government was offering viruses to people who called the relevant BBS.
The information in this section was provided by and used with permission of Dr. Solomon Software. Please do not further use the material without obtaining your own permission to use it.
 Dr Solomon History |
|
 |
 |
| 1991 Product Launches and Polymorphism | 1993 Polymorphics and Engines |