F-Secure Blog

I wasn’t really aware of computer viruses until the early 2000s when viruses such as Nimda and ILOVEYOU got a lot of attention so I find it interesting to learn that computer viruses were causing problems in the 80s when the world wasn’t half as connected as it was by the end of the millenium.

There’s not much technical details included in this news report video It mentions two logic bombs that are activated on Friday 13th and shows how one of these viruses (I’m guessing “Data Crime”) caused damaged to the UK’s Royal National Institute for the Blind which, at the time, was helping blind people use computers.

This Computer Knowledge article on the 1989 Datacrime virus [1] has more information:

> … on any day after October 12th, it would trigger a low level format of cylinder zero of the hard disk, which would, on most hard disks, wipe out the File Allocation Table, and leave the user effectively without any data. It would also display the virus’ name: Datacrime virus.

It looks like the 1989 “Data crime” virus was not notable enough to be included in Wikipedia’s Timeline of computer viruses and worms [2] – though the Jerusalem virus is included under 1987:

> The Jerusalem virus, part of the (at that time unknown) Suriv family, is detected in the city of Jerusalem. The virus destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13, 1988). Jerusalem caused a worldwide…

I miss Delphi as well even though I never got to use it for anything professional as I was very young at the time.

However I do remember very fondly how I came to know about Delphi 2 (or 3?).

Somehow I met this guy in ICQ and started talking about programming and about these (back then) very popular programs for "hacking" your friends: Back Orifice, Netbus, Sub7, etc. when he then says that he's actually developing his very own trojan tool called "Hacker's Paradise".

Long story short, at some point he sends me the source code and starts to explain to me how it works.

Some time later time he realizes that there's much more future in actually developing a tool for sysadmins so he renames the tool "Master's Paradise"[1] and starts trying to sell it.

Sadly, I never knew or heard from him again, but I love that story because I was around 10 or 12 at the time and it seemed like magic to me be able to open the Delphi editor, drag and drop some buttons and have a fully functional Windows program at my fingertips. Just beautiful.

Also, the fact that I was getting source code from a stranger over the internet for a tool that would do such "magical" things as opening and closing the cd-rom tray of whoever you had the chance to infect, made me feel like part of the super elite hacker world (ha!).

[1]Now classified by antivirus programs not as a virus but as a backdoor tool: https://www.f-secure.com/v-descs/paradise.shtml

This is HN. Can we skip the blogspam and link directly to F-Secure? There is nothing of value in the blog post.

Actual content:

http://www.f-secure.com/weblog/archives/00002256.html

It's important to note that this is a trojan virus, which means the user must download and run it. It would be far more significant if this were a drive-by attack.

One interesting item I noticed in the information about the trojan itself is this bit:

===QUOTE===

On installation, the installer first checks if the following file is found in the system:

* /Library/Little Snitch/lsd

Little Snitch is a firewall program for Mac OS X. If the program is found, the installer will skip the rest of its routine and proceed to delete itself.

===QUOTE===

So if you're running Little Snitch, this trojan deletes itself. Effective.

Professional poker players have been dealing with this type of risk for years. Major poker tournaments present a juicy target for organised hacking gangs. A high-stakes pro might have tens or hundreds of thousands of dollars deposited in their PokerStars account. Hundreds of professional players in a tournament cardroom means hundreds of very valuable laptops left in hotel rooms.

The most sensible precautions seem to be a) full-disk encryption with a strong passphrase, b) hardware 2fa using a token that is stored separately from the computer, c) physically securing the machine whenever possible and d) tamper-evident seals covering screwholes or seams.

If your adversary is capable of beating these precautions, you're probably screwed anyway.

https://www.f-secure.com/weblog/archives/00002647.html

I've been using Freedome[0] for a few months now and I am really liking it. While I don't use it to escape censorship and digital embargos it's adequate for such purposes too. You can pick from exit IPs all over the world and easily switch it.

I run all my traffic through Finland usually because they have fairly strong data protection laws, especially compared to the UK where I live.

It's also a nice way to get around traffic shaping and other invasive measures from your ISP. During peak hours I have better speeds for Netflix and the likes through Finland than without VPN.

0: https://www.f-secure.com/en_GB/web/home_gb/freedome

To see if you haven't got it:

In terminal run:

defaults read /Applications/Safari.app/Contents/Info LSEnvironment

You should get this error:

The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist

Then run:

defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES

You should get this error:

The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist

If you do you are clean of this variant!

If this doesn't happen go to http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml to fix it