On: The Malware Museum

[luso_brazilian]

Back in the days a lot of thought and ingenuity was put into making these viruses. For instance, the Friday 13th [1][2][3] virus:

* was only 419 bytes long

* infected both .COM and .EXE, increasing the size of the former by only 1813 bytes

* on infection, became memory resident (using only 2kb of memory)

* hooked itself into interrupt processing and other low level DOS services to, for instance, suppress the printing of console messages in failure cases (like trying to to infect a file on a read-only floppy disk)

* activated itself every friday 13th and deleted programs used that day

It still managed to spread itself worldwide (mostly via floppy disk sharing as the world wide web didn't exist yet) and went mainstream enough for the broadcast news to advise people not to turn on their computers on that date or to push the date one day ahead.

All that in 419 bytes, about a third of the size of this post.

[1] https://en.wikipedia.org/wiki/Jerusalem_%28computer_virus%29

[2] https://www.f-secure.com/v-descs/jerusale.shtml

[3] http://www.pandasecurity.com/mediacenter/malware/famous-viru...

[sillysaurus3 → luso_brazilian]

about a third of the size of this post.

This was a delightful comparison. It didn't really sink in until you said that.

[laacz → sillysaurus3]

Or three tweets, if you did not try squeezing it inside multi-byte characters.

[kenbellows → laacz]

Somebody tweet it!

[sarciszewski → kenbellows]

It's raw binary. The best way would be to base64 encode it and break it into four tweets.

[treve → sarciszewski]

The best way to find some other base?????? encoding that maps to unicode glyphs!

[JoshTriplett → treve]

https://www.npmjs.com/package/base65536

[whoopdedo → treve]

How about Emoji?

http://www.windytan.com/2014/10/visualizing-hex-bytes-with-u...

[cademetz → luso_brazilian]

Hello Luso Brailian: I'm a senior writer with Wired (www.wired.com). Am putting together a small story on this. Would love to chat, if you have a second: cade_metz@wired.com

[luso_brazilian → cademetz]

No problems, I'll e-mail you. My hash is 66aaeaf1850395a78696b3b6c178d49fd71bf5c3

[dcposch → luso_brazilian]

curious, what does that mean?

[tgsovlerkhgsel → dcposch]

Most likely authentication. He'll e-mail the reporter and include the input that hashes to the value. This way, the reporter can be sure it's him.

[ntsb → cademetz]

> I'm a senior writer with Wired (www.wired.com). Am putting together a small story on this. Would love to chat

You must not have a full grasp of how HN operates.

If all it takes to get into a Wired article is to regurgitate information already plentifully available online, I'm pretty worried about Wired's future.

While the comment was substantive and linked to sources, this is normal for HN and nothing special.

How about you contact the guy who posted the article? He's the CRO from F-Secure, one of the research companies that was linked to as a source.

I really hope Wired doesn't start using random comments as "experts" in articles.

[CDokolas → luso_brazilian]

I have a printout of the disassembly of that virus (in wide format fanfold) from around then. When I come across it I'll donate it to the Hellenic IT Museum...

[paulannesley → luso_brazilian]

Here's a disassembly of a strain of that virus: http://textfiles.com/virus/jeru-b.asm

[0x0 → luso_brazilian]

Aren't these two statements contradictory?

  > * was only 419 bytes long
  > * infected both .COM and .EXE, 
      increasing the size of the former 
      by only 1813 bytes

[db48x → 0x0]

Compressing the payload was pretty common.

[CaptSpify → 0x0]

I know nothing about these, but is it possible it put it's code in multiple places on the .com or .exe?

[hartpuff → luso_brazilian]

> mostly via floppy disk sharing as the world wide web didn't exist yet

Great post, but wouldn't the internet, email, BBS and other networks have been the main cause of its worldwide spread?

[luso_brazilian → hartpuff]

As the initial source of infection in a certain geographical area maybe but as far as I remember most viruses (specially boot sector ones) spread through floppy disk sharing, first from people to people inside companies, from company computer to personal computer at home, from friend to friend personal computer and then from personal computer to company computer.

Much like the spread of HIV back in the late 80's and early 90's most people didn't really understand how exactly computers programs worked and didn't follow IT guidelines on how to avoid getting infected. The number of infections was naturally limited by the small number of people at risk: computer users.

But as the availability of computers and the number of useful applications increased so did the volume of infections being spread through the same bad habits: floppy sharing without protection, and by that I mean the read only lock.

And, instead of the ideal (but very hard) way to eradicate the problem (informatic prophylaxis and education for users) the industry "solved" the problem by creating the antivirus and accepting an occasional infection as something unavoidable.

Then the World Wide Web exploded, creating a frictionless media for the spread of these infections and here we are.

[hartpuff → luso_brazilian]

Thanks. Yeah, I think I was overestimating usage of online file transfer systems at that time, and underestimating offline/business usage of PCs.

[sehugg → hartpuff]

In 1987 sneakernet was way more popular than any online service. The majority of regular folks weren't online yet.

[tclancy → sehugg]

And some of us who were were still rocking a Commodore. 30+ years, still 0 infections here!

[digi_owl → tclancy]

Reminds me that Woz claimed that one reason the early Macs were so resistant to viruses was that most of the OS lived in ROM.