221 lines
13 KiB
Prolog
221 lines
13 KiB
Prolog
|
|
|
|
Mark Garvin -- Xymetric Productions -- New York City 3-7-87
|
|
|
|
|
|
I guess I have stirred some interest with my recent messages to BBS's
|
|
concerning Trojan horse programs. I have decided to write the following
|
|
file in the interest of warning others and hopefully finding clues to the
|
|
origin of the programs.
|
|
|
|
I have been operating a Priam 60 Meg hard disk on my AT for the past two
|
|
years with good results. About four months ago, I encountered a Trojan
|
|
horse program called HI-Q.COM which corrupted the FAT table on the disk.
|
|
I lost access to the entire D: drive and the files and boot sectors on
|
|
the C: drive were so badly damaged that I had to reformat the drive.
|
|
Since there was nothing to be lost by trying the program again, I decided
|
|
to confirm that HI-Q.COM was indeed the culprit. I ran a couple of the
|
|
popular Trojan finders on the file first: Nothing. Thinking perhaps I
|
|
was mistaken, I ran HI-Q under an INT13-trapper. No INT 13's were found
|
|
and HI-Q ran normally. Upon rebooting the system, I found the same boot-
|
|
sector errors, and CHKDSK again reported numerous cross-links, etc. I
|
|
reformatted the drive and ran media checks to make sure the Priam was
|
|
sound. After checking several other programs (I did NOT run the Trojan-
|
|
testers or INT13-trapper again in case those were perhaps Trojan), I ran
|
|
HI-Q.COM for the third time. Same results. This is enough for me: I'm
|
|
convinced.
|
|
|
|
Up until this point, I had heard of Trojan horses, but honestly doubted
|
|
that there were actually competant computer programmers around who were
|
|
wierd enough to write such a thing. I should also note that there is a
|
|
program called HI-Q.EXE which has been tested by some boards, and is
|
|
supposedly NOT a Trojan. I'm not going to try it on my hard disk system.
|
|
The HI-Q.COM program may not have even been an intentional Trojan -- I'm
|
|
willing to keep an open mind on the subject. Maybe it was incompetent
|
|
programming, or perhaps someone ran SPACEMAKER or a similar program on
|
|
the .EXE file to convert it to a .COM file, and inadvertantly created a
|
|
Trojan.
|
|
|
|
OK -- that's one thing.. The next Trojan I ran was DEFINITELY intentional.
|
|
I had reformatted my Priam after the previous incident, and I haven't
|
|
allowed the mysterious HI-Q program back on the system. However, I HAVE
|
|
run numerous file-managers, etc. from local BBS's -- maybe I'm just a
|
|
trusting individual, but I wasn't ready to give up on Public Domain or
|
|
shareware software just yet. Recently, the Priam starting giving me
|
|
trouble again: crosslinked and lost files, and no boot. I called Priam,
|
|
hoping to get instructions for perhaps salvaging files on the D: drive,
|
|
since the partition was destroyed. Priam's tech guided me through a HEX/
|
|
ASCII dump of the boot record via a trap-door in Priam's FDISK program.
|
|
Needless to say, we were BOTH incredulous at the result. Dis-believers
|
|
should look closely at the HEX/ASCII dump below. This was NOT retyped
|
|
or altered in any way. After booting from floppy, I redirected printer
|
|
output to a disk file. What you are looking at below is exactly what
|
|
appeared on my screen after the crash.
|
|
|
|
____________________________________________________________________________
|
|
|
|
|
|
|
|
0 = Master Boot Record, 25 = Extended Volume Record
|
|
1 - 24 = Volume Boot Record
|
|
|
|
Enter number of record to display (0 - 25) : [ 0]
|
|
|
|
D H 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
|
0/ 0 EB 7D 53 4F 46 54 4C 6F 4B 2B 20 33 2E 30 0D 0A ..SOFTLoK+ 3.0..
|
|
16/ 10 11 28 43 29 20 53 4F 46 54 47 55 41 52 44 0D 0A .(C) SOFTGUARD..
|
|
32/ 20 53 59 53 54 45 4D 53 2C 20 49 4E 43 2E 20 0D 0A SYSTEMS, INC. ..
|
|
48/ 30 32 38 34 30 20 53 74 20 54 68 6F 6D 61 73 0D 0A 2840 St Thomas..
|
|
64/ 40 45 78 70 77 79 2C 20 73 74 65 20 32 30 31 0D 0A Expwy, ste 201..
|
|
80/ 50 53 61 6E 74 61 20 43 6C 61 72 61 2C 20 20 0D 0A Santa Clara, ..
|
|
96/ 60 43 41 20 39 35 30 35 31 20 20 20 20 20 20 0D 0A CA 95051 ..
|
|
112/ 70 34 30 38 2D 39 37 30 2D 39 34 32 30 10 07 00 FA 408-970-9420....
|
|
128/ 80 8C C8 8E D0 BC 00 7C FB 8B F4 8E C0 8E D8 FC BF ......|.........
|
|
144/ 90 00 06 B9 00 01 F3 A5 EA D4 06 00 00 45 72 72 6F ............Erro
|
|
160/ A0 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 r loading operat
|
|
176/ B0 69 6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 ing system.Missi
|
|
192/ C0 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 ng operating sys
|
|
208/ D0 74 65 6D 00 BE BE 07 B9 04 00 AC 3C 80 74 15 83 tem........<.t..
|
|
224/ E0 C6 0F E2 F6 CD 18 AC 0A C0 74 FE BB 07 00 B4 0E .........t......
|
|
240/ F0 CD 10 EB F2 4E 8B 14 8B 4C 02 BB 00 7C B8 11 02 ....N...L...|...
|
|
|
|
Press <Esc> to ABORT, any other key to continue .
|
|
|
|
0 = Master Boot Record, 25 = Extended Volume Record
|
|
1 - 24 = Volume Boot Record
|
|
|
|
|
|
_____________________________________________________________________________
|
|
|
|
|
|
In the interest of justice, I would like to make the following obser-
|
|
vations:
|
|
|
|
1) The MAIN phone no. for SoftGuard systems is: 408-970-9240, NOT 9420.
|
|
The no. listed above is not in use. The message it gives IS the
|
|
normal message for that area, even though it sounds like it is com-
|
|
puter generated. The phone co. says it is actually registered to
|
|
Siliconix, a Silicon Valley chip-manufacturer, who probably has no
|
|
interest in Public Domain software or BBS's.
|
|
|
|
2) I called SoftGuard, and they gave me a Mr. Phelps-type message, disavow-
|
|
ing any knowledge of any Trojan programs or of SOFTLok, etc. which they
|
|
said is not an official product. However, they have not returned my
|
|
calls requesting additional information, and a request to speak to some-
|
|
one knowledgable about their software protection techniques has not been
|
|
answered. This may mean either that the message was cooked up by some-
|
|
one with a vendetta against SoftGuard (I don't know why!), or that Soft-
|
|
Guard wants to be able to identify the source of the Trojan program by
|
|
the information phoned in by irate people whose disks have just crashed.
|
|
In my opinion, the juxtaposition of the phone no. digits could be caused
|
|
by errors on the part of whoever wrote the Trojan program, whether it
|
|
was within SoftGuard, or not. After restoring the hard disk, I scanned
|
|
every file on it, and "SoftGuard" did not appear anywhere. The clever-
|
|
ness in bit-shifting the ASCII digits, or otherwise disguising them, may
|
|
also have resulted in the wrong phone no.
|
|
|
|
3) I have not, and will not, install SoftGuard programs on my disks. Also,
|
|
I obviously do not have any reason to run any of the unprotect programs
|
|
for SoftGuard, of which some are supposedly Trojans themselves (see
|
|
below). I have no idea of which file of the 2,000+ files on my system
|
|
was the origin of the message. As explained above, I have scanned them
|
|
for ASCII text and I've come up with nothing so far.
|
|
|
|
|
|
|
|
There are numerous warnings in circulation concerning SoftGuard Systems,
|
|
manufacturers of the SuperLock copy-protection scheme. They SUPPOSEDLY
|
|
upload Trojan programs to BBS's either to try to get their own form of
|
|
justice against those who try to crack their software, or because they
|
|
are just bitter about the numerous SoftGuard/SuperLock unprotectors which
|
|
are circulating on the BBS's. Most of these Trojans have the name SUG..
|
|
(Soft-Un-Guard) or something similar. I did not originally believe that
|
|
SoftGuard would be stupid enough to do such a thing. After all, a lesson
|
|
should have been learned by the example of Prolok (another copy-protect
|
|
manufacturer), who claimed that their new software would destroy the hard
|
|
disk of anyone who tried to mis-use it. Most users, legitimate and other-
|
|
wise, dropped them instantly, even though Prolok realized their grave
|
|
error and retracted their previous advertising. After all, who wants to
|
|
have their hard disk destroyed by accidently inserting the wrong key disk?
|
|
|
|
The SUG programs mentioned are reported to say something like: "Courtesy
|
|
of SoftGuard Systems .. So sue us!" -- after trashing the hard disk.
|
|
|
|
My feelings about possibly casting doubt on the integrity of SoftGuard ?
|
|
They did NOT convince me that they were blameless, and if they cared, they
|
|
would have returned my phone calls. However, it MAY just be coincidence
|
|
that a lot of the Trojan programs mention SoftGuard.
|
|
|
|
|
|
Recommendations:
|
|
|
|
Whether SoftGuard is at fault or not, they did not give me an adequate
|
|
explanation of the rumors circulating about them, and they did not
|
|
return my calls. I would recommend that individuals and companies stay
|
|
away from SoftGuard/SuperLock, or any other copy-protect program which
|
|
writes hidden, strange information onto their hard disks. Users of such
|
|
copy-protected software should write or call the manufacturers and re-
|
|
quest that the copy protection be discontinued. Explain to them that
|
|
pirates will always crack copy-protection, and that only the legitimate
|
|
users suffer from its use. If you work for a company that uses copy-
|
|
protected software, why not get a print-out of this file and show it to
|
|
the person in charge of purchasing software?
|
|
|
|
If you DO have a hard disk crash, try to recover the boot-record on the
|
|
disk before just giving up and reformatting. You may find something
|
|
similar to the above. The manufacturer or vendor of your hard disk may
|
|
be able to steer you through the proper procedure for doing this.
|
|
|
|
Read this month's (March 1987) issue of 'Computer Language' for more
|
|
information on Trojan horse programs. The article recommends contacting
|
|
Eric Newhouse at THE CREST BBS regarding trojan horse programs. If you
|
|
DO run into one, keep a copy of the file, and have a knowledgable BBS-
|
|
user send it, and an explanation to Eric's BBS at 213-471-2518. DO NOT
|
|
SEND THE FILE WITH ITS ORIGINAL NAME. The file name should be changed
|
|
to something NOT ending in .EXE or .COM (how about .TRJ), and it should
|
|
be sent to the attention of the SYSOP. This is usually done by waiting
|
|
for the prompt to enter the file description, and starting the descrip-
|
|
tion with '/'. Afterwards, also leave a comment to SYSOP which states
|
|
the nature, and description of the file. In other words, don't inadver-
|
|
tantly upload a Trojan program which could victimize others.
|
|
|
|
Watch out for some of the so-called Trojan testers. The majority of
|
|
these are legitimate, but a few of them are actually Trojans themselves.
|
|
Also, before jumping the gun and assuming a program is Trojan, check
|
|
other possible sources for disk errors, etc. Sometimes hard disk media
|
|
just develops errors, and there ARE some programs circulating as 'jokes'
|
|
which put a message up which says they are reformatting your drives, or
|
|
even claim to be draining excess water out of your disk drives. Most of
|
|
the nasty Trojan programs don't cause their damage immediately. They
|
|
wait for the drive to fill up a bit, or they wait for a random time
|
|
interval. In the latter case described above, I suspected a file manager
|
|
that I had just run. It turns out that others have used the program with
|
|
no ill effects.
|
|
|
|
It seems to me that the future of PD software, as well as BBS systems
|
|
is being threatened by this type of thing. A concerted effort on the
|
|
part of SYSOPS to correlate the names and origins of people who upload
|
|
Trojan software may help to track them down. Most BBS software keeps
|
|
track of the names of people uploading software. I doubt that Trojan
|
|
writers are stupid enough to list their real names, but it's time that
|
|
some ingenuity was used in putting a stop to this.
|
|
|
|
I am a serious software developer, and I have taken some time off to
|
|
write this message in the interest of helping other PD software users.
|
|
Unfortunately, I don't have the time to coordinate any effort in analysis
|
|
of Trojan programs and I cannot be contacted by phone (unlisted), but if
|
|
you DO run into something similar, or if you have questions about any of
|
|
the info presented here, leave me a personal message on any of the larger
|
|
BBS's in New York City, and I will try to reply on the same board.
|
|
|
|
|
|
PLEASE DO circulate this file. It is important information for anyone
|
|
running a BBS, or using Public Domain or SoftGuard/SuperLock software.
|
|
|
|
|
|
|
|
|
|
cturer), who claimed that their new software would destroy the hard
|
|
disk of anyone who tried to mis-use it. Most users, legitimate and other-
|
|
wise, dropped them instantly, even though Prolok realized their grave
|
|
error and retracted their previ |