🚀 go-pugleaf

HISVIRN.CVP   921022
 
                           CHRISTMA EXEC
 
During the summer of 1988 there was considerable confusion regarding
the CHRISTMA EXEC.  This was "early days" for the virus field as a
whole, of course, and so there were the usual media reports
confusing microcomputers and mainframes, talking on the one hand
about international networks and on the other about disks being
erased.  One story describes the symptoms of the CHRISTMA EXEC while
at the same time talking about computerized medical systems being
sabotaged.  There was also a rumour among Mac users that CHRISTMA
was a Mac virus.  (I mean, it had to be IBM, right?  Who else uses
eight character filenames?  :-)
 
The author of the CHRISTMA EXEC was fairly quickly traced back to a
university computer in Germany.  The culprit's account was lifted. 
The NETLOG file that the EXEC used to obtain account and system
names is a transaction file that lists all mail sent and received. 
Therefore, while the file could be suppressed by some users, in most
cases an entry would show where the message had come from, and
confirm where it had been sent to.  Backtracking the infestation was
therefore relatively easy, even though the author had left no clues
in the program, and eventually the paths converged.  (This was a
good thing: this particular type of mail system does not carry the
same amount of header and "received from" information that others
may be used to.)
 
In fact, the author had not intended to cause any problems: he had
thought to send the greetings to his friends.  A second student used
the EXEC created by the first, with some slight modifications, and
didn't realize the havoc he was about to cause.  Fortunately, his
lack of programming expertise showed up in other areas: the
"parsing" of account info from the NETLOG file was faulty, and
reduced the traffic to only five percent of what it could have been.
 
Also, some copies never did get to reproduce, because they ended up
on incompatible systems.  One VMS user received six copies of
CHRISTMA.  Obviously, he never sent any on.
 
One of the frequently asked questions in the virus world is "has
there ever been a virus in a mainframe and can I can a scanner for
mine?"  CHRISTMA and the Morris worm are often used as examples of
viral programs on mainframes and networks (with the obligatory "it's
not a virus, it's a worm" pedantry), but the answer about scanners
is always "no".  This is not correct.  All major Bitnet backbone or
"core" sites run a "selective file filter" to catch any of the known
variants of CHRISTMA EXEC ... a scanner by any other name ...
 
copyright Robert M. Slade, 1992   HISVIRN.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "My son, beware ... of the
Institute for  Robert_Slade@sfu.ca      |  making of books there is
Research into  rslade@cue.bc.ca         |  no end, and much study is
User           p1@CyberStore.ca         |  a weariness of the flesh."
Security       Canada V7K 2G6           |          Ecclesiastes 12:12