🚀 go-pugleaf

HISVIRM.CVP   921022
 
                    CHRISTMA Wannabes - part 2
 
(continued from last week ...)
 
In December of 1988, VMS systems on DECNet networks were hit by a
worm based on a file called HI.COM.  COM files on VMS systems are
similar to the REXX exec files and MS-DOS "batch" files.  They are
"programs" in VMS DCL "source" code.  HI.COM used the fact that
DECNet nodes had, by default, a standard "anonymous" account that
could be used, by the network and other machines, to gain limited
access to a machine.  This account was able to start processes
running.  The process that HI.COM started was intended to replicate,
submit itself to other machines, to inform a specific account at a
specific site, and to wait until midnight on December 24th, 1988,
and then start mailing Christmas greetings to all users.  The
content of the message and the notification address seemed to
indicate a German author with access to an account in France.  The
first notifications of this infestation came from the NASA SPAN
network and the US Department of Energy's HEPNET.
 
HI.COM owed a number of features to the Morris worm.  One was a
"stealth" technique, whereby the file was copied into memory and
then erased from the disk.  Another stealth procedure used by HI.COM
was the use of a process name suggestive of normal mail routines.
 
Spring of 1989 saw a resurgence of interest in mutating the original
CHRISTMA on VM systems.  A modified version (BUL EXEC) was released
from the EARN backbone site in Turkey on March 8, ORGASM EXEC was
released from Pennsylvania State University on April 4, and HEADACH
EXEC found at the University of Ottawa on April 8.  DIR EXEC,
discovered November 1989, purported to be a version of the MS-DOS
DIR command for VM systems, but was a dropper for CHRISTMA.  There
was a Turkish version EXEC in November 1990, called TERM MODULE, and
a reposting of CHRISTMA EXEC to alt.hackers in December of 1990. 
The latest reported sighting was as GAME2 MODULE in January 1991.
 
The WANK/W.COM worm of October 1989, and its successor, owed most of
its inspiration (if you can call plagiarism inspiration) to the
Morris worm and HI.COM.
 
Finally, there was the XA1 Christmas Tree PC virus in March 1990. 
Although it owed no technical or programming detail to any of the
network worms, it seems to have been written "in memoriam".  It
contains (in German) the message, "And still it is alive : The
Christmas Tree !"
 
copyright Robert M. Slade, 1992   HISVIRM.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "virtual information"
Institute for  Robert_Slade@sfu.ca      |   - technical description of
Research into  rslade@cue.bc.ca         |     marketing info disguised
User           p1@CyberStore.ca         |     as technical description
Security       Canada V7K 2G6           |            - Greg Rose