Re: Good times virus (ANSI BOMB?)

-----BEGIN PGP SIGNED MESSAGE-----

>On Dec 7,  1:04am, ADAM GERSTEIN, _THE_ MACGURU wrote:
>> Need I remind you of a certain Robert T. Morris? Does the "Internet Worm"
>mean
>> anything to you? Sure, it wasn't actual email, but it did use email and other
>> means of transport to cripple the net in a matter of hours.
>
>The Internet Worm used the sendmail DEBUG mode to execute commands on
>a remote system.  It did not propogate itself via email messages, which was
>what the original (ridiculous) warning claimed.
>
>I can't feel a lot of sympathy for people who took this announcement
>seriously.  Such stupidity reaps its own rewards.

Although the concept of "text viruses" seems a bit far fetched to some
people, there these lovely toys known as ANSI bombs. Essentially they work
in a similar method to the some techniques used in the sendmail bug, but
they are MS-DOS specific, they will use embedded ANSI codes to run programs
as the files is viewed... anyone know what will happen if deltree /XXX
(where XXX represents an unpublished string of characters) is run from the
root directory of a DOS hard disk? Its gone, quickly. Sure the files can be
undeleted, but undeleting a whole disk is tricky business...

Maybe Good Times is a hoax, but ANSI bombs exist and using a DOS ANSI text
viewer will surely be a foolish thing to do on any downloaded text file...

If anyone feels the need for proof I collected a few a while back, but
really don't see the need to post them...heh heh.

     Adam Philipp

PS: Please no comments about superiority of MACs or LINUX boxs because they
are immune to ANSI boms...that ought to be clear enough...

- --
PGP Key available on the keyservers. Encrypted E-mail welcome.

SUB ROSA: Confidential, secret, not for publication.
           -Black's Law Dictionary

GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V
po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++--

- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBLuVnPSoZzwIn1bdtAQEjeAF+Pi65kg9SMBZ1bzO5gJBsumi5x2vJFgqC
o0hc3bMaqLYb5WY/jlaAtWURtzXzOUc6
=/53s
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, adam.philipp@ties.org writes:

> Although the concept of "text viruses" seems a bit far fetched to some
> people, there these lovely toys known as ANSI bombs. Essentially they work
> in a similar method to the some techniques used in the sendmail bug, but
> they are MS-DOS specific, they will use embedded ANSI codes to run programs
> as the files is viewed...

The MS-DOS ANSI bomb relies on the capability of redefining keystrokes
through the ANSI screen driver.  Most all the DOS boxen I lay hands on
lose this capability quickly, when I install more capable ANSI drivers
that have this misfeature disabled.  Fortunately, few people rely on
ANSI-based text viewers, so I'd hope that even the otherwise unprotected
machines have some immunity.  (how many people use 'type filename'
anymore?)

I first learned of ANSI bombs back in the Cretacious period (1989), when
it briefly became popular to slip them into PKZIP 0.92 comment fields.
I even saw a couple in files I downloaded, because even then I had
removed the function from my screen driver.  The attempted redefs would
show up as plain text.

> If anyone feels the need for proof I collected a few a while back, but
> really don't see the need to post them...heh heh.

I wonder if anyone's mail readers are even succeptible?  (he
said, grinning)
- -- 
       Roy M. Silvernail         [ ]  roy@cybrspc.mn.org
                    PGP public key available by mail
     echo /get /pub/pubkey.asc | mail file-request@cybrspc.mn.org
         These are, of course, my opinions (and my machines)

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1

iQCVAwUBLuY7wBvikii9febJAQFE7AP/RObKGqQ0Usi9SRyM3TA5doewB9E/VVKs
NOOGan6aPZrt0B0wGZRxvmYBDfSixc5LhmCvDBmSiQid3sxbtCZKAUdLqjic7N2F
6ypNktYtcaJgQ95DO9xqzPR42UxJN2GDLIuwX0/01Cu3x08tgu9R2FVoVgkvGMmF
YggtpKNrUWk=
=V3Nl
-----END PGP SIGNATURE-----

On Wed, 7 Dec 1994, Roy M. Silvernail wrote:

> I wonder if anyone's mail readers are even succeptible?  (he
> said, grinning)

  This code altered my screen running Pine 3.89 on an X-terminal hung of 
an RS/6000 running AIX 3.2.5, much to my surprise! 
_________________________________________________________________________
Anthony Wm. Iannotti, Network Manager                   Security APL
101 Hudson Street                                       201/332-2020
Jersey City, NJ 07302                                   tony@secapl.com

-----BEGIN PGP SIGNED MESSAGE-----

In trying to be too terribly clever, I included a bit of ANSI commands
in my last post to the list.  At least one person has suffered grevious
harm to his telnet session as a result.

That person asks that I post instructions for recovering from so heinous
an attack.  All I can suggest is escaping to a shell and doing a 'clear'
(or, under MS-DOS, 'cls').

Sorry, folks.  I won't do that again.
- -- 
             Roy M. Silvernail --  roy@cybrspc.mn.org
    "Usenet: It's all fun and games until somebody loses an eye."
                        --Jason Kastner<jason@wagner.com>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1

iQCVAwUBLuadbBvikii9febJAQFl2AP/X+0X/qMqmTY4NgrItdUyrRx1ZNrI+nmS
p423JUy9JS68uCfD7oE6cp0nEtMcr46kDsCgKd1lG8hnM8BaFpbOwRy4UgUDyVP7
LI1nvUfxW2PFZGs5QRJBJkGwShMkUai9C+8btd6nzgpxIpskt/7e5xwPR3YCQnro
6MvLHGXv/2o=
=XcHI
-----END PGP SIGNATURE-----

On Wed, 7 Dec 1994, Roy M. Silvernail wrote:

> That person asks that I post instructions for recovering from so heinous
> an attack.  All I can suggest is escaping to a shell and doing a 'clear'
> (or, under MS-DOS, 'cls').

I have found that some attacks that leave your screen doing strange 
things can be recoverd from by ussing the talk command. This program, on 
UNIX machines seems to reset alot of things that might have gone array 
with your screen.

						Groove on Dude
						Michael Conlen

-----BEGIN PGP SIGNED MESSAGE-----

meconlen@IntNet.net (Michael  Conlen) once said:

ME>                                                                             
ME>                                                                             
ME> On Wed, 7 Dec 1994, Roy M. Silvernail wrote:                                
ME>                                                                             
ME> > That person asks that I post instructions for recovering from so heinous  
ME> > an attack.  All I can suggest is escaping to a shell and doing a 'clear'  
ME> > (or, under MS-DOS, 'cls').                                                
ME>                                                                             
ME> I have found that some attacks that leave your screen doing strange         
ME> things can be recoverd from by ussing the talk command. This program, on    
ME> UNIX machines seems to reset alot of things that might have gone array      
ME> with your screen.                                                           

'stty sane'

also helps


!*(#%&@#!*&*&(!#!@# NO CARRIER
_______________________________________________________________________________
kafka@desert.xs4all.nl  Cryptoanarchy, MDMA, Tekkkkno, SL-1200
        <blink> Kafka's home page
_______________________________________________________________________________


-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQBUAwUBLuhVV5RymF15lPcFAQEsiAH49DtxHeWC2GRa8sKGusHH+qQ0y8GuJHyA
IP5zK7Zbj5jwVEcom881CkQWWygTuJiPl3P7sNhyAcDXTQoBjpUH
=hhF7
-----END PGP SIGNATURE-----

> 
> 
> On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
> 
> > That person asks that I post instructions for recovering from so heinous
> > an attack.  All I can suggest is escaping to a shell and doing a 'clear'
> > (or, under MS-DOS, 'cls').
> 
> I have found that some attacks that leave your screen doing strange 
> things can be recoverd from by ussing the talk command. This program, on 
> UNIX machines seems to reset alot of things that might have gone array 
> with your screen.

If you hit the control button with both mouse buttons at the same time in
twm(an X windows manager) there pops up a menu--choose the 'reset
terminal' option.

Ben.

Who's not signing cause the DEC Rainbow he's using to dial in isn't secure.

In the world according to Ben:
> > On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
> > > That person asks that I post instructions for recovering from so heinous
> > > an attack.  All I can suggest is escaping to a shell and doing a 'clear'
> > > (or, under MS-DOS, 'cls').

> > I have found that some attacks that leave your screen doing strange 
> > things can be recoverd from by ussing the talk command. This program, on 
> > UNIX machines seems to reset alot of things that might have gone array 
> > with your screen.

> If you hit the control button with both mouse buttons at the same time in
> twm(an X windows manager) there pops up a menu--choose the 'reset
> terminal' option.

Flash/ANSI Bomb/terminal codes or just general screwups can be quite a pain.
Though the methods suggested above may work in some circumstances, they won't
work all the time. One method I have found to be quick and highly effective
is the following alias (shown from my bash rcfile, but you can easily
translate to other shells):

## This last one is a nifty little way to fix the terminal after being
## flashed or otherwise messed up by some program.  If your terminal is
## really screwed up, it may not be able to parse the return (^M) correctly.
## If so, use linefeed (^J), then type "sanity", then type another linefeed.
alias sanity='stty 500:5:96c:3b:0:3:1c:8:17:4:0:0:0:500:5:96c:8000003b:3:1c:8:17
:4:0:0:0:ff:ff:ff:4:0:1a:11:13:0:0:1a:ff'

(N.B.: make sure that is one line for the alias).  Unfortunately this does
assume that your terminal is at least semi-clued (i.e. minimal vt100 features,
but it should be able to get your back to a sane setup wherein you can re-
source your own rcfiles or set the terminal paramters yourself.  There is
also a script called unflash which will fix basic terminal codes attacks, 
but it is less robust (it just echos {esc}c {esc}0 and clears the screen,
which will end text properties but not neccesarily fix status lines and
other problems).

If you use it, let me know how this generalizes, its been quite stable in
my experience.  The real tough one to deal with is xterm, which can have
font properties set through escape codes, a well designed talk request,
terminal write, or irc bomb can make it entirely unintelligible and very
difficult to recover.  Get you admin to install a good fingerd/talkd
and/or use mesg n to prevent access in the first place.  There are several
around now which disallow terminal codes in the talk requesters id and
check IPs, etc.

|Robert

-- 
Robert Seymour					rseymour@reed.edu
Reed College Artificial Life Project		NeXTmail, MIME, PGP accepted

  WWW Pages