Re: Good times virus (ANSI BOMB?)
-----BEGIN PGP SIGNED MESSAGE-----
On Dec 7, 1:04am, ADAM GERSTEIN, _THE_ MACGURU wrote:
Need I remind you of a certain Robert T. Morris? Does the "Internet Worm" mean anything to you? Sure, it wasn't actual email, but it did use email and other means of transport to cripple the net in a matter of hours.
The Internet Worm used the sendmail DEBUG mode to execute commands on a remote system. It did not propogate itself via email messages, which was what the original (ridiculous) warning claimed.
I can't feel a lot of sympathy for people who took this announcement seriously. Such stupidity reaps its own rewards.
Although the concept of "text viruses" seems a bit far fetched to some people, there these lovely toys known as ANSI bombs. Essentially they work in a similar method to the some techniques used in the sendmail bug, but they are MS-DOS specific, they will use embedded ANSI codes to run programs as the files is viewed... anyone know what will happen if deltree /XXX (where XXX represents an unpublished string of characters) is run from the root directory of a DOS hard disk? Its gone, quickly. Sure the files can be undeleted, but undeleting a whole disk is tricky business... Maybe Good Times is a hoax, but ANSI bombs exist and using a DOS ANSI text viewer will surely be a foolish thing to do on any downloaded text file... If anyone feels the need for proof I collected a few a while back, but really don't see the need to post them...heh heh. Adam Philipp PS: Please no comments about superiority of MACs or LINUX boxs because they are immune to ANSI boms...that ought to be clear enough... - -- PGP Key available on the keyservers. Encrypted E-mail welcome. SUB ROSA: Confidential, secret, not for publication. -Black's Law Dictionary GJ/CS d H S:+ g? p? au+ a- w+ v++ c++ UL+ UU+ US+ P+ 3 E N++ k- W++ M-- V po- Y++ t++ 5+ jx R G' tv+ b+++ D++ B--- E+++ u** h-- f++ r+ n+ y++-- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuVnPSoZzwIn1bdtAQEjeAF+Pi65kg9SMBZ1bzO5gJBsumi5x2vJFgqC o0hc3bMaqLYb5WY/jlaAtWURtzXzOUc6 =/53s -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- In list.cypherpunks, adam.philipp@ties.org writes:
Although the concept of "text viruses" seems a bit far fetched to some people, there these lovely toys known as ANSI bombs. Essentially they work in a similar method to the some techniques used in the sendmail bug, but they are MS-DOS specific, they will use embedded ANSI codes to run programs as the files is viewed...
The MS-DOS ANSI bomb relies on the capability of redefining keystrokes through the ANSI screen driver. Most all the DOS boxen I lay hands on lose this capability quickly, when I install more capable ANSI drivers that have this misfeature disabled. Fortunately, few people rely on ANSI-based text viewers, so I'd hope that even the otherwise unprotected machines have some immunity. (how many people use 'type filename' anymore?) I first learned of ANSI bombs back in the Cretacious period (1989), when it briefly became popular to slip them into PKZIP 0.92 comment fields. I even saw a couple in files I downloaded, because even then I had removed the function from my screen driver. The attempted redefs would show up as plain text.
If anyone feels the need for proof I collected a few a while back, but really don't see the need to post them...heh heh.
[0;5;30;47mI wonder if anyone's mail readers are even succeptible? (he said, grinning) - -- Roy M. Silvernail [ ] roy@cybrspc.mn.org PGP public key available by mail echo /get /pub/pubkey.asc | mail file-request@cybrspc.mn.org These are, of course, my opinions (and my machines) -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuY7wBvikii9febJAQFE7AP/RObKGqQ0Usi9SRyM3TA5doewB9E/VVKs NOOGan6aPZrt0B0wGZRxvmYBDfSixc5LhmCvDBmSiQid3sxbtCZKAUdLqjic7N2F 6ypNktYtcaJgQ95DO9xqzPR42UxJN2GDLIuwX0/01Cu3x08tgu9R2FVoVgkvGMmF YggtpKNrUWk= =V3Nl -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- In trying to be too terribly clever, I included a bit of ANSI commands in my last post to the list. At least one person has suffered grevious harm to his telnet session as a result. That person asks that I post instructions for recovering from so heinous an attack. All I can suggest is escaping to a shell and doing a 'clear' (or, under MS-DOS, 'cls'). Sorry, folks. I won't do that again. - -- Roy M. Silvernail -- roy@cybrspc.mn.org "Usenet: It's all fun and games until somebody loses an eye." --Jason Kastner<jason@wagner.com> -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuadbBvikii9febJAQFl2AP/X+0X/qMqmTY4NgrItdUyrRx1ZNrI+nmS p423JUy9JS68uCfD7oE6cp0nEtMcr46kDsCgKd1lG8hnM8BaFpbOwRy4UgUDyVP7 LI1nvUfxW2PFZGs5QRJBJkGwShMkUai9C+8btd6nzgpxIpskt/7e5xwPR3YCQnro 6MvLHGXv/2o= =XcHI -----END PGP SIGNATURE-----
On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
That person asks that I post instructions for recovering from so heinous an attack. All I can suggest is escaping to a shell and doing a 'clear' (or, under MS-DOS, 'cls').
I have found that some attacks that leave your screen doing strange things can be recoverd from by ussing the talk command. This program, on UNIX machines seems to reset alot of things that might have gone array with your screen. Groove on Dude Michael Conlen
-----BEGIN PGP SIGNED MESSAGE----- meconlen@IntNet.net (Michael Conlen) once said: ME> ME> ME> On Wed, 7 Dec 1994, Roy M. Silvernail wrote: ME> ME> > That person asks that I post instructions for recovering from so heinous ME> > an attack. All I can suggest is escaping to a shell and doing a 'clear' ME> > (or, under MS-DOS, 'cls'). ME> ME> I have found that some attacks that leave your screen doing strange ME> things can be recoverd from by ussing the talk command. This program, on ME> UNIX machines seems to reset alot of things that might have gone array ME> with your screen. 'stty sane' also helps !*(#%&@#!*&*&(!#!@# NO CARRIER _______________________________________________________________________________ kafka@desert.xs4all.nl Cryptoanarchy, MDMA, Tekkkkno, SL-1200 <blink> Kafka's home page _______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBUAwUBLuhVV5RymF15lPcFAQEsiAH49DtxHeWC2GRa8sKGusHH+qQ0y8GuJHyA IP5zK7Zbj5jwVEcom881CkQWWygTuJiPl3P7sNhyAcDXTQoBjpUH =hhF7 -----END PGP SIGNATURE-----
On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
That person asks that I post instructions for recovering from so heinous an attack. All I can suggest is escaping to a shell and doing a 'clear' (or, under MS-DOS, 'cls').
I have found that some attacks that leave your screen doing strange things can be recoverd from by ussing the talk command. This program, on UNIX machines seems to reset alot of things that might have gone array with your screen.
If you hit the control button with both mouse buttons at the same time in twm(an X windows manager) there pops up a menu--choose the 'reset terminal' option. Ben. Who's not signing cause the DEC Rainbow he's using to dial in isn't secure.
In the world according to Ben:
On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
That person asks that I post instructions for recovering from so heinous an attack. All I can suggest is escaping to a shell and doing a 'clear' (or, under MS-DOS, 'cls').
I have found that some attacks that leave your screen doing strange things can be recoverd from by ussing the talk command. This program, on UNIX machines seems to reset alot of things that might have gone array with your screen.
If you hit the control button with both mouse buttons at the same time in twm(an X windows manager) there pops up a menu--choose the 'reset terminal' option.
Flash/ANSI Bomb/terminal codes or just general screwups can be quite a pain. Though the methods suggested above may work in some circumstances, they won't work all the time. One method I have found to be quick and highly effective is the following alias (shown from my bash rcfile, but you can easily translate to other shells): ## This last one is a nifty little way to fix the terminal after being ## flashed or otherwise messed up by some program. If your terminal is ## really screwed up, it may not be able to parse the return (^M) correctly. ## If so, use linefeed (^J), then type "sanity", then type another linefeed. alias sanity='stty 500:5:96c:3b:0:3:1c:8:17:4:0:0:0:500:5:96c:8000003b:3:1c:8:17 :4:0:0:0:ff:ff:ff:4:0:1a:11:13:0:0:1a:ff' (N.B.: make sure that is one line for the alias). Unfortunately this does assume that your terminal is at least semi-clued (i.e. minimal vt100 features, but it should be able to get your back to a sane setup wherein you can re- source your own rcfiles or set the terminal paramters yourself. There is also a script called unflash which will fix basic terminal codes attacks, but it is less robust (it just echos {esc}c {esc}0 and clears the screen, which will end text properties but not neccesarily fix status lines and other problems). If you use it, let me know how this generalizes, its been quite stable in my experience. The real tough one to deal with is xterm, which can have font properties set through escape codes, a well designed talk request, terminal write, or irc bomb can make it entirely unintelligible and very difficult to recover. Get you admin to install a good fingerd/talkd and/or use mesg n to prevent access in the first place. There are several around now which disallow terminal codes in the talk requesters id and check IPs, etc. |Robert -- Robert Seymour rseymour@reed.edu Reed College Artificial Life Project NeXTmail, MIME, PGP accepted WWW Pages
On Wed, 7 Dec 1994, Roy M. Silvernail wrote:
[0;5;30;47mI wonder if anyone's mail readers are even succeptible? (he said, grinning)
This code altered my screen running Pine 3.89 on an X-terminal hung of an RS/6000 running AIX 3.2.5, much to my surprise! _________________________________________________________________________ Anthony Wm. Iannotti, Network Manager Security APL 101 Hudson Street 201/332-2020 Jersey City, NJ 07302 tony@secapl.com
participants (7)
-
adam.philipp＠ties.org -
Anthony Wm. Iannotti -
Ben -
kafka＠desert.xs4all.nl -
Michael Conlen -
roy＠cybrspc.mn.org -
rseymour＠reed.edu