Article 41569 of comp.sys.amiga.misc: Path: news.csos.orst.edu!flop.ENGR.ORST.EDU!ogicse!emory!sol.ctr.columbia.edu!xlink.net!news.dfn.de!urmel.informatik.rwth-aachen.de!hathi!stefanb From: stefanb@hathi.informatik.rwth-aachen.de (Stefan Becker) Newsgroups: comp.sys.amiga.misc Subject: WARNING (Was: New Fish CD is here.) Keywords: Fish, CDROM Message-ID: <2bilh3$336@urmel.informatik.rwth-aachen.de> Date: 7 Nov 93 11:17:55 GMT Article-I.D.: urmel.2bilh3$336 References: <2b6388INNbr@life.ai.mit.edu> Organization: Rechnerbetrieb Informatik - RWTH Aachen Lines: 22 NNTP-Posting-Host: hathi.informatik.rwth-aachen.de Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit bn@gnu.ai.mit.edu (Bo Najdrovsky) writes: >Just wanted to drop a note here that I got my shiny new CD from Fred Fish >yesterday. Great job, Fred! I love the fact that the whole GCC installation BEWARE: On Fish 919 is a file named "Saddam Virus", which is a test file for virus checkers. It really does contain the Saddam virus, so PLEASE DON'T EXECUTE THIS FILE!!! If I remember right this virus will only do harm on 1.3 systems, but you never know for sure :-) I talked with Fred on the WoC in Cologne. He'll destroy the first run of the CD and produce a new version without the file. Everyone will get the new version for free. I'm sure he'll post an official statement on this when he gets back to the US. Stefan -- Mail : Stefan Becker, Holsteinstrasse 9, D-52068 Aachen /// Only Phone : +49-241-505705 Germany /// Amiga makes InterNet: stefanb@pool.informatik.rwth-aachen.de \\\/// it possible.. ADSP : stefanb@yello.adsp.sub.org ECG148 \XX/ -->A3000/25<-- Article 41577 of comp.sys.amiga.misc: Newsgroups: comp.sys.amiga.misc Path: news.csos.orst.edu!gaia.ucs.orst.edu!umn.edu!news-feed-2.peachnet.edu!gatech!howland.reston.ans.net!darwin.sura.net!sgiblab!majipoor.cygnus.com!fnf From: fnf@cygnus.com (Fred Fish) Subject: Re: WARNING (Was: New Fish CD is here.) Message-ID: Keywords: Fish, CDROM Organization: Cygnus Support, Mountain View, CA References: <2b6388INNbr@life.ai.mit.edu> <2bilh3$336@urmel.informatik.rwth-aachen.de> Date: Sun, 7 Nov 1993 18:31:10 GMT Lines: 27 In article <2bilh3$336@urmel.informatik.rwth-aachen.de>, Stefan Becker wrote: >I talked with Fred on the WoC in Cologne. He'll destroy the first run of >the CD and produce a new version without the file. Everyone will get the >new version for free. I'm sure he'll post an official statement on this >when he gets back to the US. I managed to find an internet connection here in Cologne so I could telnet back home to read my mail and news postings about this issue. Stefan is correct (thanks for posting in case I couldn't), the first CD does contain a virus and I will have to make a replacement CD-ROM. This replacement will be available about Nov 20-24 and will be free to anyone that wishes to return the original for replacement. I'm not going to insist that people return their original CD-ROM if they understand the issues involved and wish to keep it for personal use. However, if the CD-ROM is to be made publically accessible such as via ftp, or via a BBS, then it must be replaced with the virus-free version. I will send a letter to all subscribers who received the CD-ROM directly from me, explaining the problem and offering the replacement CD-ROM. I will do this immediately upon my return from Germany, on Nov 12th. We destroyed about 500 CD-ROM's here at the Cologne WOC show, where I carved up the optical side with a knife and signed the front, and gave them away as souvenirs. -Fred Article 41582 of comp.sys.amiga.misc: Newsgroups: comp.sys.amiga.misc Path: news.csos.orst.edu!gaia.ucs.orst.edu!umn.edu!news-feed-1.peachnet.edu!darwin.sura.net!sgiblab!majipoor.cygnus.com!fnf From: fnf@cygnus.com (Fred Fish) Subject: Virus on disk 919 & CD-ROM Message-ID: Organization: Cygnus Support, Mountain View, CA Date: Sun, 7 Nov 1993 19:53:40 GMT Lines: 76 (I've also mailed this to the comp.sys.amiga.announce moderator but I wanted to get it posted as soon as possible so please excuse the duplication here. -Fred) On Nov 2nd, two hours before I had to leave to get on a plane to go to the WoC show in Cologne Germany, I got a FAX that said there was an active Saddam Hussein virus on disk 919 in the BBBF submission. This was later confirmed when I arrived in Cologne on Nov 4th. Because the contents of disks 911-930 are on the Oct Fresh Fish CD-ROM, this problem also affects that CD-ROM. The details, as I understand them at the moment, are: (1) The virus is on disk 919 in the BBBF submission. The exact filename is "BBBF/FileVirLib/VirusToTest/Saddam_Hussein_virus". (2) The virus is only dangerous if you are running kickstart 1.2 or 1.3. However it is a *very* dangerous virus. (3) In order to infect your system you would need to execute the file containing the virus. Under normal use of the CD-ROM, there is no danger from the virus. User's might legitimately ask how such an error could occur, including an easily detectable virus (using most virus checkers) and one with an obvious name as well! The only explanation I can offer at this point is that we obviously didn't run a virus checker over all files on the CD-ROM (though we do normally have virus checkers running on the test systems that will detect viruses when they get run), and that the person working for me on that batch of floppy disks didn't realize that this was an actual working virus and not just a test file that simulated a virus or a castrated virus that would be no danger. It's still my responsibility though, so any blame for including it must fall on me. As soon as I return home, on about Nov 12th, I will reissue disk 919 with the virus removed, and send copies of the replacement floppy to all of my direct subscribers. I will also send a letter to all of my direct CD-ROM subscribers, notifying them of the problem and offering a replacement CD-ROM at no charge, should they wish to return the virus infected one. I will not insist that all CD-ROM users return their CD-ROM's, except those that use the CD-ROM in such a way that the file containing this virus is publically accessible, such as on a BBS or ftp server. Once we were certain that the CD-ROM contained an active virus we halted further distribution of the CD-ROM. This meant that I had to destroy approximately 500 CD-ROM's at the WoC show in Cologne, much to the frustration of local German users who begged to be allowed to purchase them. The optical side was carved up with a knife, I signed the front, and we gave them away as souvenirs of the show. Ultimately I expect this virus to cost me about $3,000 to $5,000 in lost productivity time, CD-ROM replacement production costs, and shipping charges. So you can be very sure I'll be doing everything in my power to avoid future virus problems. I am very disappointed that Safe Hex International apparently offered no warning that their distribution included an actual working virus rather than just a file simulating a virus or a castrated, harmless virus. Furthermore, to pick such a dangerous virus seems to me to be very irresponsible. I'm not contemplating any sort of legal action at this time since I don't feel that the submission had any malicious intent, though I'm also not ruling such action out for now, or in the future should I discover new submissions containing trojan horses or viruses. Because of the time I will lose dealing with this problem, the next Fresh Fish CD-ROM may be delayed a week or so. My best estimate at the moment is that the December Fresh Fish CD-ROM (aka the second monthly CD-ROM) should ship about the second or third week of December. -Fred