ibm christmas card attach: cs571
TRANSCRIPT
IBM Christmas Card
Gauri PulekarCS 528
Spring 2015
Season Of Joy And Gifts
History of the
Christmas Card Malware
Christmas 1999 WM97/Melissa-AG virus infected Microsoft word
documents, spreading via email
Subject line: “Message from <username>”
Message: “This document is very Important and you've GOT to read this !!!”.
Payload trigger on December 25th
• Attempt to format the C: drive on the next reboot.
• Insert randomly colored blocks in the current Word document
Christmas 2000W32/Navidad virus spread via email, masquerading as an electronic
Christmas card.
Mysterious blue eye icons in the Windows system tray
Mouse over the eyes
Christmas 2000W32/Music email-aware worm
Message: "Hi, just testing email using Merry Christmas music file, you'll like it.”
Worm attached as a file called music.com, music.exe or music.zip.
Plays the first few bars of the song "We wish you a Merry Christmas”
Displays a cartoon of Santa Claus with the caption "Music is playing, turn on your speaker if you have one" or "There is error in your sound system, music can't be heard."
Christmas 2001Maldal virus spread via email using a seasonal electronic
greeting card called Christmas.exe.
Picture: Santa Claus on skis accompanied by a prancing reindeer
Message: "From the heart, Happy new year!".
IBM Christmas Card
The Beginni
ngOf the Story
IBM Christmas Card: FactsWhen: 09th December 1987 Name: Christmas Tree Exec Place of Origin: GermanySignificance: Worms were first noticed as a
potential computer security threat Effect: It brought down both the world-wide IBM
network and BITNET Source Language: REXX
BehaviorE-mail Christmas cardSubject line "Let this exec run and enjoy
yourself!”.Included executable code.Claimed to draw a Christmas tree on the display. The user had to execute the program by typing
christma or christmas.
• Displayed an ASCII Christmas tree.
A comment inside the source code:browsing this file is no fun at all just type
CHRISTMAS from cms
Sent a copy to everyone on the user's address lists.
WorkingRead the files:
NAMES: Collection of information about other users with whom you communicate
NETLOG: File transfer log
Mailed itself to every email addressApproximate number exceeded 1,000People trusted it, because it was coming from a
regular correspondent
The Name: CHRISTMA EXECIBM VM systems originally required file names to be formatted
as 8 characters + space + 8 characters
IBM required REXX script files to have a file type of "EXEC”
Source of the Christmas card
A student at the University of Clausthal in West Germany
REXX scripting language: a shell script-like language for IBM’s VM/CMS system
Found by December 21 Barred from using his/her system. “The damage was unintentional and that the
program was written to send Christmas greetings to my friends.”
Damage DoneWorm itself wasn’t malicious Exponential growth patternsClogged servers, communication paths, spool
directories Unintentional denial of service attack
Damage DoneEARNet:
The European Research and Education Networking Association (TERENA)
BITNET: BITNET was an university computer network
founded in 1981s at the City University of New York (CUNY) and Yale University
Destroyed by December 14th
Damage Done IBM's VNet electronic mail network
International computer networking system deployed in the mid-1970s.
Developed inside IBM Provided the main email and file-transfer backbone for the
company December 15th
Paralyzed on 17th December Brought to a standstill two days later, only getting rid of the
worm by shutting down the network. In 1990, Christmas Tree resurfaced after being posted to
Usenet. IBM was forced to shut down its 350,000-terminal network
Countermeasures TakenProgrammer at Cornell University had written a simple
programExamined the network queues every five minutes and
delete any files called Christma Exec; Purged about 300 copies in four and a half hours.
Other operators did the same, writing and passing around ad-hoc program to eliminate copies of the worm.
Countermeasures TakenSuch simple tools could only sample the queues
every few seconds and purge what they foundWorm could still sneak through to a limited degree.
In Israel, one programmer wrote a program “anti-Christma Christma,”Examined users’ netlog to determine whether they had
been victimized If yes, the new Christma would retrieve any copies of
the original that had not yet been read by the addressee and then send itself onward to the same set of targets used by the original Christma.
Debate: Trojan or WormTrojan:
Appear to be useful, but will do damage once installed
Required the user to download and run the attachment to make it replicate
Worm: Virus Encyclopedia refers to it as a worm.
Worms move from one computer to another regardless of any human action
References Burger, Ralf (1988). Computer viruses - a high tech disease. Abacus/Data
Becker GmbH. p. 276. ISBN 1-55755-043-3. Capek, P.G.; Chess, D.M.; White, S.R.; Fedeli, A. (2003).
"Merry Christma: An Early Network Worm". Security & Privacy 1 (5): 26–34. doi:10.1109/MSECP.2003.1236232.
Martin, Will (March 4, 1988). "Re: BITNET Security". Security Digest (Mailing list). Archived from the original on September 25, 2006. Retrieved October 30, 2008.
Patterson, Ross (December 21, 1987). "Re: IBM Christmas Virus". RISKS Digest (Mailing list). Retrieved October 30, 2008.
"Viruses for the "Exotic" Platforms". VX Heaven. Archived from the original on August 6, 2013. Retrieved October 30, 2008.
Otto Stolz. VIRUS-L Digest, Volume 5, Issue 178, "Re: CHRISTMA: The "Card"! (CVP)". 1992.11.12
Time to Discuss!
Trojan ?
? Worm
Thank You