Subject: Re: [Fwd: Virus Alert]

From: [email-masked] (Terry Eck)
Date: Fri, 16 Aug 96 13:40:19 CDT

I remember reading about this several months ago. It was the opinion
of most people at the time to be just a joke. Anyone know for sure
if it is anything other than a joke?
Terry
_____________________________________________________________________________
Terry Eck                   [email-masked]                (214)575-6196
Texas Instruments           P.O. Box 869305 MS 8456            Plano TX 75086

      "Unix is a user friendly OS... it's just choosy about its friends"

---

From: Robbie Honerkamp <[email-masked]>
Date: Fri, 16 Aug 1996 16:44:20 -0400 (EDT)

> if it is anything other than a joke?

Not true. You can't get a virus from reading an email message.

Notice that the original post came from AOL.. :)

Robbie
(who wonders how many people deleted this message in fear when they 
saw the Subject: line..)

---

From: Rob Browning <[email-masked]>
Date: 16 Aug 1996 15:52:12 -0500

> if it is anything other than a joke?

Well, I'd like to see the code for the infinite loop that'd melt down
my processor.  I've written a few in my time (accidentally), and the
machine's still here.

I think this is probably a joke.  I actually have received a "GOOD
TIMES" message, actually got one a couple of times, way back when I
used AOL (feel free to flame, it was pre-linux for me, too).  Anyway,
the message was a virus in some sense, but it required active
participation.  It was a message saying that it had been around the
world X number of times and that anyone who would do what it said and
continue the pyramid, tacking on their own name, would get great
wealth and voodoo luck.  If you failed to do this in Y number of days,
all manner of evil catastrophies would befall you.

I ignored it with no ill effects at the specified instance of doom.

--
Rob

---

From: "Charles A. Schuman" <[email-masked]>
Date: Fri, 16 Aug 1996 15:48:25 -0500 (CDT)

Re: Virus, Internet:  Good Times

> if it is anything other than a joke?

Either it is an obvious joke or now you have the virus.

---

From: Lars Wirzenius <[email-masked]>
Date: Sat, 17 Aug 1996 05:47:04 +0300

> Not true. You can't get a virus from reading an email message.

Not true. The Good Times virus is a hoax, but it is possible to get a virus
from e-mail, in some circumstances.

Some e-mail systems allow the sender to tag the contents as being plain
text, HTML, C source code, a shell script, and so on. This is not something
that MIME invented -- it existed well before MIME. It's a good thing, since
it allows programs to handle mail more intelligently.

However, stupid people can also write mail user programs that automatically
run a program that comes in e-mail. Even more stupid people use such 
programs. For example, I've seen a procmail rule that was essentially 
like this:

	:0
	* ^Subject: runme
	| sed '1,/^$/d' | sh
	
For those who don't understand procmail's syntax, this takes every letter
that has "runme" in the subject and runs its body as shell commands.
Very, very dangerous.

I've been told that some Windows mail programs have something similar
built in (if you receive a Word document, they automatically run Word
and load that document -- Word documents can contain powerful macros
that are run automatically when the document is loaded), but I haven't
verified it.

GNU Emacs had a similar feature (certain magic lines in a file could
run any Emacs commands automatically when the file was loaded -- and
Emacs commands are powerful indeed).

So it's quite possible to get a virus from e-mail, but you have to either
be wantonly stupid (if you install a dangerous procmail rule), or just
ignorant that the program had the capability (what do you mean you didn't
read the footnote on page 481 of the technical reference manual you must
buy separately?).

For more information, you might want to search the RISKS archive (see
the comp.risks newsgroup).

> Notice that the original post came from AOL.. :)

Not everyone from AOL is stupid. I've exchanged mail with an AOL user
who wrote C compilers to cure hangovers...

Most AOL users are new on the net, and they're clumsy, silly and sometimes
irritating, but there's some very shrewd people on AOL as well. With six
million users (three times as many as on the whole of Usenet when I started
reading it) you get all kinds of people.

-- 
Rural sizes win <[email-masked]> <http://www.iki.fi/liw/>
Please don't Cc: me when replying to my message on a mailing list.

---

From: Philippe Troin <[email-masked]>
Date: Fri, 16 Aug 1996 20:57:14 -0700

> Emacs commands are powerful indeed).

FYI, this is now disabled by default.
The emacs variable are:
	enable-local-eval (defaults to ask user)
	enable-local-variables (defaults to obey)

Phil.

---

From: Juha Ylitalo <[email-masked]>
Date: Sat, 17 Aug 1996 11:37:37 +0300 (EETDST)

> Not true. You can't get a virus from reading an email message.

Actually this is something that can be disputed quite lot, but thankfully
its not something that would happen while using Debian/Linux. Just to
point out, what I mean by that is that one of the most common ways that I
know for passing around all those macro viruses, that now exist in M$-Word
and Excel, will quite heavily spread around throught M$-Mail or about any
other mailer that supports easy interface for adding those documents or
spreadsheets as attachments. 

--
Juha 'Ylis' Ylitalo	[email-masked]		<work e-mail>
+358 0 511 23313	http://www.helsinki.fi/~jylitalo	<public www>
     "True friendship is never serene." - Marie de Rabutin-Chantal

---

From: "Brian C. White" <[email-masked]>
Date: Sat, 17 Aug 1996 12:53:31 -0400

> Not true. You can't get a virus from reading an email message.

Actually, there is a "Good Times" virus and it does come by email.
The announcement itself _is_ the virus and it spreads _exteremely_
quickly!

For more information, check out the following FAQ:

	http://www-mcb.ucdavis.edu/info/virus.html

                                        Brian
                               ( [email-masked] )

-------------------------------------------------------------------------------
    In theory, theory and practice are the same.  In practice, they're not.

---

From: Christian Lynbech <[email-masked]>
Date: Mon, 19 Aug 1996 08:40:33 +0200

>>>>> "Rob" == Rob Browning <[email-masked]> writes:

Rob> [email-masked] (Terry Eck) writes:

Rob> Well, I'd like to see the code for the infinite loop that'd melt
Rob> down my processor.  I've written a few in my time (accidentally),
Rob> and the machine's still here.

Well, lucky you. :-)

The issue of destroying a computer through software was once (probably
has been several times) discussed on alt.folklore.computers. 

It is (or rather was) possible, but only in one known case. I do not
remember many details, but some old microcomputer (Commodore of some
sort I believe) allowed you to flip a bit in a register on the video
chip that would cause power to build up somewhere until the chip
eventually died.

---------------------------+--------------------------------------------------
Christian Lynbech          | Computer Science Department, University of Aarhus
Office: R0.32              | Ny Munkegade, Building 540, DK-8000 Aarhus C
Phone: +45 8942 3218       | [email-masked] -- www.daimi.aau.dk/~lynbech
---------------------------+--------------------------------------------------
Hit the philistines three times over the head with the Elisp reference manual.
                                        - [email-masked] (Michael A. Petonic)

---

From: Dominik Kubla <[email-masked]>
Date: Mon, 19 Aug 1996 14:08:11 +0200

>>>>> Terry Eck writes:

> if it is anything other than a joke?  Terry

It is. There is even a FAQ about it.  I will dig out the URL ...

Dominik

---

From: "Christopher R. Hertel" <[email-masked]>
Date: Mon, 19 Aug 1996 10:07:34 -0500

On Aug 16,  4:44pm, Robbie Honerkamp wrote:
> Subject: Re: [Fwd: Virus Alert]
:
: Not true. You can't get a virus from reading an email message.
:
>-- End of excerpt from Robbie Honerkamp

Actually, that depends upon your E'mail system.  Microsoft mail allows
you to send macros along with messages.  These macros are automatically
run when the message is read.  I have first-hand experience with a
"virus" (actually, a destructive macro) that was transmitted this way.

...but that's a hole in Microsoft mail.  Obviously, this kind of thing
could not be done via the standard Unix mail system (unless you had a
MIME-aware mail reader that was willing to run Java code for you...
Oooops!)

Chris -)-----

-- 
Christopher R. Hertel -)-----                   University of Minnesota
[email-masked]              Networking and Telecommunications Services

---

From: Rick Macdonald <[email-masked]>
Date: Mon, 19 Aug 1996 14:26:09 -0600 (MDT)

> MIME-aware mail reader that was willing to run Java code for you...

Actually...

I don't use emacs for email, but apparently its mail reader uses the emacs
"enable-local-variables" feature. And, apparently, some mischief can be
done by this mechanism. This feature is disabled with
    (setq enable-local-variables nil)
or
    (setq enable-local-variables 1) 
The later causes it to query you if local variables exist.

Perhaps someone on the list is more familiar with this issue and emacs
mail.

...RickM...

---

From: [email-masked] (Bruce Perens)
Date: Tue, 20 Aug 96 14:26 PDT

From: Christian Lynbech <[email-masked]>
> chip that would cause power to build up somewhere until the chip

It is possible to destroy a number of existing PC and PC-clone video
monitors by programming the VGA video timing registers. This is why we
try to be careful not to allow people to set their video card to just
any timing. I think that most of the susceptible monitors are out of
circulation, but of course there's lots of legacy hardware running Debian.

The monitors with this problem drive the flyback transformer at the
horizontal sync frequency. They have a sync detector that shuts down
the transformer if sync is absent, but this sync detector does not shut
down the transformer if it sees a very low horizontal frequency, or
only vertical sync without horizontal sync. The transformer gets driven
with only vertical sync or with very low frequency horizontal sync.
This causes the primary winding to have too low an impedance, which
causes too much current to flow through it, and it burns up.

The original IBM CGA color monitor is said to have this problem, and many
clones of it were said to have it as well. I don't know about more modern
hardware. If you have a monitor that is susceptible to this, it is possible
to destroy it by typing the wrong numbers into your XFree86 configuration
file.

This has been discussed in boring detail on various public forums. All of
the details are available to any malicious person. Thus, it's best for
everyone to know about the vulnerability.

	Thanks

	Bruce