(C) IE Moiseenkov Skiped by Werewolves
Absolutely precise sequence of events is currently
almost impossible to recover because, firstly, in
while most attacks were all primarily interested in fast
containment and removal of viruses, but not in the detailed
recording of facts [B1]; and, secondly, because the virus
rapidly blocked attacked computer networks, resulting in
interrupted communication between users. The specialists of
the older generation say that the message held in nets during a
virus attack, very similar messages about enemy combatants,
received on communication in World War II. In any case, these
messages can feel the utter helplessness that prevailed during
the viral attacks in different network nodes, to estimate the
opportunity users to understand what is going on and draw
conclusions about the system requirements to assist in such
situations. So, on Nov. 2, 1988, Wednesday. 17:00 virus
detected at Cornell University (New York). 21:00 The virus was
found in the systems Stanford University and the firm Rand
Corporation (California) 22:00 Virus hit system at Berkeley.
23:00 virus experts discovered the Department of Mathematics at
Princeton University (New Jersey).
First, all found a virus thought it was just another incident
that relates only to their system. No of course could not
imagine what extent will the epidemic within a few hours.
Nevertheless, administrators attack the system will send
messages about the incident. 23:28 In an e-mail VIRUS_L was
the first message about the virus. It is reported that attacked
universities in the Davis and San Diego Lawrence Livermore
Laboratory name and the Research Center of NASA (all in
California) Entry of the virus is identified as an SMTP Attack
all of 4.3 BSD and Sun 3.X. It is noted that the virus
distributed through TELNETD, FTPD, FINGER, RSHD and SMTP.
23:45 The virus was found in a research lab ballistics.
Gradually it became clear that the same clinical signs of the
virus are watching users located in different parts of country.
Given the coincidence of events in time, it was concluded that
the national computer system attacked by the same virus that
spreads through the network, since otherwise the spread can not
be explained by the speed with which virus appeared in
different parts of the United States, unless, of course, do not
assume that everything that happens the result of a pre-planned
and well-prepared action of some criminal gang, which has
access to all national systems. Life administrators American
systems after the fact, as they say, ceased to be
bezinteresnoy! For users and system administrators attacked
nodes network behavior of the virus has been incomprehensible.
In some systems directory / usr / tmp files appeared unusual,
and in magazines files of several utilities have appeared
strange messages. Most notable, however, was that more and more
increased loading systems, which led eventually to the
exhaustion of any free space allocated for swapping or overflow
the system process table - in any case it meant locking system.
As the name network, in which the virus was detected, its
immediately dubbed the virus Milnet / Arpanet. Soon, however,
revealed that the virus from the Arpanet successfully migrated
to the network Science Internet - and he immediately gets the
name "virus Internet ". But after a Cornell University expressed
indirectly proved by the assumption that the virus has probably
developed within its walls, the virus finally gets one of the
most common, thanks to the efforts of the press, the name - the
virus Cornell / Arpanet.
Occurred on November 3, Thursday ...
1:00 Reports of infection of a 15-node network Arpanet. 2:00
infected with a virus system, Harvard University
(Massachusetts). 3:30 The virus was found at the Center for MIT
Institute. 3:46 In the message, which took place in the e-mail
RISKS clarifies that the attacking system UNIX - 4.3 BSD - and
similar s Sun, running on VAX computers and computer firm DEC
Sun. It is also reported that the virus is spread through holes
in security tools available Sendmail e-mail within these
systems. 04: 00 Because the network is overloaded, the spread
of the virus is slowed down, by this time have been infected
for more than 1000 network nodes. 05: 15 Carnegie Mellon
University in Pittsburgh (Pennsylvania) of the 100 computers
connected to the Arpanet, out of order 80. 8:00 Report of the
virus from Center for Astrophysics Smithonian. Subsequently,
there were several versions of how exactly and by whom virus
was detected. The first is that the virus was discovered on the
night of 2 / 3 November 1988 one of the scientists Lawrence
Livermore Laboratory. Lawrence. Referring to your home terminal
to the computing system lab he noticed an unusual increase in
the intensity of her boot. Suspecting something was wrong, the
employee reported it to the operator on duty and he (obviously
guided instruction), immediately disconnect the system from the
network Science Internet, through which the virus spreads.
Specialists Livermore Laboratory could really alone of the
first to detect the virus. The fact that this laboratory,
conduct studies on the SDI program and the development of new
types of nuclear weapons in May 1988 had already been
confronted with a virus, then, appear to have been taken
further precautions and increased vigilance.
Immediately about the incident was reported to the
Communications Department of Defense (Defence Communication
Agency; DCA), which manages the network Arpanet. At three
o'clock in the morning on virus attacks has learned leadership
DoD. However, despite the efficiency of the notice, to localize
the virus in the network was no longer possible. According to
the second version of the notice of the appearance of the virus
has been sent an unknown person via a computer network,
together with instructions for its destruction. But the network
was overloaded and too many data centers do not immediately
receive the signal. When, finally, message noticed it was too
late.
To be continued ...
