4 ms·

A Virus for the BBC Micro

76 points by pabs3 3y ago

rsaxvc 3y ago
That's terrific! Ages later I made one for a GoPro using the autoexec.ash script (before they changed CPU vendors). It copied itself into the internal storage, then back to new SD cards. I wrote out a little text file explaining what had happened and how to remove it. Never figured out how to tell them about it.
- codetrotter 3y ago
  In the beginning of the 2010's I was at a train station with my laptop and a dude walks up to me holding a USB stick. (Or was it an SD card?) Asks me if he can send an email or something. I remember him opening his storage device on my computer and he had some sketchy looking files. Was there a trojan on his USB stick? If there was, had he put them there intentionally? Is this how he scammed people? By approaching them at train stations with some device and an excuse to plug it in? Or was he just an unknowing carrier of the malicious files, a victim to his own habit of plugging his device into random strangers computers? Perhaps there was nothing there and I was mistaken? I never found out. But I also haven’t noticed anything out of the ordinary with any of my accounts since then. So even if something was up, I think it was not successful. Your story reminded me of this experience. And also of autorun.inf files on CD-ROMs that would make Windows 95 and later run things. I think at some point in WinXP they disabled auto run of CDs and you had to explicitly choose to run programs that autorun.inf wanted to run. Only tangentially related to what those GoPro cameras you mention would do with memory cards of course. But a memory nonetheless.
  - rsaxvc 3y ago
    I found a thumb drive outside work once. Piped it into a VM and found...coworkers visa renewal paperwork. Perhaps this is a weakness, but I'm glad I checked.
  - jacquesm 3y ago
    If someone were to do that to me I'd never agree with it. Rando wants to stick a USB device into my computer sounds like a very bad idea. You're a very nice person.
PrimeMcFly 3y ago
I'm pretty sure his mom could, in fact, understand what a computer virus is if he explained it to her.
- optimalsolver 3y ago
  And if he really cared, he'd get her some hands-on experience with the BBC.
spacedcowboy 3y ago
I posted this the last time this topic surfaced - apparently I can’t figure out how to permalink a post, it’s probably just too late for my tired brain :) Along the same lines, I wrote my first ever (and last) virus for the BBC micro... Some history: Waaay back in the mists of time (1988) I was a 1st-year undergrad in Physics. Together with a couple of friends, I wrote a virus, just to see if we could (having read through the Advanced User Guide and the Econet System User Guide), then let it loose on just one of the networked BBC machines in the year-1 lab. I guess I should say that the virus was completely harmless, it just prepended 'Copyright (c) 1988 The Virus' to the start of directory listings. It was written for the beebs (the lab hadn't got onto PC's by this time, and the Acorn range had loads of ports, which physics labs like :-) It spread like wildfire. People would come in, log into the network, and become infected because the last person to use their current computer was infected. It would then infect their account, so wherever they logged on in future would also infect the computer they were using then. A couple of hours later, and most of the 50 or so computers in the yr1 lab was infected, and it had spread to the yr2 machines as well, we were told later. You have to remember that viruses in those days weren't really networked. They came on floppy disks for Atari ST's and Amiga's. I witnessed people logging onto the same computer "to see if they were infected too" - at which point the act of logging in would infect them... Of course "authority" was not amused. Actually they were seriously unamused, not that they caught us. They shut down the year-1,2,3 network and disinfected all the accounts on the network server by hand. Ouch. There were basically 3 ways the virus could be activated: - Typing any 'star' command (eg: "* .", which gave you a directory listing). Sneaky, I thought, since the virus announced itself when you did a '* .' When you thought you'd beaten it, you'd do a '* .' to see if it was still there :-) - The events (keypress, network, disk etc.) all activated the virus if inactive, and also re-enabled the interrupts, if they had been disabled - The interrupts (NMI,VBI,..) all activated the virus if inactive, and also re-enabled the events, if they had been deactivated. On activation, the virus would replicate itself to the current mass-storage media if it wasn’t already present. This was to cause problems because we hadn't really counted on just how effective this would be. Within a few days of the virus being cleansed (and everyone settling back to normal), it suddenly made a re-appearance again, racing through the network once more within an hour or two. Someone, we decided, had put the virus onto their floppy disk (by typing *. on the floppy when saving their work, rather than the network) and had then brought the disk back into college and re-infected the network. If we thought authority was unamused last time, this time they held a meeting for the entire department, and calmly said the culprit, when found, would be expelled - no ifs, no buts. Excrement and fans came to mind. Of course, they thought we'd just re-released it, but in fact it was just too successful for comfort... Since we had "shot our bolt", owning up didn't seem like a good idea. The only solution we came up with was to write another (silent, this time :-) virus which would disable any copy of the old one, whilst hiding itself from the users. We built in a time-to-die of a couple of months, let it go, and prayed... We had actually built in a kill-switch to the original virus, which would disable and remove it - we didn't want to be infected ourselves (at the start). Of course, it became a matter of self-preservation to be infected later on in the saga - 3 accounts unaccountably (pun intended :-) uninfected... It wasn't too hard to destroy the original by having the new virus "press" the key combination that deleted the old one. So, everyone was happy. Infected with the counter-virus for a while, but happy. "Authority" thought they'd laid down the law, and been taken seriously (oh if they knew...) and we'd not been expelled. Everyone else lost their infections within a few months ... It is vaguely possible that I still have the source code, on a degrading 5.25” floppy somewhere in the attic, but it’s not likely, and I don’t have any way to read that hypothetical floppy disk anyway… In any event, I've never written anything remotely like a virus since [grin].
exitb 3y ago
Reminds me of the Bu£a virus for C64, that infected the 1541 disk drive, thus could survive power cycling of the main unit. Here’s a detailed analysis - https://youtu.be/4k9EKkCcWoc https://youtu.be/4k9EKkCcWoc
lowbloodsugar 3y ago
When was it 1986 or so that computer viruses made the news? How do they work? Hmm. Ok thanks! <typing> I was in a BBC B so no sideways ram. I’m not sure if I hid it under 1900 somewhere or increased PAGE a bit more. DFS stole a bunch anyway.
davelondon 3y ago
When our BBC crashed with the message "Sideways RAM required" my kid brother tried whacking the side of the case. Didn't work unfortunately.
- flir 3y ago
  Friend of mine wrapped the expansion bus on his Electron in silver foil. I've no idea what possessed him, but I do know it never ran again. Just looked it up, and it had 18V AC on pins 1 and 2. So yeah, a kit kat wrapper will do that.
rwmj 3y ago
The BBC Micro / Econet network used in UK schools was a lot of fun, very open, and not at all secure. There was no internet so you had to work everything out by reading the docs (which were very good) and reverse engineering. Each account started with a quota (8K!), but you could easily steal more if you could persuade someone to run a program under your control. That was because if they created a file in your directory, and you deleted that file, then the quota to write the file came from their account, but deleting the file credited the quota back to your account. Needless to say I had a lot of spare quota after a while, so much so that I had to "hide" the fact by creating lots of random-filled files, since the system only tracked quota for free space, possibly the root cause of the bug. Another one was that writing to address 3362 allowed you to change your station number (think IP address if you only had 256 addresses) on the Econet network. So you could trivially impersonate any other logged in account by assuming their station number and sending requests to the file server. I worked out the address (3362) by printing every address that contained the same byte as the station number across a few machines and cross-referencing them by hand. Another one was the *NOTIFY command which sent messages to other machines on the network. Except it worked by literally typing those strings as if they had been entered on the keyboard of the other machine, obviously allowing you to send arbitrary commands. The system admins at our school removed the program but couldn't remove the underlying "system call" [as we'd refer to it nowadays] in ROM, so I wrote a program that performed a broadcast notify letting you type commands to as many other machines in the room as you liked. I was banned from the school computer room after a couple of years of this.
- jlokier 3y ago
  I was banned from the school computer room within a few days of my first computer lesson. Also using BBC Micro / Econet. While the teacher was typing in their admin password to the Econet file server, I quickly typed a one-liner on one of the BBC Micros in the class that all of us children could see. It fetched the contents of the keyboard buffer from the file server repeatedly and displayed it on the BBC Micro screen. So we watched, fascinated, as the teacher's very secret admin password appeared one character at a time on our screen. After logging in, teacher turned round to see what the class was so excited by, and then I was banned from that room for the next 5 years. Never saw it again, couldn't take computer studies as a class. Even so, when the school held a programming competition to make a pretty demo, I won the competition with my animated story about a plant being rained on and growing to a big happy plant, complete with music and unfurling leaves. Programmed outside school of course.
masswerk 3y ago
A somewhat interesting aspect is the assembly by hand and the POKEs from DATA statements (as you would do on most other micro computer systems). Notably, BBC BASIC featured a built-in assembler, so you could directly interleave 6502 assembler code with BASIC statements. – Was this some kind of obfuscation, or did the built-in capabilities of BBC BASIC fail to come to the notice of an otherwise well-versed kid? Or was this an intricacy of the Sideways RAM, which couldn't be reached this way?
- jacquesm 3y ago
  Anything between [ and ] was passed to the assembler. https://central.kaserver5.org/Kasoft/Typeset/BBC/Ch43.html https://central.kaserver5.org/Kasoft/Typeset/BBC/Ch43.html
PlunderBunny 3y ago
A guy at my school created a ‘virus’ simply by typing in a short program when people’s backs were turned.
helpfulContrib 3y ago
A couple of years ago, a friend of my teenage son showed up at our house with an old computer he'd found in his Grandma's attic .. a Commodore PC20-II, which was a very early PC clone, as in 8088 and MS-DOS .. The story went that his grandparents had bought the thing brand new, used it for a couple of months, and then 'something went wrong with it', they stashed it in the attic and its been there ever since. Would I take a look at it and see whats up? Indeed I would! I have a bit of a thing for old computers. We plug it in, boot it up, and there she is in all the amber glory, C:\> I tell the kids "let her settle for a bit, lets just bathe in the glory a little more", a few seconds go by .. and sure enough .. that old clunky 20Meg hard drive gives a little tick. Okay, I have a hunch. C:\> echo > DEADBEEF.COM C:\> dir DEADBEEF.COM DEADBEEF.COM 0 bytes (I'm paraphrasing) Okay .. interesting, what happens if we: C:\>DEADBEEF.COM <blink blink> C:\> dir DEADBEEF.COM DEADBEEF.COM 76 bytes Ah hah! Kids, we have a Virus. And probably one of the very, very early viruses. "And very well self-contained", I proclaim as I duct-tape the 5.4" floppy drive with great drama, because there's no way any of the highly valuable 5.4" floppy disks in my collection are ever going in there .. We spend a few days delighting in all the things we can do with C:\DOS\DEBUG.COM and that little virus, which happily copies itself wherever we tell it to, and the kids get a boot camp introduction into interrupt service routines, BIOS calls and old-school hygiene techniques .. After a week or so of this, the caps blow, and the virus returns to its slumber. We'll replace the caps soon enough, and it'll become an exhibit .. its the perfect way to explain to interested young computer nerds what a virus is, how it works, and what you can do with it/for it/against it, in a controlled environment ..
- rep_lodsb 3y ago
  That story doesn't check out...
  - helpfulContrib 3y ago
    Sure it does, because it really happened.
    - rep_lodsb 3y ago
kalleboo 3y ago
When I was in my early teens I wrote a worm for HyperCard on the Mac (it did nothing but spread. No messages or anything). In my infinite wisdom, I thought the ideal way to put my mark on history was to post it to Usenet to spread it... Of course, nearly all news servers filtered out binaries from discussion groups, so I assumed nobody ever saw it. Years and years later, I was poking through the virus definition files for a Mac antivirus to see how they worked, and lo and behold - there was the HyperTalk source code for my worm, verbatim in the antivirus definition file... I guess someone did end up seeing it in the end... sorry for wasting someone's time!

76 points by pabs3 3y ago

That's terrific! Ages later I made one for a GoPro using the autoexec.ash script (before they changed CPU vendors). It copied itself into the internal storage, then back to new SD cards. I wrote out a little text file explaining what had happened and how to remove it. Never figured out how to tell them about it.

codetrotter 3y ago
In the beginning of the 2010's I was at a train station with my laptop and a dude walks up to me holding a USB stick. (Or was it an SD card?) Asks me if he can send an email or something. I remember him opening his storage device on my computer and he had some sketchy looking files. Was there a trojan on his USB stick? If there was, had he put them there intentionally? Is this how he scammed people? By approaching them at train stations with some device and an excuse to plug it in? Or was he just an unknowing carrier of the malicious files, a victim to his own habit of plugging his device into random strangers computers? Perhaps there was nothing there and I was mistaken? I never found out. But I also haven’t noticed anything out of the ordinary with any of my accounts since then. So even if something was up, I think it was not successful. Your story reminded me of this experience. And also of autorun.inf files on CD-ROMs that would make Windows 95 and later run things. I think at some point in WinXP they disabled auto run of CDs and you had to explicitly choose to run programs that autorun.inf wanted to run. Only tangentially related to what those GoPro cameras you mention would do with memory cards of course. But a memory nonetheless.
- rsaxvc 3y ago
  I found a thumb drive outside work once. Piped it into a VM and found...coworkers visa renewal paperwork. Perhaps this is a weakness, but I'm glad I checked.
- jacquesm 3y ago
  If someone were to do that to me I'd never agree with it. Rando wants to stick a USB device into my computer sounds like a very bad idea. You're a very nice person.

PrimeMcFly 3y ago

I'm pretty sure his mom could, in fact, understand what a computer virus is if he explained it to her.

optimalsolver 3y ago
And if he really cared, he'd get her some hands-on experience with the BBC.

spacedcowboy 3y ago

I posted this the last time this topic surfaced - apparently I can’t figure out how to permalink a post, it’s probably just too late for my tired brain :) Along the same lines, I wrote my first ever (and last) virus for the BBC micro... Some history: Waaay back in the mists of time (1988) I was a 1st-year undergrad in Physics. Together with a couple of friends, I wrote a virus, just to see if we could (having read through the Advanced User Guide and the Econet System User Guide), then let it loose on just one of the networked BBC machines in the year-1 lab. I guess I should say that the virus was completely harmless, it just prepended 'Copyright (c) 1988 The Virus' to the start of directory listings. It was written for the beebs (the lab hadn't got onto PC's by this time, and the Acorn range had loads of ports, which physics labs like :-) It spread like wildfire. People would come in, log into the network, and become infected because the last person to use their current computer was infected. It would then infect their account, so wherever they logged on in future would also infect the computer they were using then. A couple of hours later, and most of the 50 or so computers in the yr1 lab was infected, and it had spread to the yr2 machines as well, we were told later. You have to remember that viruses in those days weren't really networked. They came on floppy disks for Atari ST's and Amiga's. I witnessed people logging onto the same computer "to see if they were infected too" - at which point the act of logging in would infect them... Of course "authority" was not amused. Actually they were seriously unamused, not that they caught us. They shut down the year-1,2,3 network and disinfected all the accounts on the network server by hand. Ouch. There were basically 3 ways the virus could be activated: - Typing any 'star' command (eg: "* .", which gave you a directory listing). Sneaky, I thought, since the virus announced itself when you did a '* .' When you thought you'd beaten it, you'd do a '* .' to see if it was still there :-) - The events (keypress, network, disk etc.) all activated the virus if inactive, and also re-enabled the interrupts, if they had been disabled - The interrupts (NMI,VBI,..) all activated the virus if inactive, and also re-enabled the events, if they had been deactivated. On activation, the virus would replicate itself to the current mass-storage media if it wasn’t already present. This was to cause problems because we hadn't really counted on just how effective this would be. Within a few days of the virus being cleansed (and everyone settling back to normal), it suddenly made a re-appearance again, racing through the network once more within an hour or two. Someone, we decided, had put the virus onto their floppy disk (by typing *. on the floppy when saving their work, rather than the network) and had then brought the disk back into college and re-infected the network. If we thought authority was unamused last time, this time they held a meeting for the entire department, and calmly said the culprit, when found, would be expelled - no ifs, no buts. Excrement and fans came to mind. Of course, they thought we'd just re-released it, but in fact it was just too successful for comfort... Since we had "shot our bolt", owning up didn't seem like a good idea. The only solution we came up with was to write another (silent, this time :-) virus which would disable any copy of the old one, whilst hiding itself from the users. We built in a time-to-die of a couple of months, let it go, and prayed... We had actually built in a kill-switch to the original virus, which would disable and remove it - we didn't want to be infected ourselves (at the start). Of course, it became a matter of self-preservation to be infected later on in the saga - 3 accounts unaccountably (pun intended :-) uninfected... It wasn't too hard to destroy the original by having the new virus "press" the key combination that deleted the old one. So, everyone was happy. Infected with the counter-virus for a while, but happy. "Authority" thought they'd laid down the law, and been taken seriously (oh if they knew...) and we'd not been expelled. Everyone else lost their infections within a few months ... It is vaguely possible that I still have the source code, on a degrading 5.25” floppy somewhere in the attic, but it’s not likely, and I don’t have any way to read that hypothetical floppy disk anyway… In any event, I've never written anything remotely like a virus since [grin].

exitb 3y ago

Reminds me of the Bu£a virus for C64, that infected the 1541 disk drive, thus could survive power cycling of the main unit. Here’s a detailed analysis - https://youtu.be/4k9EKkCcWoc https://youtu.be/4k9EKkCcWoc

lowbloodsugar 3y ago

When was it 1986 or so that computer viruses made the news? How do they work? Hmm. Ok thanks! <typing> I was in a BBC B so no sideways ram. I’m not sure if I hid it under 1900 somewhere or increased PAGE a bit more. DFS stole a bunch anyway.

davelondon 3y ago

When our BBC crashed with the message "Sideways RAM required" my kid brother tried whacking the side of the case. Didn't work unfortunately.

flir 3y ago
Friend of mine wrapped the expansion bus on his Electron in silver foil. I've no idea what possessed him, but I do know it never ran again. Just looked it up, and it had 18V AC on pins 1 and 2. So yeah, a kit kat wrapper will do that.

rwmj 3y ago

The BBC Micro / Econet network used in UK schools was a lot of fun, very open, and not at all secure. There was no internet so you had to work everything out by reading the docs (which were very good) and reverse engineering. Each account started with a quota (8K!), but you could easily steal more if you could persuade someone to run a program under your control. That was because if they created a file in your directory, and you deleted that file, then the quota to write the file came from their account, but deleting the file credited the quota back to your account. Needless to say I had a lot of spare quota after a while, so much so that I had to "hide" the fact by creating lots of random-filled files, since the system only tracked quota for free space, possibly the root cause of the bug. Another one was that writing to address 3362 allowed you to change your station number (think IP address if you only had 256 addresses) on the Econet network. So you could trivially impersonate any other logged in account by assuming their station number and sending requests to the file server. I worked out the address (3362) by printing every address that contained the same byte as the station number across a few machines and cross-referencing them by hand. Another one was the *NOTIFY command which sent messages to other machines on the network. Except it worked by literally typing those strings as if they had been entered on the keyboard of the other machine, obviously allowing you to send arbitrary commands. The system admins at our school removed the program but couldn't remove the underlying "system call" [as we'd refer to it nowadays] in ROM, so I wrote a program that performed a broadcast notify letting you type commands to as many other machines in the room as you liked. I was banned from the school computer room after a couple of years of this.

jlokier 3y ago
I was banned from the school computer room within a few days of my first computer lesson. Also using BBC Micro / Econet. While the teacher was typing in their admin password to the Econet file server, I quickly typed a one-liner on one of the BBC Micros in the class that all of us children could see. It fetched the contents of the keyboard buffer from the file server repeatedly and displayed it on the BBC Micro screen. So we watched, fascinated, as the teacher's very secret admin password appeared one character at a time on our screen. After logging in, teacher turned round to see what the class was so excited by, and then I was banned from that room for the next 5 years. Never saw it again, couldn't take computer studies as a class. Even so, when the school held a programming competition to make a pretty demo, I won the competition with my animated story about a plant being rained on and growing to a big happy plant, complete with music and unfurling leaves. Programmed outside school of course.

masswerk 3y ago

A somewhat interesting aspect is the assembly by hand and the POKEs from DATA statements (as you would do on most other micro computer systems). Notably, BBC BASIC featured a built-in assembler, so you could directly interleave 6502 assembler code with BASIC statements. – Was this some kind of obfuscation, or did the built-in capabilities of BBC BASIC fail to come to the notice of an otherwise well-versed kid? Or was this an intricacy of the Sideways RAM, which couldn't be reached this way?

jacquesm 3y ago
Anything between [ and ] was passed to the assembler. https://central.kaserver5.org/Kasoft/Typeset/BBC/Ch43.html https://central.kaserver5.org/Kasoft/Typeset/BBC/Ch43.html

PlunderBunny 3y ago

A guy at my school created a ‘virus’ simply by typing in a short program when people’s backs were turned.

helpfulContrib 3y ago

A couple of years ago, a friend of my teenage son showed up at our house with an old computer he'd found in his Grandma's attic .. a Commodore PC20-II, which was a very early PC clone, as in 8088 and MS-DOS .. The story went that his grandparents had bought the thing brand new, used it for a couple of months, and then 'something went wrong with it', they stashed it in the attic and its been there ever since. Would I take a look at it and see whats up? Indeed I would! I have a bit of a thing for old computers. We plug it in, boot it up, and there she is in all the amber glory, C:\> I tell the kids "let her settle for a bit, lets just bathe in the glory a little more", a few seconds go by .. and sure enough .. that old clunky 20Meg hard drive gives a little tick. Okay, I have a hunch. C:\> echo > DEADBEEF.COM C:\> dir DEADBEEF.COM DEADBEEF.COM 0 bytes (I'm paraphrasing) Okay .. interesting, what happens if we: C:\>DEADBEEF.COM <blink blink> C:\> dir DEADBEEF.COM DEADBEEF.COM 76 bytes Ah hah! Kids, we have a Virus. And probably one of the very, very early viruses. "And very well self-contained", I proclaim as I duct-tape the 5.4" floppy drive with great drama, because there's no way any of the highly valuable 5.4" floppy disks in my collection are ever going in there .. We spend a few days delighting in all the things we can do with C:\DOS\DEBUG.COM and that little virus, which happily copies itself wherever we tell it to, and the kids get a boot camp introduction into interrupt service routines, BIOS calls and old-school hygiene techniques .. After a week or so of this, the caps blow, and the virus returns to its slumber. We'll replace the caps soon enough, and it'll become an exhibit .. its the perfect way to explain to interested young computer nerds what a virus is, how it works, and what you can do with it/for it/against it, in a controlled environment ..

rep_lodsb 3y ago
That story doesn't check out...
- helpfulContrib 3y ago
  Sure it does, because it really happened.
  - rep_lodsb 3y ago

kalleboo 3y ago

When I was in my early teens I wrote a worm for HyperCard on the Mac (it did nothing but spread. No messages or anything). In my infinite wisdom, I thought the ideal way to put my mark on history was to post it to Usenet to spread it... Of course, nearly all news servers filtered out binaries from discussion groups, so I assumed nobody ever saw it. Years and years later, I was poking through the virus definition files for a Mac antivirus to see how they worked, and lo and behold - there was the HyperTalk source code for my worm, verbatim in the antivirus definition file... I guess someone did end up seeing it in the end... sorry for wasting someone's time!