The CHRISTMA EXEC network worm – 35 years and counting! – Naked Security

Overlook Sergeant Pepper and his Lonely Hearts Membership Band, who taught the band to play a mere 20 years in the past in the present day.

December 2022 sees the thirty fifth anniversary of the primary main self-spreading pc virus – the notorious CHRISTMA EXEC worm that briefly crushed the most important mainframe networks of the day…

… not by any intentionally coded side-effects corresponding to file scrambling or knowledge deletion, however just by leeching an excessive amount of community bandwidth for its personal unauthorised goal.

As a decoy to disguise the truth that it learn within the Eighties IBM equivalents of your e mail deal with e book (NAMES) and your known-hosts file (NETLOG) so as to discover as many new recipients of the malware as potential to ship itself to, the malware displayed this:

                *               
                *               
               ***              
              *****             
             *******            
            *********           
          *************                A
             *******            
           ***********                VERY
         ***************        
       *******************           HAPPY
           ***********          
         ***************            CHRISTMAS
       *******************      
     ***********************         AND MY
         ***************        
       *******************         BEST WISHES
     ***********************    
   ***************************     FOR THE NEXT
             ******             
             ******                    YEAR
             ******

When you’re questioning why the virus is broadly often known as CHRISTMA EXEC, relatively than by the total phrase CHRISTMAS…

…that’s as a result of filenames have been restricted to eight characters, which could possibly be adopted by an area and what we might in the present day name an “extension” of EXEC so as to flip them into scripts that could possibly be run immediately by the consumer – executed, in technical jargon.

The virus itself was written in IBM’s highly effective text-based scripting language REXX (the resoundingly named Restructured Prolonged Executor), so a non-programmer wanting on the message would in all probability recognise it as “program code”, and due to this fact are inclined to ignore it as unimportant and irrelevant, for all that it’d look attention-grabbing.

Besides that the writer of the virus discovered a cheerful option to embed an tutorial lure proper into the code itself, which begins with a comment (as within the C language, textual content between /* and */ in REXX packages is handled as a remark and ignored when the file will get used)…

/*********************/
/*    LET THIS EXEC  */
/*                   */
/*        RUN        */
/*                   */
/*        AND        */
/*                   */
/*       ENJOY       */
/*                   */
/*     YOURSELF!     */
/*********************/

…after which provides the next cheery recommendation to non-techies:

/*  shopping this file is not any enjoyable in any respect
       simply kind CHRISTMAS from cms     */

CMS is brief for Conversational Monitor System, a command immediate surroundings on high of IBM’s venerable VM/370 working system and its many variants, which supplied particular person customers a real-time digital machine that behaved like a pc all of their very own, with its personal disk area for storing private information and packages.

Handily, the consumer didn’t should be taught to depart the ultimate -S off the phrase CHRISTMAS, as a result of CMS would routinely ignore any additional characters and hunt for CHRISTMA EXEC, which was the very script program that the consumer had simply acquired with out anticipating it or asking for it.

As said above, the code did certainly show the Christmas Tree ASCII artwork – or, extra exactly, EBCDIC artwork, on condition that IBM famously had its personal character encoding system often known as Prolonged Binary Coded Decimal Interchange Code (pronounced ebb-si-dick).

But it surely additionally trawled by your NAMES and NETLOG information, which listed different customers and computer systems you commonly contacted, and copied itself to all of them, in order that for each consumer who innocently typed CHRISTMAS on the command immediate…

…a sea of copies of the virus (20? 50? 200?) can be distributed, probably worldwide, and if any of these recipients (20? 50? 200?) innocently typed CHRISTMAS on the command immediate…

…a sea of copies of the virus can be distributed, and so forth, and so forth.

Shades of the long run

As we mentioned on this week’s podcast, the place we mentioned this seminal worm:

[This is j]ust like fashionable macro malware that claims to the consumer, “Hey, macros are disabled, however to your ‘additional security’ you must flip them again on… why not click on the button? It’s a lot simpler that means.”

35 years in the past, malware writers had already found out that if you happen to ask customers properly to do one thing that’s not in any respect of their curiosity, a few of them, probably a lot of them, will do it.

We additionally remarked that:

[The Christmas Tree worm] ought to have been a warning shot throughout all our bows, however I believe it was felt to be somewhat little bit of a flash within the pan.

Till a yr later – then got here the Web Worm, which after all attacked Unix methods and unfold far and large.

And by then I believe all of us realised, “Uh-oh, this viruses-and-worms scene may end up fairly troublesome.”

If solely we’d been incorrect, eh?

Featured picture of IBM 3279 terminal due to consumer Shieldforyoureyes by way of Wikimedia.