27-12-2007, 13:26
MBDF Virus
In 1992, four undergraduate students at Cornell University created and released the MBDF virus, which attacks Apple Macintosh computers. This virus was released in three shareware programs:
Obnoxious Tetris, a computer game,
Ten Tile Puzzle, a computer game, and
Tetriscycle, a Trojan Horse program that contained an encrypted copy of the MBDF virus.
David S. Blumenthal wrote the virus and inserted it in the three programs. Blumenthal also created an anonymous account on a Cornell computer, so that apparently untraceable file transfers could be made. Mark A. Pilgrim used this anonymous account on 14 Feb 1992 to upload the three programs to an Internet archive at Stanford University.
The initial victims downloaded the programs from Stanford and infected their computers. As these victims shared their infected files with other users, they unwittingly spread the virus to additional victims.
The MBDF virus was a relatively benign program that did not directly harm the victim's data files. However, this virus could cause harm in three different ways:
The virus caused some programs to crash when the user selected an item from the menu bar.
The CIAC reported on 25 February 1992: "When MBDF A infects the system file, it must re-write the entire system file back to disk; this process may take two or three minutes. If the user assumes the system has hung, and reboots the Macintosh while this is occurring, the entire system file will be corrupted and an entire reload of system software must then be performed."
The virus took several seconds to infect each program file on the victim's computer, and, during those several seconds, the display would freeze. If the victim rebooted the computer during those several seconds, application files on the computer could become corrupted.
To recover from such problems, the victim first needed to run anti-virus software to delete the MBDF virus, then any corrupted files (e.g., either applications software or the operating system itself) would need to be re-installed. Depending on the skill of the victim in identifying which files were damaged, the recovery process could take hours or days.
Compared with other malicious programs, the damage from the MBDF virus was relatively small. The only reason that I mention the MBDF virus in this essay is that it is one of a very few cases in which the author and distributors of a malicious program were arrested and punished for their crime.
The MBDF virus was first discovered in the wild by a professor of mathematics in Wales, who sent it to John Norstad, the author of a now-discontinued anti-virus program for the Macintosh. Experts in computer security at several universities promptly traced the origin of the MBDF virus to Cornell University.
Blumenthal and Pilgrim were arrested and put in jail on 24 February, just ten days after the MBDF virus was first released. They were arraigned in a New York state court on charges of second-degree computer tampering, a misdemeanor. They each posted $2000 cash bail and were released from jail. Pilgrim cooperated with the police, told them the details of what had happened, and incriminated Blumenthal.
As reports of infected computers were received from all over the USA, Japan, Europe, Australia, and Canada, the district attorney contemplated increasing the charges to a felony, because he could prove a larger harm than what had initially been apparent.
During grand jury proceedings in June 1992, two other Cornell students were revealed to have played a role in the distribution of the MBDF virus to various computer bulletin boards. One of them was granted immunity from criminal prosecution in exchange for his testimony. The other, who will be identified here by the fictitious name Doe, was indicted along with Blumenthal and Pilgrim, but Doe later had his record expunged.
On 16 June 1992, a 17-count indictment was issued against Blumenthal, Pilgrim, and Doe. The indictment included four counts of first-degree computer tampering (a felony), and also seven counts of attempted computer tampering (a misdemeanor), plus one count of second-degree attempted computer tampering. In addition, Blumenthal alone was charged with felony counts of forgery and falsifying business records, for his creation of the anonymous computer account at Cornell University. I obtained a photocopy of the indictment from the Tompkins County Court and posted it here.
On 4 September 1992, Blumenthal and Pilgrim each pled guilty to one count of second-degree computer tampering, a misdemeanor, in exchange for the dismissal of all other charges and neither prison nor fines. On 5 October 1992, Blumenthal and Pilgrim were each sentenced to:
pay restitution (a total of $ 6000 to Cornell University, $ 1300 to a victim in New York City, and $ 65 to a victim in California);
each would provide 520 hours of community service, which they fulfilled by writing software for a handicapped person in Tennessee;
forfeit their personal computers; and be on probation.
The court clerk has informed me that there is no written Judgment filed for either Blumenthal or Pilgrim. Doe pled guilty to disorderly conduct and later had his record expunged, so there is no record of Doe's sentence.
Additionally, each of the four students was either expelled or suspended from Cornell University for at least one year.
Cornell University, whose reputation had been besmirched by the Morris Worm in November 1988, found itself in 1992 portrayed by journalists as a breeding ground for malicious computer programs. University administrators must be ready to deal with both the legal and public relations aspects of arrests of students for creating malicious computer programs.
In 1992, four undergraduate students at Cornell University created and released the MBDF virus, which attacks Apple Macintosh computers. This virus was released in three shareware programs:
Obnoxious Tetris, a computer game,
Ten Tile Puzzle, a computer game, and
Tetriscycle, a Trojan Horse program that contained an encrypted copy of the MBDF virus.
David S. Blumenthal wrote the virus and inserted it in the three programs. Blumenthal also created an anonymous account on a Cornell computer, so that apparently untraceable file transfers could be made. Mark A. Pilgrim used this anonymous account on 14 Feb 1992 to upload the three programs to an Internet archive at Stanford University.
The initial victims downloaded the programs from Stanford and infected their computers. As these victims shared their infected files with other users, they unwittingly spread the virus to additional victims.
The MBDF virus was a relatively benign program that did not directly harm the victim's data files. However, this virus could cause harm in three different ways:
The virus caused some programs to crash when the user selected an item from the menu bar.
The CIAC reported on 25 February 1992: "When MBDF A infects the system file, it must re-write the entire system file back to disk; this process may take two or three minutes. If the user assumes the system has hung, and reboots the Macintosh while this is occurring, the entire system file will be corrupted and an entire reload of system software must then be performed."
The virus took several seconds to infect each program file on the victim's computer, and, during those several seconds, the display would freeze. If the victim rebooted the computer during those several seconds, application files on the computer could become corrupted.
To recover from such problems, the victim first needed to run anti-virus software to delete the MBDF virus, then any corrupted files (e.g., either applications software or the operating system itself) would need to be re-installed. Depending on the skill of the victim in identifying which files were damaged, the recovery process could take hours or days.
Compared with other malicious programs, the damage from the MBDF virus was relatively small. The only reason that I mention the MBDF virus in this essay is that it is one of a very few cases in which the author and distributors of a malicious program were arrested and punished for their crime.
The MBDF virus was first discovered in the wild by a professor of mathematics in Wales, who sent it to John Norstad, the author of a now-discontinued anti-virus program for the Macintosh. Experts in computer security at several universities promptly traced the origin of the MBDF virus to Cornell University.
Blumenthal and Pilgrim were arrested and put in jail on 24 February, just ten days after the MBDF virus was first released. They were arraigned in a New York state court on charges of second-degree computer tampering, a misdemeanor. They each posted $2000 cash bail and were released from jail. Pilgrim cooperated with the police, told them the details of what had happened, and incriminated Blumenthal.
As reports of infected computers were received from all over the USA, Japan, Europe, Australia, and Canada, the district attorney contemplated increasing the charges to a felony, because he could prove a larger harm than what had initially been apparent.
During grand jury proceedings in June 1992, two other Cornell students were revealed to have played a role in the distribution of the MBDF virus to various computer bulletin boards. One of them was granted immunity from criminal prosecution in exchange for his testimony. The other, who will be identified here by the fictitious name Doe, was indicted along with Blumenthal and Pilgrim, but Doe later had his record expunged.
On 16 June 1992, a 17-count indictment was issued against Blumenthal, Pilgrim, and Doe. The indictment included four counts of first-degree computer tampering (a felony), and also seven counts of attempted computer tampering (a misdemeanor), plus one count of second-degree attempted computer tampering. In addition, Blumenthal alone was charged with felony counts of forgery and falsifying business records, for his creation of the anonymous computer account at Cornell University. I obtained a photocopy of the indictment from the Tompkins County Court and posted it here.
On 4 September 1992, Blumenthal and Pilgrim each pled guilty to one count of second-degree computer tampering, a misdemeanor, in exchange for the dismissal of all other charges and neither prison nor fines. On 5 October 1992, Blumenthal and Pilgrim were each sentenced to:
pay restitution (a total of $ 6000 to Cornell University, $ 1300 to a victim in New York City, and $ 65 to a victim in California);
each would provide 520 hours of community service, which they fulfilled by writing software for a handicapped person in Tennessee;
forfeit their personal computers; and be on probation.
The court clerk has informed me that there is no written Judgment filed for either Blumenthal or Pilgrim. Doe pled guilty to disorderly conduct and later had his record expunged, so there is no record of Doe's sentence.
Additionally, each of the four students was either expelled or suspended from Cornell University for at least one year.
Cornell University, whose reputation had been besmirched by the Morris Worm in November 1988, found itself in 1992 portrayed by journalists as a breeding ground for malicious computer programs. University administrators must be ready to deal with both the legal and public relations aspects of arrests of students for creating malicious computer programs.