Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!uwm.edu!zaphod.mps.ohio-state.edu!brutus.cs.uiuc.edu!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: proton!spin!legg@ucsd.edu (David Legg)
Newsgroups: comp.virus
Subject: Re: The AIDS "Trojan" is a Copy Protection System
Message-ID: <0006.9002132006.AA19225@ge.sei.cmu.edu>
Date: 13 Feb 90 17:40:35 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 57
Approved: krvw@sei.cmu.edu

munnari!mqccsunc.mqcc.mq.oz.au!ifarqhar@uunet.UU.NET (Ian Farquhar) writes:
>For several weeks we have been monitoring the discussion in comp.virus

Quote of license agreement, summary of warning in same, and the
conclusion that this is merely an elaborate copy protection scheme
deleted for brevity.

I too have been following the discussion, and while Mr. Farquhar
presents a some reasonable comments, I think he should consider the
following.

A. The disks were unsolicited material.
	 In the US, that means the receiver owns them free and clear,
	 no matter what "agreement", invoices or other demand for
	 payment is made.  What is the australian (and other target
	countries) law in this regard.

B The "COPY PROTECTION" prevented all subsequent use of the entire
	computer system, but only after it had been executed.
	It would not prevent copying the master disks on an
	unaffected system, nor would it have prevented the execution
	of those copyied disks on other systems. Ususal copy protection
	either prevents copying the master, or makes the copies useless
	on other systems.

C For it to be "COPY PROTECTION" system, there must be something
	real to protect, I have not seen any mention of anyone
	finding any real programs or information on the disk.
	 (The survey program I saw mentioned seemed to be more
	 of a quick and dirty mockup than anything else.)

C This is not another instance of a program which will self-destruct
	if used in an unlicensed environment. It effectively destroyed
	the entire computer environment. As Mr. Farquhar states, this
	might have been a recoverable event, we dont know if PC Cyborg
	would have sent a fix-up disk in response to payment,
	this is extortion.

If PC Cyborg was really interested in leasing software about aids, there
are well established methods for advertising, making demo versions, etc.

The sophistication of the methods they employed demonstrates the level of
skill and knowledge they have.  The effects on the computer systems are
intentional, not the results of faults in the code as in the case of many
viruses.

The cost of mailing the disk was significant.

Therefore I think we can be sure that the authors knew exactly what they
were doing and expected a large financial return for thier efforts.

Disclaimer: These are my own opinions and not necessarily those of my
	employer.
Dave Legg			|Internet: legg%proton.uucp@ucrmath.ucr.edu
Radiation Research Lab		|UUCP:	...!ucrmath!proton!legg
Loma Linda University Medical Center
Loma Linda, CA 92354. (714) 824-4075