Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!usc!elroy.jpl.nasa.gov!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: attcan!ram@uunet.UU.NET (Richard Meesters)
Newsgroups: comp.virus
Subject: Re: AIDS Copy Prtection System
Message-ID: <0004.9002231213.AA10580@ge.sei.cmu.edu>
Date: 22 Feb 90 14:37:31 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 142
Approved: krvw@sei.cmu.edu

munnari!mqccsunc.mqcc.mq.oz.au!ifarqhar@uunet.UU.NET (Ian Farquhar) writes:
> 1)   FREE MARKET
>
> Many writers pointed out that the program itself was garbage, and
> justified their position (that it was a Trojan) with the argument
> that the money for the program was far too much and thus the
> program was an extortion racket.
>
> Being an Australia, I am used to being charged extortionate
> prices for software by both amateurs and professional companies.
> The point that must be made, however, is that in a free market
> economy the supplier can charge what they like.  The idea is that
> supply and demand will weed out the excessively priced garbage
> from the reasonably priced quality items.

While I agree with you that in a free market economy, you can charge
whaterver you like for the purchase of a product, the issue here with
the AIDS trojan is whether you can give someone a disk and then demand
payment for it.  It really doesn't matter if the cost was 10 dollars
or 10 thousand.

I believe the argument being raised was not whether the AIDS
infromation package was any good or not, but rather if the package
indeed constituted a real software package, or simply a front to
introduce a trojan into your system.

> 2)   THE ABSENCE OF THE REGISTRATION DISKS
>
> It is presumed that PC Cyborg would have sent the defuser program
> on receipt of the registration fee.  Many people have pointed out
> that this did not happen.  I imagine that the US Military rolling
> into Panama may have had something to do with that.

The end really doesn't justify the means.  If this was a case of a
real company trying to copy protect their software, (and I don't
believe that for a second) this scheme has a major flaw.  Consider
what happens to the hapless user if the company goes out of buisness.
He has now lost all data on his hard drive without any possibility of
recovery through what you obviously consider legal channels.  If a
scheme like this is used to copy protect the software, the company
producing it should have some level of responsiblilty (moral, if not
legal) to protect your system from damage from a package you have
rightly purchased.


> 3)   THE DEFINITION OF COPY PROTECTION
>
> Copy protection, by my definition, is a device, system or
> technique whereby the copyright holder can guarantee that the
> terms of the license are followed.

True.  But copy protection is NOT a mechanism by which the copyright
holder can damage or hinder the operation of aspects of your system
unrelated to the operation of said program.

> The AIDS CP System was simply an extension of this.  It allowed
> copying of the distribution disk, and it allowed backing up of
> the hard disk.  All it did was to ensure that people who were
> unregistered (and which were, I hasten to add, involved in a
> criminal activity) would have a lot of trouble.

> As for the concept of the user having legal control over what was
> deleted from his/her hard disk, I cannot see this as a problem.
> Multi-user systems have traditionally provided mechanisms for the
> superuser to control the user's files with far more privileges
> than the users themselves.  This has never, to my knowledge,
> caused any legal problems.

The superuser on a multi-user system has responsibility to the users
and owners of the system he administers.  This is not the same as
someone (ie. a hacker) illegally logging into your system as root and
deleting or damaging files.  This has caused several legal problems
worldwide, and is a more apt description of what the AIDS trojan is,
in effect accomplishing.  It is true that the system administrator in
this case, has left the door open for the damage to be done, but that
still doesn't excuse the actions.  That would be like letting a
burglar off from all charges because the homeowner left the front door
unlocked.

> 5)   PRESUMPTION OF INNOCENCE
>
> Under British law, there is a concept called the "presumption of
> innocence".  Put basically, someone is innocent until they are
> proven guilty.  It would be nice to know that this basic concept
> is still followed, though I really do have my doubts.
>
> If I were the defense lawyer with access to this newsgroup, the
> first thing that I would have done is to take all of the relevant
> articles that have appeared, and present them as evidence
> prejudicial to the fair conduct of the trial.

You are most certainly correct that a person is innocent until proven
guilty, but what we are debating here is whether or not a crime has
been committed, not by whom.  The person or persons brought to justice
for this problem should, IMHO, recieve a fair and impartial trial.

> 6)   CONCLUSION
>
> I am left wondering about the motives of many of the writers.
> There seems to be a fanatical, indeed almost religious zeal to
> see anyone concerned with the generation of viruses and Trojans
> convicted irregardless of the evidence (or its lack).
>
> There certainly seems to be a panic mentality at work here - the
> illusion that quick action is necessary regardless of the
> advisability of that action.  There also is a strong reluctance
> to change an opinion in the light of new evidence, which is very
> worrying indeed.
>
> I have always maintained that computer security experts and
> employees of the intelligence services share many things in
> common, primarily the huge and quite unwarranted sense of
> paranoia.  This whole discussion has only strengthened this view.

Sorry Ian, but I really don't see how you could have possibly drawn
this conclusion from the previous discussions.  We are not judge or
jury in this case.  If indeed the AIDS trojan was a copy protection
scheme, then the answer to the problem is to prevent this type of CP
scheme to be used in the future.  However, the evidence and conjecture
I have seen as a result of this discussion point to the fact that this
is NOT a simple case of copy protection gone awry.

You state that there is a reluctance to change opinion in the light of
new evidence, yet you really haven't provided the group (or certainly
me, anyway) with any strong evidence that would convince me to change
my opinion.

By the way, I am neither a computer security expert nor a member of
the intelligence services, as you put it.  What I have seen from this
discussion appears to be a case of fraud and extortion, but it is,
after all, up to the courts to decide that.

Regards,

- ------------------------------------------------------------------------------
     Richard A Meesters                |
     Technical Support Specialist      |     Insert std.logo here
     AT&T Canada                       |
                                       |     "Waste is a terrible thing
     ATTMAIL: ....attmail!rmeesters    |      to mind...clean up your act"
     UUCP:  ...att!attcan!ram          |
- ------------------------------------------------------------------------------