270 lines
11 KiB
Plaintext
270 lines
11 KiB
Plaintext
==Phrack Magazine==
|
|
|
|
Volume Four, Issue Forty-Four, File 11 of 27
|
|
|
|
****************************************************************************
|
|
|
|
[Editor's Note:
|
|
|
|
The following two files are very interesting. I never paid ANY
|
|
attention to the realm of our community that focus on virii. For
|
|
some reason, the whole idea behind them is a novel concept, but
|
|
I never saw any reason to take notice of them. Even when I've
|
|
given lectures, I always leave discussion about virii out, since
|
|
they should be a moot point. I mean, when "fdisk /mbr" will take
|
|
care of so many problems, what's the big deal?
|
|
|
|
I know I'm over-simplifying things, but jesus...
|
|
|
|
Well, while I continued to overlook this small but earnest group
|
|
of folks who dabble in virii, all kinds of things began to happen.
|
|
Groups formed, rivalries flared, paranoia ran rampant and one of the
|
|
most ridiculous cottage industries in the history of personal
|
|
computing appeared (living on the spread of Fear, Uncertainty and
|
|
Doubt.)
|
|
|
|
Well, in all of this several names have popped up as potential threats
|
|
to this little world. One in particular, Sarah Gordon, even got the
|
|
spotlight as a paranoid, BBS-busting, hacker-bashing psychopath in a
|
|
rather ill-researched and hastily prepared Phrack piece a few years
|
|
back. It is rather odd that in all the hype we in the underground
|
|
drum up, no one ever bothers to get the other side of the story, so we
|
|
feed the fervor and continue the paranoia.
|
|
|
|
Well, with this in mind, I received a file claiming to have info
|
|
regarding the big "expose" of Sarah masquerading as the Dark Avenger.
|
|
Now, even a moron like me has heard of the Dark Avenger, so I read it.
|
|
After doing so, I wanted to pipe it to /dev/null, but then decided it
|
|
would be much more fun to send it to Sarah too, and let her respond to it.
|
|
|
|
It's amusing as hell, and just goes to show that the underground
|
|
has as many similarities in its distinct groups as it does
|
|
differences.]
|
|
|
|
-----------------------------------------------------------------------------
|
|
|
|
|
|
Sara(h?) Gordon AND THE DARK AVENGER SCAM.
|
|
By Kohntark
|
|
|
|
|
|
In one of my many online conversations with Sara Gordon
|
|
I once asked her about the validity of the VNI interviews and
|
|
her real relationship with the alleged dark avenger; after
|
|
logging into her VFR BBS and seeing a #2 (hers being #1)
|
|
account named after him.
|
|
I proceeded to leave a message for the dark avenger there,
|
|
claiming that the whole account was bogus as it is highly
|
|
improbable that this person might call all the way from
|
|
Bulgaria and log into a mediocre BBS just to chat with her,
|
|
considering the expense of such long distance call , the
|
|
economic situation in Eastern Europe and a fact that
|
|
would learn later: Sara(h) Gordon has an account on the
|
|
Bulgarian DIGSYS unix server, locally accessible by phone
|
|
from there!
|
|
|
|
As it was expected, Sara(h) quickly 'noticed' my personal
|
|
message to the dark avenger and replied to my questioning in
|
|
a public post in FIDONET, (I don't read FIDONET posts and she
|
|
knows I have no access to them!!!! )
|
|
She claimed that the dark avenger was fully aware of how much
|
|
money she made out of the VNI interviews and that she was in
|
|
touch with him, etc.etc.
|
|
|
|
Afterward, I questioned her again about the whole affair
|
|
and demanded a proof, or some sort of direct contact from the
|
|
dark avenger to my anonymous internet account.
|
|
|
|
Since this was the first time anyone had ever questioned the
|
|
validity of her relationship with the DA, she took this to
|
|
heart and shortly after, I received 3 short messages
|
|
originating from <dav@danbo.digsys.bg> an Internet connected
|
|
UNIX system in Bulgaria.
|
|
|
|
Here they are:
|
|
|
|
(Private, compromising parts are X'd out)
|
|
1st Message:
|
|
|
|
--------------------------------------------------------------------------------
|
|
-
|
|
From daemon@digsys.bg Wed Jul 14 19:07 EDT 1993
|
|
Received: from danbo.digsys.bg by XXXXXXXXXXXXXXXXXXXXXX; Wed, 14 Jul 93 19:07:3
|
|
4 -0400
|
|
Return-Path: <dav@danbo.digsys.bg>
|
|
Received: by XXXXXXXXXXXXXX (5.67/1.35)
|
|
id AA12850; Thu, 15 Jul 93 02:04:46 +0300
|
|
Message-Id: <9307142304.AA12850@XXXXXXXXXXXX>
|
|
To: XXXXXXX
|
|
From: dav@danbo.digsys.bg
|
|
Date: Wed, 14 Jul 93 23:41:36 +0300
|
|
Subject: No subject
|
|
Status: RO
|
|
|
|
|
|
kohntark-
|
|
|
|
i just talked to a friend of mine who said you dont like her user
|
|
log. why shouldnt i call her from bulgaria? i call whoever i want
|
|
to, and this is not your problem.
|
|
|
|
by the way, she sent me your mail. for your information, i do
|
|
know how much money she made of that interview. and i also think
|
|
that this is none of your business.
|
|
|
|
also, maybe it would be good for you to know, that by offending
|
|
her, you are offending me, too. keep this in mind.
|
|
|
|
<dav>
|
|
Second Message:
|
|
-------------------------------------------------------------------------
|
|
|
|
|
|
>My mail with her is none of your business either.
|
|
|
|
i dont think so, dude.
|
|
|
|
|
|
maybe you need to read the next few lines again,
|
|
in case you missed them.
|
|
|
|
|
|
>>
|
|
>> also, maybe it would be good for you to know, that by offending
|
|
>> her, you are offending me, too. keep this in mind.
|
|
>>
|
|
>> <dav>
|
|
>
|
|
>HA HA! and you expect me to believe that you are the DA!
|
|
>send me a proof: an email address from bulgaria or tell me
|
|
>how many addressing modes does the MTE have?
|
|
>
|
|
>nice try.
|
|
|
|
|
|
well, what do you think the domain .bg in my email address stands for?
|
|
maybe you think its kameroon?
|
|
as for the mte, im not giving you any info.
|
|
|
|
i need not prove anything to anybody, and certainly dont plan to waste more
|
|
of my time talking to you. you have been warned.
|
|
|
|
|
|
<dav>
|
|
|
|
Third Message:
|
|
-------------------------------------------------------------------------
|
|
|
|
oh, yeah. sure it did.
|
|
only you will not know where something else came from, when it knocks on your
|
|
door. i have nothing more to say.
|
|
|
|
-------------------------------------------------------------------------
|
|
|
|
|
|
In my ignorance, I blindly trusted the three cryptic replies
|
|
to be true, even thought whoever replied refused to give out
|
|
trivial information such as the number of addressing modes
|
|
for a 2 year old encryption engine (MTE) and spelled Cameroon
|
|
with a 'k' (Check out Sara Gordon's spelling of URUGUAY in
|
|
VIRUS-L Volume 6 Issue 120 -v06i120)
|
|
Shortly after other unrelated discussions and a CUD post from
|
|
Sara(h) in which I was mentioned (unnamed), someone warned me
|
|
of several posts in NUKENET by an alleged dark avenger and
|
|
Todor Todorov from an account belonging to the last,
|
|
mentioning me and Aristotle.
|
|
In those messages I was referred to as 'hotshot,' a word that
|
|
Sara Gordon had used on me several times on our personal
|
|
email exchange; It was then that I became highly suspicious
|
|
of the whole matter.
|
|
|
|
I called Virginia's Virus Research Institute's sysop and
|
|
owner, Aristotle to find out more about the posts and he
|
|
bought to my attention the particular writing style of
|
|
Sara(h) Gordon: She NEVER uses capital letters and
|
|
apostrophes on her personal email, and always signs her name
|
|
on the lower left hand corner. (She seldom signs her posts
|
|
nowadays and changes her user name in her vfr@netcom.com
|
|
account every week!; for further proof of her writing style,
|
|
please refer to public posts in VIRUS-L Volume 6 #120; I also
|
|
have over 100K of personal email exchange to prove this
|
|
fact!)
|
|
|
|
It was then that we realized that she was passing herself as
|
|
Todor Todorov and the dark avenger (who could possibly verify
|
|
their online identity?) and had infiltrated NUKENET..
|
|
|
|
The writing style described corresponds exactly to the one on
|
|
the posts I received from the 'dark avenger.'
|
|
Shortly afterward the <dav@danbo.digsys.bg> account was
|
|
cancelled and I learned the whole truth:
|
|
|
|
The danbo.digsys.bg Bulgarian site belongs to Daniel Kalchev,
|
|
another self appointed AV researcher whose best claims to
|
|
fame are submitting various Bulgarian viruses to Patricia
|
|
Hoffman's VSUM!!
|
|
(You can check this by doing a search on 'Kalchev' on the
|
|
current VSUMs or you can contact him thru:
|
|
<daniel@danbo.sigsys.bg> )
|
|
He is a very close friend of Sara(h) Gordon and he has an
|
|
account in her VFR BBS (you can check this by logging into
|
|
her system and checking the user list) and SHE has an
|
|
account in digsys.bg under <sarah@danbo.digsys.bg> (this
|
|
account is still valid as far as I know; notice the H after
|
|
her name!)
|
|
|
|
What I concluded is that is the DA would never get an account
|
|
in such system as he HATES Daniel Kalchev!!!!
|
|
|
|
This is what really happened: Sara(h) Gordon in her
|
|
desperation to prove that she was in touch with the dark
|
|
avenger, told her pal Daniel Kalchev to make an account under
|
|
the dark avenger's name (<dav> this is how she always refers
|
|
to him, even though he never signs his name that way (check
|
|
the source code for his 'Dark Avenger' virus or the
|
|
'Commander Bomber' virus message name: [DAME])
|
|
From there she could email me messages that would come from
|
|
Bulgaria and would be untraceable since she would log into
|
|
her account in digsys.bg and log into the <dav> account
|
|
internally from the same site in Bulgaria. (You can check
|
|
where and when most of the people log from in most internet
|
|
unix and vax sites)
|
|
|
|
As it is expected from her, she has denied any of this.
|
|
Some of her ridiculous explanations include things like
|
|
"hotshot is a very common English word in Bulgaria" !!!
|
|
|
|
You might ask yourself what is the deal with the h? is it
|
|
sara or sarah??
|
|
Well, I asked her the same question when I noticed this in
|
|
one of the VNI interviews, where her name is spelled as
|
|
Sarah.
|
|
She replied that this was a mistake of the publisher.
|
|
Mistake? well not really, it was another lie, meant to throw
|
|
off any information and truth seekers, for example you can
|
|
check her account in Daniel Kalchev's system:
|
|
<saraH@danbo.digsys.bg> , spelled with an H,
|
|
another 'mistake of the publisher?'
|
|
:)
|
|
|
|
Other countless Sara Gordon lies are told in NUKE Info-
|
|
Journal # 6.
|
|
|
|
This behavior puts in question the validity of the VNI
|
|
interviews and the reputation of Sara(h) Gordon as a serious
|
|
(self appointed) 'virus researcher'
|
|
|
|
IMHO the VNI interviews are a complete fabrication, meant
|
|
only to boost her validity as a 'journalist', and to make her
|
|
lots of money, charging for further 'interviews' to other
|
|
magazines. (She has offered her paid 'interviewing' services
|
|
to various other publications.)
|
|
|
|
To the best of my knowledge the information I present here
|
|
is true and can be checked.
|
|
I chose to publish this information, despite threats against
|
|
my well being and countless lies about me propagated by
|
|
Sara(h) Gordon.
|
|
I am doing this to stop the lies and corruption fostered by
|
|
the Anti-Virus industry.
|