Interview with VirusBuster about 29A by hh86 and SPTH This is an interview with VirusBuster mainly about 29A, done in August 2012. VirusBuster, a former virus-collector from spain, was a member of 29A since the first hour. In addition he was editor of the 29A magazine from issue #5 to the last issue #8. You can reach him via malware.collector@gmail.com. Thanks alot goes to SlageHammer and VirusTrader who helped us to find VirusBuster! ############################## ## Hello VirusBuster! Thanks alot for accepting to answer a few questions! I'm ## looking forward :-) First could you please give a small introduction to ## yourself, for instance how do you spend your free-time/hobbies, what kind of ## music do you listen to, ...? My main hobby used to be virus and malware collecting but I got retired in january of this year because I had so much stuff that managing properly the collection was requiring too many resources in time and hardware terms. So after 17 years of collecting, I gave up. I have been developing a malware behavior analyzer for almost three years. The tool is named "Buster Sandbox Analyzer" and the official web can be reached at http://bsa.isoftware.nl I am married and have a son, so I spend part of my free-time with family. From time to time I visit friends or they visit me. Music: I love blues, specially Texas and Chicago styles. My favourite bluesman is Stevie Ray Vaughan and I like also people like B.B. King, Buddy Guy, Albert Collins, Albert King, Jimmy Thackery, Eric Clapton or Johnny Winter. I like cinema a lot, specially old movies. It is quite hard to find good movies nowadays. If you want quality you must watch TV shows like "The Sopranos", "The wire", "Rome", "Oz", "Game of thrones", "Dexter", "Mad men", etc. I like reading, specially epic fantasy. I like a lot Robert Jordan's "The wheel of time" and Steven Erikson's "Malazan book of the fallen" sagas. I used to play basketball with buddies but not anymore. Now I do some sport at gym two or three days per week. And that's how I spend my life when I'm not working. ############################## ## On Friday 13th, december of 1996, 29a#1 was released - and started path of ## this most famous virus writing group. You have been member from the first ## hour. Can you please explain how this group was founded? It consisted of 12 ## members, most of them from spain. Where those people already active in the ## scene before? Did you already work together in former projects? What was ## Dark Node? Most of my life I have been collecting something. When I was young I used to collect stamps with the help of my father. When I was a teenager I used to collect games, first for Amstrad CPC 464 and later for PC. Back in 1992 (if my memory doesn't fail), during my summer holidays, a cousin talked me about a guy from his town that was collecting games too. He arranged a meeting to talk about exchanging games. After the exchange he talked me about a strange hobby he had: virus collecting and modification. He told me he was using a few antivirus to identify the menaces and then using an hexadecimal editor to modify binaries and produce what he called "mutations". His technique was very rudimentary because he didn't know about opcodes and he ignored completely what effect had the changes over the code. He just was locating in what part of the code was placed the detection and then he was changing one byte to avoid it. If the binary continued to work after the change... good!, if not, he changed byte value or other byte. My previous experience with viruses was the typical: I had been infected a few times with "Ping-Pong" boot sector virus and with a file infector named "Flip" or "Omicron". Initially my reaction was like: what the hell are you doing handling viruses? Is not that really dangerous? After he explained his procedures to keep safe the computer while managing viruses, I got more interested and asked him his collection to play with it. After a while I was producing better mutations with the help of a disassembler named "Sourcerer". As I told, I have been a collector all my life, so I considered that collecting viruses was as good as collecting anything else. In that time in Spain we didn't have Internet at home, just BBSs. Inside Fidonet there was a channel named VIRUS.R34. I met other people interested in viruses there, sadly virus sharing, exchange or request became a forbidden question, so after talking with a few VIRUS.R34 members, my friend and me decided to put online our own BBS dedicated to viruses. We decided to name the BBS "Dark Node". It was 1994. The complete freedom to talk about virus writing, the big amount of material (sources, binaries, virus construction kits, virus magazines, ...) made "Dark Node" famous, even internationally. Very talented spanish coders joined the BBS and started to share ideas and code. Nobody had previous experience in the vx scene. One day Mister Sandman proposed to certain members of the BBS (the most talented and active) to create a virus magazine with the best ideas, articles and viruses shared in the BBS. We thought the idea was excellent so we started to collect and select the best stuff, write our own article viewer, etc. When we considered the magazine had enough quality to be released it went out. In that time (1996) some "Dark Node" members had access to Internet at home, so it was released over there. Initially "Dark Node" was just a BBS, but after a while it became a Fidonet style network, with several nodes. "Dark Node" was the node 66:666/1. When we had to choose a name for the magazine someone (Mister Sandman???) proposed 29A (it was not so obvious as 666) in reference to the network number and the "diabolic" stuff we were releasing. So that is how initially 29A was formed: a group of guys from all over Spain, without any previous experience in vx scene, interested in virus coding that used to meet in a BBS dedicated to viruses named "Dark Node". ############################## ## Most members of 29a that time (and also later) where from spain. Did you ## meet several of them in real life? Have there been 29a-real-life-meetings? Between 1994 and 1996 there were three "Dark Node" meetings. Mister Sandman, GriYo, Wintermute, Tcp, The Slug, Blade Runner, Gordon Shummway, Leugim San, Mr. White and me, among other people, were in one or more of the meetings. After 29A became an international group, we moved 29A meetings to Madrid. There were two meetings in Spain's capital and people like GriYo, Wintermute, Mister Sandman, AVV, Darkman, Reptile, Super, Mental Driller, Bumblebee, Tcp, b0z0 or StarZer0 from IKX assisted. There was also a meeting in The Netherlands being Rajaat the hoster, and other in Brno (.cz) where Benny and Ratter were the hosters. So yes, we had several real-life-vx-meetings and not only for 29A members but for people from other groups too. We even had some guests like Antonio Ropero and Bernardo Quintero from Hispasec and GriYo, Darkman and me bringed our girlfriends to some meetings. ############################## ## How did you manage the decision-making within the group? How did you chose ## new members? Other than membership applications, did you also send offers to ## good coders to join your team? How did you deside which articles and viruses ## appear in the 29a-magazines? There were kinda three stages in 29A. In the first stage Mister Sandman was the editor and the manager of the group. After 29A #1 release, he took over the group, decided to kick some members and bringed new international members. I was kicked out so I do not know much about how things used to work internally in those times. The first stage finished after two incidents: Mister Sandman was accused by b0z0 from IKX group of stealing a piece of code and using it in his multiplatform virus named "Esperanto". The other incident involves GriYo and Mister Sandman: Mister Sandman was very good at english (written and spoken) and GriYo was not so good in that time. When BBC (I'm not sure if this is correct but it doesn't matter) pretended to interview GriYo, he asked Mister Sandman to make the interview for him. Mister Sandman took over the interview and talked about his creations instead about GriYo's. When GriYo readed the interview he felt betrayed. After these incidents Mister Sandman left 29A and the vx scene. In the second stage Darkman becomes the new 29A editor. Even if I was not a virus writer the group asked me to re-join 29A because they considered it was not fair Mister Sandman kicked me out. I accepted. My role inside 29A was to sort and get new contributions for the magazine and also recruit talented virus coders. In that stage we used to manage decision-making by majority. New members had to be accepted by all members and they were being chosen based in their virus writing talent. Sometimes we received applications to join the group and others we asked people to join. Articles to be published followed similar rules. If most members agreeded to publish something, it was being published. The end of second stage at 29A becomes when I noticed the group was dying slowly. To accept new members we had rules, but we had none to kick inactive members. There was a moment when several members were not replying to 29A-mailing list and other were not producing anything to be published on next magazine. Darkman, the 29A editor, was one of them. I exposed the problem to the group and suggested to kick members due inactivity. My intention was good. I wanted idling members to wake up and start producing again. I even proposed that kicked members may rejoin the group at any moment if they had new material to publish. Darkman didn't like the idea (he was having personal problems in real-life) but rest of members accepted. When next 29A magazine was published, members like Darkman, Lord Julus or SoPinky (if I remember correctly) were kicked. The third and last 29A stage starts with me as new 29A editor. I proposed ideas to keep the group active and communicative, but the virus writer is an alone animal by nature and finally this is, among other factors, what killed 29A group. One anecdote will explain this very well: GriYo left 29A and nobody noticed it. No member got any notification about the quit and we were working for a while thinking GriYo was still a member. There are other reasons to explain why 29A disappeared: pressure against virus writers from govs, assembler becoming a lost art, old virus writers finishing the university career and starting to work, etc. ############################## ## How did the group change from the beginning in 1996 to the end in 2008? ## Where there a big number of people who wanted to join? I would say the main difference was that 29A started being a local (spanish) group and ended being an international group. After Immortal Riot and VLAD groups disappeared, most virus writers wanted to join 29A. Having the "/29A" in your nick was a signal of respect. ############################## ## 29a was a very famous viruswriting-project ever. This of course attracts ## much attentions, from media and from police. Can you tell what was the ## relationship between 29a and the media? And did you often get into troubles ## with police? In end of 2004, Ratter and Benny where questioned. Whale was ## sentenced. Do you have further informations about criminal investigations ## against your group? The relationship with the media was good. They used to send interviews to 29A members and members were glad to reply them. As far as I know only Benny got troubles with police, but I don't know much about that so I prefer to don't comment. If there was any criminal investigation against 29A, I never heard of it. I don't think there was any because one of the rules in 29A was to not spread our creations. ############################## ## How was your relationship to the anti virus community? What did you think ## when ex-members joined some AV company (such as Benny for instance)? In my opinion the anti virus community had a double face. Publicly they were trash talking 29A, but in private they enjoyed our releases. I would say that there are still people in av industry missing the golden years of vx scene. About virus writers joining AV companies: it was the natural thing and I always considered it fine. In fact there were several virus writers working for some AV company and being members of a virus writing group at the same time. People knew about it and nobody complained. ############################## ## On 1st january 2005 you released the last e-zine issue 29a#8 - just 9months ## after 29a#7. It was full of pioneering codes and ideas - such as the first ## virus for win64 (and even a win32/win64 cross-infector by roy g biv), the ## first worm for mobile phones with symbianOS (by ValleZ) and the first ## infector for Microsoft smart phones with WinCE (by Ratter). In the intro you ## even wrote "Probably 29A #8 is, along with 29A #3, the most technical virus ## magazine that any virus group released ever." - Now I can not understand why ## after such a successful release you where not able to create another ## magazine. What where the reasons? Did you start to collect stuff for 29a#9? As 29A editor, I did my best to keep the group alive, but every year was more difficult to do it. There was a total lack of communication between members. I requested tons of times to members to write to 29A-mailing list at least one time per month, commenting the state of their projects, future projects, etc. We were not receiving news from some members for long periods of time. I think people like Z0MBiE left the group because we were not a group anymore. A group needs communication and we didn't have it. One day I proposed to 29A members to kick GriYo due his inactivity. GriYo heard about this and then he told me he had left the group already some time before. It was the first news about that. This is a good example of the grade of communication we had internally. In that moment I felt upset I decided to leave 29A, but I didn't communicate it to the group (in fact the "group" was only ValleZ and me). I just wrote a note in my site commenting I was leaving 29A. Some time later I heard in #virus channel that GriYo and Slage Hammer were collecting stuff for next 29A release. I asked myself: who the fuck is Slage Hammer to be collecting contributions for 29A? And why is GriYo asking for contributions if he is not a 29A member anymore? I got so angry that decided to "rejoin" 29A. As I didn't communicate my leaving at 29A-mailing list, oficially I was still being a 29A member. I had a talk with ValleZ and explained what was going on. ValleZ didn't know GriYo had left 29A so he agreeded with me that was not correct what GriYo and Slage Hammer were doing. We decided to stop GriYo on his tracks. GriYo had a private talk with ValleZ (don't know what they talked) but as result of the talk ValleZ decided to leave 29A and stop talking to me. I guess he was in the group to write viruses, not to get involved in internal battles. GriYo was always a talented coder but his social skills inside 29A group were not so good. Bumblebee (one of the few friends I still keep from vx scene times) left 29A due GriYo's attitude. After ValleZ's quit, I was the only active member. In that moment I considered the vx scene didn't have the talent required to keep alive a group like 29A so I decided that was the end of 29A. I considered it was fair because 29A was born in "Dark Node", the BBS I created, so I was like the alpha and the omega of the group. If I was able to get back to the past I would not change anything of what I did. ############################## ## On 28th February 2008, you said "that 29A goes officially retired". What was ## your feeling at that moment when you had officially to close this awesome ## and well-known project? Years later, do you think there might have been a ## way to save the group? Obviously I was sad, but I knew since some time ago that vx scene was dying and 29A would have to split up some day and that it would happen sooner than later. No, I don't think it was possible to save the group. Nothing last forever and you must know when to give up. ############################## ## What did you do after the retirement of 29a? Do you still have contact to ## some of the old viruswriters? Did you continue trading? Are you still ## interested in virus technology? I continued trading for years (until january 2012) but I lost contact with old viruswriters but Bumblebee. After 29A disappeared I never exchanged a mail with old buddies like Z0MBiE, Vecna, Wintermute, b0z0, StarZer0, ... Our common interest was the vx scene. When this interest disappeared, I guess we didn't have any reason to continue the relationship. Virus technology is dead. Nowadays rootkit and browser vulnerabilities rule the security world. I continue interested in security technology. As I commented I have been writing a malware behavior analyzer for last years.