********************************************** Interview with JPanic by hh86 and SPTH ********************************************** JPanic is a viruswriter who started his career in the 1990. He was member of VLAD and Immortal Riot, two legendary virus-writing groups from the early times :) In the late 1990s he went to sleep. He woke up now, and has already showed his skill by creating a fantastic crossinfector for Windows, Linux and MacOS. More to come... You can reach him via jpanic.vx@gmail.com. The interview was done in two sessions via email in September/October 2013. Have fun :) ############################## ## Hey JPanic! Thanks alot for agreeing to talk with us. First - could you ## please describe yourself a bit. Where are you from, how old are you, what ## are your hobbies, what’s your favorite music and your favorite movies? Ok. I am JPanic (J-K-Panic, J-FUQING-PANIC), who likes to be called 'Panic'. I am a programmer and on-and-off-again virus writer from Australia. I was born 1979. My hobbies are limited: Programming, viruses, bible study, and some reading of prose/poetry. I am very interested in all things mental health related. I am also very interested in the old world cultures.. Egypt, sumarians, Mayans, Incas, Hindus etc. I love all things God. I like "body art" but have not had any tattoos done for a while now. Favorite novels include "The Bell Jar" by Sylvia Plath, "1984" by George Orwell. Favorite movies include "Fortress" - an Australian movies mad 1986 starring Rachael Ward - any one who wants to seed a high-quality rip of this movie contact me. "Leon: The Professional" - I wish I was Leon ;). Maybe "Ali G - In Da House" is my favourite comedy. Music Artists I listen to consistently include: Garbage, Front 242, Guns N Roses, Kirsty MacColl, Sonic Youth, Nirvana, The Church (Australian band) .N.W.A, Cypress Hill, Transvision Vamp, Pantera, Rollins Band + Black Flag. Hilltop Hoods are good too. All time favorite songs: Garbage - Queer: http://www.youtube.com/watch?v=EEHhBS0B3R0 Front 242 - Welcome To Paradise (Live Code Version): http://www.youtube.com/watch?v=YFMq40eM8EY Sepultura's cover of Motorheads "Orgasmatron" - http://www.youtube.com/watch?v=pUA42GzIOpE All time favorite music videos: Guns'N'Roses - Welcome To The Jungle: http://www.youtube.com/watch?v=o1tj2zJ2Wvg Guns'N'Roses - The Garden: http://www.youtube.com/watch?v=V2yomzLw62I Sonic Youth - Dirty Boots: http://www.youtube.com/watch?v=7XdYnh729IQ Sonic Youth - 100%: http://www.youtube.com/watch?v=N3gN9Up6hmc Garbage - Sex Is Not The Enemy: http://www.youtube.com/watch?v=drwKU72Ikzg Pantera "Vulgar Display of Power" is an album everybody should listen to once in their life time. ############################## ## How does a usual day in your life look like? Ha! I wish you hadn't asked me this. I have some health problems. I have not worked as a professional coder for a long time. I mainly leave the home for medical appointments only and to see family once a week or so. I can not sit at a monitor/screen for more than 2 or 3 hours without building up to seizure, so I do not code much per day. I drink too much and chain smoke. ############################## ## You have used several aliases - like Sepultura or now JPanic. Can you tell ## us why you changed your handle, and what they mean? I do not know why I change aliases - maybe when I change aliases it is because the new handle reflects me more accurately at that time. I would like the name "persona non grata" - a legal term in Latin for "an unwelcome person", but this name is taken by a member of "TridenT" (early 1990s Netherlands VX group). I started with "Sepultura" in 1993.. I liked the band, but I liked the meaning of the word - "some one who puts in the grave". From 1997 to 1998 I used the name "The Soul Manager" on 3 viruses. This comes from the Front 242 song "Soul Manager" (see http://www.youtube.com/watch?v= LcU2sV7i3mQ). Now I am using 'JPanic' - This comes from the short story by Sylvia Plath " Johnny Panic and The Bible Of Dreams". I do not like the story that much, but the name seems apt. ############################## ## When did you for the first time heard about the possibility of self- ## replicating computer codes? What did you think about that? 1992 - MtE came out, there was the "Michaelangelo" scare. There was also an interview with The Unforgiven (head of Immortal Riot) in a local magazine. This is when I became fascinated with computer viruses. ############################## ## Why did you decide to code a virus yourself? What was the story behind ## that? Did you had alot of source codes to study? I started writing computer viruses in 1993 because I looked up to the virus writers that I read about - like they were rock stars. The documentation from the MS-DOS anti-virus "F-Prot" mentioned that viruses were written in assembler. I got a book "DOS: The Complete Reference" by Kris Jamsa from the local library. This taught me some assembler code and DOS internals. I did not have a modem or know any programmers at the time, so I had no tools or access to viruses. I had to write and disassemble code in MS-DOS 'debug.com'. Like other virus writers, I also got into virus-writing for the sex and the money that comes with being a VX'er :P. I did not have any source code to study, but I had samples of three viruses I found in the wild (trading warez with school friends). These were 'Stoned' (I do not know what strain), 'Michaelangelo' (Stoned.March6), and Slow.1721 (An encrypted 'Jerusalem' variant that was common in Australia at the time). ############################## ## Can you please tell us about some viruses that you have been written in the ## past, and what they did? I will list the first two, and some that were less trivial (they are mainly stone aged MS-DOS viruses). Sepultura Boot - My first virus in 1993, a boot sector virus similar to Stoned written in MS-DOS DEBUG. This escaped and became quite widespread in my city for a while. There is a '.b' strain - the same virus but ported to A86 assembler, published in VLAD#5. Resvir1 - (aka Disillu.341) My first file infector written in 1993, also in MS-DOS DEBUG. A memory-resident MS-DOS .COM file prepender. Disillusionist - (aka Disillu.1108). An encrypted, tunnelling, fast infecting prepender of MS-DOS .COM files in 1994, with an activation routine. H8YourNMEs - (aka H8.1171) - 1994, Similar to Disillusionist but without encryption and with size-stealth and some other added functionality. My first virus published (in VLAD#5) 2FU (Too Fucked Up) - A 199 byte full stealth infector of the MBR and all floppy formats, written 1995 and published in IR#7. Chaos-AD - Used my first poly engine TCE (The Chaos Engine). Not the best written virus, some sloppy code. Full stealth (disinfect on open), polymorphic, retro (anti-anti-virus) fast infector of MS-DOS .COM/.EXE files. Had some interesting features and anti-tunnelling code. Written 1995 and published in IR#7. TotalTrash.2169 - One of my favorite of my own viruses. Full stealth (read-on- the-fly stealth) and mirror infector of MS-DOS .EXE files. Had some retro and anti-heuristic code. By "mirror" I mean when certain programs were running the viruses modified findfirst/next, read, and lseek calls to make clean files look uninfected - without ever writing to disk. You could PKZIP or RAR a file from a write-protected floppy for example and the copy in the archive would be infected. Inspired by Mirror.4130 by Bit Addict/TridenT, Kaspersky got his description of this virus wrong. Written 1996, published in IR#7. Win16.RedTeam - Written 1997. My other favorite of my own viruses, perhaps the one that got the most press/media attention. The first Windows email infector, infecting NE (Win16) files and the Win16 kernel as well as the 'Eudora' outbox. Used very reliable infection techniques. The ".a" strain had a bug ( one-letter typo :/) that was fixed in the .b strain. This bug affected the virus under Win32 OS's like NT and 9x/ME. Published in SGWW Infected Voice. CSV (C Startup Virus) aka TSM.5536 - Written 1998. This viruses tricked AV scanners of the time by making them think infected files were Borland Turbo C executables and skipping them. The virus started with standard Turbo C code, with polymorphic routine in 'main' function. Kaspersky got his description wrong - the virus was written in ASM to like like a Turbo C compiled binary, but he wrote it was written in C using inline ASM. A polymorphic memory- resident fast infector of MS-DOS .EXE files. Most of the 5536 bytes were taken by Turbo C start/library code. RTP (RedTeam Polymorphy) - An overly large but complex and effective (for its day) polymorph - See "SoulManager.4838". Published in iKx Xine Issue 3. CAPZLOQ TEKNIQ 1.0 (CLT10) - A small cross-platform Win32/Linux infector written 2006. This virus would be trivial except for its cross-platform ability. I was happy with the size - 1.2k for a Win32/Linux PE/ELF infector. Published in rRlf#7. CAPZLOQ TEKNIQ 2.0 (CLT20, Clapzok) - An advanced version of CLT10 above written 2013. i386 OSX FAT/MACHO support was added along with some other features. Published in Valhalla Issue 4. ############################## ## What do you think about polymorphism? Especially, in your interview in 1999 ## in asterix#1-zine, you said "Traditional polymorphism (with a static virus ## wrapped in a highly variable decryptor) is a dying concept in my opinion. ## With the advent of generic decryption, polymorphism is not really much of a ## threat to the scanners any more." Do you still think that’s true? :) Not as true. Of course, poly engines have to be smarter now to dodge heuristics and such. EPO technology makes a difference. Who knows if virus writers will ever run out of EPO ideas? There are more platforms and architectures - as polymorphic viruse come out for them the AV will have to update and extend their emulators. There are more known anti-emulator tricks now. Ofcourse besides emulation there are other methods such as cryptanalysis (not that useful now), statistical analysis and geometric analysis of the file. ############################## ## You have been an active virus writer in the 1990s. Can you tell us about ## something about the spirit and the people from that time? How many active ## people were around these days? I can think of about 30 virus writers at least that were around in those days. Virus writing culture was flourishing I thought the spirit of the scene was good in those days, lots of people writing viruses and talking to each other sharing ideas. Now I have changed my mind. I think they were not good times. People were judged on social status, not code. If you were a great coder, but from the wrong country or not in an 'elite' group, you were put down - even by lesser coders. There was back-stabbing as well. people ripping other coders off, for "fame". ############################## ## You have been member of VLAD and member+organiser of Immortal Riot. Can you ## tell us something about the groups in the 1990s? How did you communicate, ## did you plan projects together etc? I was only a member of VLAD for a week (:P). The rule was *all* members had to vote you in, but one was on holiday - when he returned he objected. I never had much respect for this persons technical abilities anyway. Immortal Riot became "Immortal Riot/Genesis" soon after I joined - Genesis was a new, but talented VX group. Maybe Immortal Riot had the looks and Genesis had the brains. Communication was pretty much by IRC and e-mail. There was not much planning of projects together, a little bit but not much. The majority of viruses were by a single author. There was more collaboration on the Zines than the viruses. There were some 'closed' circle for sharing of ideas. Groups in the 1990s included: Phalcon/SKISM, NuKe, TridenT (great coders from the Netherlands), Immortal Riot, VLAD, iKx (international Knowledge exchange), SGWW (Russian/Ukrainian Stealth Group World Wide), SVL (Slovakian Virus Labs), TPVO (Taiwanese Power Virus Organisation), SLAM. There were groups that called themselves virus writers that didn't do much like ARCV. 29A started in the latter half of the 90s. ############################## ## Have you ever met other virus writers in person? I have met 'DV8', the author of Win95.MrKlunky - the first memory resident Win95 virus, and some other viruses. But only once. ############################## ## Are you involved in some other computer-security projects, such as hacking? I am not involved in hacking. In the 90's when I could not get legitimate internet access, I used such things as 'carding', key loggers (which I wrote myself) and exploit scripts to get access. But that’s about it. I could once dial out on certain types of payphones and ride the bus for free (problems with our public transport ticketing system). I can not do these things now. I still sometimes crack my own warez. ############################## ## Can you tell something about the "Ruxcon 2012 CTF"? I read some funny ## Storyline: " JPanic, rumoured to herald from the trumpets of the digital ## gods, who incarnated this mythical beast to dominate the digital ## underground. Upon this immaculate conception he ruled over the 90s VX # ## Scene, sprinkling his magic, 16 bits at a time. [...]" (see ## http://exploit-exercises.com/mainsequence/storyline). :D Ok. Every year Chris (organiser of the conference), chooses a different Australian infosec person to be the centre of the CTF plot (I think it was 'andrewg' of The Feline Menace the year before - 2011). 2012 Chris suggested me and I was happy with that. Some different ideas were pitched, and I suggest me writing a super-virus and my cat 'Thomas' betraying me and trying to leak the source to Buo. That is how Buo entered the story, but the cat wasn't used. Chris is the one who wrote the story. Just FYI - 'Buo' is my favourite malware analyst. If you want to know why Buo - "You wouldn't understand" ;). ############################## ## Did you have contact with people from the anti-virus scene? If so, how was ## that? I had some contact with certain AV'ers in the old days. It is a great feeling when you point out a flaw in their product and they compliment you for it. It is also a great story when they do a great analysis of one of your works. ############################## ## After Insane Reality#8, you seemed to disappear (except on an internet in ## 1998 or 1999 for asterix#1). What was the reason? Why did you leave? The interview for asterix#1 was in 1996 - I was still using the handle 'Sepultura'. Things went wrong in my life around then - physical and mental illness, narcotics abuse, periods of detention, homelessness. That is why I had to drop out of the "scene", I was in no position to be coding. Anyone who would like to disrespect me for these things or hold them against me... feel free. ############################## ## You released an awesome multiplatform infector (CAPZLOQ) in rRlf#7 in 2006. ## Did anybody recognised that you are the coder from the 1990s? CAPZLOQ TEKNIQ 1.0 was hardly awesome. I wrote it because I thought I would not write another virus again. I am sure people recognised I am the coder from the 1990s because the text strings said so. I suspect certain AV'ers only published analysis of it because they remembered me. ############################## ## In 2013 you came back - what made you come back? Or didn’t you ever leave ## but just coded very very slowly? :-) I did leave. I do code slowly now, but not *that* slowly. Some things have improved in my life, so I can code; but my brain is rotting. For this reason I decided to make use of my brain while I still can. That is why I have returned. I do not know how long for. ############################## ## Your CAPSLOQ v2 in 2013 (source released in this magazine Valhalla#4) got ## quite some attention. There have been reversed codes and description in ## VirusBulletin. What did you think about it? Did you expect that? I expected some attention because a Win32/Linux/OSX infector (albeit limited) opens the door for more cross-platform malware. I did not expect that much attention, especially from the OSX corners of the world - there was already Roy G Biv's 'macho man'. ############################## ## CAPSLOQ is able to infect binaries on/for windows, linux and MacOS. It uses ## a very special and unique design. Can you explain the idea briefly. What is ## the difference to other multi-platform infectors? There is an article in Valhalla 4 describing the technique. Personally I do not see the big deal about it.. It is something coders have been doing for a long time. Basically all calls to the operating system (whether Win32, Linux or OSX) have a standard interface, as do the routines to infect the different file formats. This eliminated repetition of code for different OS's and binary formats, making things smaller. I guess the difference from most (but not all) cross-patform infectors is the lack of repeated code. It is not a virus for operating system 'A' and the same virus for operating system 'B' re-written and bundled together. ############################## ## Did you still have contact to VXers over all the years? Did you follow ## VX-news? I am not in contact with the old virus writers, but a couple of AV'ers. I have not really kept up with the virus/malware related news much. I try to be in contact with the current breed of virus writers. ############################## ## What are your favorite viruses of all the time and why? I am a 16-bit man living in a 64-bit world, but I will try and list more modern viruses first: SQL.Slammer, IIS.CodeRed, Conficker family: These spread far and wide. In my opinion remote code execution vulnerabilities are the way to mass-propogate these days (if you can get your hands on one). MetaPHOR family by Mental Driller - Excellent metamorphy, clean efficient code. Strain '.1d' added linux support too. EfishNC family and ACDC by Roy G Biv: EfishNC really was efficient as the name said, fitting a huge amount of functionality in to a small amount of code. As for ACDC.. I am not into script viruses, but I think a cross-platform VBScript and JScript virus is a great idea in this day and age. Mistfall/ZCME/RPME/SETG/KME engines by Z0mbie. Great engines. I think Win32.Crypto and Happy99 were great. As for older viruses.. I love Neurobashers work. He was ahead of his times, and seem to be the only person who really reverse engineered all the AV products of the time to find ways to bypass them. Tremor (1992) was the first virus to be both polymorphic and full-stealth (plus a bunch of new tricks), and all his viruses were common in the wild. His viruses were: Tremor, Alphastrike, Neuroquilla (Havoc) and the Nightfall (n8fall) family. Dark Avenger: The 'Eddie' family laid down the ground work for the classic DOS virus. Most MS-DOS viruses used engineering introduced in this family. MtE and Commander Bomber had very complex yet optimised code. Phoenix family was interesting for a lot of reasons. Their encryption engines generated 204 decryptors from a tiny engine. DIR-II: A new paradigm in viruses: modifying the directory entry, not the file. Very stealthy, spreading amazingly quickly. Dark Slayer: DSME and DSCE engines - DSCE introduced some new idea. I really like the 'DS' (Dark Slayer) family, DOS16/Win16 full-stealth MBR/Boot Sector/ MZ/NE (Win16)/EXE (MZ) in 3.5k. Q the Misanthropist was good, especially 'Goldbug'. Zhengxi, Nutcracker family, SSR, MAD were great. I wish Zhengxi didn't use 'single stepping' (INT 01h) to find the DOS kernel - it is its weak spot. 'Natas' by Priest was good. ############################## ## What do you think are the most influential techniques that have ever been ## developed for self-replicators? Polymorphy and polymorphic engines. Stealth in the MS-DOS days. Residency as opposed to direct action. More and more attempts at EPO methods. Internet worms: first email worms, than others such as SQL.Slammer and IIS.CodeRed. Macro viruses that made the move away from just binary infectors, so we have script viruses and such now. Metamorphy is considered a big thing - but not many viruses have done it, in the scheme of things. ############################## ## What do you think about code optimisation? Do/did you use it alot in your ## codes? I think code optimisation is a good thing and a good skill to have - but not the most important feature of a virus. I consider features and reliability (no bugs) more important. I think the best optimisation comes when you can write optimal code as you go along, not writing code than optimising when you are done. I got good at writing optimised code, but have been out of the game. I find x64 code especially hard to optimise, because I am not used to it. ############################## ## What do you think about machinal learning in self-replicators? How could ## that work - any wild guess? What would be worth to learn for a self- ## replicator? I do not know about these things. All I can think is that for a replicator to "learn" about a new OS, it has to be able to run under that OS first anyway. Catch 22. If you want to analyse glibc you have to be able to open glibc in the first place, etc. ############################## ## How would you imagine the most fantastic digital self-replicator? Be ## creative! (Bonus question: What is missing to get that done? Would it be ## possible some day?) I would like to see a self-replicator become pandemic using remote exploits for multiple OS's. Maybe a metamorphic virus that spreads quickly but can infect many different file formats and rebuild itself not just for many OS's but many architectures (x86,x64,ARM,IA-64 etc). Able to work with any combination of executable format, OS and architecture. More infection methods and EPO methods than you can pull out of a hat, maybe code integrating ZMist style. Able to infect every platform under the sun. Active over the local network on all platforms and maybe the internet via email attachments, network shares, etc. Back- dooring the infected machine. MBR or BIOS infecting, loading before AV programs to disable them. ############################## ## What were the most surprising self-replicators that you have ever seen? ## Which techniques made you think "crazy shit this is"? :) MtE amazed me at the time. The code of Bomber did too. One-half by Vyvojar and "Tremor" and "Neuroquilla" by Neurobasher. Tequilla and Gingerbread Man. Ply. Dark Paranoid, Stainless Steel Rat (SSR). Happy 99 and the word macro "Concept". MetaPHOR, ZMist (Mistfall engine), Lexotan, Z0mbies plugin project virus. Definately Hybris. Win95.SK, Inca. EfishNC amazed me for its feature to size "ratio". CyberGOD's "Tracer" engine. Definitely IIS.CodeRed. ############################## ## Do you know the work of academic researchers such as Eric Filiol and Mark ## Stamp, and what do you think about that? I do not know anything of their work. My interest is 95% in 'real world' viruses. ############################## ## What are future projects that you want to work on? More complex Linux and OSX viruses than we have seen so far. More x64 infectors. Worms using remote code execution vulnerabilities. Escalation of Privilege exploits (I find it hard to get my hands on these last 2). Kernel mode viruses. More and better multi-platform viruses. ############################## ## Now let's be creative and and think about the future: How would self- ## replicators look like in 5 years from now? What about 15 years? And what’s ## your long-term prognosis for the self-replicators in 50years? 5-years: More viruses and worms using remote execution exploits to spread rapidly around the net, and escalation of privileges to have more access to resources. Hardware infectors - we already have 'BIOS kits', now we have BIOS kits that can survive a BIOS update and people working on hard drive firmware infection that can survive an Operating System re-install. See https://ruxconbreakpoint. com/speakers/#John%20Butterworth, https://ruxconbreakpoint.com/speakers/# Jeroen%20Domburg and http://spritesmods.com/?art=hddhack More multi-platform and multi-architecture malware. Multi-platform libraries to facilitate development of multi-platform malware. More and more file formats infected, more script viruses. Viruses running in kernel mode on different OS's. Rootkit like technology that used to be called 'stealth in VX terms' - hiding the viruses presence. Viruses/Worms for portable devices such as Android, iOS and Windows. Viruses/Worms facilitating data theft, cyber-espionage and so on. More clever use of crypto. 15-years, 50-years: I have no idea. God knows what computing will look like than. ############################## ## Imagine a good ghost offered you three wishes - what would it be? :-) WISH NUMBER ONE: I would like to be a more friendly, helpful, Godly person reducing peoples suffering. WISH NUMBER TWO: I would like to be of good health. WISH NUMBER THREE: I would like the following people destroyed: 1) Nations who's media makes the people hate every person and every society different from theirs. Creating massive social-cleavage, poverty, crime and drug problems to control their people. Carrying on about how bad other governments are while their own government takes what their own government wants. Nations with the most wealth and power, with the least educated people and the least accountability for their actions. This means you 'America' - a nation that usurped the name of an entire continent. 2) People who traffic people for slavery, sexual exploitation, war and child soldiers. 3) Drug Dealers - They sell the seeds of misery. 4) Everyone from judges and doctors to paedophiles and criminals and abusive care takers who prey on the most vulnerable, least able people. 5) The false 'Church' saying they are men of God, but are really small, pathetic evil people. They turn people away from the light by lying about God. 6) Anyone who wants to blow themselves up with other people in the name of God - This is not what God wants: you will not get your 7, 70, 77 or 777 virgins. Maybe I should forget this last wish and just wish for a happy world without suffering. OF COURSE - I would not make any wishes at all.. They always come with a catch. Try prayer instead. ############################## ## Thanks alot for the interview - feel free to use the rest of the file for ## whatever you like! I would like to send warm regards to the following people (alphabetical order): The Australian infosec "scene" - Going on, feeling strong. Virus Writers I have had recent contact with: Herm1t, hh86, SPTH. Life Long AV'ers: Vesselin Bontchev, Igor Daniloff, Paul Ducklin, Peter Ferrie, Mikko 'Hermanni' Hypponen, Eugene Kaspersky, Stefan Kurtzhals, Fridrik Skulason, Peter Szor. You are more than worthy adversaries - you are my superiors. Ilfak Guilfanov - Creator of Interactive Disassembler (IDA) Pro. Groups I have been a member of: IR/G, NOP, Team MiSSiON.