Welcome, John Powers.

[jpowers@uiu-raven ~]# whisper show scpf-cthompson:/scp/4406

Connecting to scpf-cthompson…

Connected.

SCP-4406: SUDDEN THUNDER

Authors: aismallard and pxdnbluesoul

Image Credit: Created by pxdnbluesoul, freely released into the public domain.

For Collab-Con 2019:

FBI Unusual Incidents Unit & Pentagram

NOTICE FROM THE FOUNDATION RECORDS AND INFORMATION SECURITY ADMINISTRATION

You are viewing this file in discussion mode. Proposed edits, notes, commentary, or section information will be visible in the article. For more information about viewing modes, please contact your RAISA liaison.

Item #: SCP-4406
Level 3/4406

Object Class: Keter Neutralized
Classified

Unrolled main loop of SCP-4406 for the x86_64 architecture. Note presence of _P5GMPUB3 call in green.

Special Containment Procedures: An inert copy of SCP-4406 is kept on a standard issue field laptop in a TEMPEST-certified1 vault at Site-11. Foundation computers exhibiting symptoms listed in Document 4406-3L are to be checked by I/O-TORNADO for SCP-4406 contamination.

Archived Description: SCP-4406 is highly advanced surveillance software, which masks itself from the host operating system by means of an electronic antimeme. Unlike most catalogued antimemetic objects, this effect is not known to impact sapient perception: the anomaly only renders itself invisible to any computer system relaying information about it. SCP-4406 achieves this by manipulating CPU pipelines to prevent execution of code which would indicate its existence to automated systems. This concealment strategy is similar to that of non-anomalous rootkits.2 Experimental semantic analysis techniques have proven useful in study of the anomaly despite its computation-inhibiting properties (see Addendum 4406-1).

It is believed that SCP-4406 is authored and maintained by GoI-616 ("Pentagram"). Reverted. Please refrain from speculation. -C. Thompson

Data gathered by TEMPEST-warded machines indicates that SCP-4406 communicates via UDP port 45666 to addresses in the 134.11.0.0/16 range, an address space owned by the Department of Defense. Reverted. Logs of network activity do not match this claim. -C. Thompson

It is not known how SCP-4406 receives directives or from whom; the current hypothesis is that it utilizes some form of thaumaturgic remote communication to an unknown party. Approved. -C. Thompson

Current Description: SCP-4406 was experimental antivirus software developed by GoI-616 ("Pentagram")3 for the purpose of detecting both anomalous and mundane malware on US military computers. Due to a programming error, SCP-4406 escaped its internal network and installed itself on over ███████████ devices worldwide. Though harmless, the antimemetic nature of the antivirus made identification of the software difficult, however cooperation with the FBI's Unusual Incidents Unit led to the development of an effective uninstaller.

No further action is needed at this time. Approved. -C. Thompson

NOTE: This section has been locked. Modifications to the description require manual approval by Lead Researcher Thompson.

Addendum 4406-1: Discovery

On 2018/02/11, hardware built for Project SUDDEN THUNDER4 reported a significant number of semantic transitions5 occurring on a RAISA █████ computing cluster in Site-11. A technical audit revealed inconsistencies between automated diagnostics and manual calculations. Furthermore, when information about the discrepancy was introduced to an infected computer, the unusual behavior could no longer be detected.

Controlled thaumaturgic execution failed to fully isolate the payload, but static analysis led to the discovery of the referenced function "_P5GMPUB3", which returned a public key value linked to Pentagram. Following this discovery, all additional experimentation was conducted in a thaumaturgically-warded TEMPEST-certified chamber.

During secondary replication testing, SCP-4406 was determined to be a rootkit operating at Ring -2. Reverted. This level of access is normal for antivirus software. Please stop pushing this false narrative. It is not a rootkit. -C. Thompson

During secondary replication testing, weak ontologically-negative emissions were detected from affected devices. A test within a Type 1 hypervisor revealed that SCP-4406 was capable of gaining Ring -2 access,6 enabling it to escape virtualized or otherwise sandboxed environments. Once installed on the system, it would use its abilities to antimemetically cloak itself from other computer processes, as well as deliberately execute invalid CPU instructions to perform ad hoc thaumic invocations. These messages were then encrypted with the aforementioned public key.

The contents and intended destination(s) of these broadcasts is unknown, but are presumed to be requests for updated antivirus signatures. Approved. -C. Thompson

NOTE: This section has been locked. Modifications to this addendum require manual approval by Lead Researcher Thompson.

Addendum 4406-2: Communications with the US Government

After the discovery of potential Pentagram involvement, strategy for containment of the anomaly was debated. Eventually it was decided that the Unusual Incidents Unit should be contacted to both alert federal authorities to the breach and maintain the veil. Lead Researcher Thompson reached out to a designated contact on 2018/02/14.

The government confirmed the existence of SCP-4406, but resisted requests for technical information on the anomaly's capabilities or design. Talks on the terms of mutual containment were solidified on 2018/03/07: The UIU would, under the supervision of the Foundation, develop a counter-ontological agent to neutralize all SCP-4406 instances.7 Pentagram would provide any needed help and support for the effort, and would also be responsible for any further clean-up should the anomaly be discovered again. A representative from Pentagram has delivered an official apology on behalf of the organization.

Lead Researcher Thompson was seen leaving a Washington, DC area strip club the same night. Reverted. This is an outrageous breach of privacy, and is not relevant to the anomaly. I will not hesitate to reach out to HR if conspiracy theorists continue to have me tailed. -C. Thompson

The source code for the uninstallation agent was delivered to the Foundation and repurposed as I/O-TORNADO.

NOTE: This section has been locked. Modifications to this addendum require manual approval by Lead Researcher Thompson.

Addendum 4406-3: Incident 4406-1

On 2018/03/10, a wide semantic shift was detected across all Foundation electro-ontology sensors for over six hours. Unusual Incidents Unit contact John Powers confirmed this corresponded to the agency's clean-up efforts. Both automated and human testing conducted by the Foundation on previously-infected electronics could not detect the presence of SCP-4406. After 90 days with no detected symptoms of the anomaly, it was reclassified as Neutralized.

NOTE: This section has been locked. Modifications to this addendum require manual approval by Lead Researcher Thompson.

Footnotes:

▸ Access data

▾ Hide data

Footnotes

1. TEMPEST is a NATO certification for emission security (EMSEC) indicating that equipment and/or structures are insulated from 'leakage' of data via electromagnetic or acoustic emissions.

2. A rootkit is a malicious program which gives an attacker backdoor access to a system, and avoids detection by removing itself from process lists and execution statistics. Because it utilizes its escalated permissions to hide evidence of itself, rootkits can be very difficult to detect and eliminate.

3. The occult branch of the Department of Defense.

4. A project created to study electrical-ontology: a means of measuring informational intrinsics, or anomalous modifications to the properties of semantic entities. This was originally initiated to produce a means of instant one-way communication by manipulating the recipient's ontology directly.

5. Changes in a discrete state from existentially true to false, or vice-versa.

6. A protection ring is a permissions architecture within modern operating systems to limit access to resources based on its current level of privilege, with lower numbers indicating higher access. Ring 3 is generally the level user applications run at, and Ring 0 provides access to the system's kernel. Ring -1 and below provide access to the CPU itself, and require exploitation of its microcode programming.

7. Due to the anomalous nature of SCP-4406's informational structure, it would not be possible to limit the effective range of the elimination.

END OF FILE

[jpowers@uiu-raven ~]# whisper copy scpf-cthompson:/home/cthompson/copied/scp-* ~/scp-foundation/files/ &

Copying…

[1] 616003

[jpowers@uiu-raven ~]# whisper show scpf-tornado:/scp/001

Connecting to scpf-tornado…

Connected.

Error: (1063) Field berrymanlang_answer expected, not provided.

See "man 3 killme" for more information on memetic verification protocols.

[1] + 616003 done

[jpowers@uiu-raven ~]# whisper exit

Terminating connection…

You have been logged out from WHISPER.