From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: CHRISTMA: The "Card"! (CVP)
Date: 6 Nov 92 20:21:47 GMT

HISVIRH.CVP   921022
 
                     CHRISTMA EXEC - the card
 
In December of 1987 IBM mainframe computers in Europe, connected via
the EARN network, experienced a "mailstorm".  Such events are fairly
common on the "internetworks", caused by mailer problems,
incompatibilities, or even "autoanswer" daemons replying to messages
from unmoderated "distribution lists".  This particular mailstorm,
however, was of unprecedented severity.  It shut down whole sections
of the net, at least as far as effective work was concerned.
 
For many, probably for most, users, email is simply text.  A select
group are involved with the exchange of programs or other binary
files, often UU or XXencoded and sent through email systems, and
often "imbedded" within messages as a greater or lesser portion. 
Some users have these facilities provided for them, through systems
that are configured with these functions.  (NeXT users have these
functions in automated form, for example, and also have a reputation
for not knowing how they work, cross-posting incomprehensible
garbage to distribution lists and newsgroups.)  IBM mainframe users
often have such functions provided through PROFS and an interpreter
language called REXX.  Programs in REXX are called EXECs.
 
The CHRISTMA EXEC was a message that contained such a program. 
"Christmas card" messages with this system can be more than just the
usual "ASCII tree".  (Perhaps, since this deals with IBM mainframes,
I should use the more generic "typewriter picture".  Anybody
remember what a typewriter was?  :-)  These messages could include
forms of animation such as asterisk snowflakes falling on a winter
scene, or a crackling fire from a yule log.  The message header
contained a note that "Browsing this message is no fun at all.  Just
type Christmas .." which was intended to stop people from trying to
read the "source code" of the message, but it is unlikely that few
would even think to do so.
 
Typing either "Christmas" or "Christma" would generate the "card". 
It really wasn't anything special, a very simplistic conifer shape
made out of "X"s.  (Mine is *way* better  :-)  At least on the
surface.  However, at the same time that it was displaying the tree
on the screen, it was also searching for the NAMES and NETLOG files
associated with the user's account.  This provided a list of other
users that either sent mail to or received mail from this account. 
The important thing was that it was a list of valid email addresses. 
The CHRISTMA EXEC would then mail copies of itself to all of these
accounts.
 
The important point, technically, was that all of the accounts were
valid.  As a side benefit, all of those accounts would be used to
receiving mail from the account that had just read it.  And they
would tell 40 friends, and they would tell ...
 
copyright Robert M. Slade, 1992   HISVIRH.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "My son, beware ... of the
Institute for  Robert_Slade@sfu.ca      |  making of books there is
Research into  rslade@cue.bc.ca         |  no end, and much study is
User           p1@CyberStore.ca         |  a weariness of the flesh."
Security       Canada V7K 2G6           |          Ecclesiastes 12:12