To confirm his hunch, Solomon dialed an electronic bulletin board in Sofia, linking to the East European country via Fidonet, an international public-access computer network run by hobby- ists. The board he accessed was owned by MicroComm, a subsidiary of the Bulgarian public telephone company. Once linked to the board, he managed to make contact with one of the company's engineers, Veni Markovski, who spoke a little English Solomon uploaded the code to Sofia, and Veni looked at it with his Cyrillic converter. If the code represented Cyrillic characters the converter--a program that translates keyboard strokes into Cyrillic--would recognize them and display the message in the virus. The text, though, would be in Bulgarian, which was why Solomon needed Veni's help.
The converter rapidly deciphered the code, changing it to Cyrillic. Solomon had guessed correctly. The phrase, Veni reported, was an idiomatic Bulgarian expression. It took some time to translate--Veni's English is poor--and its meaning is obscure. But, Veni said, it translates to something like: "This fat idiot instead of kissing the girl's lips, kisses quite some other thing."
Solomon wasn't surprised that the message was in Bulgarian. By 1990 everyone involved in computer security had become aware that something odd was going on in that obscure East European country. Increasingly sophisticated and damaging viruses that affected IBM-type PCs were moving into the West, carried on diskette or transferred by electronic bulletin boards, and all had one thing in common: they had been written in Bulgaria.
Though only a few of the viruses had actually been seen "in the wild"--that is, infecting computers--reports from Bulgaria suggested that two new viruses were being discovered in that country every week. By mid-1990 there were so many reported Bulgarian viruses that one researcher was moved to refer to the existence of a "Bulgarian virus factory." The phrase stuck.
The origins of that factory go back to the last decade. In the early 1980s the then president of Bulgaria, Todor Zhivkov, decided that his country was to become a high-tech power, with computers managing the economy while industry concentrated on manufacturing hardware to match that of the West. Bulgaria he decided, would function as the hardware-manufacturing center for Comecon (Eastern Europe's Council for Mutual Economic Assistance, now defunct), trading its computers for cheap raw materials from the Soviet Union and basic imports from the other Socialist countries. Bulgaria had the potential, in that it had many well-educated young electronics engineers; what it didn't have, with its archaic infrastructure and ill-managed economy, was any particularly useful application for its own hardware.
With the resources of the state behind Bulgaria's computerization, the country began manufacturing copies of IBM and Apple models. The machines were slow-- very slow by today's standards--and were already obsolete even when they first started crawling off the production line. They had been "designed" at the Bulgarian Academy of Sciences, but without the help or blessing of either IBM or Apple. The Bulgarian machines were simply poorly manufactured clones that used the same operating systems and computer language as the real IBMs and Apples.
In the latter half of the 1980s shiny new computers started to appear in state organizations, schools, colleges, and computer clubs. Many were destined to sit on the boss's desk, largely unused, symbols of a high-tech society that never really existed. Few businesses had any real need for computers; some used them simply to store personnel records. It was a gloss of technology laid over a system that, at its core, wasn't functioning.
In addition, Bulgaria didn't have any software. While the factories continued to manufacture PCs, the most basic requirement--programs to make the machines function had to be pirated. So the Bulgarians began copying Western programs, cracking any copy-protection schemes that stood in their way, and became more and more skilled at hacking--in the classic sense of the word. They could program their way around any problem; they learned the ins and outs of the IBM and Apple operating systems; they became skilled computer technicians as they struggled to keep their unreliable and poorly manufactured computers func- tioning. In short, they were assimilating all the skills they would need to become first-class virus writers.
The first Bulgarian viruses to arrive in the West were seen in 1989. They became increasingly sophisticated and malignant progressing within a year from the relatively harmless Yankee Doodle to the more destructive Eddie and then to Nomenklatura, which was deadly.
