On several occasions, Vesko says, he has tried to smoke out the virus writer. Once Vesko announced that he had carefully analyzed two viruses attributed to the Dark Avenger: the Number of the Beast and Eddie. He said that, in his view, they could not possibly be the work of the same writer. One was clever, the work of a professional, the other sloppy, the work of an amateur. Furthermore, he said that he intended to present his evidence at a lecture that would be held in Sofia. He guessed that the Dark Avenger would appear, if only to hear what Vesko had to say about his programs.
The meeting was well attended, particularly for a cold Friday night in early December. Vesko presented his evidence. Number of the Beast, he said, was obviously written by an extremely skilled specialist whose style contrasted in every way with the poor quality of Eddie. He watched the audience during his presentation, Vesko says, looking for someone who might be the Dark Avenger; during the questions and discussion afterwards he listened for anyone defending the programming of Eddie. He saw and heard nothing that gave him any clues.
But two days after the lecture he received a letter from the Dark Avenger. According to the letter, the virus writer had attended the meeting. Vesko published his comments in the magazine Komputar za was. "The author of the Eddie virus is writing to you," the Dark Avenger began. "I have been reading your pieces of stupidity for quite a long time but what I heard in your lecture was, to put it boldly, the tops." The virus writer went on to complain about Vesko's critique of his programming skills. Then he added:
"I will tell you that my viruses really destroy information but, on the other hand, I don't turn other people's misfortunes into money. Since you [get paid to] write articles that mention my programs, do you not think I should get something?"
Virus writing is not a lucrative field. The Dark Avenger had once before alluded to getting paid for his skills, in a message to a local bulletin board operator, when he had suggested, none too hopefully, that "maybe someone can buy viruses." So far as is known, he has never sold any of his bugs.
In 1990 Vesko put together a psychological profile of the Dark Avenger, a compilation of all the known facts about him: his taste in music, his favorite groups, his supposed interest in the Princess of Wales, his need for money and so on. From his letter Vesko gleaned he had been a student at Sofia University and, from sarcastic remarks he had made about Vesko's engineering degree, that he was either a mathematics or science student (there is a traditional rivalry between engineering and the other two faculties). He sent the profile to seven former students at the university, asking if they knew anyone who fitted the criteria. All seven replied, Vesko says, and all seven mentioned the same name- -that of a young man, then twenty-three, a programmer in a small, private software house in Sofia.
Vesko didn't turn him in. Even had he wanted to, there was little point: writing viruses is not illegal in Bulgaria.
HACKING FOR PROFIT
Inevitably there are people in the computer underworld who use their skills to make money--legally or illegally. Hacking into suppliers to steal goods, or looting credit card companies, has become established practice. But there seems to be little commercial potential in viruses--unless it becomes part of a scam.
In December 1989 the first such scam appeared. The virus was used as a blackmail weapon to frighten computer users into paying for protection. Jim Bates, a free-lance computer security consultant, was one of the first to examine the blackmail demand delivered on an apparently ordinary computer diskette. He had received a call earlier that day from Mark Hamilton, the technical editor of a British computer magazine called PC Business World. Mark had sounded worried: "There's apparently been a trojan diskette sent out to PC Business World customers. We don't know anything about it. If we send you a copy, can you look into it?"
Jim runs his little business from his home in a commuter suburb ith the misleadingly bucolic name of Wigston Magna, near ~icester, in the English Midlands. Though he had other work to at the time, he agreed to "look into it"- -which meant, effecvely, disassembling the bug. It would be a time-consuming task. "What does it do?" he asked.
"We don't know. It may be some sort of blackmail attempt."
