==Phrack Magazine==
Volume Four, Issue Forty-Four, File 11 of 27
[Editor's Note:
The following two files are very interesting. I never paid ANY attention to the realm of our community that focus on virii. For some reason, the whole idea behind them is a novel concept, but I never saw any reason to take notice of them. Even when I've given lectures, I always leave discussion about virii out, since they should be a moot point. I mean, when "fdisk /mbr" will take care of so many problems, what's the big deal?
I know I'm over-simplifying things, but jesus...
Well, while I continued to overlook this small but earnest group of folks who dabble in virii, all kinds of things began to happen. Groups formed, rivalries flared, paranoia ran rampant and one of the most ridiculous cottage industries in the history of personal computing appeared (living on the spread of Fear, Uncertainty and Doubt.)
Well, in all of this several names have popped up as potential threats to this little world. One in particular, Sarah Gordon, even got the spotlight as a paranoid, BBS-busting, hacker-bashing psychopath in a rather ill-researched and hastily prepared Phrack piece a few years back. It is rather odd that in all the hype we in the underground drum up, no one ever bothers to get the other side of the story, so we feed the fervor and continue the paranoia.
Well, with this in mind, I received a file claiming to have info regarding the big "expose" of Sarah masquerading as the Dark Avenger. Now, even a moron like me has heard of the Dark Avenger, so I read it. After doing so, I wanted to pipe it to /dev/null, but then decided it would be much more fun to send it to Sarah too, and let her respond to it.
It's amusing as hell, and just goes to show that the underground has as many similarities in its distinct groups as it does differences.]
Sara(h?) Gordon AND THE DARK AVENGER SCAM.
By Kohntark
In one of my many online conversations with Sara Gordon
I once asked her about the validity of the VNI interviews and
her real relationship with the alleged dark avenger; after
logging into her VFR BBS and seeing a #2 (hers being #1)
account named after him.
I proceeded to leave a message for the dark avenger there,
claiming that the whole account was bogus as it is highly
improbable that this person might call all the way from
Bulgaria and log into a mediocre BBS just to chat with her,
considering the expense of such long distance call , the
economic situation in Eastern Europe and a fact that
would learn later: Sara(h) Gordon has an account on the
Bulgarian DIGSYS unix server, locally accessible by phone
from there!
As it was expected, Sara(h) quickly 'noticed' my personal
message to the dark avenger and replied to my questioning in
a public post in FIDONET, (I don't read FIDONET posts and she
knows I have no access to them!!!! )
She claimed that the dark avenger was fully aware of how much
money she made out of the VNI interviews and that she was in
touch with him, etc.etc.
Afterward, I questioned her again about the whole affair
and demanded a proof, or some sort of direct contact from the
dark avenger to my anonymous internet account.
Since this was the first time anyone had ever questioned the
validity of her relationship with the DA, she took this to
heart and shortly after, I received 3 short messages
originating from <dav@danbo.digsys.bg> an Internet connected
UNIX system in Bulgaria.
Here they are:
(Private, compromising parts are X'd out)
1st Message:
- From daemon@digsys.bg Wed Jul 14 19:07 EDT 1993 Received: from danbo.digsys.bg by XXXXXXXXXXXXXXXXXXXXXX; Wed, 14 Jul 93 19:07:3 4 -0400 Return-Path: dav@danbo.digsys.bg Received: by XXXXXXXXXXXXXX (5.67/1.35) id AA12850; Thu, 15 Jul 93 02:04:46 +0300 Message-Id: <9307142304.AA12850@XXXXXXXXXXXX> To: XXXXXXX From: dav@danbo.digsys.bg Date: Wed, 14 Jul 93 23:41:36 +0300 Subject: No subject Status: RO
kohntark-
i just talked to a friend of mine who said you dont like her user log. why shouldnt i call her from bulgaria? i call whoever i want to, and this is not your problem.
by the way, she sent me your mail. for your information, i do know how much money she made of that interview. and i also think that this is none of your business.
also, maybe it would be good for you to know, that by offending her, you are offending me, too. keep this in mind.
Second Message:
My mail with her is none of your business either.
i dont think so, dude.
maybe you need to read the next few lines again, in case you missed them.
>
also, maybe it would be good for you to know, that by offending her, you are offending me, too. keep this in mind.
HA HA! and you expect me to believe that you are the DA! send me a proof: an email address from bulgaria or tell me how many addressing modes does the MTE have?
nice try.
well, what do you think the domain .bg in my email address stands for? maybe you think its kameroon? as for the mte, im not giving you any info.
i need not prove anything to anybody, and certainly dont plan to waste more of my time talking to you. you have been warned.
Third Message:
oh, yeah. sure it did. only you will not know where something else came from, when it knocks on your door. i have nothing more to say.
In my ignorance, I blindly trusted the three cryptic replies
to be true, even thought whoever replied refused to give out
trivial information such as the number of addressing modes
for a 2 year old encryption engine (MTE) and spelled Cameroon
with a 'k' (Check out Sara Gordon's spelling of URUGUAY in
VIRUS-L Volume 6 Issue 120 -v06i120)
Shortly after other unrelated discussions and a CUD post from
Sara(h) in which I was mentioned (unnamed), someone warned me
of several posts in NUKENET by an alleged dark avenger and
Todor Todorov from an account belonging to the last,
mentioning me and Aristotle.
In those messages I was referred to as 'hotshot,' a word that
Sara Gordon had used on me several times on our personal
email exchange; It was then that I became highly suspicious
of the whole matter.
I called Virginia's Virus Research Institute's sysop and
owner, Aristotle to find out more about the posts and he
bought to my attention the particular writing style of
Sara(h) Gordon: She NEVER uses capital letters and
apostrophes on her personal email, and always signs her name
on the lower left hand corner. (She seldom signs her posts
nowadays and changes her user name in her vfr@netcom.com
account every week!; for further proof of her writing style,
please refer to public posts in VIRUS-L Volume 6 #120; I also
have over 100K of personal email exchange to prove this
fact!)
It was then that we realized that she was passing herself as
Todor Todorov and the dark avenger (who could possibly verify
their online identity?) and had infiltrated NUKENET..
The writing style described corresponds exactly to the one on
the posts I received from the 'dark avenger.'
Shortly afterward the <dav@danbo.digsys.bg> account was
cancelled and I learned the whole truth:
The danbo.digsys.bg Bulgarian site belongs to Daniel Kalchev,
another self appointed AV researcher whose best claims to
fame are submitting various Bulgarian viruses to Patricia
Hoffman's VSUM!!
(You can check this by doing a search on 'Kalchev' on the
current VSUMs or you can contact him thru:
<daniel@danbo.sigsys.bg> )
He is a very close friend of Sara(h) Gordon and he has an
account in her VFR BBS (you can check this by logging into
her system and checking the user list) and SHE has an
account in digsys.bg under <sarah@danbo.digsys.bg> (this
account is still valid as far as I know; notice the H after
her name!)
What I concluded is that is the DA would never get an account
in such system as he HATES Daniel Kalchev!!!!
This is what really happened: Sara(h) Gordon in her
desperation to prove that she was in touch with the dark
avenger, told her pal Daniel Kalchev to make an account under
the dark avenger's name (<dav> this is how she always refers
to him, even though he never signs his name that way (check
the source code for his 'Dark Avenger' virus or the
'Commander Bomber' virus message name: [DAME])
From there she could email me messages that would come from
Bulgaria and would be untraceable since she would log into
her account in digsys.bg and log into the <dav> account
internally from the same site in Bulgaria. (You can check
where and when most of the people log from in most internet
unix and vax sites)
As it is expected from her, she has denied any of this.
Some of her ridiculous explanations include things like
"hotshot is a very common English word in Bulgaria" !!!
You might ask yourself what is the deal with the h? is it
sara or sarah??
Well, I asked her the same question when I noticed this in
one of the VNI interviews, where her name is spelled as
Sarah.
She replied that this was a mistake of the publisher.
Mistake? well not really, it was another lie, meant to throw
off any information and truth seekers, for example you can
check her account in Daniel Kalchev's system:
<saraH@danbo.digsys.bg> , spelled with an H,
another 'mistake of the publisher?'
:)
Other countless Sara Gordon lies are told in NUKE Info-
Journal # 6.
This behavior puts in question the validity of the VNI
interviews and the reputation of Sara(h) Gordon as a serious
(self appointed) 'virus researcher'
IMHO the VNI interviews are a complete fabrication, meant
only to boost her validity as a 'journalist', and to make her
lots of money, charging for further 'interviews' to other
magazines. (She has offered her paid 'interviewing' services
to various other publications.)
To the best of my knowledge the information I present here
is true and can be checked.
I chose to publish this information, despite threats against
my well being and countless lies about me propagated by
Sara(h) Gordon.
I am doing this to stop the lies and corruption fostered by
the Anti-Virus industry.