Snorre Fagerland

Snorre Fagerland

@snoffle.bsky.social

Dad. Husband. Threat researcher at Stealth Startup. He/Him. Maintainer of the Virus History Project. Bannskapsarkitekt. #infosec #cats #nature #science #art #antifascist #drawing #istandwithukraine

1K followers3K following1K posts

#ukeslutt #nrk Det er ikke snuttifisering. Det er dagbladifisering. Lettbeint klikkbaiting i stedet for folkeopplysning. Og det er grunnen til at NRK ikke lenger er en seriøs aktør i mine øyne.

Tyrkerne som driver pizzaen borti her er pinadø mer nordlendinger enn gjennomsnittet av oss. Jeg bestiller pizza. "Tar det lang tid?" - "Ca. to timer." Deadpan. Jeg flirer. Han flirer.

Fint at Bergen er på Oxford-lista. En av dem. Hvis du plukker ut livskvalitet. På overall-lista er de nr 40. Det er en drøss med slike lister. Global Liveability Index har dem ikke på lista. Ikke World's Best Cities heller. Ikke Monocle heller. Jug med statistikk. #ukeslutt #nrk

@spaf.me As a computer security legend, you have seen a LOT of interesting incidents. I try to preserve data on malware and incidents from pre-2000 at github.com/SnorreFagerl... You would not happen to have retained any data that could benefit from preservation? Source, samples, notes, writeups?

github.comGitHub - SnorreFagerland/virushistory: A museum of malicious samples from the DOS eraA museum of malicious samples from the DOS era. Contribute to SnorreFagerland/virushistory development by creating an account on GitHub.

Ser at Steinar Suvatne betaler seg for NRK. Trekker inn den verste søpla i norsk mediebilde, antakeligvis for "engasjement". Nei, melder meg ut av den kanalen. Det er ikke mye nytt der lenger; dagbladifiseringen er nesten fullført.

<rant>Herreh, så lei jeg er av Norges tøffeste, dummeste, mesterste liste med b-kjendiser. Tragisk at disse hjernedøde realitykonseptene får fribillett til å gjentas sesong på sesong. 🤮 </rant>

@spaf.me Sent you an email to you job addy. There's no rush, so I won't say it is, but its not spam either. Happy sabbatical. PS: I never thought about using those words as part of my vocabulary, but now I have an urge to. argh.

NASA FIRMS is not bad at spotting heat. In fact, some of the feeds seem to be better at spotting industrial heat sources than wildfires - here, it sees the ferromanganese smelter at Sauda, Norway. The circle shows the margin of error from a previous plot.

Litt ironisk FP eller kreativt ansettelsestriks: E-tjenestens jobbannonse blokkeres av Telenor. Annonsen ender opp hos webcruiter, så den SER jo legit ut - men ring, for sikkerhets skyld.

I *think* I've known only one Hungarian person - my old doctor. Pointed at me and said "bit fat, yeah?". Showed me a huge handful of biscuits; "you need to stay away from these"; before he wolfed them down. Liked him straight away.

Not well known, but after Hypercard was released for Macs, people made viruses for it. One such was "Wormcode", but no sample could be found. However, Wikipedia says: Originally posted to the usenet group comp.sys.mac.hypercard" in a stack called "Font Preview". And what do you know.

Google Groups hold much of the old usenet, and so even these very old posts can be found again. The binhex decodes to a stuffit archive, from which the infected stack can be extracted. Uploaded to the Virus History Project. github.com/SnorreFagerl...

github.comGitHub - SnorreFagerland/virushistory: A museum of malicious samples from the DOS eraA museum of malicious samples from the DOS era. Contribute to SnorreFagerland/virushistory development by creating an account on GitHub.
View full thread

This spawned a series of copycats on other OS's: Atari ST, DOS, Win32, VBA etc. There were also - apparently - variants of the original that asked other questions - the Susan Ford (wants a date) and Richard Nixon (wants a pardon). Not seen samples of those, but sounds plausible.

Seth Stein, an MIT freshman from Providence, volunteered a story about an IBM computer operator at Brown who liked to tease his users by locking out their terminals and manually sending them messages asking for a cookie until they typed "cookie."

If you are a veteran of infosec/malware scene in the 70-90'ies you may receive a cold mail/message from me asking if you have historical material. Sorry about being such a pest. Just pipe to dev\null if not interested. There will be only one ping, hopefully it should be manageable.

In the 80-90'es Japan also struggled with DOS viruses - but with a twist. Their market was dominated by NEC PC-98 computers. They ran a DOS port on 8086 but BIOS was different, and disk IO was not via INT 13h but INT 1Bh. Thus Japanese boot viruses had to be custom made, like NEC/Hallow.

The file viruses worked normally but they had local variants. Their first virus - Japanese Christmas - discovered Nov 89 - showed an English Christmas greeting ("A merry christmas to you!") Dec 25th.

In 1987, a year before the Morris worm, the CHRISTMAS EXEC worm spread over email on EARN, BITNET and VNET. It's well documented. Did you know that several copycats followed on BITNET - at least 10 variants? Three of them - FACES, RAMA and ZT are uploaded to VHP. Below: RAMA aka Happy Ramadan.

I just received a fantastic donation of historical material for the Virus History Project. It will take some time to catalogue, but there's stuff in here that I have never seen - like three CHRISTMA EXEC-like worms for VM/CMS.

This is going to be unpopular, but I think it's the truth. Just poked around at one of the AI-music generation services. The kids are taking to this as fish to water, generating, sampling, remixing. The quality of much of this is *really high*, any genre. Not slop. These are the new playlists.

The DECNET Father Christmas worm of '88 hit (and notified its creator about) 35 out of >2500 NASA SPAN nodes. It's likely a coincidence, but one of them was OCEAN1 (node 6.58) - the box next to DIATOM (node 6.59) that was used as drop for the WANK worms the year after.

One WANK worm is likely lost, but I have to try: From the Dreyfus book: "Underground" ... but the Easynet version ... was ... distinct. It had a strange line of code in it, *a line missing from any other versions*....no circumstances was it to attack computers inside DEC's area 48. Anyone seen it?

I'm interested in getting in touch with anyone who was involved in the WANK/OILZ worm outbreak at NASA/CERN/DoE in 1989. I've talked to a few folks, but there are still blanks in this story - if you were part of that please ping me.

I hate the Word spell checker the most out of all modern application features. This condescending, unimaginative, language-averaging automat has caused more damage to writing than anything else up to the AI era.