Dark Avenger was the
pseudonym
A pseudonym (; ) or alias () is a fictitious name that a person or group assumes for a particular purpose, which differs from their original or true name (orthonym). This also differs from a new name that entirely or legally replaces an individua ...
of a
computer virus writer from
Sofia
Sofia ( ; bg, София, Sofiya, ) is the capital and largest city of Bulgaria. It is situated in the Sofia Valley at the foot of the Vitosha mountain in the western parts of the country. The city is built west of the Iskar river, and h ...
, Bulgaria. He gained considerable popularity during the early 1990s, as some of his viruses spread not only nationwide but across Europe as well, even reaching the United States and Australia.
Background and origins
In the 1980s and 1990s, Bulgaria had a blooming computer hardware industry specialized in providing large numbers of PCs for educational purposes. Thus, many schools and universities were provided with computers and computer science was a commonly studied subject. This helped foster a certain attitude about computers among that generation.
In April 1988, Bulgaria's trade magazine for computers, ''Компютър за Вас'' (''Computer for You''), issued an article explaining in detail the nature of computer viruses and even methods for writing them.
A few months after that, Bulgaria was "visited" by several foreign viruses, namely "Vienna", "Ping Pong", and "Cascade". The interest spawned by both the article and the viruses was huge, and soon young Bulgarian programmers began to search for ways to devise their own viruses.
Soon a wave of Bulgarian viruses erupted, started by the "Old Yankee" and "Vacsina" viruses. Dark Avenger made his first appearance in the spring of 1989.
[
]
Viruses
Dark Avenger's first virus appeared in early 1989 and contained the string, "This program was written in the city of Sofia (C) 1988–89 Dark Avenger". Thus, this first virus is usually referred to as "Dark Avenger", eponymous to its author.
It was very infectious: if the virus was active in memory, opening or just copying an executable file was sufficient to infect it. Additionally, the virus also destroyed data, by overwriting a random sector of the disk at every 16th run of an infected program, progressively corrupting files and directories on the disk.
Corrupted files contained the string, "Eddie lives... somewhere in time!"—possibly a reference to
Iron Maiden
Iron Maiden are an English heavy metal band formed in Leyton, East London, in 1975 by bassist and primary songwriter Steve Harris. While fluid in the early years of the band, the lineup for most of the band's history has consisted of Harri ...
's album ''Somewhere in Time''. Due to its highly infectious nature, the virus spread worldwide, reaching
Western Europe
Western Europe is the western region of Europe. The region's countries and territories vary depending on context.
The concept of "the West" appeared in Europe in juxtaposition to "the East" and originally applied to the ancient Mediterranean ...
, the
USSR
The Soviet Union,. officially the Union of Soviet Socialist Republics. (USSR),. was a transcontinental country that spanned much of Eurasia from 1922 to 1991. A flagship communist state, it was nominally a federal union of fifteen nationa ...
, the
United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territori ...
, and even
East Asia
East Asia is the eastern region of Asia, which is defined in both Geography, geographical and culture, ethno-cultural terms. The modern State (polity), states of East Asia include China, Japan, Mongolia, North Korea, South Korea, and Taiwan. ...
.
It even received moderate mention in ''
The New York Times
''The New York Times'' (''the Times'', ''NYT'', or the Gray Lady) is a daily newspaper based in New York City with a worldwide readership reported in 2020 to comprise a declining 840,000 paid print subscribers, and a growing 6 million paid d ...
'' and ''
The Washington Post
''The Washington Post'' (also known as the ''Post'' and, informally, ''WaPo'') is an American daily newspaper published in Washington, D.C. It is the most widely circulated newspaper within the Washington metropolitan area and has a large nati ...
''.
[http://vx.org.ua/lib/static/vdat/ephearto.htm ]
Dutch author
Harry Mulisch reported having encountered the virus on his laptop while writing his magnum opus ''
The Discovery of Heaven'' in his logbook on 21 October 1981 in the 51st chapter of the book, and because of his own and the book’s
cabalistic nature, interpreted it as a “favourable sign from higher powers”, and subsequently considered it referring to the raven named Edgar (after
Edgar Allen Poe’s
short story
A short story is a piece of prose fiction that typically can be read in one sitting and focuses on a self-contained incident or series of linked incidents, with the intent of evoking a single effect or mood. The short story is one of the oldest ...
) which appeared in the corrupted scene of the book, and even considered naming his upcoming son Eduard, after the virus’ output ‘Eddie lives... somewhere in time’, though he eventually named him Menzo instead. A few weeks later, on 16 November he re-encountered the virus, and throughout 23–27 November he eventually had the virus professionally removed.
This virus was soon followed by others, each employing a new clever trick. Dark Avenger is believed to have authored the following viruses: Dark Avenger, V2000 (two variants), V2100 (two variants), 651, Diamond (two variants), Nomenklatura, 512 (six variants), 800, 1226, Proud, Evil, Phoenix, Anthrax, and Leech. As a major means for spreading the
source code
In computing, source code, or simply code, is any collection of code, with or without comments, written using a human-readable programming language, usually as plain text. The source code of a program is specially designed to facilitate the w ...
of his viruses, Dark Avenger used the then popular
bulletin board systems
A bulletin board system (BBS), also called computer bulletin board service (CBBS), is a computer server running software that allows users to connect to the system using a terminal program. Once logged in, the user can perform functions such a ...
.
In its variants, the virus also contained the following strings:
* "Zopy (sic) me – I want to travel"
* "Only the Good die young..."
* "Copyright (C) 1989 by Vesselin Bontchev"
In technical terms, the most prominent feature of some of Dark Avenger's viruses was their
polymorphic engine, the
Mutation Engine (MtE); MtE could be linked to the plain virus in order to generate polymorphic decrypters. Dark Avenger did not, however, invent polymorphism itself, since this had already been predicted by
Fred Cohen
Frederick B. Cohen (born 1956) is an American computer scientist and best known as the inventor of computer virus defense techniques. He gave the definition of "computer virus". Cohen is best known for his pioneering work on computer viruses, t ...
and later put into practice by Mark Washburn, in his
1260
Year 1260 ( MCCLX) was a leap year starting on Thursday (link will display the full calendar) of the Julian calendar.
Events
By place Africa
* October 24 – Saif ad-Din Qutuz, Mamluk sultan of Egypt, is assassinated by Baibars, who sei ...
virus, in 1990. It wasn't until a year or more later that Dark Avenger's viruses began to employ polymorphic code.
Dark Avenger made frequent attacks on Bulgarian anti-virus researcher Vesselin Bontchev. Such is the case with the viruses V2000 and V2100, which claim to have been written by Bontchev, in an attempt to defame him.
This "conflict" between the two has led many to believe that Bontchev and Dark Avenger were intentionally "promoting" each other or that they might even be the same person.
Dark Avenger's actions were not treated as a crime at that time in Bulgaria, since there was no law for information protection.
Identity
The identity of the person behind the pseudonym has never been ascertained. However, a lot can be inferred via various details of the viruses. Additionally, Dark Avenger was the subject of an interview conducted by
Sarah Gordon which contains revealing information. Some of Dark Avenger's contemporaries, mainly Vesselin Bontchev, have also shed light on his potential identity.
Dark Avenger may have been a fan of
heavy metal music. The string ''Eddie lives...somewhere in time'', which the virus outputs, draws attention.
Eddie
Eddie or Eddy may refer to:
Science and technology
*Eddy (fluid dynamics), the swirling of a fluid and the reverse current created when the fluid flows past an obstacle
* Eddie (text editor), a text editor originally for BeOS and now ported to Lin ...
is the name of the mascot of the heavy metal band
Iron Maiden
Iron Maiden are an English heavy metal band formed in Leyton, East London, in 1975 by bassist and primary songwriter Steve Harris. While fluid in the early years of the band, the lineup for most of the band's history has consisted of Harri ...
. Additionally,
Somewhere in Time is the title of the band's sixth album. Furthermore, in his interview with Gordon, Dark Avenger states that he named himself after "an old song";
Manowar (another heavy metal band) have a song titled ''Dark Avenger'', on their
debut album. One of the viruses, Anthrax
may have been named after a heavy metal band of the same name.
Some hypothesize that Dark Avenger is Dr. Vesselin Vladimirov Bontchev due to the fact that a "Vesselin Bontchev" was mentioned in a 1989 virus by the Dark Avenger soon after Bontchev had written his doctoral thesis on computer viruses.
Interview with Sarah Gordon
One of the victims of Dark Avenger's viruses was
Sarah Gordon, a computer security researcher. Gordon became intrigued with the virus and joined a virus-exchange
Bulletin Board System ("BBS") in search of more information. Thus, she randomly came upon Dark Avenger, who was an avid visitor and BBS participant. The two came into contact and maintained it through e-mails for several years. Sarah Gordon later compiled most of these e-mails into a makeshift interview.
The interview offers the best available insight into Dark Avenger's personality and motives, and it contains some valuable information. Dark Avenger had previously stated on several occasions that "destroying data is a pleasure". However, in this "interview", he confesses that he regrets his actions, and that they were not right. The degree to which Dark Avenger exposes himself to Gordon has led many to believe that he held a deep affection for her. He even went as far as devoting one of his viruses to her.
It has been suggested by some virus writers that the Dark Avenger personality was a social experiment and Gordon was the object of a study herself, while helping build the myth. Others have hypothesized that Gordon herself was Dark Avenger.
References
*
External links
MtE downloads for three of its versions*
ttps://web.archive.org/web/20040812231047/http://vx.netlux.org/lib/static/vdat/epgenvir.htm General psychological profile over virus writers I, by Sarah GordonGeneral psychological profile over virus writers II, by Sarah GordonMany papers on virus writers by Sarah GordonDark Avenger Virus Information
{{DEFAULTSORT:Dark Avenger
Living people
Computer viruses
People from Sofia
Bulgarian criminals
Computer criminals
Year of birth missing (living people)