Work Text:
Worm.RPC2.RatEconWorm was the first piece of malware that effected the Rat Republic's computers. It began infection on the 2nd of April 1992 and ended on the 13th of April 1992.
Background
The introduction of the Rodent's PC Mark 2 on the 1st of August 1991. Unlike the Rodent's PC Mark 1, the RPC2 was significantly more successful and widespread.
It was quickly realized, by multiple people, that these computers could be used to automate/speed up a lot of work the Rat Republic's "middle managers". Tracking resources, calculating lots of math, tracking which workers are available when and where (idk, maybe someone has a dentist appointment), tracking which and how many books are checked out of the library, etc.
Another "obvious" thing realized by multiple people is that a lot of industrial equipment could be automated with computers. No more god awful highly repetitive factory jobs! SWEET!
But woman.... It would be really cool if one computer could "talk" with another computer in another location! (Without moving tapes around.)
So the Rat Republic's internet was born.
The RPC2, like many of the 8 bit home micros in the early 80's, has two 3.5mm tip-and-sleeve connectors (and on the Rodent version: 2.5mm connectors). One goes into the MIC input to a cassette deck, the other the earphone output on the deck.
This is how the RPC2 loaded and saved programs and data. It used audio cassettes.
But what if instead of a cassette deck, we connected it to the phone line?
That's exactly what the Rats of NIMH (and technically also the "Humans of NIMH") did: Make a telephone adapter for the RPC2.
All these different workplaces and job sites though.... They all have their own crappy BASIC program written by whatever laymen with the most computer skills in the group, and their ALL incompatible with each other! It would be really nice if there was one piece of standardized software that could like..... Replace all the one-off BASIC programs. Would make stuff like maintenance and technical support much easier! And it would allow less tech savvy people to computerize their own workplace.
Now it's called.... Well it would manage workplaces so.... "Workplace Manager!" There! That's a good name!
Put it on a cartridge that also has extra IO for GPIO and connecting to a floppy drive for storage. Oh! You know what would be really nice? If we could have like..... Some sort of telemetry system so we can know how many wrenches are being made, or if the grain mill broke down, so add that telephone adapter too so it can report back to the central server.
And BOOM! Standardized cybernetics software! One cartridge plus two audio patch cables for the tape interface, and you've paved the road to Fully Automated Luxury Trans Space Communism™!
The RATECON Network
The first iteration of RATECON leveraged the republic's already existing POTS (Plain old telephone service) network, much like how the western internet originally used "Dialup".
The original RATECON Network had a "Top->Down" architecture.
On Saturday of every week the central RATECON telemetry system in Alexgrad would begin going through the list of phone numbers corresponding to computers running Workplace Manager. At this point the Rats of NIMH had rewired the phone network so the RATECON network was seperate from the regular phone network.
Made it so that Chloe could use the phone to bitch to Devine about how her stupid monogamy was compromised because Kevin had sex with another woman. Made it so the central offices weren't hammered by RATECON and completely saturated.
Uh... Well short stab at monogamy aside, the central RATECON server network rang up multiple computers at once where it would play "25 Questions" with the client, inquiring the statistics of that workplace, if any of the workers there had written any messages towards either "to the top" or other workplaces, etc. All of that good stuff!
With the server now done, it was now the client's turn to ask questions. Some of them are hard coded into the ROM and are thus asked first: "What's the current date and time?", "Are there any announcements or messages directed towards me?", "What are the dates for the next 15 holidays, and what are their memos?", "Did another workplace send any messages towards me?", etc.
Then the client asks it's "programmable questions": "How much cast iron ingots are available?", "Is there new software I should download?", "Does the wrench factory have 2000 wrenches, and the paper mill 1600m
2
of cardboard stock?", etc. These questions varied.
All of this would get saved to the attached floppy drive.
Of course, this system was heavily limiting, and it would get replaced with the proper internet, relying on TCP/IP and doing all communications over port 28 (The "RATECON" port.)
How the Worm Works.
Worm.RPC2.RatEconWorm exploited a buffer overflow bug in the RPC2's stock ROM.
To save on ROM space Workplace Manager invoked many functions in the computer's """"BIOS"""", including the cassette load and save subroutines.
The way the RPC2 talked over the internet was by essentially treating it exactly like a cassette deck. Hence the audio patch cables bundled with the Workplace Manager cartridge.
Now it's not like entering "LOAD" or "SAVE" in BASIC, Workplace Manager sent and received 256 byte """"packets"""" at a time, and hardware wise the cassette interfaces went through audio level changing and electronics for both coupling those lines to the phone line safely and including pulse and dual tone dialing hardware, alongside ring detection circuity.
But what Workplace Manager was doing was invoking the same exact routines used by both "LOAD" and "SAVE". So in essence Workplace Manager was saving and loading corrupted BASIC program listings that maxed out at 256 bytes long.
The Rodent's PC Mark 2 is a Harvard Architecture machine, meaning there are separate buses for both data and instructions. BASIC programs live in data ram. The program stack also lives in data ram.
Workplace Manager is a very complicated program, so the layout of stuff in data memory is almost completely different then that of an instance of BASIC. However a few memory locations that get used by subroutines in the """"BIOS"""" that Workplace Manager invoke get left alone.
Including the 256 byte long stretch from $0100-$0200. The cassette save and load routines are hard coded to begin at $0100 as that's where BASIC program listings begin, so the network """"packet"""" buffer has to start there.
The first revision RPC2 (which is what most places used in April of 1992) has 16KiB+16KiB of ram. As such, the stack begins at $3FFF in data memory. The SP (Stack Pointer) decrements as the stack grows and increments as it shrinks.
The issue with relying on the built in save and load routines is that they are null byte terminated. They'll just keep reading or writing until they hit a $00, or "NULL" byte.
So what the worm does is it just keeps on sending data!
The very first couple hundred bytes are actually a real proper BASIC program that runs the spreading process.
The next couple hundred bytes are a "compressed" form of what a-to-be-infected computer will receive. It tells the worm how much padding it should send, and the stack overwrite data.
The next couple thousand bytes are just padding so the stack is eventually reached.
And the last couple dozen bytes are the ROP (return oriented programming) chain. It begins with a NOP (No operation) pad for alignment purposes, cleans up RAM enough so that the BASIC interpreter doesn't freak out when invoked, writes a $00 byte at the very beginning of the previous padding, then jumps to BASIC.
And the last byte is a $00 byte so that the load subroutine can exit. From there a CPU "ret" instruction eventually gets run, and the ROP chain is initiated.
With the worm's BASIC program now running, it begins "war dialing" for other computers on the network.
You see, while the RATECON network was "top->down", there was nothing stoping one "client" computer from dialing and connecting to another "client" computer.
The uninfected client simply assumes it's being dialed up by the central server, so it invokes the load subroutine where it eventually gets infected too.
A quark of the infection process is that it's fairly slow and unreliable. Almost 16KiB of data are being sent over the phone line at around 100 bits a second, resulting in infection times taking ~21 minutes. That is AGONIZINGLY slow!
And even then infection wasn't guaranteed. First off, someone might look over at the computer, see weird garbage on the screen, or that the job the computer was doing stopped, and reset it.
Another issue is that the cassette phone line thing wasn't reliable!
Both Workplace Manager and the central RATECON servers added error correction to the """"packets"""" to help compensate for noisy phone lines and what not.
The worm did not do this! Sometimes the uploaded payload was corrupted, so the worm ended up crashing the computer.
Damages
The worm took down about half of the RATECON network, and caused many machines to stop working.
But some computers just didn't get infected and the portion of the economy that was computerized at this time was only ~10%.
The downtime in production likely cost ~$200 million RRD (Rat Republic Dollars).
Mitigation
The Rats of NIMH eventually figured out what was happening, although it did take a little while as this was the first time any of them did malware research!
The first (and easiest) method they did was block the client computers from dialing out. There was no real need for the client to dial out, the central server initiated things by dialing in, so this simple fix stopped the worm dead in it's tracks.
But this required going to all the central offices and phone switches and whatnot and doing stuff. This process took some time.
The second (and harder, but more "proper") method was patching Workplace Manager to use it's own (fixed buffer length) load and save routines. Coding that up was simple enough, but getting the patched software out required getting MASK ROMs manufactured, getting the old cartridge sent in, swapping the new ROM in, and sending it back out.
Or sending someone with the ROM and tools to the site and doing the work there.
It was a big old pain in the ass, but they did get there in the end.
Origin
We do not know who made and sent this worm.
It could've been the CIA or NSA. The United States is a fascist terror organization, so it's entirely possible they made it to try and screw over the "Marxist Leninist" Rat Republic.
Except there's no evidence the CIA/NSA made the worm. IANIMH (Intelligence Agency of NIMH) scrubbed through captured classified documents after WW3 and no mention of the worm was found.
Many classified documents where destroyed when the Army of NIMH marched towards Washington, so it's entirely possible the CIA did make the worm, but they covered their tracks up well during the dying days of the US empire.
But the consensus is that an amateur computer hacker in the Rat Republic made the worm. 1992 was just a bit too early for both the CIA and NSA to get into cyber warfare. Besides, what little cybersecurity the two had where focuses primarily on the domestic threat malware posed to the US.
And those classified documents the Rats of NIMH went through? We might not have the full picture, but the general "vibe" is that both the CIA and NSA probably began to look into the Rodent's PC Mark 2 in about 1994.
The worm was somewhat sloppily written. There where objects and stuff on the heap MUCH closer to $0200 that could've been used for arbitrary code execution. Be it a CIA/NSA agent, or an amateur hacker, they only had modest knowledge of the platform.
Okay then, so how did the worm even GET onto the RATECON network? It was separate from the regular phone network!
Who knows! Probably by going into a workplace and loading the worm up from there? Could've been vandalized phone wires, or even hooking a computer up inside a central office.