Elk Cloner

2025-03-24T19:29:50Z

71.246.145.76: /* Development */

{{Short description|Microcomputer virus}}
{{Infobox computer virus | Fullname = Elk Cloner
| Image = Elk Cloner poem.png
| Common name = Elk Cloner
| Classification = [[Computer virus]]
| Type = [[Apple II]]
| Subtype = [[Boot sector]] virus
| IsolationDate = 1982
| Isolation = [[Mt. Lebanon, Pennsylvania]], U.S.
| Origin = Mt. Lebanon, Pennsylvania, U.S.
| Author = [[Rich Skrenta]]
}}

'''Elk Cloner''' is one of the first known [[computer virus|microcomputer viruses]] that spread "in the wild", i.e., outside the computer system or laboratory in which it was written.<ref>{{cite news|agency=Associated Press|publisher=[[CTV Television Network|CTV]]|url=https://www.ctvnews.ca/prank-starts-25-years-of-computer-security-woes-1.254640|title=Prank starts 25 years of computer security woes|url-status=live|archive-url=https://web.archive.org/web/20080107152519/http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20070831/virus_prank_070831/20070831?hub=SciTech|archive-date=2008-01-07}}</ref><ref>{{cite web|url=http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci989616,00.html|title=Elk Cloner|access-date=2010-12-10}}</ref><ref>{{cite web|url=http://science.discovery.com/top-ten/2009/computer-viruses/computer-viruses-10.html|title=Top 10 Computer Viruses: No. 10 - Elk Cloner|access-date=2010-12-10}}</ref><ref>{{cite web|url=http://www.infoniac.com/hi-tech/list-of-computer-viruses-developed-in-1980s.html|title=List of Computer Viruses Developed in 1980s|access-date=2010-12-10}}</ref> It attached itself to the [[Apple II]] [[operating system]] and spread by floppy disk. It was written around 1982 by programmer and entrepreneur [[Rich Skrenta]] as a 15-year-old high school student, originally as a joke, and put onto a game disk.

==Infection and symptoms==
Elk Cloner spread by infecting the [[Apple DOS|Apple DOS 3.3]] operating system using a technique now known as a [[boot sector virus]]. It was attached to a program being shared on a disk (usually a game). At set numbers of times the disk's program had been run (all multiples of 5), it would cause various strange behaviors of the Apple II, many requiring a reboot to correct. Most noticeably, every 50th time the program was run, instead of executing normally, it would change to a blank screen that displayed a [[poetry|poem]] about the virus. If a computer [[booting|boot]]ed from an infected [[floppy disk]], a copy of the virus was placed in the computer's [[Random-access memory|memory]]. When an uninfected disk was inserted into the computer, a modified version of DOS including Elk Cloner would be copied to the disk, allowing it to spread from disk to disk. To prevent the DOS from being continually rewritten each time the disk was accessed, Elk Cloner also wrote a signature byte to the disk's directory, indicating that it had already been infected.<ref name=Crandall>{{cite arXiv|last1=Levy|first1=Scott|last2=Crandall|first2=Jedidiah|date=30 July 2020|title=The Program with a Personality: Analysis of Elk Cloner, the First Personal Computer Virus|class=cs.CR |eprint=2007.15759 }}</ref>

The poem that Elk Cloner would display was as follows:

ELK CLONER:
THE PROGRAM WITH A PERSONALITY
 
IT WILL GET ON ALL YOUR DISKS
IT WILL INFILTRATE YOUR CHIPS
YES IT'S CLONER!
 
IT WILL STICK TO YOU LIKE GLUE
IT WILL MODIFY RAM TOO
SEND IN THE CLONER!

Elk Cloner did not cause deliberate harm, but [[Apple DOS]] disks without a standard image had their reserved tracks overwritten.<ref name="sydney">{{cite news| url=http://www.smh.com.au/articles/2007/09/01/1188671795625.html | work=The Sydney Morning Herald | title=First virus hatched as a practical joke | date=2007-09-03}}</ref>

==Development==
Elk Cloner was created by Skrenta as a prank in 1982. Skrenta already had a reputation for pranks among his friends. In sharing computer games and software, he would often alter the floppy disks to shut down or display taunting on-screen messages. Due to this reputation, many of his friends simply stopped accepting floppy disks from him. Skrenta thought of methods to alter floppy disks without physically touching or harming them. During a winter break from [[Mt. Lebanon School District#Mt. Lebanon High School|Mt. Lebanon High School]] in [[Mt. Lebanon, Pennsylvania]], Skrenta discovered how to launch the messages automatically on his [[Apple II]] computer. He developed what is now known as a [[boot sector]] virus, and began circulating it in early 1982 among high school friends and a local computer club. Twenty-five years later, in 2007, Skrenta called it "some dumb little practical joke."<ref>{{cite web|url=https://www.salon.com/2007/07/12/virus_birthday/|title=The computer virus turns 25|work=Salon.com|accessdate=April 12, 2013|author=Farhad Manjoo|date=July 12, 2007}}</ref><ref>{{Cite web|url=https://www.cnet.com/topics/security/|archive-url=https://archive.today/20120715063504/http://news.cnet.com/A-20-year-plague/2009-7349_3-5111410.html|url-status=dead|title=Security: News|website=CNET|archive-date=2012-07-15|access-date=2021-03-02}}</ref><ref>{{Cite web|url=https://community.broadcom.com/home|title=Home - Broadcom Community - Discussion Forums, Technical Docs, and Expert Blogs|website=community.broadcom.com}}</ref>

==Distribution==
According to contemporary reports, the virus was quite contagious, successfully infecting the floppies of most people Skrenta knew, and upsetting many of them. Skrenta's high school math teacher, on encountering the program on his computer, accused Skrenta of breaking into his office.<ref name=Crandall /><ref>{{cite web|url=http://www.skrenta.com/cloner/sci-am.html|title=Computer Recreations:A Core War bestiary of viruses, worms and other threats to computer memories|access-date=2015-03-22}}</ref>

Part of the "success" was that people were not at all wary of the potential problem, nor were [[Antivirus software|virus scanners]] or cleaners available. The virus could be removed using Apple's MASTER CREATE utility or other utilities to rewrite a fresh copy of DOS to the infected disk. Furthermore, once Elk Cloner was removed, the previously infected disk would not be reinfected since it already contained the Elk Cloner "signature" in its directory. It was also possible to "inoculate" uninfected disks against Elk Cloner by writing the "signature" to the disk; the virus would then think the disk was already infected and refrain from writing itself.

==References==
{{Reflist|30em}}

{{Hacking in the 1980s}}

[[Category:Computer viruses]]
[[Category:1982 in Pennsylvania]]
[[Category:Hacking in the 1980s]]
[[Category:Public-domain software]]

wiki143 - User contributions [en]

Elk Cloner