PHL-made virus' anniversary marked; expert recalls worldwide impact
Sophos senior technology consultant Graham Cluley said it was on May 4, 2000 that the worm, also called the "Love Bug," spread worldwide.
"There was nothing particularly clever about the Love Bug's code that explained why it had spread so widely so quickly – the reason for its 'success' was that it had tapped into a universal need: the desire to be loved," he said in a blog post.
But more importantly, he said the incident occurred at a time virus writers were in it not so much for the money but to show off.
In this respect, he said virus author Onel de Guzman had succeeded greatly.
"De Guzman had become a national celebrity, and his former college was said to be swamped with requests from budding students," he said.
On the other hand, he lamented that while technology has improved in the last several years, "majority of the general public are still woefully uneducated about how to act safely online and best protect their bank accounts and identities."
Cluley said the Love Bug, also known as ILOVEYOU, LoveLetter or VBS/LoveLet, spread itself via email using the subject line "ILOVEYOU."
Its message was a simple, "Kindly check the attached LOVELETTER coming from me," he added.
Attached to the email was a file, LOVELETTER.TXT.VBS, which used a double extension to hide its VBS nature and present itself as a text file.
The virus creator, De Guzman, at the time submitted a thesis proposal for a program that would steal usernames and passwords from other computer users to save money when accessing the Internet.
But his school's academic board rejected the proposal for advocating illegal behavior.
On the eve of de Guzman's graduation on May 4, 2000, the worm spread rapidly worldwide, seeking forward passwords to email addresses in the Philippines.
What gave De Guzman away was the line: rem by:spyder / email@example.com / @GRAMMERSoft Group /... Manila,Philippines
"Data sent by the worm to the mail.com email address were forwarded to firstname.lastname@example.org and email@example.com, two Filipino addresses that were buckling under the pressure as information was stolen from victims' computers worldwide," Cluley said.
On May 10, De Guzman eventually admitted he may have "accidentally" released the virus but refused to confirm that he was the author.
It was later revealed that De Guzman and fellow student Michael Buen – later determined to be the author of the WM97/Michael-B virus – were members of an underground computer gang called GRAMMERSoft, providing services to small businesses and allegedly selling homework to other students at AMA Computer College.
"Unfortunately, despite evidence mounting of De Guzman's involvement, the (National Bureau of Investigation was) unable to take action. It was only in June 2000 that authorities in the Philippines introduced computer crime legislation as a result of the Love Bug incident. These laws could not be backdated, and the main suspect walked free," Cluley said.
Cluley said that when the worm spread worldwide, he was in a Stockholm hotel giving a talk to system adminstrators, telling an amusing story of a virus called NoSmoking that was programmed to intermittently send messages from one Novell NetWare user to another.
During the coffee break, the guests' pagers and mobile phones began to beep, and several sought more information about the NoSmoking worm, which they thought was the malware spreading.
"As soon as I turned on my phone after the talk concluded, it went haywire. I was bombarded with calls, voicemails and SMS text messages asking me for information about the 'ILOVEYOU' worm that apparently wasn't hitting inboxes around the world," he said.
As his plane landed at Heathrow Airport, a TV news station was waiting to whisk him to its studios to discuss "what was rapidly becomingly the biggest computer virus outbreak the world had ever seen." — LBG, GMA News