Noncryptographic Security Issues - Codes: The Guide to Secrecy from Ancient to Modern Times - page 400

by e-mail and applied to MS-Word documents. Moreover, those recipients who
opened the documents found that the first fifty people in their address books
also received the virus. This was so effective that on Friday, March 26, 1999,
Microsoft Corporation was forced to disable incoming e-mail. Melissa operated
by incorporating a message that told the recipient that an important (secret)
message was contained in the attachment. Once opened, the infected file was
read to the global macro file. Then the virus employed the visual basic lan-
guage 10.26 to read the first fifty names in the address book, and send them all
the virus. 10.27
Macro viruses are memory-resident since they are active not only when the
infected documents are opening or closing, but for the entire time the system is
running.
Melissa suggests that e-mail is becoming the medium of choice for attackers
and this is indeed the case.
E-Mail Viruses : Malicious software employing e-mail is becoming more
common with each passing day. Melissa was just the beginning. More powerful
versions of e-mail viruses have emerged wherein the virus is spread to all the
e-mail addresses within the address book of the infected host. Thus, the rapid
deployment of e-mail viruses is now a major threat.
On Thursday, May 4, 2000, a new e-mail virus called the “I Love You” virus,
also called the love bug , spread itself around the world in a matter of hours. Its
name is derived from the fact that it contained a message to check the attached
“love letter”, which was a file in Visual Basic containing the virus. If the e-
mail was deleted without opening the attachment, then the computer was safe.
However, if opened, the computer was infected and the virus was distributed
via e-mail employing MS-Outlook's address book. This was an advance in the
degree of malevolence over Melissa since the latter only sent to the first fifty
addresses, whereas the former sent to everyone in the address book. The love
bug was much more destructive than Melissa since it copied itself into two vi-
tal system directories and added triggers in the Windows registry. This meant
that every time an infected computer rebooted, the love bug was executing. It
infected data files by overwriting them using Visual Basic, and deleting the orig-
inal file. Typically files associated with WWW development, and multimedia
files were extinguished, such as those of type MP3 (music) and JPG (images).
An example, to illustrate the magnitude of the losses, was reported by the Nor-
wegian photo agency Scanpix, which lost over six thousand of its photos, and
was able to recover less than twenty-five percent of them. The love bug only
affected versions of the Windows and NT operating systems, so Macintosh and
Unix platforms were safe. Yet this was enough to cause billions of dollars in
10.26 Visual Basic is a graphical programming language introduced by Microsoft in 1990. It is
used for developing GUI Windows applications.
10.27 David Smith, who wrote Melissa, was caught within a week of the virus hitting the
Internet. Although he pleaded guilty and was sentenced to ten years in a New Jersey state
prison, his sentence was reduced to twenty months when he cooperated in thwarting attacks
and aided in the arrest of other hackers.