Attack Of The Love Bug

(3 of 4)

The major antivirus firms quickly posted antidotes--software to neutralize the bug--on their websites, but they were too late to prevent widespread chaos. Desperate for a cure, victims deluged the sites, making them all but inaccessible. McAfee received requests for help from 10,000 affected companies on the first day of the outbreak alone.

Alerted by their overseas offices, most multinationals escaped the Love Bug's full embrace. Tipped off by colleagues in England and Germany, computer-security personnel at AT&T;'s operations hub in New Jersey reported for duty by 6 a.m. to block the virus. Within hours, some 100 desktop machines were already infected, and technicians had to ditch more than 2 million infected e-mail messages. By contrast, colleges and universities, strongholds of Linux and Macintosh computer systems rather than the targeted Microsoft Windows, got off comparatively lightly.

The consensus among computer-security experts is that the Love Bug is the biggest virus outbreak in history--"by at least threefold," says Tippett. Agrees McAfee president and ceo Gene Hodges: "It's clear at this point that this is the most damaging and the most widespread virus outbreak ever." Symantec's Moritz is more cautious, conceding that it is No. 1 in numbers and rate of spread, but for sheer destructiveness he prefers last year's Explore.Zip, an especially vindictive virus designed to destroy Microsoft Word, Excel and Powerpoint files.

The extraordinary efficacy of the Love Bug was caused partly by its timing, striking as it did on a busy weekday morning, but also by its seductiveness. It was a minor masterpiece of what hackers like to call "social engineering"--in other words, manipulating the rubes. Few of the lonely hearts among cubicle dwellers could resist its siren song. (This reporter couldn't--and paid the price in lost files.)

From a technical standpoint, the Love Bug is not radically new. Hijacking your e-mail address, for example, has been done--most notably by Melissa. The difference this time was a mix of shrewdness and ruthlessness. While Melissa sent out its tainted e-mails one by one, sometimes overloading the very server that was supposed to distribute them, the Love Bug spewed them as a single batch--and it didn't stop at the first 50 names.

And if you happened to enter a computer chat room--looking for kindred spirits in cyberland--it passed copies of itself as well to everybody out there. (Imagine how receptive patrons of a singles chat room would be to a poisoned "love letter.") Nor would you have been protected if your computer was part of a so-called local area network, or lan. The Love Bug would leap that barrier like some hyperactive flea. And there's more. If you were surfing with Internet Explorer, it would reset your home page to a website in the Philippines, from which it would download a second virus--this one designed to round up all those treasured passwords on your hard drive and ship them off to an e-mail address, also in the Philippines. Fortunately, that contaminated site was shut down early Thursday morning once virus hunters spotted it.

The drama wasn't over yet. By Thursday night, more than a day after its first appearance, the Love Bug began to mutate. Either the creator or, more likely, other members of the virus-writing clan started editing the virus and reintroducing it to the Internet with some new, tilted spins. One version had the subject line "FWD: Joke." Another was written in Lithuanian. One, more devious, bore the subject header "Mother's Day Order Confirmation"--posing as an e-mail receipt for a credit-card transaction for flowers or a gift for Mom. Perhaps most diabolical of all was the version titled "Dangerous Virus Warning," with an attached file that cleansed the system of the Love Bug but substituted an equally dangerous one of its own.

As the initial outbreak cooled down by midday Friday, the search for its author heated up. Filipino virus hunters, working in cooperation with the FBI and local authorities, determined that the virus had originally been released from two e-mail addresses, spyder@super.net.ph and mailme@super.net.ph , both belonging to Supernet, an ISP based in Manila. The identity behind the two accounts proved difficult to trace--the perpetrator had used a series of faked and stolen e-mail addresses and anonymous, prepaid Internet-access cards.

By late Saturday, authorities had targeted two suspects: a 23-year-old Filipino student attending Amable Mendoza Aguiluz Computer College and living in the Pandacan district of Manila; and a twentysomething German exchange student living in Australia, known variously on the Internet as Michael and Mikael.

It is tempting to romanticize virus makers as brilliant, rogue hackers in the cyberpunk tradition of William Gibson's science fiction. Experts agree, though, that the Love Bug is at best the work of a resourceful plagiarist. "It isn't like you have to be a genius," says Tippett. "This is just a guy who's been connected to the virus community for a while. He took pieces from three or four viruses that came out this year and glommed them together."