Do you remember when the Love Bug worm spread around the world?
I remember pretty clearly Thursday, May 4th 2000.
I was in Stockholm, in a fairly swanky hotel, giving a talk to about a hundred system adminstrators. Before the coffee break I told them all the amusing story of a virus called NoSmoking that was programmed to intermittently send messages from one Novell NetWare user to another.
I told the delegates that if you were on the receiving end of NoSmoking’s payload you would receive a pop-up on their screen saying “No smoking, please !” or – with perhaps awkward implications in the office as the messages were indistinguishable from one intentionally sent by a colleague – “Friday I’m in LOVE !”.
But something strange then happened during that morning’s coffee break. The pagers and mobile phones carried by the talk’s guests began to beep, and several of them approached me asking for more information about the NoSmoking worm.
“This NoSmoking virus – did you say it only sends NetWare Send messages? What about email?”
I assured them that NoSmoking didn’t spread in any form via email and wasn’t considered widespread, but it was clear that something was spreading words of love to the email accounts protected by many people attending the talk.
As soon as I turned on my phone after the talk concluded, it went haywire. I was bombarded with calls, voicemails and SMS text messages asking me for information about the “ILOVEYOU” worm that apparently wasn’t hitting inboxes around the world.
In fact, I was getting so many calls about this new outbreak on the way to the airport, that I had to swap my Nokia’s phone battery with my taxi driver (Thanks, whoever you were!). The calls continued all the way until I was boarding the plane back to London.
By now it was obvious that something very big was happening – and it had nothing to do with NoSmoking.
As my plane taxied along the runway after landing at Heathrow Airport, I had the unusual experience of hearing my name being announced by an air hostess over the tannoy. Apparently someone was waiting for me to arrive, and I should make myself known to the crew.
It turned out that a TV news station were waiting at the airport for me, in order to whisk me to their studios to discuss what was rapidly becomingly the biggest computer virus outbreak the world had ever seen. Media reports from the time claim that the CIA, Ford and the British Parliament were amongst the many organizations affected.
The Love Bug
The Love Bug, also known as ILOVEYOU, LoveLetter or VBS/LoveLet, spread itself via email using the subject line “ILOVEYOU” and the message body “Kindly check the attached LOVELETTER coming from me”.
Attached to each email was a file, LOVELETTER.TXT.VBS, which used a double extension to try and hide that it was a Visual Basic Script rather than a text file.
There was nothing particularly clever about the Love Bug’s code that explained why it had spread so widely so quickly – the reason for its “success” was that it had tapped into a universal need: the desire to be loved.
If you received the email from that cute girl in the accounts department, you’d open it. After all, who doesn’t want to be desired? If you’d received it from your 300lb boss with a walrus moustache you’d even open it – after all, it’s probably a funny joke, right? Even if you were in a loving, stable happy relationship – simple curiousity would probably have meant that many of us would have found it hard to resist investigating further.
And even if you didn’t speak English you would probably open it. After all, “I Love You” are probably the most recognised words in the English language even amongst those who have never met an English speaker.
With the virus spreading around the world, the hunt was now on for its author.
The Filipino connection
In 1999, Onel de Guzman, a student at the AMA Computer College in the Philippines, submitted a thesis proposal for a program that would steal usernames and passwords from other computer users in order to save money when accessing the internet.
De Guzman’s proposal (seen above) was rejected by the college’s academic board for advocating illegal behaviour. If Guzman had listened to his teacher’s advice, maybe the world would never have heard of the Love Bug.
But, as it was, on May 4th 2000 (the day before his graduation day) a worm following Guzman’s blueprint spread rapidly across the globe, attempting to forward passwords to email addresses in the Philippines.
Because it was a Visual Basic Script (VBS) virus, the Love Bug’s code was plain to see – even by people without any experience of analysing viruses. Indeed, within a day of the initial worm’s spread a number of copycat viruses had also emerged.
However, in its code was a clue to the Love Bug’s origin:
rem by:spyder / [email protected] / @GRAMMERSoft Group / Manila,Philippines
Data sent by the worm to the mail.com email address were forwarded to [email protected] and [email protected], two Filipino addresses that were buckling under the pressure as information was stolen from victims’ computers worldwide.
The first arrest
On Monday, May 8th, 2000, officers from the National Bureau of Investigation (NBI), raided an apartment in the Pandacan area of Manila and arrested a 27-year-old man called Reomel Ramones.
Although no computer was found at the address, a computer disk was discovered which contained code similar to that used by the Love Bug.
It eventually became clear that Ramones was unlikely to have been responsible for writing the Love Bug, but when police met Ramones’ girlfriend, 23-year-old Irene de Guzman, their attention focused on her brother who had just failed to graduate from the AMA Computer College.
Onel de Guzman
With evidence of his rejected thesis proposal revealed to the world by his former college, Onel de Guzman admitted to the world’s media on Wednesday, May 10th, 2000 that he might have accidentally released the Love Bug virus, but refused to confirm that he was the author.
His sister Irene sat beside him, wearing dark glasses, and hugging him close.
It was revealed that de Guzman and fellow student Michael Buen (later determined to be the author of the WM97/Michael-B virus, which laughably contained his contact details) were members of an underground computer gang called GRAMMERSoft, providing services to small businesses and allegedly selling homework to other students at AMA Computer College.
Unfortunately, despite evidence mounting of de Guzman’s involvement, the NBI were unable to take action. It was only in June 2000 that authorities in the Philippines introduced computer crime legislation as a result of the Love Bug incident. These laws could not be backdated, and the main suspect walked free.
A year or two later I got to visit Manila, and met the lead investigator in the Love Bug case. He expressed to me his frustration at not being able to prosecute the people he believed to be responsible.
An additional irritation was that because the Love Bug had caught the attention of the world’s media, Guzman was hailed as a hero by many of his fellow countrymen.
The Philippine Star newspaper, for instance, wrote that “here is a Filipino genius who has put the Philippines on the world map. And who has proven that the Filipino has the creativity and ingenuity to turn, for better or for worse, the world upside down.”
According to columnist Art A. Borjal, the Love Bug virus was something that will ”make foreigners look at Filipinos with hidden envy.”
When you remember that at the time most most malware was written to show off, rather than to make money, it’s clear that the Love Bug succeeded. De Guzman had become a national celebrity, and his former college was said to be swamped with requests from budding students.
It’s sad to say, but although technology may have improved in the last nine years, the majority of the general public are still woefully uneducated about how to act safely online and best protect their bank accounts and identities.
The end of the story?
So, what next for the curious case of the Love Bug worm?
Well, the latest I have heard is that they are making a romantic comedy inspired by the incident.
The name of the movie? Subject: I Love You.
