ILOVEYOU: a love letter brings the world to a halt
Summary
On 4 May 2000 the CERT Coordination Center warned about the “Love Letter” worm, which spread as an email with the subject ILOVEYOU and the attachment LOVE-LETTER-FOR-YOU.TXT.VBS. By 8 May more than 650 sites had reported over 500,000 infected computers. The worm exploited no security hole but the curiosity of recipients, hidden file extensions and Outlook’s address books.
How the worm worked
The Visual Basic Script ran on Windows as soon as someone opened the attachment. It sent itself via Microsoft Outlook to every entry in every address book, so the mail seemed to come from acquaintances. It also spread via Windows file sharing, IRC and Usenet.
On the infected machine the worm overwrote files with its own code, for example JPG images, appending .vbs to their names, and hid MP3 files. It also changed the browser’s start page to download a program called WIN-BUGSFIX.exe that stole passwords.
Ideas
- A worm needs no hole when people open the attachment themselves.
- Hidden file extensions make a script look like a text file.
- Mail from acquaintances is no proof of harmlessness.
- Automatically executed scripting languages enlarge the attack surface.
Insights
- ILOVEYOU made social engineering a mass phenomenon: the attack targeted people, not software, and that is exactly why no patch helped.
- Windows’ default of hiding known file extensions was part of the problem; only years later did vendors and authorities widely advise showing them.
Facts
- CERT advisory CA-2000-04 of 4 May 2000, last revised on 9 May 2000.
- By 8 May 2000 more than 650 sites had reported over 500,000 affected systems.
- Windows systems with Windows Scripting Host enabled were affected.
References
Remarks
- The advisory survives via the Web Archive; the CERT pages of the time no longer exist.
Recommendations
- Always show file extensions in Explorer and the mail program.
- Block script and executable attachments at the mail server.
- For unexpected attachments from acquaintances, check back briefly via another channel.
Links to the original source and the Web Archive open in a new tab.