Cyber chaos as the Love Bug strikes

By MATHEW DEARNALEY

Analogies between biological and electronic epidemics were rammed home yesterday as the world's worst computer virus outbreak hit New Zealand.

Swifter than the spread of any human venereal disease, the virus had already been christened the "Love Bug" en route from the Philippines before many unsuspecting office workers found it lurking in their e-mail.

The virus began its rampage as an e-mail program with the subject line "Love You," but Internet servers were last night intercepting mutated forms of the message aimed at penetrating hastily erected electronic barriers.

An early variation renamed the message "Fwd: Joke" with an attached document labelled: "Very Funny.vbs" but with the same devastating though invisible contents.

The attachment was originally alluringly titled: "Love-Letter-For-You.TXT.vbs."

Computer experts trying to head off havoc had a simple message: treat the e-mail like any unwanted love letter and throw it away unopened (or in other words, hit that delete button).

Auckland University computer and network security manager Russell Fulton said there was no substitute for common sense and sound judgment when confronted with an unknown e-mail attachment.

"I spend a lot of my time telling people that if they get an [unknown] attachment, don't open it. I say to myself: When did the dean last send you a message saying, 'I love you'?"

Merely opening the covering e-mail was not enough to trigger the program, but there was no love waiting for computer users seduced into launching the attached document.

Instead, the program started chewing into graphics, music and some text files written in what is called visual basic script, renaming them so computers would find it difficult if not impossible to recover them.

It even set about searching for Internet passwords, including those for online bank accounts, which it then tried to e-mail to overseas Websites now being pursued by the US Federal Bureau of Investigation.

The virus also replicated itself by worming its way into e-mail address books, hurling itself at every listed contact, even before it dawned on previous recipients that they had spread the infection to customers and friends.

One Herald reporter received a declaration of love in an exotic language unknown to him, before he realised the name of the sender was of a Norwegian journalist to whom he gave a business card about six months ago.

Luckily, the newspaper's information technology boffins had already alerted all staff to the outbreak, even though the Herald uses a different e-mail server from the Microsoft Outlook package most susceptible to the bug.

One Auckland printing company was reported by an associate to have lost large volumes of customers' data, but that could not be independently verified.

Other large users, such as State Insurance and the Government's education and fisheries ministries, voluntarily disabled their systems to limit any damage.

Parliament faced none of the disruption which crippled communications in the Britain's House of Commons, as MPs were forewarned by news bulletins on their way to work.

But State Services Minister Trevor Mallard, releasing details of a rapid audit of Government agencies, described the Love Bug as the most serious computer virus to hit this country.

"We regard this as a malicious attack on critical infrastructures."

He hoped the delay in the bug's reaching New Zealand would help to minimise the effects.

"But I want to emphasise it is already very serious."

He said some departments, such as Statistics New Zealand, had closed down their external e-mail systems. Most Government departments were immediately updating their virus protection systems.

Once the initial crisis was sorted out, precautions would be reviewed with a cross-Government approach to ensure New Zealand stayed in the forefront of protection.

Mr Mallard said home users should not open their e-mail package until they had received advice from their Internet service provider or updated anti-virus protection.

And last night, the insurance industry had chilling news for people stung by the virus.

Insurance Council chief executive Chris Ryan said some firms were covered for accidental damage to computer systems, but not for acts of vandalism such as virus infections.

A few specialised insurers are beginning to offer cover, but it is not yet common in New Zealand.

Self-replicating computer viruses often do little damage other than wasting time because their "payloads" are limited.

Melissa infected 300,000 computers worldwide before its designer, who named it after a lap dancer he knew and faces up to 10 years' jail, was put on trial in the United States in December.

Just six weeks ago, an Auckland public relations consultant received a virus called Pretty Park which he unwittingly passed to hundreds of media contacts.

But the Love Bug has flabbergasted computer experts by the speed at which it is spreading - twice as fast as Melissa in the first 10 hours since it was detected overseas late on Thursday - and because of its lethal multipurpose payload.

By late yesterday, Telecom's Xtra Internet service had deleted about 9000 messages through electronic filters. E-mail traffic was running at twice normal volumes, said spokesman Chris Thompson, leading to fears that it could start crippling some smaller Internet servers.

Mr Thompson said the extra traffic was mainly from computer users warning associates against the virus.

Internet provider ihug also took the unusual step of screening e-mail from yesterday morning, but the virus had already struck many of its customers and, by late yesterday, it had blocked 200 outward-bound Love Bug messages.

Users who disabled their Microsoft Outlook packages also lost associated features such as calendars, disrupting meeting schedules in organisations such as the Ministry of Education. Phone bills soared as the ministry and other big users resorted to older technology while purging their e-mail systems.

The crisis is painting the embattled Microsoft Corporation in even worse light, with international computer experts railing at the vulnerability of its standardised systems to virus attacks.

Graham Cluley, of British anti-virus software company Sophos, said: "Microsoft's monopoly is a key problem. The whole world is using the same operating system."

His criticism was amplified in New Zealand by ihug engineering manager John Russell, who said it was "totally irresponsible" of Microsoft to have supplied one e-mail package that automatically opened attached files.

Links:

Virus Bulletin

F-Secure Corporation

Network Associates (to download anti virus update)

Sophos

Symantec AntiVirus Research Center