ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected tens of millions of Windows computers following its release on 4 May 2000. The worm was mainly distributed through email attachments sent to contacts on an infected system's address book, and is an example of malware using social engineering to aid its spread. Once run, the worm overwrites files with its source code and attempts to spread to other computers.

The worm was created by Onel de Guzman, a dropout of AMA Computer College in the Philippines, because of his belief that internet access was a human right; the worm attempts to download a computer trojan that steals dial-up Internet access credentials to fulfil this aim. Philippine prosecutors ultimately dropped all charges against de Guzman because of a lack of laws against hacking in the country. In response, President Joseph Estrada signed an e-commerce law to cover against similar activity.

Affecting an estimated 10% of internet-connected computers at the time, the ILOVEYOU worm is considered to be one of the most virulent examples in the history of malware. The worm caused approximately US$10 billion worth of damages to numerous government agencies and corporations. It has inspired several creative works, including art installations, songs and films.

Background

The ILOVEYOU worm was coded by Onel de Guzman, a former student at AMA Computer College in the Philippines. At the time of its creation, de Guzman was poor and struggling to pay for the country's dial-up internet access. De Guzman believed that internet access was a human right, He reasoned that this would allow users to afford an internet connection, arguing that those affected by it would experience no loss. De Guzman later described his professors as close-minded, and eventually dropped out of the college.

Technical details

De Guzman wrote ILOVEYOU in the programming language VBScript. The Windows Script Host is used by Windows to run its code. ILOVEYOU was distributed through malicious email attachments. The worm was found in emails with the subject "ILOVEYOU" and a message of "kindly check the attached LOVELETTER coming from me." The attachment <code>LOVE-LETTER-FOR-YOU.TXT.vbs</code> contained the worm. The worm also removes a 10-second timeout for scripts set in the Windows Registry, so it can continue to run without constraints. encouraging potential victims to open the infected attachment by playing on their romantic desires. By using each victim’s address book, emails sent by the worm appeared to come from close contacts. This further encouraged recipients to run the worm. The worm's subsequent success demonstrated the capability of social engineering, which continues to be used in many modern-day malware attacks. Over 25 variants of the ILOVEYOU worm have been recorded. Variants of ILOVEYOU differed from the original worm in many aspects, such as changing which file extensions were affected, and modifying the worm's email subject and body to target specific audiences.

Computer worm NewLove, which spread in a similar fashion to ILOVEYOU, was especially destructive since it targeted every file on the victim's hard drive until their computer stopped working and evaded antivirus software. Despite widespread coverage of this worm by media outlets, it failed to cause significant damage. moving westward through corporate email systems as employees began their workday first to Hong Kong, then to Europe, and finally the United States. One user opening an attachment was enough to compromise entire networks. Email systems had to be shut down due to the volume of incoming mail sent by the worm. The worm affected numerous financial institutions, including the banking system of Belgium. The Veterans Health Administration received 7,000,000 ILOVEYOU emails during the outbreak, requiring 240 man-hours of work to resolve the problems created. ISPs also linked ILOVEYOU to a phone line registered to an apartment associated with de Guzman. De Guzman's mother warned him of the worm's public attention and hid his computer, but left behind floppy disks that unintentionally implicated other students from AMA Computer College. A police raid on 8 May 2000 led to the seizure of these disks and the arrest of de Guzman's sister's boyfriend.

The Philippines' National Bureau of Investigation was unsure of what felonies could apply since there were no specific laws against hacking in the Philippines at the time. All charges against de Guzman were later dropped by prosecutors, since the evidence collected did not support what had been filed.

Later whereabouts and admission of de Guzman

De Guzman's last known public appearance was at a press conference on 11 May 2000, where he obscured his face and allowed his lawyer to answer most questions; his whereabouts remained mostly unknown afterward. Within ten days of the first reported cases, tens of millions of infections had been reported, and it is estimated that 10% of Internet-connected computers in the world were eventually affected. but estimates in the 2020s place it at approximately US$10 billion.

To address legislative deficiencies against computer hacking, Philippine President Joseph Estrada signed an e-commerce law in June 2000. Since this law was passed after the worm's release, de Guzman could not be prosecuted retroactively under it.

Cultural impact

ILOVEYOU has led to the creation of several creative works. It inspired the song "E-mail" by the English pop duo Pet Shop Boys, included in their top-ten album Release. The 2011 movie Subject: I Love You, starring Jericho Rosales and Briana Evigan, was also based off the worm. Multiple art installations reference the worm, including the 2006 exhibition "I love you [rev.eng]" and a 2019 email exhibition entitled "How to Prevent Hair Loss". The Persistence of Chaos, a laptop infected with notable malware including ILOVEYOU, was sold at auction in 2019 by Chinese artist Guo O Dong.

See also

  • Computer virus
  • Timeline of notable computer viruses and worms

References

  • Radsoft: The ILOVEYOU Roundup
  • "No 'sorry' from Love Bug author" at The Register
  • CERT Advisory CA-2000-04 Love Letter Worm (archive)