FBI: A Look Back At The Melissa Virus

The FBI released the below information:

Two decades ago, computer viruses—and public awareness of the tricks used to unleash them—were still relatively new notions to many Americans.

One attack would change that in a significant way.

In late March 1999, a programmer named David Lee Smith hijacked an America Online (AOL) account and used it to post a file on an Internet newsgroup named “alt.sex.” The posting promised dozens of free passwords to fee-based websites with adult content. When users took the bait, downloading the document and then opening it with Microsoft Word, a virus was unleashed on their computers.

On March 26, it began spreading like wildfire across the Internet.

The Melissa virus, reportedly named by Smith for a stripper in Florida, started by taking over victims’ Microsoft Word program. It then used a macro to hijack their Microsoft Outlook email system and send messages to the first 50 addresses in their mailing lists. Those messages, in turn, tempted recipients to open a virus-laden attachment by giving it such names as “sexxxy.jpg” or “naked wife” or by deceitfully asserting, “Here is the document you requested ... don’t show anyone else ;-).” With the help of some devious social engineering, the virus operated like a sinister, automated chain letter.

The virus was not intended to steal money or information, but it wreaked plenty of havoc nonetheless. Email servers at more than 300 corporations and government agencies worldwide became overloaded, and some had to be shut down entirely, including at Microsoft. Approximately one million email accounts were disrupted, and Internet traffic in some locations slowed to a crawl.

Within a few days, cybersecurity experts had mostly contained the spread of the virus and restored the functionality of their networks, although it took some time to remove the infections entirely. Along with its investigative role, the FBI sent out warnings about the virus and its effects, helping to alert the public and reduce the destructive impacts of the attack. Still, the collective damage was enormous: an estimated $80 million for the cleanup and repair of affected computer systems.

Finding the culprit didn’t take long, thanks to a tip from a representative of AOL and nearly seamless cooperation between the FBI, New Jersey law enforcement, and other partners. Authorities traced the electronic fingerprints of the virus to Smith, who was arrested in northeastern New Jersey on April 1, 1999. Smith pleaded guilty in December 1999, and in May 2002, he was sentenced to 20 months in federal prison and fined $5,000. He also agreed to cooperate with federal and state authorities.

The Melissa virus, considered the fastest spreading infection at the time, was a rude awakening to the dark side of the web for many Americans. Awareness of the danger of opening unsolicited email attachments began to grow, along with the reality of online viruses and the damage they can do.

Like the Morris worm just over a decade earlier, the Melissa virus was a double-edged sword, leading to enhancements in online security while serving as inspiration for a wave of even more costly and potent cyberattacks to come.

For the FBI and its colleagues, the virus was a warning sign of a major germinating threat and of the need to quickly ramp up its cyber capabilities and partnerships.

Fittingly, a few months after Smith was sentenced, the Bureau put in place its new national Cyber Division focused exclusively on online crimes, with resources and programs devoted to protecting America’s electronic networks from harm. Twenty years later, with nearly everything in our society connected to the Internet, that cyber mission is more crucial than ever.

U.S. Strategic Command General Cites Cyber Domain Challenges

By Cheryl Pellerin, American Forces Press Service

WASHINGTON, Oct. 19, 2011 - Space and cyberspace are growing in strategic importance as other nations increase their capabilities, the chief of U.S. Strategic Command told defense reporters here yesterday.

A recent example of cyber threats facing the Defense Department is a computer virus that affected a stand-alone ground control system for the nation's drone fleet based at Nevada's Creech Air Force Base, according to Stratcom commander Air Force Gen. C. Robert "Bob" Kehler.

The virus was not targeted at the drone fleet but entered "from the wild," Kehler said, adding the precise means of infection is still under investigation.

Stratcom systems detected the virus, quarantined it, and it had little to no impact on operations, he noted.

Both accidental and targeted attacks on DOD networks are on the rise, the general said.

"The trend is that we see multiple, deliberate attempts to try to get into our networks almost daily," he said.

Based at Offutt Air Force Base near Omaha, Neb., Stratcom serves as U.S. Cyber Command's headquarters, and also oversees the nation's missile defense, and global strike and space operations, as well as combating weapons of mass destruction.

The Stratcom mission set touches that of every other combatant command, Kehler said, noting that there are vital linkages between military and commercial information networks in areas like transportation and logistics.

"The Internet is mostly in the commercial and civil domains ... but we use it," he said.

Perfect defense of all networks is probably not achievable, but "mission assurance is something that we must achieve," Kehler said.

The Defense Department has made great progress in cyber defense, but "sometimes ... the more you know, the worse you look," he said.

In the past, some attacks may have gone undetected, the general explained, but defense officials are "far more aware today of the things that are happening to us, and we are taking strides to deal with the realities of operating in cyberspace."

Robust protections are in place on the "dot mil" domain and defense officials have begun a pilot program that extends some of those safeguards to defense industries, he noted.

A fundamental issue in cyber domain operations is defining what an attack is, and developing a legal framework, doctrine and rules of engagement for those operations, Kehler said.

"In other domains ... rules of engagement are based on things like hostile intent," he said. "Much of what we see on our networks or at our boundaries, at our firewalls, I'm not sure you could describe as an attack."

Cyberspace threats include predators, vandals and spies, not all of whom are attackers by national security terms, Kehler said.

He noted much of the hostile activity on DOD's networks involves attempts to steal industrial or military secrets.

"The word 'attack' makes it sound as though people are trying to take our systems down every day, and that's not the case," the general said.

Attempts to exploit military information or disrupt network activities could evolve into destructive attacks, Kehler said.

The United States has a military edge in cyberspace, but other nations possess "very sophisticated" capabilities in that domain, he said.

An important question being asked inside the Defense Department, Kehler said, is how to retain that edge as the global population gets smarter in cyberspace.

"I think there's a great question for us that goes all the way into our education system [and] our university system," the general said. "Can we, as a nation, provide the wherewithal in the information age to maintain a national security advantage, like we did in the industrial age?"

"I don't know that we quite have the answer yet," he added.

My On Crime & Security Column: Scareware: The FBI Issues a Warning About Those Pop-Up Bogus Security Warnings

The national online small business magazine Businessknowhow.com published my latest On Crime & Security column today.

The column deals with the FBI's warning about pop-up security warnings. The bogus security warnings pose a serious threat to your computer, as they may contain viruses.

My column, which also passes on the Federal Trade Commission's tips on how to handle the pop- ups, can be read here