Computer Viruses

From ETHW

Brain A

Basit and Amjad Farooq Alvi

In January 1986, two brothers, Basit and Amjad Farooq Alvi, created “Brain A,” the first computer virus to attack the MS-DOS operating system, in Lahore, Pakistan. The programmers, aged 17 and 24, respectively, ran a computer store that sold software—both their original creations and pirated versions of popular programs like Lotus 1-2-3 and WordStar. Alarmed that their customers were illegally copying their software, they created a “friendly” virus designed to track how far the programs had spread and to punish the piracy. It was the first of millions of viruses to strike personal computers, and the dawn of the $4 billion anti-virus industry.

In creating the virus, the brothers’ purported targets were customers who illegally copied a heart monitoring program they designed for IBM-compatible computers. But they also included the virus on the 5.25 inch floppy disks storing software that they had pirated themselves and sold to American tourists. These buyers paid as little as $1.50 for programs that cost hundreds of dollars in the United States.

When buyers got home and loaded the software, a virus infected the boot sector of their floppy disks. The virus occupies three sectors and displaces the normal boot sector in order to mimic the boot process. It slowed down the floppy disk drive, but generally did not infect the hard disk. As a result, users often did not notice their computers were infected. When they copied the program and distributed it to other users, floppy disks inserted in their computers became infected. Unlike a modern virus, of course, its destructive potential was limited to computers exposed to an infected disk.

All along, the brothers were selling pirated versions of foreign software to Pakistani buyers that was free of bugs, under the rationale that computer software could not be copyrighted in Pakistan. But the software they sold to Americans contained the virus.

Perhaps the most surprising part of this story was that the brothers actually included their names, addresses, and phone numbers in the lines of infected code, urging victims to “Contact us for vaccination.” When the infected boot sector is successfully read, often there is text displayed to the user regarding that that their computer had been infected with a virus. These text vary in display, and are dependent on the programmer. [1]They soon received numerous calls from the United States and Europe demanding that the programmers disinfect their computers. A media frenzy ensued. The New York Times, TIME Magazine, and other outlets all reported on this act of programmer retribution.

The Brain Virus was relatively harmless, though some instances have been known to overlay FAT and data areas, its original purpose was designed to scare users who were pirating software. It was the earliest known MS-DOS virus and was also the first example of a "stealth" virus. When a user requests to view the original boot sector, the infected system will display the original boot sector, deceiving the user into believing that nothing had changed [2].

Basit and Amjad Farook Alvi never faced criminal charges but claimed to stop selling infected software in 1987. They became leaders in Pakistan’s technology industry, and now run Brain Net.

Brain Net is currently the largest service provider in Pakistan with a presence in over 350 cities, and one of the largest within the Middle East for the consumer and corporate sector. It was established in 1982 and is one of the first ISP's in the Internet Service Industry in Pakistan. In 1992, Brain Net was the first to innovate the emailing system in Pakistani region, and to incorporate commerce internet services to the area. Currently Brain net owns the largest Optic Fiber network in Lahore in which many IT companies are subscribed to, and hold an agreement under the Local Loop License (LLC) by Pakistan Telecommunication Authority (PTA) to run Telecom operations in Lahore under BrainTEL.

Love Bug

Originating in the year 2000, the ILOVEYOU was a virus that disguised itself as a love letter via email. Sent as a spam message to millions of people across the globe, the virus would be an email that read the subject "I LOVE YOU" with the attached message saying "kindly check the attacked love letter coming from me." If the user were to open the attached document, a virus would open and begin to replace itself with all the files with media extensions such as images, mp3s, and documents with itself. Acting as a worm, it would send an identical copy of itself via email to all the contacts of the victims address book.

Developed for destructive purposes, the ILOVEYOU virus had caused extensive damage, affecting thousands of corporate sites, businesses, and individual computers. An example of such places to be affected by the virus were the Silicon Graphics, the Department of Defense , Daimler Chrysler, The Motion Picture Association of America, the Federal Reserve and Cox Cable. Due to the the viruses ability to destroy data, it was estimated that it caused $5.5-8.7 billion dollars worth of damages. Additionally, due to the virus's nature to easily spread, it costed roughly $15 billion worldwide to remove, as the virus had infected more then 10 million computers worldwide, inevitably spreading to more then 45 million worldwide.

Onel de Guzman, former student of the Phillippines AMA Computer College was suspected of creating the virus. Hailing from the city of Manila, he acknowledged that he may have released the virus by accident, but refused to admit he authored it. Additionally, earlier in the year he had failed to graduate university after his professors rejected his thesis proposal for a program which steals internet passwords, a feature located within ILOVEYOU. Eventually the virus was traced to his apartment via telephone line by internet providers. The Philippines at the time didn't have laws that allowed for the prosecution of computer crimes and Onel de Guzman was instead charged with theft and violation of the law which related to credit card fraud. These charges were dropped under the notion that there was no sufficient evidence to support these specific claims.

References