10 ms·

> he tweaked the code, adding an auto-spreading feature that would send copies of the virus to victims' Outlook contacts, using a flaw in Microsoft's Windows 95

by jwilk 7y ago

> he tweaked the code, adding an auto-spreading feature that would send copies of the virus to victims' Outlook contacts, using a flaw in Microsoft's Windows 95 operating system. What's the flaw?

tachion 7y ago
It's Windows 95.
jplayer01 7y ago
Beyond the fact that W95 was a terrible POS security-wise, I can't find any more detailed information with a brief Google search. I wish there was a site that did in-depth analysis of how a virus worked and presented that technical information for public readers. edit: Although, this is decent https://malware.wikia.org/wiki/ILoveYou https://malware.wikia.org/wiki/ILoveYou
- easytiger 7y ago
  It was a .vbs that the user has to run by clicking on it
  - jplayer01 7y ago
    Yeah, thanks for the complete lack of technical detail? The link I gave adds stuff like When the worm is executed, it copies itself as the files LOVE-LETTER-FOR-YOU.TXT.VBS and MSKERNEL32.VBS in the Windows_system_folder and WIN32DLL.VBS in the Windows directory. It creates its own key named MSKernel32 under the Local machine registry key that causes programs to run and adds the value MSKERNEL32.VBS to it. It also creates a new Local Machine RunServices key named Win32DLL and adds WIN32DLL.VBS as a value to it, so it will run when the system boots, before the user even logs on. which is far more interesting than "a user is tricked into running a vbs script". And this is HN, that one liner is really not sufficient. edit: Why is this getting downvoted? He comments with a zero effort comment with zero useful information in response to my legitimate question and I get shit on. Typical HN. Fucking hate you stupid assholes.
- skrebbel 7y ago
  > W95 was a terrible POS In their defense, it wasn't really designed for cash registers anyway.
  - syockit 7y ago
    Yes, but when you market yourself as a general purpose OS, someone is bound to use it somewhere they deem to be a general purpose. Not to mention it's easier for lay people to program things for Win95 than other OS due to availability and also due to VB. When I was a kid and saw an out of order POS was showing Win95 desktop (could be NT. When did NT start having start menu?), I thought it was cool. I wanted to play Solitaire on it while waiting for my mom to finish paying at some other counter.
    - jonhohle 7y ago
      Whoosh! I believe the comment you replied to was a dad-joke level double entendre. > When did NT start having start menu? Windows NT 4 in 1996 had a similar shell to Windows 95.
      - jplayer01 7y ago
        > Whoosh! I believe the comment you replied to was a dad-joke level double entendre. That was a master level dad joke. I didn't realize either until reading your comment.
- NiekvdMaas 7y ago
  Here is the source code: http://www.cexx.org/loveletter.htm http://www.cexx.org/loveletter.htm I love that the guy put in his email and physical location.
easytiger 7y ago
If I recall... That file extensions were hidden by default and that double clicking on a .vbs file ran it.
- usrusr 7y ago
  A fresh install of Windows 10 will still try to pull that off.
  - bzb3 7y ago
    Like an exe. And thank the lord we can still easily run all the code we want on Windows. We can't say the same thing about our mobiles or video game consoles, and OS X is making it as hard as they can.
    - easytiger 7y ago
      I ditched OSX a while back and that idiotic measure was a significant contributor
      - dicknuckle 7y ago
        I'm not familiar with OSX anymore, are you referring to the Developer ID Certificate requirement? That's all I found with a quick search.
        filmgirlcw 7y ago
        Applications have to be signed now (unless you explicitly turn off all protections), yes, but I think GP is referring to Gatekeeper — which would prevent a file from executing unless you right click and choose “allow” for programs from an unknown developer. But a right click could get it to run. Now applications need to be notarized with Apple in order to work in macOS (unless you flat out disable all security), which adds an extra burden on developers but ostensibly offers much more security.
dharmab 7y ago
The flaw was the entire security model of Windows 95. The "virus" was a VBS script that the email convinced humans to double-click on, which ran the script immediately with enough privileges to access virtually anything on the computer.
- upofadown 7y ago
  That sounds like it was entirely on Outlook. An email client should not allow you to accidentally execute code.
  - filmgirlcw 7y ago
    But if you did want to purposefully execute code, you’re saying a mail client shouldn’t let you open an attachment by design? As far as I remember, this wasn’t a more advanced virus that self-executed upon being opened. People had to willingly double-click the VBS file. The self-replication and use of the address book was clever — and it was a definite Windows flaw that ultimately allowed it all to work — but I don’t think allowing people to willfully execute an attachment is a flaw. It was after Melissa and this incident that you started seeing the very public campaigns telling people not to open unknown or weird attachments. And AV vendors like Norton started doing more robust AV updates online (rather than selling new virus definitions on floppy disk or CD-ROM) each year. Norton was already doing online definition updates in 2000, but I seem to recall (I was 16 so my memory is fuzzy) the updates becoming more frequent. I do remember having to install ILoveYou patches on my dad’s computer and my uncle’s computer down the street. I’m also pretty sure this was one of the viruses we purposefully sent around our high school’s network that helped get the entire county infected. Novell’s enterprise rules didn’t catch up until it was too late.
    - upofadown 7y ago
      >But if you did want to purposefully execute code, you’re saying a mail client shouldn’t let you open an attachment by design? That sounds reasonable. You should have to save the attachment and run it from disk. The chances of any hunk of executable code being of some potential use on your particular architecture and OS was low back in the Win95 days and is even lower these days.

by jwilk 7y ago

> he tweaked the code, adding an auto-spreading feature that would send copies of the virus to victims' Outlook contacts, using a flaw in Microsoft's Windows 95 operating system. What's the flaw?

tachion 7y ago

It's Windows 95.

jplayer01 7y ago

Beyond the fact that W95 was a terrible POS security-wise, I can't find any more detailed information with a brief Google search. I wish there was a site that did in-depth analysis of how a virus worked and presented that technical information for public readers. edit: Although, this is decent https://malware.wikia.org/wiki/ILoveYou https://malware.wikia.org/wiki/ILoveYou

easytiger 7y ago
It was a .vbs that the user has to run by clicking on it
- jplayer01 7y ago
  Yeah, thanks for the complete lack of technical detail? The link I gave adds stuff like When the worm is executed, it copies itself as the files LOVE-LETTER-FOR-YOU.TXT.VBS and MSKERNEL32.VBS in the Windows_system_folder and WIN32DLL.VBS in the Windows directory. It creates its own key named MSKernel32 under the Local machine registry key that causes programs to run and adds the value MSKERNEL32.VBS to it. It also creates a new Local Machine RunServices key named Win32DLL and adds WIN32DLL.VBS as a value to it, so it will run when the system boots, before the user even logs on. which is far more interesting than "a user is tricked into running a vbs script". And this is HN, that one liner is really not sufficient. edit: Why is this getting downvoted? He comments with a zero effort comment with zero useful information in response to my legitimate question and I get shit on. Typical HN. Fucking hate you stupid assholes.
skrebbel 7y ago
> W95 was a terrible POS In their defense, it wasn't really designed for cash registers anyway.
- syockit 7y ago
  Yes, but when you market yourself as a general purpose OS, someone is bound to use it somewhere they deem to be a general purpose. Not to mention it's easier for lay people to program things for Win95 than other OS due to availability and also due to VB. When I was a kid and saw an out of order POS was showing Win95 desktop (could be NT. When did NT start having start menu?), I thought it was cool. I wanted to play Solitaire on it while waiting for my mom to finish paying at some other counter.
  - jonhohle 7y ago
    Whoosh! I believe the comment you replied to was a dad-joke level double entendre. > When did NT start having start menu? Windows NT 4 in 1996 had a similar shell to Windows 95.
    - jplayer01 7y ago
      > Whoosh! I believe the comment you replied to was a dad-joke level double entendre. That was a master level dad joke. I didn't realize either until reading your comment.
NiekvdMaas 7y ago
Here is the source code: http://www.cexx.org/loveletter.htm http://www.cexx.org/loveletter.htm I love that the guy put in his email and physical location.

easytiger 7y ago

If I recall... That file extensions were hidden by default and that double clicking on a .vbs file ran it.

usrusr 7y ago
A fresh install of Windows 10 will still try to pull that off.
- bzb3 7y ago
  Like an exe. And thank the lord we can still easily run all the code we want on Windows. We can't say the same thing about our mobiles or video game consoles, and OS X is making it as hard as they can.
  - easytiger 7y ago
    I ditched OSX a while back and that idiotic measure was a significant contributor
    - dicknuckle 7y ago
      I'm not familiar with OSX anymore, are you referring to the Developer ID Certificate requirement? That's all I found with a quick search.
      - filmgirlcw 7y ago
        Applications have to be signed now (unless you explicitly turn off all protections), yes, but I think GP is referring to Gatekeeper — which would prevent a file from executing unless you right click and choose “allow” for programs from an unknown developer. But a right click could get it to run. Now applications need to be notarized with Apple in order to work in macOS (unless you flat out disable all security), which adds an extra burden on developers but ostensibly offers much more security.

dharmab 7y ago

The flaw was the entire security model of Windows 95. The "virus" was a VBS script that the email convinced humans to double-click on, which ran the script immediately with enough privileges to access virtually anything on the computer.

upofadown 7y ago
That sounds like it was entirely on Outlook. An email client should not allow you to accidentally execute code.
- filmgirlcw 7y ago
  But if you did want to purposefully execute code, you’re saying a mail client shouldn’t let you open an attachment by design? As far as I remember, this wasn’t a more advanced virus that self-executed upon being opened. People had to willingly double-click the VBS file. The self-replication and use of the address book was clever — and it was a definite Windows flaw that ultimately allowed it all to work — but I don’t think allowing people to willfully execute an attachment is a flaw. It was after Melissa and this incident that you started seeing the very public campaigns telling people not to open unknown or weird attachments. And AV vendors like Norton started doing more robust AV updates online (rather than selling new virus definitions on floppy disk or CD-ROM) each year. Norton was already doing online definition updates in 2000, but I seem to recall (I was 16 so my memory is fuzzy) the updates becoming more frequent. I do remember having to install ILoveYou patches on my dad’s computer and my uncle’s computer down the street. I’m also pretty sure this was one of the viruses we purposefully sent around our high school’s network that helped get the entire county infected. Novell’s enterprise rules didn’t catch up until it was too late.
  - upofadown 7y ago
    >But if you did want to purposefully execute code, you’re saying a mail client shouldn’t let you open an attachment by design? That sounds reasonable. You should have to save the attachment and run it from disk. The chances of any hunk of executable code being of some potential use on your particular architecture and OS was low back in the Win95 days and is even lower these days.