Twenty-six years ago, on March 28, 1999, the FBI took a historic step: Its National Infrastructure Protection Center (NIPC) issued its first warning about a computer virus. The NIPC had “received reports of significant network degradation and email outages,” and while there were no reported effects to data, system administrators were being forced to shut down affected networks and email servers. Let’s dive into this week’s Tech Time Warp.
A defining moment in cyber threat history
The virus to trigger this cybersecurity milestone was the Melissa virus, the work of a New Jersey man named David Lee Smith. According to the U.S. Department of Justice, Smith used a stolen America Online account to post a document containing the virus on an “Alt.Sex” internet newsgroup. The document purportedly contained access codes to pornographic websites but actually infected the opening user’s machine with the Melissa virus. (Melissa was reportedly named for a stripper in Florida.) If a user took the bait and was running Outlook on their machine, guess what? Their first 50 contacts received an email carrying the document and so on. The email subject was “Important Message From Application.UserName,” and its message read “Here is the document you asked for … don’t show anyone else.”
It was social engineering at its finest. In the early days of the internet and with the promise of pornography, Melissa spread like wildfire.
In his plea agreement, Smith acknowledged his handiwork had caused more than $80 million in damage. Lockheed Martin shut down its email system to deal with Melissa. The Computer Emergency Response Team (CERT) at Carnegie-Mellon University estimated at least 250 other organizations did the same.
Did you enjoy this installation of SmarterMSP’s Tech Time Warp? Check out others here.
Photo: Ceri Breeze / Shutterstock
This post originally appeared on Smarter MSP.