2000WormSocial engineering
ILOVEYOU (Love Letter) worm
4 May 2000
ILOVEYOU arrived as an email with the subject line "ILOVEYOU" and an attachment that looked like a text file but was a Visual Basic script. When opened it overwrote many files and mailed itself to everyone in the victim's Outlook address book, so it spread around the world within hours.
- Victim
- Windows users and organisations worldwide
- Sector
- Cross-sector
- Public attribution
- The cited advisories do not attribute it; this page makes no attribution.
Impact
Within hours of the first reports, CERT/CC had heard from hundreds of sites with hundreds of thousands of affected systems (CERT Advisory CA-2000-04, as redistributed by AusCERT).
Root cause
Users trusted an emotionally appealing lure, file extensions were hidden by default so a .vbs script looked like a .txt file, and the script host ran it without restriction.
Lessons learned: the controls it teaches
- Show full file extensions and block script attachments such as .vbs at the email gateway.
- Security awareness training on lures that play on curiosity or emotion.
- Restrict script hosts and macro execution on endpoints.