Anna Kournikova (computer virus)
2001 computer virus inside email attachment
From Wikipedia, the free encyclopedia
The Anna Kournikova virus (also known as VBS/OnTheFly, VBS/SST and VBS_Kalamar) was an email worm released on 11 February 2001 by Jan de Wit, a 20-year-old Dutch man who used the online name "OnTheFly". He created it within a few hours using the Vbs Worm Generator, a toolkit developed by an Argentine programmer known as "[K]Alamar". The worm was disguised as a photograph of Russian tennis player Anna Kournikova in an attachment named AnnaKournikova.jpg.vbs. When opened on a Windows computer using Microsoft Outlook, it attempted to send itself to every address in the user's address book.
| Anna Kournikova | |
|---|---|
| Malware details | |
| Type | Computer virus |
| Origin | Sneek, Netherlands |
| Author | Jan de Wit |
| Technical details | |
| Written in | VBScript |
The worm spread worldwide on 12 February. Contemporary reports variously put the number of infected computers at hundreds of thousands or millions. The worm did not corrupt stored data, but the email traffic it generated threatened to overload systems, and some businesses shut down their email services as a precaution. De Wit posted an online admission and surrendered to police on 14 February. In September 2001, the court rejected De Wit's denial that he had intended to cause damage and sentenced him to 150 hours of community service. The court also confiscated his CD-ROM virus collection.
Creation and operation
On 11 February 2001, Jan de Wit, a 20-year-old Dutch man who used the online name "OnTheFly", downloaded the Vbs Worm Generator and used it to create the worm later that day.[1][2] The generator had been developed by an Argentine programmer known as "[K]Alamar".[3] At about 3:00 p.m. that day, De Wit posted the worm to an Internet newsgroup.[1]
The worm arrived in an email with a subject beginning "Here you have" and an attachment named AnnaKournikova.jpg.vbs, presented as a photograph of Kournikova.[4][2] The filename used a double extension, and Microsoft Outlook could suppress the final .vbs, making the attachment appear to be a JPEG image.[5] When opened on a Windows computer, the file ran a VBScript program that attempted to mail itself to every address in the user's Outlook address book instead of displaying a photograph.[1][2] Because it spread automatically to other recipients, it was classified as a worm.[1]
Outbreak and impact
On 12 February, the day after De Wit released it, the worm spread worldwide.[1] The CERT Coordination Center received reports from more than 100 sites that day. Mail.com blocked nearly 53,000 copies in one 24-hour period, while MessageLabs had stopped another 18,000 by 14 February.[1] Estimates of the outbreak's size differed. IDG News Service reported that hundreds of thousands of computers were infected within two days, while Out-Law reported claims that the number had reached millions.[6][3] The worm affected email services in the United States and Europe; in Australia, Trend Micro reported at least 50,000 affected users and 15 severely affected organisations.[5]
The worm did not corrupt stored data or directly damage files on infected computers.[3][1] Its mass mailing generated heavy email traffic that threatened to overload servers, and some businesses shut down their email systems as a precaution.[3][6] Mikko Hyppönen of F-Secure said that the heavy traffic, email shutdowns and reputational damage caused economic losses for businesses.[6] Although the outbreak was smaller and less destructive than ILOVEYOU, virus experts quoted by BBC News described it as the largest outbreak since ILOVEYOU in May 2000.[3][5]
Identification and prosecution
On 13 February, De Wit posted an online statement under the name "OnTheFly" in which he said that he had created the worm with the Vbs Worm Generator.[1][3] He said that he wanted to test whether email users had learned from the ILOVEYOU outbreak and denied intending to harm those who opened the attachment.[3] After discussing the outbreak with his parents, he surrendered to police in Sneek the following morning.[1] David L. Smith, the author of the Melissa worm, also supplied the FBI with De Wit's name, home address and email address; the FBI passed the information to European authorities.[7]
De Wit went on trial in Leeuwarden in September 2001. He was charged with spreading data through a computer network with the intention of causing damage, an offence carrying a maximum sentence of four years' imprisonment and a fine of 100,000 guilders.[6] The prosecutor sought 240 hours of community service and asked the court not to return De Wit's computer or a CD-ROM containing computer viruses.[6] The defence sought an acquittal, arguing that there was no convincing evidence that De Wit had caused damage or interrupted any service. De Wit admitted creating the worm but said that he had not foreseen its effects and had not intended to cause damage.[6]
The FBI submitted an estimate of about US$166,000 in losses based on reports from 55 firms, but the court found that the report lacked sufficient detail.[8] On 27 September, De Wit was sentenced to 150 hours of community service, with 75 days' imprisonment as the alternative.[8] The court rejected his denial of intent, finding that his work in a computer shop and extensive virus collection meant that he should have understood the likely consequences.[8] It took his voluntary surrender and status as a first-time offender into account, and confiscated his CD-ROM virus collection.[8]
Aftermath
Within a week of the outbreak, Sneek mayor Sieboldt Hartkamp said that he was prepared to offer De Wit an interview for a municipal information technology job after De Wit completed his studies. Sophos criticised the proposal, saying that virus writers should not be rewarded and that De Wit had shown little programming skill because he used a construction kit.[9]
On 16 February, an 18-year-old Argentine programmer using the name "[K]Alamar", who said that he had created the Vbs Worm Generator, removed the program from his website after his alias was mentioned on television. He said that friends had advised him to remove the program. According to ZDNet, he regarded himself as an involuntary accomplice in the outbreak.[4] In 2020, Gente identified Javier Derderyan as the person who had used the name "kalamar". Derderyan said that he had created software intended to help others learn virus programming and that the outbreak led him to reconsider that work.[10]