the ILOVEYOU virus

securityops culture

The 2000 email worm whose 'ILOVEYOU' subject line tricked millions into infecting their own machines.

Opening the attached 'love letter' ran a script that overwrote files and mailed itself to the victim's entire address book, spreading around the globe in hours. Its social hook, not any technical brilliance, is what made it one of the most damaging worms of its time.

ILOVEYOU spread in May 2000 as an email attachment with a subject line promising affection, and reached millions of machines in days. It overwrote files, harvested passwords, and mailed itself to everyone in the victim's address book, which is why it moved faster than anything before it.

The technical trick was social rather than clever. The attachment was a script whose real extension was hidden by a Windows default that concealed known file types, so a file that looked like a text document was executable. The virus did not defeat a security control; it exploited an interface decision made for tidiness, and the interaction between a cosmetic default and an executable file format was the whole vulnerability.

Its lasting effect was on defaults rather than on antivirus. Mail systems began stripping executable attachments, scripting hosts were restricted, and the assumption that a user's judgement is the last line of defence lost credibility in a way that produced real architectural change. The other legacy is the recognition that a message from a known contact carries trust that the content has not earned, which is still the mechanism behind most successful phishing.

Also known as: ILOVEYOU, Love Bug, LoveLetter

← All glossary entries