Love Bug Virus Creator Comes Clean
On its 20th anniversary, Onel de Guzman has admitted writing the virus-laden love letter that infected 45 million machines, claiming he had no idea it would spread worldwide.
— -
The creator of the world’s first global computer virus has admitted to his guilt, 20 years after his software infected tens of millions of machines worldwide.
Filipino Onel de Guzman, now 44, says he unleashed the “Love Bug” computer worm to steal passwords so he could access the internet without paying. He claims he never intended to spread it worldwide, and regrets the damage his code caused.
“I didn’t expect it would get to the US and Europe. I was surprised,” he said in an interview for Crime Dot Com, my forthcoming book on cybercrime.
The “Love Bug” outbreak began on May 4th, 2000. Victims were tricked into opening an email attachment entitled LOVE-LETTER-FOR-YOU. A virus hidden in the attachment would then overwrite files, steal passwords, and automatically send copies of itself to all contacts in the victim’s Microsoft Outlook address book.
Within 24 hours, the virus caused major problems across the globe. It reportedly infected 45m machines. But in addition, it overwhelmed organisations’ email systems, clogging them up. Some IT managers disconnected parts of their infrastructure to prevent infection. This led to estimates of damage and disruption running into billions of pounds.
In the UK, Parliament shut down its email network for several hours to protect itself, and even The Pentagon was reportedly affected.
“Love Bug” was not the first such computer worm: the previous year, the Melissa malware had reportedly infected a million machines using similar tactics. However, in the speed and scale of its propagation, the “Love Bug” dwarfed previous outbreaks and exposed the vulnerability of the world’s increasingly internet-connected existence to attack.
Investigators, including the FBI, traced where the stolen passwords were being sent, and discovered an email address registered in the Philippines. From there they homed in on an apartment in the capital Manila. The occupant’s brother was Onel de Guzman, a computer science student at the city’s AMA Computer College. He was a member of an underground hacking group called GRAMMERsoft and quickly became the lead suspect.
A press conference was held on May 11th and de Guzman appeared before the world’s media. But he appeared to speak little English and communicated mainly through his lawyer. When asked whether he may have released the virus accidentally, de Guzman said “It is possible”.
However, at the time the Philippines had no law covering computer hacking: neither de Guzman nor anyone else was ever prosecuted. Suspicion also fell on de Guzman’s fellow student Michael Buen, another GRAMMERsoft member whose name was found on computer diskettes discovered in the apartment raided by police. As a result, Buen is frequently cited online as the co-author (and sometimes sole author) of the “Love Bug”.
For my book on cybercrime, Crime Dot Com, I set out to finally lay to rest the mystery of who was behind the virus by tracking down Onel de Guzman.
Online rumours claimed he had moved to Germany, to Austria or to the US. Some claimed he had been recruited by Microsoft following the outbreak. All proved to be wide of the mark.
On a forum dedicated to the Filipino underworld, a user claimed in 2016 that de Guzman ran a mobile phone repair shop in the Quiapo district of Manila. In April 2019 I visited the area hoping to find the “Love Bug” suspect, only to find a sprawling market containing dozens of mobile phone repair shops.
In desperation, I wrote Onel de Guzman’s name on a piece of paper and showed it to shop workers at random in the hope that someone would recognise it. Finally an employee said he knew of de Guzman and believed he worked in another phone repair booth at a shopping mall elsewhere in Manila.
After several hours wandering the mall, still brandishing de Guzman’s name, I was directed to a cramped, messy stall at the very back of the building, and after waiting several hours for him to turn up, I came face to face with Onel de Guzman.
His face has filled over two decades, but some distinctive facial features convinced me it was him, even before he began describing the virus and his part in its creation and spread.
De Guzman speaks in broken English, and claims his lawyer told him to pretend not to speak the language in the press conference in 2000. He claims the “Love Bug” was a revamped version of an earlier virus he had created in order to steal passwords. In the era of dial-up Internet, such passwords were needed to get online, and de Guzman says he could not afford access himself.
He claims he initially sent the virus only to Filipino victims with whom he communicated in chatrooms, because he only wanted to steal Internet access passwords that would work in his local area.
However, in spring of 2000 he tweaked the code. He added an auto-spreading feature that would send copies of the virus to victims’ Outlook contacts, using a flaw he says was present in Microsoft’s Windows 95 operating system. He also created a title for the email attachment that would have global appeal, tempting people across the world to open it.
“I figured out that many people want a boyfriend, they want each other, they want love, so I called it that,” he said.
De Guzman claims he sent the virus initially to someone in Singapore, and then went out drinking with a friend. The first he knew of the global chaos he had unleashed was when his mother told him police were hunting a hacker in Manila.
His mother hid his computer equipment, but left the diskettes containing de Guzman’s classmates’ names, including Michael Buen. De Guzman insists Buen had nothing to do with the “Love Bug” and that he was its sole creator.
After a period of lying low, de Guzman returned to computer work but did not go back to college. He now runs the small booth with another member of staff. He says he regrets writing the virus, and the infamy it has brought.
“Sometimes I get my picture on the Internet,” he said. “My friends say, ‘It’s you!’ I’m a shy person, I don’t want this.”
The “Love Bug” may have faded into history, but its story has echoes in the current, virus-afflicted world.
Just like coronavirus, de Guzman’s infection spread from East to West, crippling computer systems as the working day began and employees opened up their email inboxes.
De Guzman’s virus exploited a weakness in Windows computers, a fatal vulnerability in the digital immune system for which a fix could not be generated quickly enough to stop the spread.
The damage was mainly caused not by the virus itself, but by organisations (such as Parliament), sealing off their networks to prevent infection. In a digitally connected world, isolating computers proved to be as economically ruinous as distancing people.
But where viruses like “Love Bug” differed from SARS-Cov-2 is that their victims immediately knew they were infected, because their files were unusable. In the 20 years since the Love Bug, that’s changed: the best computer viruses now sit, stealthily controlling computers without the user’s knowledge. And it’s exactly these hidden infections that are being used to spread the current round of coronavirus spam email.
— -
Crime Dot Com — From Viruses to Vote Rigging, How Hacking Went Global by Geoff White will be published by Reaktion Books on August 10th and is available to pre-order now on Amazon.
