The Love-Bug

Two of the biggest computer stories this year are the Microsoft anti-trust suit and the advent of highly malicious viruses spread by email. These are related much more closely than might first appear. Microsoft has become the most pervasive software supplier in the world with the unique position of supplying not only the operating system for most computers manufactured today, but supplying the key business software to run on those same machines. The pervasive use of Microsoft products and the demands we have for software has directed development of much more tightly integrated programs. In order for us to fully manipulate files and jump from program to program and flow our data, Microsoft had to open the barriers between programs and the operating system. This combination of tightly integrated software with a ubiquitous operating system has left our critical and personal information susceptible. The “I-Love-You” and “Melissa” viruses have highlighted this new condition.

The embedding of pictures in email is no different from the embedding of scripts in other programs. The scripts, like the programs they run on, can have access to global properties of your computer. Scripts are small pieces of computer code that instruct other programs to perform certain tasks or to automate certain functions. MS Word “Macros,” which generate windows that pop open during web surfing, are scripts. The sorting of file views in Windows use scripts. Some of these scripts have become very sophisticated “languages,” and are key to the fluid automation and integration that is found in such groups of programs as MS Office Suite. They also enable sophisticated interaction of online content and services. Playing music or automatically installing the files necessary to do this are all script-driven. The “I-Love-You” virus took advantage of this integration and exposed how this has extended to critical parts of the operating system as a whole. When the virus was clicked on, it booted up a piece of software called “Windows Scripting Host,” which allowed Visual Basic Scripts (VBS) to run. The virus is able to run independently of such related programs as Internet Explorer. Because the virus was written in VBS, it had access to the email and address book of MS Outlook and also the Windows Registry. The Registry is that particular file that Windows uses to keep track of what programs are installed, where they are on the hard drive, and critically, what particular types of files are associated with those programs. Because of VBS permissions, the “LOVE-LETTER-FOR-YOU.vbs” virus was able to mail a copy of itself to the Outlook mail list, alter the registry, and replicate itself by replacing every file with the extensions .jpg, .mps, and .js (as well as files with the .css, .js, .vbs extensions and others in variants of the virus) with a copy of itself. Now this could only occur in an environment where scripts that normally have very few permissible activities have been enabled with extensive control over other programs and the operating system software itself. In other words, to accommodate the fluid installation of plug-ins, games, downloadable upgrades, and certain programs through the browser, scripts such as VBS have been given the ability to directly instruct the operating system to perform critical tasks and affect key parts of the system. The “I-LOVE-YOU” virus exploited all those open doors between the internet, the browser, Outlook, and the operating system.

The VBS of the love bug highlights what is going to happen more and more. When the technology is perfect for having a little icon of a Visa card on your desktop that you merely drop on a web page to buy a product, a porous operating system is needed to allow programs to talk to each other in a fluid way. Quick and clean integration is a solution—but the trade off is security. The love bug augurs just one of the most obvious holes right now. Currently, our systems are very exposed. This precarious situation is directly the result of our impulse to connect as much as possible with each other and to make our systems as integrated as possible. It is our demand for convenience, flexibility, integration, and automation that drives commercial developers to make highly integrated software suites. Of course, it is also a big payoff for these companies because the more pervasive and extensive their product, the more we are committed to their world.