Macintosh Love Bug

Just a week ago the Windows world was infected by the LoveLetter worm - and that, labelled the first Open Source virus on Slashdot, spawned four variants within the first day. The media was hysterical, often forgetting that every operating systems besides Windows was immune to the "Love Bug."

Anne Onymus has done some leg work and managed to interview one of the Mac communities leading code crunchers.

5/11/2K: Macintosh über-hacker Jeeves Stob (yes, it's a pseudonym - and, we think, a clever almost-palindrome) gets frustrated every time there's a major virus.

Like a lot of Mac users, Stob never received a copy of the LoveLetter virus that was launched one week ago - at least not from an unwitting Windows user. He figures it must be because all his friends are too smart to run unknown enclosures or they use Macs.

Most likely, it's both.

Stob had fun perusing the Visual Basic code used to create the Love Bug after a hacker acquaintance forwarded him a copy. He said the code was not at all difficult to follow, explaining why it was so easy for others to modify the source code and create their own variants of the LoveLetter worm. Of course, the whole thing depends on the tight integration of Microsoft Windows, Outlook, and Visual Basic.

In Stob's words, "It's hard to say whether that integration is a good thing or a bad thing. It lets you do some very powerful things, but it also makes you a ready target for malicious hackers. In fact, it seems that Microsoft's email clients (and only on Windows) are the only ones capable of carrying such a payload and distributing it so widely. The ubiquity of Windows and Outlook among the masses create a tempting target for the kind of people who created Melissa and LoveLetter."

As for the Mac, Stob says that's a whole 'nother story. Mac users run many different versions of the OS and don't boot from a hard drive called "C:" - this presents a lot more variables for the potential Mac worm or virus maker. Mac users may or may not have Java. They may have disabled AppleScript. A hacker cannot depend on those kind of resources when creating a virus.

Maybe that's why there are only about five-dozen Mac viruses, compared with over 20,000 in the Windows/DOS world.

Mac viruses tend to be easily contained. People using Disinfectant (240K), a freeware antivirus program discontinued nearly three years ago, can easily clean up all viruses created before the AutoStart Worm and Word Macro viruses. The AutoStart Worm can be disabled simply by turning off Enable CD-ROM Auto Play in the QuickTime Settings control panel - and several free programs can detect and eradicate it, should your Mac become infected.

As for Word macro viruses, there have long been patches and settings to take care of them, too. Avoiding Word would also do the job, but with an estimated 94% of computer users across platforms using Word, that may not be a practical solution.

The Mac just isn't an attractive platform for the virus maker.

I asked Stob to speculate on how one might create something like LoveLetter for the Macintosh. He replied that it wouldn't be terribly difficult to create the worm itself using AppleScript or even the popular VISE software installer. As is obvious from LoveLetter, it wouldn't be hard to get the average user to run the program - just devise a cover letter and create a fitting file name and icon for the worm itself.

The program itself could cause no end of problems: renaming files, moving resources to other folders, overwriting files, etc. This would be no trouble at all for a good programmer.

The biggest problem is viral reproduction. Just how could the program send itself to everyone in the user's address book when Mac users choose from such a broad variety of email clients: Eudora, Outlook Express, Claris Emailer, Pegasus, Netscape, QuickMail, MailSmith, Green, SafeMail, SnapMail, and PowerMail among them - not to mention Web-based email.

The simple fact is, to successfully launch a program like LoveLetter on the Mac, the hacker would have to address at least the three or four most popular mail clients. Even then, with Mac users representing perhaps 10% of the worldwide installed base, the worm would have a tough time delivering itself to enough people who had Macs, would actually run the program, and would be using one of the targeted email clients.

No matter how good a Mac worm, because the Macintosh is a minority platform, it could never cause the kind of widespread damage and hysteria of Melissa or LoveLetter. There might be a few isolated cases, but the media would never even take notice of it.

Stob notes that hackers want notoriety, which means they have to target Windows, the dominant operating system, and its most common applications. This explains Word and Excel macro viruses, as well as email-borne viruses that are dependent on Microsoft email clients.

They won't get their fifteen minutes of fame any other way.

Has Stob himself ever created a virus? Grinning, he explains he has a collection of viruses for almost every operating system - safely stored on CD-ROM. He's learned a lot of tricks and written his own code for any number of operating systems (he's given up on Windows, because there's no challenge there), but has never released a virus into the wild. "They're a great learning tool," he notes.

Stob's personal favorite isn't really malicious, but something akin to the Belgian "pie in Gates' face" scenario. Years ago, when it looked like the NeXT Computer might actually compete with the Mac, Stob created a program that would completely overhaul the visual interface and play a sound at startup.

With Stob's little NeXT virus, Steve Jobs' little black box acted just like a Macintosh.

 - Anne Onymus

Further Reading

• Viruses on the Mac, Stephen Beale, MacWeek, 5/7/00. "The first Mac viruses, nVir and MacMag, appeared in 1987...."