Melissa virus

Melissa virus
Name	Melissa
Type	Macro virus
Author	David L. Smith (convicted)
Isolation	1999
Platforms	Microsoft Windows, Microsoft Word, Microsoft Outlook
Genre	Malware

Melissa virus

The Melissa virus was a macro computer virus discovered in 1999 that rapidly propagated via email attachments, affecting corporate and governmental computer systems and provoking high-profile investigations and prosecutions. Released during a period marked by incidents such as the ILOVEYOU outbreak and scrutiny following the Nimda and Code Red episodes, Melissa highlighted vulnerabilities in Microsoft Office macro scripting and prompted urgent responses from security firms, law enforcement, and legislative bodies. The incident involved notable institutions including Microsoft, the Federal Bureau of Investigation, and major media outlets, catalyzing changes in cybersecurity practice and policy.

History and Discovery

Melissa was publicly identified in March 1999 after anomalous email traffic and server overloads were reported at organizations such as Microsoft, IBM, Lucent Technologies, and several United States Postal Service centers. Early analysis by researchers at firms like McAfee, Symantec, and Kaspersky Lab linked the outbreak to a macro embedded in Microsoft Word documents attached to messages purporting to contain lists of passwords from the Internet Relay Chat community. Investigations by the FBI and the New Jersey State Police culminated in the arrest and prosecution of David L. Smith, whose case intersected with broader legal matters including precedent from prosecutions under the Computer Fraud and Abuse Act and state cybercrime statutes. Media coverage by outlets such as The New York Times, CNN, and BBC News amplified the public profile of Melissa and spurred industry warnings from vendors like NortonLifeLock and Trend Micro.

Technical Details and Mechanism

Technically, Melissa exploited Visual Basic for Applications macros in Microsoft Word documents to execute code when a user opened an attachment in Microsoft Outlook. The macro leveraged Outlook's MAPI interfaces to harvest the first 50 entries from the victim's address book and generate messages containing the infected document, thereby automating propagation reminiscent of techniques later seen in Welchia and Melissa-like outbreaks. The payload was non-destructive compared with some contemporaneous threats but caused mail server overloads by triggering mass forwarding, affecting SMTP traffic and mail queuing on servers run by providers such as America Online, Verizon Communications, and corporate Lotus Notes gateways. Security analysts at CERT Coordination Center and academic researchers at institutions like Carnegie Mellon University and Stanford University dissected the macro to map call sequences and recommend mitigations.

Infection Vector and Spread

Attackers distributed Melissa via social engineering: messages claimed to contain a list of passwords or sensitive content, invoking themes common in phishing and early social engineering campaigns used against users at organizations including PricewaterhouseCoopers, Deloitte, and various United States Department of Defense contractors. Once a user opened the attached Word document, the macro executed and used the infected host's Outlook address book to send copies to contacts, producing exponential spread across networks spanning Fortune 500 companies, academic universities such as Harvard University and Massachusetts Institute of Technology, and municipal systems in cities like New York City and San Francisco. Email server strain led to disruptions at Internet service providers including EarthLink and CompuServe, illustrating how interconnections among providers, enterprises, and government agencies accelerated proliferation.

Impact and Consequences

Melissa's economic and operational impact included immediate productivity losses, incident response costs for technology teams at General Electric, Bell Atlantic, and financial institutions like JPMorgan Chase, and forced shutdowns or quarantines of mail systems at media organizations such as The Wall Street Journal and broadcasters like NBC. The episode influenced corporate policy changes at Hewlett-Packard, Sun Microsystems, and Oracle regarding macro execution defaults, and prompted Microsoft to issue security guidance and updates for Office and Outlook. Melissa also fed into legislative and regulatory discussions in bodies like the United States Congress and informed international cooperation through groups such as Interpol and standards efforts at ISO.

Detection and Removal

Detection relied on signature updates and heuristic rules distributed by antivirus vendors including Symantec, McAfee, Sophos, and Trend Micro, while system administrators used tools from Microsoft and third-party vendors to scan mail queues and remove infected attachments. Recommended remediation steps included disabling macros via Group Policy controls in Active Directory, applying security patches from Microsoft Security Response Center, restoring from backups maintained by teams at affected organizations like Cisco Systems, and employing intrusion detection systems developed by firms such as Snort/Sourcefire. Post-incident forensic work by specialists at Mandiant and academic labs informed incident response playbooks and curriculum at institutions including SANS Institute and University of Cambridge.

Legal and Ethical Response

The arrest of David L. Smith led to prosecution under statutes exemplified by the Computer Fraud and Abuse Act and resulted in sentencing that addressed restitution and community service; the case became a reference point in legal scholarship at Yale Law School and Stanford Law School on cybercrime liability. Ethical debate involved commentators in publications like Wired and The Guardian about proportionality of sanctions, the role of vendor responsibility at companies like Microsoft and Norton, and the balance between disclosure and suppression advocated by security communities including Full Disclosure and CERT. Melissa accelerated corporate adoption of acceptable use policies at institutions such as Goldman Sachs and informed international law enforcement collaboration through Europol.

Category:Computer worms