Malicious Melissa

Even bad ideas start somewhere. In the case of phishing schemes, it’s hard to pinpoint an exact start, but there’s one type of beginning researchers can agree on: Melissa the virus. Melissa’s impact is still felt today, which is why she rates so high on this list:

• The first virus to use Microsoft macros to replicate itself
• One of the first email-activated viruses, using the formula of an email that fools people into opening an attachment (the same primary distribution method used for attacks today)
• One of the first, if not the first, virus to include macros to email itself out to your contacts (back then, it could handle up to 50 replications by email)
• The worst computer virus that had occurred to-date (1999)
• Its creator became the first known US-based coder to be sentenced to prison for cybercrimes, paving the way to future prosecution of perpetrators

Melissa was created by programmer David L. Smith, who claimed to have named the virus after an exotic dancer in Florida. Whether or not it was done intentionally, Melissa also took advantage of what was a monoculture at the time: Microsoft-based systems dominated corporate America, ripe for the spread of a Microsoft-macro-based virus, like the great potato famine of Ireland.

Melissa really began the phishing era, but also the security research area. The whole game of software development changed, requiring a cybersecurity component beyond just standard anti-virus software and firewalls. That’s an important lesson, but one that many companies have still not learned, as shall be demonstrated with security disaster #4, the worst virus outbreak ever.