005
EXH-0052000Fictional reconstruction
Kind Regards
May 2000. The subject line is ILOVEYOU. The attachment is a .vbs file. Within hours, outlook.exe is the fastest file-sharing network on Earth.
Type
Classic
Difficulty
Beginner
Era
2000s
Time
8 min
Briefing
The help desk opened fifty tickets in an hour. Users say `I only opened an email from Carol`. Attachment type and scripting engine matter more than who sent it, the From: header is lies. Walk the quarantine logs.
Your role
Mail administrator at a university in the Philippines, ground zero for the storm.
Objective
Prove from mail queue excerpts what class of file propagated the worm and how it replicated via address books.
Terminal environment
- user
- postmaster
- host
- gw-manila
- cwd
- /var/spool/mailgateway
- steps
- 3
Enter the terminalAbout 8 minutesSafe simulation
Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.