Information Security News mailing list archives

Manila Police Seeking 10 'Love Bug' Suspects


From: William Knowles <wk () C4I ORG>
Date: Tue, 9 May 2000 01:01:27 -0500

http://dailynews.yahoo.com/h/nm/20000509/ts/virus_philippines_10.html

By Sharon Buan
Tuesday May 9 1:14 AM ET

MANILA (Reuters) - Philippine police said on Tuesday some 10 people
with links to a Manila computer school are suspected to have created
the devastating ``Love Bug'' virus that penetrated millions of
computers worldwide last week.

A Filipino couple named on Monday as the main suspects in the case
have attended the AMA Computer College (AMACC), owned by the former
head of the government's program to combat the Y2K bug, they said.

Elfren Meneses of the Philippine National Bureau of Investigation
(NBI) told reporters some 10 coded names were found embedded in the
virus.

``There were reports from the FBI (the U.S. Federal Bureau of
Investigation) that the names are somewhat from an organization called
AMACC,'' he said, adding that the college promised to help in
investigations.

AMACC said in a press statement on Monday it was aware of reports that
some people with links to it were accused of creating the ``Love
Bug,'' and it did not condone hacking.

Commitment To Cooperate

``The AMACC reaffirms its commitment to cooperate with all
investigating bodies and shall make available its resources to assist
in the efforts,'' it said.

Reomel Ramones, a 27-year-old man, is the only one arrested in the
case so far. His girlfriend Irene de Guzman was also named by the NBI
as a suspect after their dilapidated Manila flat was searched by
detectives on Monday.

De Guzman told the NBI she would turn herself in for questioning but
had not yet done so, Meneses said.

Ramones, who was held overnight, has had access to lawyers and charges
against him may be filed later in the day, the NBI officer said.

NBI chief Federico Opinion said all suspects in the case would be
subjected to questioning.

``As some said, they might have been just playing around but we will
know that because they will be subjected to tactical interrogation
later,'' he told the DZMM radio station.

Opinion also said that although no computer was found in a search of
the flat where Ramones and de Guzman stayed, there was evidence one
had been kept there and then removed.

``There were no computers retrieved but there were indications of
equipment taken out, there were computer parts,'' he said.

Under Surveillance Since Saturday

The NBI had kept the flat under surveillance since Saturday, soon
after it was informed by local Internet service providers and overseas
authorities that the computer virus was suspected to have originated
there.

But it could not move because computer hacking is not a crime under
Philippine law and it could not procure a search warrant until Monday.

Damage from the ``Love Bug'' virus and variants has already reached
about $5 billion and could amount to $10 billion before the viruses
could be eradicated, the U.S. firm Computer Economics said.

The original virus, tagged ``ILOVEYOU,'' works by enticing e-mail
recipients to open an attached letter, only to cripple their e-mail
systems.

Upon opening the attachment using Microsoft software such as the
Outlook program, it sends a copy of the virus to everyone in the
user's address book and seeks to destroy a variety of files throughout
a computer network, including picture and music files.

The latest variants on the virus include tainted messages with subject
lines such as Dangerous Virus Warning; Virus ALERT; How To Protect
Yourself From The ILOVEYOU Bug; and Thank You For Flying With Arab
Airlines.


*-------------------------------------------------*
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions             http://www.c4i.org
*-------------------------------------------------*

ISN is sponsored by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".


Current thread: