5.2 billion dollars, that’s the total amount of bitcoin payments that have been linked
to the top 10 strains of ransomware in 2021 alone.
By the end of the year there will have been over 700 million attempted ransomware attacks,
that’s over 1300 attacks every minute or 22 attacks per second, it’s madness. And
it’s growing, this year we’re up 150%.
This got me thinking, who or what kicked off this flourishing industry? Who knocked over
the first proverbial domino that has led to the absolute state of ransomware in 2021 - I
want to know. To explore the first known case of ransomware we have to turn back the clock
to 1989.
It all began when people started receiving floppy disks in the mail, in particular the
5 ¼ inch variety, these things are ancient - and compared to a cd they’re massive.
Specifically these were being sent to AIDS researchers, at the time the AIDS epidemic
was peaking.
The floppy disks were accompanied by a set of written instructions - how quaint. “Please
find enclosed a computer diskette containing health information on the disease AIDS”,
“The information is provided in the form of an interactive computer program”, “The
program provides recommendations to you, based on the life history information that you have
provided, about practical steps that you can take to reduce your risk of getting AIDS”.
All looks fairly legit I suppose, there’s nothing here to arouse suspicion. And the
program itself worked as expected, but unbeknownst to the user, malware was dropped on the victim
machine, malware known as a “logic bomb”. A logic bomb is malicious code that stays
dormant until a certain condition is met.
The condition in this case being 90 reboots. In other words, nothing would happen, until
the computer has been switched off and on 90 times. On the 90th boot, the user would
be completely locked out of their computer, just like in normal modern ransomware. Victims
found themselves staring down the barrel of the world’s first ransomware note. It seems
old habits die hard, as some modern ransomware strains still use a basic txt file for their
ransom note.
Apart from just preventing the victim from using their PC, it also encrypted the names
of all the files on the disk and set those files to hidden. Now I realise that doesn’t
sound that bad, as only the filenames were encrypted rather than the contents of those
files itself, so whilst it was possible to undo the damage if you knew what you were
doing, it was also 1989, you couldn’t just google these things. And realistically speaking
most victims were kinda screwed.
The note said “It is time to pay for your software lease from PC Cyborg Corporation”,
of course no such corporation exists. The note went on to say you could pay for a year’s
license for $189 or a lifetime license at $378 - adjusted for inflation that’s about
$850 in today’s money. This next bit kinda made me laugh. Of course modern ransomware
almost exclusively asks for ransoms to be paid in cryptocurrency, but this wasn’t
an option in 1989, so the malware asks for the next best thing, a cheque! Sent to a Panamanian
PO Box - in return the victim would be sent a floppy disk with software to unblock the
PC.
The January 1990 issue of Virus Bulletin had a lot to say about this malware, which was
just given the name the “AIDS Trojan”, because the term “Ransomware” just didn’t
exist back then. In analysing this malware, the author of the article had no idea he was
describing a soon to be multibillion dollar industry when he said “The conception is
ingenious and extremely devious”. However, his awe at this creation stops there, “the
actual programming is quite untidy”. What follows is simply amazing, and what I can
only assume is the 1990 equivalent of calling someone a noob, “The programmer was unfamiliar
with the capabilities of QuickBASIC 3.0 and not particularly well schooled in general
program construction”.
It turns out that 20 thousand AIDS researchers had received these floppy disks in the mail,
which is quite remarkable when you realise how much an operation like that costs. A floppy
disk in 1989 was about $1.5 - I am guessing somewhat, as I couldn’t find a definitive
answer on the Googles. 20 thousands floppy disks would have set you back $30k back then,
in today’s money that’s 70k, after you factor in postage it gets even more expensive,
and then you’ve got to find the time to package up all those floppy disks. Someone
went to great expense and great lengths to do all of this, and to target AIDS researchers?
It just doesn’t add up.
Besides this wasn’t a harmless prank, one of the victims explained in an interview “The
incident created a lot of damage”, “People lost a lot of work” - knowing their computers
had been infected, “some scientists pre-emptively deleted valuable data” - and I realise it
doesn’t make sense to do that. But you have to understand people just didn’t know what
they were up against, the worlds’ first MS-DOS virus had only come out 3 years beforehand.
And computers in of themselves were such an enigma, people just didn’t know what to
do. In fact, “one AIDS organization in Italy lost 10 years of work.”
However when it comes to that PO Box, it turns out that even Panamanian PO Boxes are not
immune to traceability. Police hunted down the perp to be one “Joseph Popp”. Now,
this wasn’t some kiddo trying to make some quick cash, “Joseph Popp” was an evolutionary
biologist, he even got his PHD from Harvard. Not the most archetypal hacker, I bet he never
even wore a hoodie in his life.
Since, no victims were located in the US, he was extradited to the UK to stand trial.
And by the way, if you’re looking for a reason why he made the trojan, I have no definitive
answers. The best theory is that he was just super salty about being rejected for a job
at the WHO. In fact the 20,000 researchers sent the malware came from a list of attendees
of the WHO conference in Stockholm a year earlier.
As for our hacker, Joseph Popp - he was never actually tried for his crimes. There are reports
from the time, and get ready for this - that he was observed putting curlers in his beard
and condoms on his nose in order to ward off radiation - oh and in my search for stock
footage of condoms on noses, apparently snoring condoms is a trend, which I did not need to
be made aware of. Anyway, either he had a screw loose, or this was all a ruse to look
as crazy as possible to avoid a harsh sentence. Either way, the judge ruled he was mentally
unfit to stand trial and he was deported back to America.
We don’t know if anyone actually ended up paying the ransom. But a program to clean
up the trojan called “AIDSOUT” was made freely available. Joseph Popp died in 2007,
but not before setting up a butterfly conservatory of all things, which has some, mixed reviews.
Regardless, his legacy as the father of ransomware was cemented the day he mailed out that first
floppy disk.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered. If it runs
on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware. Linode’s philosophy
is to focus on providing all the tools a developer really needs at competitive prices. Use the
link in the description now to claim your free $100.
If you enjoy this kind of video make sure to help me out by mutilating the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on the
top 5 non-ransomware related hacks of 2021
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.