December 1989. A parcel arrives at the office: a floppy disk labelled “AIDS Information – Introductory Diskette”. Free, unsolicited, about the most serious health topic of the decade, with an interactive questionnaire to assess your risk. What could possibly go wrong?
Everything. That floppy was the first known ransomware in history. Get comfortable: this is the story of a computer held hostage by a program that had warned you, in writing, and of the strangest airport luggage check in the history of cybercrime.
The parcel
According to Virus Bulletin, the specialist magazine that analysed the case in January 1990, several thousand disks were posted from London between 8 and 12 December 1989 (later accounts put the total at around 20,000). They went to computer users across the UK, Europe, Africa, Scandinavia and Australia.
The recipients weren’t random. In the UK the disks were sent to the subscriber list of PC Business World magazine, a list that, in the magazine’s words, “had been obtained by deception”. Delegates to a world congress on AIDS held in Stockholm were targeted too, and so were subscribers to French and Italian business magazines.
The fine print
The best part: the disk came with a leaflet, and the leaflet warned you. It said the software would “adversely affect other program applications” and that you would owe compensation to a company called PC Cyborg Corporation. The threat was in the licence agreement. Literally.
Ninety reboots
The disk contained two programs written in QuickBASIC 3.0. The questionnaire, AIDS.EXE, was harmless. The installer, INSTALL.EXE, was not. It created a series of hidden directories whose names used ASCII character 255, which looks like a blank space on screen, and quietly replaced AUTOEXEC.BAT, the file DOS runs at every startup:
echo off
C:
cd\
rem PLEASE USE THE auto.bat FILE INSTEAD OF autoexec.bat FOR CONVENIENCE
auto.batThat rem looks like a harmless comment, but the invisible character after it turns it into the name of a program: the trojan itself. From then on, every time you turned the computer on, it added one to a counter. Nothing else happened. Everything worked. For about ninety reboots.
Then the trap closed. The program hid all the directories on drive C:, scrambled the names of most of the files and filled the remaining free space. After that it pretended to be DOS: you typed commands, it answered like DOS, but it was still in charge. Among the files listed was a READ.ME that didn’t really exist:
C:\> TYPE READ.ME
You are advised to stop using this computer.
The software lease has expired.
Important: Renew the software lease before you use this computer again.And to pay? You were told to turn on the printer, which printed an invoice: a lease of $189, or a full licence for $378, to be sent to PC Cyborg Corporation at a post office box in Panama.
The antidote, for free
In the UK, PC Business World immediately called Jim Bates, an analyst who took the program apart line by line. He produced a removal tool, AIDSOUT, and a recovery tool, CLEARAID, which restored the scrambled names. His verdict in Virus Bulletin is still the best review of the whole affair: “While the conception is ingenious and extremely devious, the actual programming is quite untidy.”
The same issue noted that ordinary antivirus programs hadn’t noticed a thing: only checksumming programs, which detect when a file changes, had spotted the tampered AUTOEXEC.BAT.
The suitcase at Schiphol
The author was Dr Joseph Popp, an American evolutionary biologist. A few weeks after the mailing he was flying back from a WHO seminar in Nairobi when, at Amsterdam’s Schiphol airport, he wrote “DR. POPP HAS BEEN POISONED” on another passenger’s suitcase. The resulting search of his luggage turned up links to PC Cyborg.
The FBI arrested him in the United States and he was extradited to Britain, charged with blackmail and criminal damage. His lawyers said the money would go to alternative AIDS education programmes. The trial never happened: in November 1991 Judge Geoffrey Rivlin ruled that Popp was unfit to stand trial, and he was sent back to the United States. There he went back to evolutionary science, published a book called Popular Evolution, and a butterfly conservatory in upstate New York bears his name.
First ransomware, not first trojan
The AIDS disk is often called “the first trojan”, but that title belongs to someone else. In the mid-1970s John Walker wrote ANIMAL, a guessing game that quietly copied itself into every directory it could reach. It harmed no one. The AIDS disk is something else: the first known ransomware, a program that takes your data hostage and asks for money.
Its fatal weakness was cryptographic. The key to undo the damage was inside the program itself, so anyone who analysed it could build the antidote, and that’s exactly what happened. In 1996 the cryptographers Adam Young and Moti Yung showed how public-key cryptography would remove that weakness, and they gave the field a name: cryptovirology. Modern ransomware took the advice. Unfortunately.
Moo. 🐄
