To catch a pest
[Crypt Newsletter]

Chen Ing-hau, a former Taiwan college student, was detained by authorities in that nation after his school, the Tatung Institute of Technology, outed him as the author of the CIH computer virus.

Ing-hau (his initials are "CIH," get it?) was reprimanded by school authorities in 1998, who knew about him as far back as April of that year, when CIH virus first emerged in world circulation. Although news stories about CIH circled the globe at the time, much like the current crop of news pieces, apparently few were interested.

In a news story distributed by the Associated Press on April 30, Ing-hau claimed he had "created" CIH to "humiliate and take revenge on . . . incompetent anti-virus software providers."

The claim, a rather shopworn one among virus authors for the greater part of the decade, has been repeated so often in the virus underground as a rationalization for spreading the programs that even people who don't write viruses are often familiar with it.

According to AP, Ing-hau created CIH because he was also irate that he had been a victim of computer viruses as a result of his trafficking in computer games.

Ing-hau's claims, in addition to being unintentionally hilarious, paint a picture of someone completely unaware of his own hyprocrisy.

Rod Fewster, an Australian anti-virus expert commented in Crypt Newsletter 50 from August 1998 that the CIH virus was put into the wild by uploading infected copies to Gamerz sites -- legitimate and underground -- disguised as various software cracks and cheats and to pirated software sites as a phony serial number crack for the Windows98 beta.

In June of 1998, after computer game fetishists and software pirates had downloaded CIH contaminated software, one of the biggest gaming sites on the Net posted a warning about the infected downloads along with an URL pointing to an anti-virus software program that detected and removed it.

At the time, places that had infections seemed to have been predominantly universities where a student was using school computers and network time to satisfy his taste for pirated software or trivial computer games he couldn't afford in the store.

"I had it on a university in the Netherlands," commented Fewster, adding it had spread very quickly in this environment.

Ing-hau, apparently something of a PC game pirate himself, and angered over getting new computer viruses from downloaded games, wrote his own virus that was immediately seeded into the same types of sites he had been victimized from. In a simple stroke, CIH's author had made himself into that which he hated.

Wire service news reports claimed Ing-hau had not been severely disciplined in April of 1998 because he had "warned fellow students not to spread the virus."

Can you smell the burning odor of phlogiston?

In America, CIH, just like most year-old viruses for which detection routines exist, proved to be a bust despite widespread mainstream media attention.

The Associated Press reported a measly four site infections on thirty computers by mid-day of CIH high noon. Gossip on the Usenet put the figure considerably higher. ATLAS-T's author, Nick Brown, reported to Crypt News a couple of hits near Strasbourg on the 26th, owners of which fit the Western CIH victim: student warez-fetishists.

However, Taiwanese authorities seemed nothing but bewildered after detaining Chen Ing-hau as a result of media attention and subsequently finding there were no initial complaints of damage against him.

Astonishingly high figures of CIH's damage were circulated in the media: 600,000 dinged computers -- reportedly in Asia -- being the most widely reprinted. The figure was supplied by a collection of assumptions: 360,000 in China, 240,000 in South Korea. But none in Taiwan by the same types of news reports.

Of this, Rob Rosenberger of Virus Myths wryly said:

"Yeah, the numbers come from some bureaucratic assistant minister(s) for technology who 'speculated' on the total number of PCs destroyed in his ho-dink [Asian] country. We'll never know the magic equation used to calculate the arbitrary value . . . It'll go down in urban legends as a media-spouted, government-approved figure, just like the 250,000 hacker attacks on Department of Defense per year . . ."