UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 9.5 Free with a free account
How Computer Viruses Became Global Threats
Ethics in Technology · Chapter 9: Data Breaches, Digital Infections, and the Malware EcosystemSection 9.5 · lesson 46 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Classifying Viruses by Infection, Runtime, and Concealment →← What Computer Viruses Are, How They Work, and the Best Ways to Protect Against ThemNext lesson: Classifying Viruses by Infection, Runtime, and Concealment →
In this lesson
Trace nine landmark programs, their spread, their consequences, and the lessons they left.
- Distinguish replication methods from destructive effects.
- Connect nine outbreaks with their historical settings.
- Calculate a simplified growth model without treating it as measured history.
- Explain overlapping motives and lasting defensive lessons.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,805 words). Read along, or search it.
Chapter 9
From Experiments to Global Malware Threats
Self-reproducing code moved from a research question into a worldwide security problem. This lesson follows nine landmark programs, from Creeper to WannaCry. Their mechanisms differ, even when everyday speech calls every example a virus. We distinguish host infection, independent propagation, deceptive presentation, and demands for payment. Early experiments and disk pranks showed that ordinary sharing could carry unexpected code. The Morris worm demonstrated how lost availability could disrupt a connected community. Melissa and ILOVEYOU used familiar messages to reach more people through their contacts. Code Red and Conficker highlighted automatic spread and weaknesses with available fixes. WannaCry connected encryption, rapid propagation, international attribution, and disruption to essential services. A simplified calculation illustrates growth, without pretending to reproduce a measured outbreak timeline. Across these cases, technical controls, informed decisions, recovery, and cooperation provide complementary protection.
Theory and Terms
Replication Method and Harmful Purpose Are Different Questions
A virus replicates by inserting copies into a host program or suitable file. Relevant infected host code must execute before the virus becomes active. That does not require a new deliberate click for every infection. A worm is self-contained and can propagate through its own mechanisms. Some worms exploit networks automatically; others also use deceptive messages and human actions. A Trojan presents useful or harmless apparent functionality while hiding something different. Its name does not, by itself, mean that it replicates. Ransomware denies access to data or systems to demand payment; it can combine with worm behavior. John von Neumann explored self-reproducing machines in the late nineteen forties. Fred Cohen's authorized nineteen eighty-three experiments helped formalize virus research; his account credits Leonard Adleman with suggesting the name. Mechanism, harmful purpose, and permission are separate questions, even when one program combines several categories.
Early Experiments and Disks
Creeper, Elk Cloner, and Brain Showed Different Routes
Creeper, associated with Bob Thomas at BBN in nineteen seventy-one, experimented with movement between ARPANET computers. It displayed a message, and Reaper later sought and removed it. These programs were early experiments, rather than modern malicious campaigns and antivirus products. In nineteen eighty-two, fifteen-year-old Rich Skrenta created Elk Cloner for Apple Two computers. Infected floppy-disk startup and subsequent disk use carried the prank between machines. Its periodic poem, displayed every fiftieth boot, made the infection visible. It became a well-known early example of a virus circulating outside a laboratory. Brain appeared in nineteen eighty-six, created by Basit and Amjad Alvi in Lahore. It infected IBM PC-compatible floppy boot sectors and included the creators' contact information. They described an anti-piracy purpose; international disk sharing showed that networks were unnecessary for worldwide spread. Historical firsts depend on definitions and platforms, while an author's intention does not establish another user's permission.
Morris Worm · 1988
One Program Disrupted a Large Part of the Early Internet
Robert Tappan Morris released the Morris worm on November second, nineteen eighty-eight. He was a Cornell graduate student, working within the much smaller early internet. The worm used Unix service weaknesses and weak passwords as entry routes. Repeated reinfection caused heavy loads, slowing systems and communication. The FBI estimates roughly six thousand affected computers, from about sixty thousand connected machines. That approximate tenth included important university, research, and government systems. The worm disrupted availability without needing to destroy users' files. His claimed experimental purpose did not remove the consequences of unauthorized access. In nineteen ninety, Morris became the first person convicted under the Computer Fraud and Abuse Act. He received probation, community service, and a fine; the incident also prompted Carnegie Mellon's CERT coordination effort. The lasting lesson linked shared technical risk with organized response, rather than leaving each institution to work alone.
Email Era · 1999–2000
Melissa and ILOVEYOU Turned Familiar Messages into Carriers
Melissa spread in nineteen ninety-nine through an infected Microsoft Word document. Its macro used Outlook to send messages to the first fifty addresses in a victim's list. The resulting mail flood overwhelmed servers, and some organizations shut email down. David Lee Smith received twenty months in federal prison in two thousand two. ILOVEYOU followed in May two thousand, using a deceptive love-letter attachment that was actually a script. It mailed contacts, overwrote files, and stole passwords, causing widespread disruption. Familiar sender names amplified trust, but did not prove that executable content was safe. Reported device totals and financial losses vary, so they should not become a precise global census. Philippine prosecution encountered the absence of a specific computer-crime statute; charges were dropped in August. The Electronic Commerce Act, signed that June, added penalties for specified unauthorized interference and virus introduction. A later law did not automatically criminalize earlier conduct retroactively; coordinated enforcement also needed suitable legal authority.
Code Red · 2001
Automatic Spread Exploited a Weakness with an Available Fix
Code Red attacked vulnerable Microsoft IIS web-server systems in two thousand one. Microsoft had published the relevant security fix on June eighteenth. A rapid July nineteenth outbreak therefore occurred after a fix was available. CAIDA observed more than three hundred fifty-nine thousand infected hosts in less than fourteen hours. Remote exploitation did not require every server operator to open an attachment. Some affected pages displayed a defacement message, which did not reliably identify the attacker's nationality. The worm also included a planned denial-of-service attack against the White House website. Variants and the period observed matter when interpreting these historical details. Installing the available patch addressed the particular vulnerability exploited by this route. Restricting exposure, segmenting services, monitoring, and containment also contributed to defense. The lesson is preparation before discovery, followed by effective response; patching is essential without being the only possible safeguard.
Worked Growth Model
About 18.45 Doublings in 14 Hours Gives a 45.52-Minute Interval
The source asks how many doublings take one infected server to about three hundred fifty-nine thousand. Taking the base-two logarithm gives approximately eighteen point four five doublings. Fourteen hours contains eight hundred forty minutes; divide that time by the number of doublings. The result is a fitted interval of approximately forty-five point five two minutes. Our illustration starts with one host and assumes that this interval stays constant. At four hours, the model gives approximately thirty-nine infected hosts. At eight hours, it gives about one thousand four hundred ninety-four. At twelve hours, it gives roughly fifty-seven thousand seven hundred forty-four; the endpoint is fixed by construction. The source's eight-hour graph label disagrees with its table, so these values use one consistent formula. This is a simplified mathematical illustration, rather than a reconstruction of measured Code Red infections. Real growth depends on variants, reachable vulnerable targets, time, and containment; it cannot continue exponentially without limits.
Conficker · 2008
Several Routes Sustained a Large, Persistent Infection
Conficker emerged in two thousand eight and persisted through several variants. An October Windows security fix preceded the outbreak, making verified deployment an important lesson. Some variants also used removable drives, shared resources, and weak network passwords. Those alternative paths explain why an external firewall alone could not settle the problem. Conficker could support malicious remote control and additional downloads, making infected computers valuable to attackers. Such controlled infected systems form a botnet, rather than merely a collection of disconnected damaged files. Later Microsoft accounts cite estimates of roughly nine to fifteen million computers worldwide. Earlier reports used different totals and methods; detections, IP addresses, and distinct devices are not identical counts. The Conficker Working Group brought together security researchers, Microsoft, registrars, service providers, and response teams. Their cooperation addressed shared infrastructure and continuing malicious activity, rather than promising that every infection disappeared immediately. Detections years later demonstrated the importance of sustained removal, reinfection prevention, and coordination across organizations.
WannaCry · 2017
A Worm and Ransomware Combined Technical and Human Harm
WannaCry combined worm propagation with ransomware in May two thousand seventeen. Microsoft's relevant fixes appeared in March, and the EternalBlue exploit was publicly released in April. The May twelfth outbreak reached unpatched Windows systems and encrypted victims' files. Its displayed demand initially included an amount equivalent to three hundred dollars, with escalation described in the source. Payment was not a guarantee of reliable recovery or removal of the infection. Reported worldwide totals exceeded two hundred thousand computers in about one hundred fifty countries. England's National Health Service experienced lost system access, canceled appointments, and disrupted care. The UK audit estimated more than nineteen thousand canceled appointments overall, while documenting uncertainty about the full impact. Marcus Hutchins activated a domain-based kill switch, helping limit activity without restoring every encrypted file. United States and United Kingdom authorities attributed the campaign to North Korean actors. Maintained systems, controlled exposure, tested recovery copies, and rehearsed response all mattered to protecting essential services.
Comparing Impact
Outbreak Counts Are Estimates with Different Denominators
The impact chart compares estimated devices, but those counts have different meanings and observation periods. Morris affected about six thousand computers, a large fraction of a much smaller internet. ILOVEYOU is associated with reported tens of millions, but worldwide estimates vary substantially. Code Red's figure concerns a specific July outbreak observed by CAIDA. Conficker estimates reflect several variants, different periods, and different counting methods. WannaCry's device total does not capture every organization affected through shared services and dependencies. The source chart uses a logarithmic axis, where equal steps multiply by ten. That is different from a scale that adds the same number at each step. A larger plotted count does not automatically mean greater harm in every setting. Disruption depends on the importance of systems, service dependencies, recovery time, and affected people's needs. Compare coverage, timing, uncertainty, and consequences alongside the headline count, rather than manufacturing a precise ranking from rough estimates.
Overlapping Motives
Curiosity, Mischief, Profit, and State Power Coexist
The source describes a broad shift from curiosity and pranks toward financial and strategic motives. Creeper and Elk Cloner illustrate experimentation and jokes, without establishing permission for uncontrolled propagation. Later programs sought attention or produced mass disruption through email and network routes. An incident could also steal passwords, so mischief and theft were not mutually exclusive. Criminal monetization made infected access valuable for spam, theft, or attacks offered as services. Ransomware connected denied access with direct demands for payment. State-backed campaigns added espionage and disruption; Stuxnet is examined separately in this course. The historical eras overlap, and older motives did not disappear when new ones became prominent. WannaCry connects ransom demands, reuse of a publicly released exploit, and official nation-state attribution. The source associates that leaked exploit with government-tool concerns; public primary accounts confirm the release and attribution. Separate delivery, capability, motive, and consequence, and base attribution on evidence rather than the wording of a defacement message.
Lessons and Review
Match Recurring Routes with Complementary Safeguards
Recurring routes leave recurring defensive lessons, even as platforms and motivations change. Maintain security updates, and verify their actual installation rather than assuming an issued fix protects every machine. Code Red, Conficker, and WannaCry illustrate that gap between availability and deployment. Verify unexpected executable attachments; Melissa and ILOVEYOU showed why a familiar name was insufficient. Strong credentials and limited authority address lessons from Morris and Conficker. Managed removable media and internal transfers connect Elk Cloner, Brain, and Conficker. Protect and test known-good recovery copies, while recognizing that restoration does not undo every consequence. Rehearsed response and appropriate information sharing build on CERT and the Conficker Working Group. For review, distinguish a host-infecting virus from a self-contained worm, and identify each case's route. Explain Morris through availability and coordination, email outbreaks through trusted contacts, and the growth example through explicit assumptions. Finally, connect WannaCry's financial demand and international attribution without reducing history to a single motive or a single safeguard.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Computer Viruses Became Global Threats
What was the first computer virus?
How did the Melissa and ILOVEYOU viruses spread?
What was the Code Red worm?
What was the WannaCry ransomware attack?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →