AIDS was introduced into systems through a floppy disk called the "AIDS Information Introductory Diskette", which had been mailed to a mailing list. Harvard-taught evolutionary biologist Dr. Joseph Popp was identified as the author of the AIDS trojan horse and was a subscriber to this list. Popp was eventually discovered by the British anti-virus industry and named on a
New Scotland Yard arrest warrant. He was detained in
Brixton Prison. Though charged with eleven counts of
blackmail and clearly tied to the AIDS trojan, Popp defended himself by saying money going to the PC Cyborg Corporation was to go to
AIDS research. A Harvard-trained anthropologist, Popp was associated with the Flying Doctors, a branch of the African Medical Research Foundation (
AMREF), and a consultant for the
WHO in Kenya, where he had organized a conference in the new Global AIDS Program. Popp behaved erratically from the day of his arrest during a routine baggage inspection at Amsterdam
Schiphol Airport. He was eventually declared mentally unfit to stand trial and was returned to the United States. Jim Bates analyzed the AIDS Trojan in detail and published his findings in the
Virus Bulletin. He wrote that the AIDS Trojan did not alter the contents of any of the user's files, just their file names. He explained that once the extension and filename encryption tables are known, restoration is possible. AIDSOUT was a reliable removal program for the Trojan and the CLEARAID program recovered encrypted plaintext after the Trojan triggered. CLEARAID automatically reversed the encryption without having to contact the extortionist. The AIDS Trojan was analyzed even further a few years later. Young and Yung pointed out the fatal weakness in malware such as the AIDS Trojan, namely, the reliance on symmetric cryptography. They showed how to use public key cryptography to implement a secure information extortion attack. They published this discovery (and expanded upon it) in a 1996 IEEE Security and Privacy paper. A cryptovirus, cryptotrojan, or cryptoworm hybrid encrypts the victim's files using the public key of the author and the victim must pay (with money, information, etc.) to obtain the needed session key. This is one of many attacks, both overt and covert, in the field known as
cryptovirology. ==References==