Klez: the worm that faked who sent it

The story

Klez first appeared in October 2001 and spread through email to Windows computers for many months afterward, in a series of variants.

It used two approaches. Some messages took advantage of a flaw in the way older email programs displayed HTML mail, so the worm could run just by being viewed on an unpatched computer. Others relied on persuasion: the email might claim the attachment was a security update from Microsoft, or even a tool to remove Klez.

Once running, Klez searched the computer for email addresses and sent itself onward. Later versions forged the sender too, picking a random name from the infected computer’s address book. People received infected messages that appeared to come from someone they knew, while the person whose name was used had nothing to do with it.

Why it mattered

Klez made forged senders commonplace. Because it picked names at random from address books, the person who seemed to send an infected message was usually innocent, and the infected computer was somewhere else entirely. A familiar name in the From line stopped being proof of anything.

The lesson today

Klez taught two lessons that still apply. The name in the “From” line of an email can be faked. And security fixes do not arrive as email attachments. Updates come through the system’s own update process, and a message offering one is a warning sign.