Second Incident of Cyber-Terrorism in Sri Lanka.

Sri Lanka, for the second time in three years, grabbed the attention of cyber security experts when a new computer virus started circulating around the globe last week. In it's original form, the virus displays a message box entitled "Mawanella" and copies itself to the hard disk and thereafter replicates itself, copying the virus code to all out-going email messages from the infected computer.The virus code is based on the now infamous "Love Bug" virus, which originated from the Philippines. In 1997,

Sri Lanka became noted as one of the first countries to be affected by an act of cyber-terrorism when the email accounts of Sri Lanka's missions abroad were flooded by fake emails from an LTTE connected University Student in the United States. The origin of the attack was traced and the University concerned promptly acted, withdrawing the student's net access priviledges.

The new incident, while not directly harming any official sites, appears to have been designed to spread information regarding the attacks against the muslim community in Mawanella. This is the first time that a virus has been designed to spread information regarding a specific ethnically based incident or community. "This is a worrying development as other ethno-terrorist groups can take this as an example and try to flood the world with various different propoganda material", Aruna Kulatunga, the former spokesman of the Sri Lanka High Commission in the United Kingdom, who was involved in containing the 1997 cyber-attack against Sri Lanka's missions abroad, said.

"The virus code itself is a basic code that can be easily copied. In fact, different strains of the same virus code has already appeared. It can also be easily eradicated by downloading the latest update of various different anti-virus programmes as this virus strain has now been included in the lasted round of updates..," Kulatunga said.

The email message that's copied by the virus contains the following message.

"Mawanella is one of the Sri Lanka's Muslim Village. This brutal incident happened here 2 Muslim Mosques,100 Shops are burnt. I hate this incident, What about you? I can destroy your computer I didn't do that because I am a peace-loving citizen.

" The worm copies itself to the Windows System directory as a file called "Mawanella.vbs" and e-mails itself to all recipients in the Microsoft Outlook address book with the following information:

Subject: Mawanella
Mawanella is one of the Sri Lanka's Muslim Village
Attachment: Mawanella.vbs

The mailing routine occurs each time an infected .VBS file is executed. As the virus does not configure Windows to load the .VBS file at startup, this mailing routine will only occur once for most people. There is no other payload.

More Information regarding the virus can be obtained through

A spokesperson for AVERT Virus Alert Centre, operated by McAfee, developer of the Virex anti-virus software said that the company is closely tracking the virus due to the "real possibility that it can be copied and used by other groups interested in propogating propoganda in the same manner."

"We had evidence at the time of the Love-Bug virus that the LTTE was looking closely at replicating a similar virus to use in their propoganda campaigns. However, around the same time, the United Nations passed several new resolutions that addressed the issue of cyber-terrorism and the United States government and now the British government have included measures against cyber-terrorism in their new laws dealing with the Internet and terrorism. As a result, the LTTE hesitated in using the tools they already had in their hands as it would have meant a tougher crackdown against their members and agents operating in the West., Kulatunga said.

That does not appear to worry the perpertrators of the Mawanella virus. "Persumbly, the perpertrators of the Mawanella virus are based in Sri Lanka where there are no effective methods of dealing with this kind of incidents. They also are not sophisticated enough to realize that there can be strong backlash from the international community against this type of activity. In a sense, this is a suicidal mission as the perperators have only gained the wrath of the international community and not its sympathy," Kulatunga said. "


Copyright 1997-2000 www.lankaweb.Com Newspapers Ltd. All rights reserved.
Reproduction In Whole Or In Part Without Express Permission is Prohibited.