Business Report

Whose worm crashed into the DA's mail server?

Ashley Smith|Published

You think you've heard it all? Well, try this for gigabyte size - the story of how a Democratic Alliance media strategist's documents were "stolen" by a computer virus.

Phillip Grobler, head of the DA's communication department in the Western Cape, hates being called a spindoctor, but carefully told the Cape Times on Thursday how he was spinned by the Klez.E virus.

Grobler said when on May 21 he logged onto the provincial government server, he noticed an email from Government Communication and Information Services (GCIS) human resources manager June Harris with all his personal Word documents attached to it.

The email from Harris simply said in the message box that she had lost Grobler's contact details and that he should email them to her. Also in the message box was the number 082 - apparently the beginning of Harris's cellphone number.

The mystery deepened when Grobler, at that stage scratching his head and fearing his DA strategy documents were now in the hands of the GCIS - and by implication the ANC-led government - emailed Harris.

She returned his email and warned him to ignore the original email as it probably had a computer virus attached to it.

What followed was an investigation by GCIS computer experts that culminated in an "explanation" being sent to Grobler by the organisation's chief information technology officer, Terry Vandayar, who wrote that what Grobler may have experienced is what is known as "email spoofing".

"A worm known as Klez.E, which is the fastest-spreading worm worldwide, often uses this technique. With email spoofing, a machine infected with klez performs an email routine.

"It finds a person's email address (Grobler's) on the machine, inserts it into the 'From' field of an infected message and then sends it to another person (Harris)."

Harris would either reply to the message if it posed a question, or inform him that he sent her a virus, Vandayar explained.

She said in the Grobler incident an original email, sent from Grobler's machine, had reached Harris and had asked for her contact details, which she subsequently replied to.

"Examining her reply from the GCIS side revealed no evidence of any attached files. Alternatively, if a virus did not cause this, it may well be that Grobler really did ask Harris for her contact details via email."

Grobler denies he sent Harris such a message.

Internet experts said on Thursday that what had happened to Grobler was typical of the Klez.E virus, with one expert saying the virus was developed specifically to bombard mail servers to crash them "so it is highly unlikely the virus was interested in political strategy documents".