In the first week of March 1992, people who had never thought about computer security were unplugging their PCs, backing up their files onto stacks of floppy disks, and changing the date on their machines to skip a single day. News anchors explained what a "boot sector" was. Computer stores sold out of antivirus software.
The day was March 6, the birthday of the Renaissance artist Michelangelo, and the virus that shared his name was supposed to destroy millions of hard drives. V-Day, as some called it, was the first computer virus scare to reach the evening news. It turned out to be a lot smaller than promised, and the story of why is still worth telling.
The virus
Michelangelo was first found in Australia in early 1991. It was a boot sector virus, the dominant kind in the DOS era:
- It lived in the boot sector of floppy disks and the master boot record of hard disks, the first code a PC runs when it starts.
- Boot a PC with an infected floppy left in the drive, a common accident when floppies were how everyone moved files, and the virus copied itself to the hard disk. From then on, every floppy you used got infected too.
- Otherwise it stayed quiet. It did nothing visible, which helped it spread.
- If an infected PC was booted on March 6 of any year, it overwrote the beginning of the hard disk with garbage, destroying the partition table and the start of the file system. To an ordinary user, everything was gone.
Nothing in the code mentions Michelangelo. Researchers named it after the trigger date's coincidence with his birthday.
The panic
In January 1992 a few manufacturers discovered they had shipped hundreds of PCs and floppy disks with the virus already on them. That made the news, and then the predictions started. The most famous came from John McAfee, whose antivirus company stood to benefit, suggesting that as many as five million computers could be hit. Other experts gave lower estimates, but the big number was the one that made headlines.
By the first week of March, it was a global media event, with front-page stories, TV segments and lines at software stores.
The non-event
March 6 came and went. Reported cases worldwide were in the thousands, perhaps ten to twenty thousand, a real loss for the people affected, but nowhere near the predictions. Some of that was the virus being less widespread than claimed. Some of it was that millions of people had scanned their machines, cleaned infections and, for once, backed up their files.
The backlash came quickly. Journalists who'd amplified the scare felt used, and plenty of people concluded that antivirus companies had manufactured a crisis to sell software. The episode dogged McAfee's credibility for years.
What it taught
Hype has a cost. Overstating a threat works once. Then the next warning, about a real threat, gets ignored. The security industry is still fighting the credibility problem Michelangelo started, every time a vendor's press release calls something "the most dangerous ever."
But "nothing happened" doesn't mean the warning was wrong. This is the part of the story people forget. Some of the reason little happened is that people acted. Y2K went the same way a few years later: it's remembered as an overreaction, but it was a non-event mainly because organizations spent years and billions of dollars fixing the code. Successful prevention always looks like overreaction afterward.
Backups beat antivirus. A Michelangelo victim with a recent backup lost an afternoon. One without lost everything. That's still true of every ransomware attack today.
Sneakernet was a network. Boot viruses spread entirely by people carrying floppy disks between machines. No internet required. The lesson that removable media can carry malware anywhere was relearned by Stuxnet in 2010, which crossed air-gapped networks on USB drives.
Why it's nostalgic, and why it isn't
There's something charming about a threat you could defeat by changing your PC's clock to March 7. Malware then was mostly written for notoriety or mischief, spread at the speed of the postal service and did damage you could see.
Today's threats are quieter, faster and run by organized criminals for money. But the shape of the lessons hasn't changed much. And two weeks ago the world got a reminder that the software sold to protect computers can be the thing that takes them down: a bad CrowdStrike update did in one morning what Michelangelo never managed, crashing millions of PCs at once. I wrote about that in understanding widespread outages.
Back up your files. Be suspicious of anyone who profits from your fear. And if a disk shows up in your floppy drive that you don't remember putting there, take it out before you boot.