A19-year-old University of Delaware student, Rishi Khan of Wilmington, Del., was instrumental in unlocking the twisted programming secrets of "Melissa," the most contagious computer virus ever concocted, according to an article in the April 12 issue of Newsweek.
Khan, the son of Eileen and Subhotosh Khan, was cruising the Internet the evening of March 26 when he logged onto an antivirus newsgroup site and spotted a message from cybersleuth Richard Smith, president of Phar Lap Software of Cambridge, Mass.
Smith, with assistance from a Swedish researcher, was investigating similarities between Melissa and other viruses created by a computer vandal using the name, "VicodinES"-a type of narcotic painkiller. On the web, he asked his fellow programmers for help in solving the high-tech whodunnit.
A senior majoring in computer engineering at the time, Khan, EG '99, went straight to work, deciphering Melissa's code and comparing it with various other viruses. Soon, he learned that Melissa was extremely similar to the Shiver virus, created by a vandal known as "ALT-F11."
Meanwhile, because Microsoft programs embed a "digital fingerprint" called a GUID in all the work produced on a particular computer, Smith, on March 28 traced the Melissa virus to a David L. Smith of Aberdeen Township, N.J., whose name he passed along to the Federal Bureau of Investigation.
After America Online's technical team also traced the Melissa virus to David Smith, he was arrested April 1, and now faces up to 40 years in prison and a $480,000 fine. According to one source cited by Newsweek, Smith may have named the Melissa virus after a topless dancer in Florida.
Khan's persistent research made it possible to better understand the Melissa virus, which should prove useful to authorities, according to Richard Smith.
"He's a very bright kid," the Phar Lap Software executive says. "He obviously knows how to do a lot of stuff with network programming. He solved a lot of things even I didn't see, and I'm 45!"
Khan's research professor at UD, John Elias, an associate professor of electrical and computer engineering, agrees. "He's a remarkable student, one of the best undergraduates that I've seen in my 10 years at UD," Elias, head of the University's Neuromorphic Systems Laboratory, says. "He has a very broad, diverse group of interests."
Identifying Melissa's author was "sort of a race," involving three separate teams of investigators, working in parallel, Richard Smith said. His group of cybersleuths- including Khan-formed one group. The FBI and New Jersey state authorities simultaneously searched for a suspect.
Unleashed March 26, Melissa wreaked havoc for computer users for about a week, until antivirus companies managed to distribute a cure. Described by Newsweek writer Steven Levy as "a silicon social disease," the Melissa virus alerts electronic mail users to "an important message," then delivers a file containing the passwords to pornographic web sites. At the same time, Melissa grabs the first 50 names from the victim's address book and begins sending the same embarrassing message to friends and colleagues.
Could the suspect in the Melissa case, David L. Smith, be the notorious computer vandal, VicodinES? Is he also the hacker, ALT-F11, author of the Shiver virus?
Khan offers this response: "His name comes up a lot in the files that VicodinES wrote, and since America Online did a hardware trace and came up with the same person, that seems to incriminate him as VicodinES. We're still investigating ALT-F11. The Shiver virus, created by ALT-F11, had many similarities to Melissa."
Khan says his primary interest is in artificial intelligence. Elias says Khan assists him in using integrated circuit technology to build "silicon neurons," which mimic human nervous systems. The work may be useful in developing advanced robotics systems, Elias says.
Khan's father is a mechanical engineer. His mother graduated from UD with a degree in computer and information sciences. Her work involves teaching children to use computing technologies, Khan says.
-Ginger Pinholster