Say my name, worm

Perp: Jan de Wit

Status: Script kiddie walking (free)

Dossier: It's a stretch to describe Jan de Wit even as a coder. A script kiddie in every sense of the word, the Dutchman used a virus-creation toolkit to compile a worm written in Microsoft VBS (Visual Basic Script), which he released in early 2001 by posting it to a Usenet newsgroup. The worm purported to display photos of Russian tennis star Anna Kournikova. Not unlike its namesake, who never did win that major singles title, the worm was all promise, no delivery. In fact, all the Kournikova worm did was send itself to everyone in the victim's Outlook address book.

What de Wit did in terms of coding the worm, he did pretty dumb -- like inserting his online nickname (OnTheFly) into the code, which also creates a key in the Windows Registry with that string. Authorities simply had to perform an online search for OnTheFly, where they found de Wit's personal Web site, complete with photos of the tennis star prominently displayed. Our OnTheFly Dutchman demonstrated "extraordinary levels of stupidity, helping the authorities track them down," said Sophos' Graham Cluley in a 2003 blog posting. "You wouldn't have had to have been Sherlock Holmes to solve that riddle."

The worm, aka Kalamar (after the Argentine creator of the VBS worm generator de Wit used to create it), was so technically unsophisticated that it might not have progressed very far had de Wit not added the social-engineeering Kournikova twist. In fact, according to one anti-virus expert, David Perry of Trend Micro, IT admins were cleaning up after the Kournikova worm for months as a result of the interest in Kournikova: "People would continually reinfect themselves, even though they knew it was a virus, then call their help desk and say, 'I infected myself with the virus, but I didn't see any naked pictures of Anna Kournikova. What did I do wrong?' "

Upshot: As of 2002, when he lost his last appeal, de Wit worked in a computer shop repairing PCs -- fitting punishment, indeed. He could have gone to prison for as long as four years but was sentenced to 150 hours of community service in the Netherlands, where he lives. And in a stranger twist, court documents revealed in 2003 that the author of the Melissa virus, David Smith, helped the FBI track down de Wit and other virus writers -- lending further credence to the adage, There's no honor among thieves.

[ Stupid hacker index | Alexei Ivanov and Vasily Gorshkov: Here's how I steal passwords, officer ]