On This Day: The Morris Worm, Launched November 2, 1988

On November 2, 1988, at 20:30, the Morris worm was launched from the Massachusetts Institute of Technology network — a self-replicating program written by Robert Tappan Morris, a graduate student at Cornell University. He chose MIT so the trail would not lead directly to Cornell. The worm affected VAX computers and Sun-3 workstations running 4.2 and 4.3 Berkeley UNIX.

The program relied on several known weaknesses: a hole in sendmail's debug mode, a buffer overflow in the finger network service, trust between machines via rexec and rsh, and weak passwords — dictionary words or simple combinations with the username. Initially, the worm was supposed to check whether a machine was already infected, but Morris feared administrators would teach the system to report a false positive, and programmed it to copy with a 14% probability regardless of infection status. A single machine could be infected multiple times, each copy slowed it down, and eventually the system became unusable, as with a fork bomb.

The exact scale remains disputed. In 1989, Clifford Stoll wrote that two thousand machines were infected within fifteen hours, and cleanup often took two days; he himself estimated the number affected as "a couple of thousand." The figure usually cited is around six thousand large UNIX systems. Paul Graham recounted where that number came from: someone assumed that about 60,000 computers were connected to the internet and that the worm had hit a tenth of them.

To stop reinfection, the internet was split for several days: regional networks disconnected from the NSFNet backbone and from each other while they cleaned their nodes. The incident prompted DARPA to fund the creation of CERT/CC at Carnegie Mellon University, and Gene Spafford organized the Phage mailing list to coordinate the response. Morris's case became the first criminal trial in the United States to end in a conviction under the Computer Fraud and Abuse Act of 1986: after appeals, he was sentenced to three years' probation, 400 hours of community service, a $10,000 fine, a $50 special assessment, and $3,276 in supervision costs — $13,326 in total. The worm was also the first such program to attract widespread press attention.

Image: Go Card USA from Boston, USA CC BY-SA 2.0 · License

Translation editors: Соловьев В., Пеков А.