Feeds

That time when an NSA bloke's son borked the ENTIRE INTERNET...

... 25 years ago. 2 words that still stop old sysadmins' hearts: Morris Worm

Beginner's guide to SSL certificates

It's 25 years since the Morris Worm taught the world that computers were capable of contracting viruses.

The Morris Worm hit on 2 November 1988, spreading rapidly by exploiting vulnerabilities in sendmail, the email server software that was the most commonly used technology of its type at the time.

Many contemporary Unix servers were running versions of sendmail featuring buggy debugging code, a shortcoming the worm exploited to devastating effect. The worm also bundled other spreading tricks, including the the ability to guess passwords and a stack overflow vulnerability in Unix systems.

The worm only exploited known vulnerabilities in Unix sendmail, finger, and rsh/rexec, as well as weak passwords. It was meant only to gauge the size of the nascent internet, but mistakes in its spreading mechanisms had unintended consequences that turned it into a powerful server-crashing tool.

Computer systems were flooded with malicious traffic as the worm tried to spread itself further, with many systems either crashing or grinding to a halt. According to estimates, 6,000 of the 60,000 systems in the early (and much smaller) internet of the day got infected by the worm.

Although the worm had no malicious payload its promiscuous spread created chaos.

A PBS television news report about the worm, which created all manner of headaches for early sysadmins, set the scene for many reports to follow. The suspect was a "dark genius", it concluded.

"Life in the modern world has a new anxiety," said the news anchor. "Just as we've become totally dependent on our computers they're being stalked by saboteurs, saboteurs who create computer viruses."

Youtube Video

The creator of the worm was eventually identified as Robert T Morris, a computer science graduate student in the first year of his doctorate at Cornell University.

Morris was prosecuted over his actions, found guilty of breaking US computer abuse laws (specifically, the recently passed Computer Fraud and Abuse Act), and sentenced to three years’ probation. He was also ordered to complete 400 hours of community service and fined just over $10,000.

"What Morris did was stupid and reckless – there is no doubt about that. But he wasn’t the first person to write a virus, and he was far from the last to create and spread destructive malware," notes veteran security researcher Graham Cluley in a blog post marking the Morris Worm anniversary.

Morris, now a professor at the Computer Science and Artificial Intelligence Laboratory at MIT, declined The Register's invitation to answer questions on the creation of the worm. Morris's late father, also named Robert, worked for the NSA.

"A lot of this story sounds eerily familiar, even 25 years later," notes anti-virus industry veteran Paul Ducklin in a post on the Sophos Naked Security blog. Ducklin's post reflecting on the Morris Worm event, and the lessons that can be learned from the incident - many of which continue to be relevant today - can be found here.

Bugnote

Shortly after the outbreak, security researcher Eugene Spafford wrote what remains the definitive analysis (PDF) of the bugs exploited by the Morris Worm.

Choosing a cloud hosting partner with confidence

More from The Register

next story
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Heatmiser digital thermostat users: For pity's sake, DON'T SWITCH ON the WI-FI
A stranger turns up YOUR heat with default password 1234
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.