Morris worm

Morris worm. The Morris worm was one of the first major computer worms distributed via the early Internet. It was created by Robert Tappan Morris, then a graduate student at Cornell University, and launched from the Massachusetts Institute of Technology on November 2, 1988. The worm's rapid replication caused widespread disruption, infecting thousands of systems and leading to significant legal and technical repercussions in the nascent field of computer security.

Background and development

The late 1980s saw the ARPANET evolving into a broader network of interconnected academic and research institutions. This environment was largely built on trust, with systems like BSD and SunOS having well-known security vulnerabilities. Robert Tappan Morris, the son of National Security Agency chief scientist Robert Morris, was a doctoral student exploring network security. He developed the worm as an experiment to gauge the size of the Internet, exploiting weaknesses in common services like the sendmail mail transfer agent, the finger protocol, and weak passwords via rsh. His work was influenced by earlier concepts discussed within the hacker culture surrounding the Chaos Computer Club and readings from publications like Phrack.

Release and spread

On the evening of November 2, 1988, the worm was released from a computer at the Massachusetts Institute of Technology, a tactic possibly intended to obscure its origin at Cornell University. It propagated with astonishing speed, exploiting the sendmail debug mode and a buffer overflow in the fingerd daemon. The worm also attempted to crack user passwords using a built-in dictionary and the system's etc/passwd file. A critical flaw in its replication algorithm, however, caused it to infect machines multiple times, leading to severe denial-of-service conditions as systems became overloaded. Within 24 hours, it had crippled approximately 6,000 of the 60,000 computers then connected to the Internet, including major institutions like University of California, Berkeley, Stanford University, and NASA.

Impact and consequences

The immediate impact was a massive slowdown and crash of academic and government systems across the United States. Key sites like the Lawrence Berkeley National Laboratory and the RAND Corporation were affected, disrupting research and communications. The United States Department of Defense and the National Science Foundation took note, as the event highlighted the fragility of critical network infrastructure. System administrators, including a team at the University of California, Berkeley led by a group of programmers, worked tirelessly to analyze the worm's code and develop patches. The incident caused millions of dollars in downtime and recovery costs, shocking a community accustomed to an open, cooperative network culture and prompting the establishment of the Computer Emergency Response Team at Carnegie Mellon University.

Technical details

The worm was written in the C programming language and targeted VAX and Sun-3 architectures running BSD-based operating systems. Its primary attack vectors were threefold: the debug feature in sendmail, a buffer overflow vulnerability in the fingerd network service, and brute-force password guessing against the rsh service. The worm would transfer a compiled binary to a new host, compile it, and begin its search for new targets. A central flaw was its mechanism to avoid detection; it would ask a remote host if it was already infected, but this check could be easily fooled, leading to multiple, resource-consuming infections on the same machine. The code also contained no malicious payload designed to damage files, but its aggressive replication was destructive enough.

Aftermath and legacy

Robert Tappan Morris became the first person convicted under the 1986 Computer Fraud and Abuse Act, receiving probation, community service, and a fine. The case was prosecuted in the United States District Court for the Northern District of New York. The event was a watershed moment, leading directly to the creation of the Computer Emergency Response Team and a new focus on cybersecurity within organizations like DARPA. It influenced future legislation and inspired both security professionals and malicious actors. The worm is frequently studied in computer science courses and is considered a pivotal event that ended the early innocence of the Internet, foreshadowing future conflicts involving Stuxnet and state-sponsored cyber warfare. Morris later became a tenured professor at the Massachusetts Institute of Technology and a co-founder of the startup incubator Y Combinator.

Category:Computer worms Category:1988 software Category:History of the Internet Category:Computer security