The Demon Morris, First Worm of the Net

Legend

In November 1988 a student, Robert Tappan Morris, released a worm that crawled between Unix machines through sendmail's debug mode, a buffer overflow in fingerd, weak passwords and the blind trust of rsh. It was only meant to count hosts, but a flaw in its reinfection logic made it multiply unchecked, until by one estimate a tenth of the young Internet was on its knees. That night gave birth to CERT/CC and to the first US conviction under the Computer Fraud and Abuse Act.

Exorcism

Cast it out by stripping network daemons of every forgotten debug feature or backdoor. No trust-based logins like rsh and rexec: every remote access must demand real authentication. And strong passwords, because this worm knew the easy ones by heart.

Technical record

Also known as

Internet Worm of 1988

Circle

Circle I · Worms

First seen

1988

Status

Dormant

Works

The Plague of the Morris Worm

Released by Robert Tappan Morris in November 1988, it spread across Unix hosts via a sendmail debug mode, a fingerd buffer overflow and weak passwords/rsh trust. A re-infection bug made it overload thousands of machines, an estimated tenth of the early Internet. It led to the first US conviction under the Computer Fraud and Abuse Act and to the creation of CERT/CC.