Scourge · November 2 1988

The Plague of the Morris Worm

Chronicle

On the evening of 2 November 1988 Cornell graduate student Robert Tappan Morris released, from an MIT machine, a worm that crawled through sendmail's DEBUG mode, a fingerd buffer overflow and the naive trust of rsh and rexec. A bug in its spreading logic made it reinfect the same hosts again and again, until some 6,000 machines, about a tenth of the Internet of the day, buckled under the load. Morris became the first person convicted of a felony under the US Computer Fraud and Abuse Act.

Lesson learned

From its ashes rose CERT/CC, the first computer emergency coordination centre, and the network learned that trust between hosts must be earned, not assumed.

Prayer of reparation

O primordial Worm, who only meant to count the machines and ended up felling them, teach us to bound our loops and never to leave DEBUG switched on in production. Amen.

How it is remembered

Remembered by switching off services nobody uses, deleting forgotten .rhosts files and making sure every loop knows how to stop.