Morris worm
1988 Internet worm
- 5 min read
- 4 chapters
Related on Lably
Architecture
The worm's creator, Robert Tappan Morris, is the son of cryptographer Robert Morris, who worked at the NSA. A friend of Morris said that he created the worm simply to see if it could be done, and released it from the Massachusetts Institute of Technology (MIT) to avoid the worm being traced directly back to Cornell, where he was a Ph.D. student at the time. Clifford Stoll, author of The Cuckoo's Egg, wrote that "Rumors have it that [Morris] worked with a friend or two at Harvard's computing department (Harvard student Paul Graham sent him mail asking for 'Any news on the brilliant project')".
The worm exploited several vulnerabilities of targeted systems, including:
- A hole in the debug mode of the Unix sendmail program
- A buffer overflow or overrun hole in the finger network service
- The transitive trust enabled by people setting up network logins with no password requirements via remote execution (rexec) with Remote Shell (rsh), termed rexec/rsh
The worm exploited weak passwords, such as words used by the spelling checker and passwords using simple patterns like username, emanresu, or usernameusername. Morris's exploits became generally obsolete due to decommissioning rsh (normally disabled on untrusted networks), fixes to sendmail and finger, widespread network filtering, and improved awareness of weak passwords.
Though Morris said that he did not intend for the worm to be actively destructive, a consequence of Morris's coding resulted in the worm being more damaging and spreadable than originally planned. It was initially programmed to check each computer to determine if the infection was already present, but Morris believed that some system administrators might counter this by instructing the computer to report a false positive. Instead, he programmed the worm to copy itself 14% of the time, regardless of the status of infection on the computer. This resulted in a computer potentially being infected multiple times, with each additional infection slowing the machine down to unusability. This had the same effect as a fork bomb, and crashed the computer several times.
The main body of the worm can infect only DEC VAX machines running 4BSD, alongside Sun-3 systems. A portable C "grappling hook" component of the worm was used to download the main body parts, and the grappling hook runs on other systems, loading them down and making them peripheral victims.
Sign in to keep reading
3 more chapters are free with a Lably account.
Replication rate
By instructing the worm to replicate itself regardless of a computer's reported infection status, Morris transformed the worm from a potentially harmless intellectual and computing exercise into a viral denial-of-service attack. Morris's inclusion of the rate of copy within the worm was inspired by Michael Rabin's mantra of randomization.
The resulting level of replication proved excessive, with the worm spreading rapidly, infecting some computers several times. Rabin would eventually comment that Morris "should have tried it on a simulator first".
Effects
During Morris' legal process, the US court of appeals estimated the cost of removing the virus from each installation was in the range of $200–$53,000. Possibly based on these numbers, Stoll, a systems administrator known for discovering and subsequently tracking the hacker Markus Hess three years earlier, estimated for the US Government Accountability Office that the total economic impact was between $100,000 and $10,000,000. Stoll helped fight the worm, writing in 1989 that "I surveyed the network, and found that two thousand computers were infected within fifteen hours. These machines were dead in the water—useless until disinfected. And removing the virus often took two days." Stoll commented that the worm showed the danger of monoculture, because "If all the systems on the ARPANET ran Berkeley Unix, the virus would have disabled all fifty thousand of them."
It is usually reported that around 6,000 major UNIX machines were infected by the Morris worm. Graham claimed, "I was there when this statistic was cooked up, and this was the recipe: someone guessed that there were about 60,000 computers attached to the Internet, and that the worm might have infected ten percent of them". Stoll estimated that "only a couple thousand" computers were affected.
The Internet was partitioned for several days, as regional networks disconnected from the NSFNet backbone and from each other to prevent recontamination while cleaning their own networks.
The Morris worm prompted DARPA to fund the establishment of the CERT/CC at Carnegie Mellon University, giving experts a central point for coordinating responses to network emergencies. Gene Spafford also created the Phage mailing list to coordinate a response to the emergency.
Morris was tried and convicted of violating United States Code Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act, in United States v. Morris. After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine of US$10,050 (equivalent to $23,800 in 2025) plus the costs of his supervision. The total fine ran to US$13,326 (equivalent to $31,500 in 2025), which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.
The Morris worm has sometimes been referred to as the "Great Worm", named after the devastating "Great Worms" of Tolkien. The Morris worm had a devastating effect on the Internet at that time, both in overall system downtime and in psychological impact on the perception of security and reliability of the Internet.
In popular culture
- The 1995 film Hackers features a main character who releases a viral attack bearing several similarities to the Morris worm. The event takes place in 1988, infects over 1,000 computers, causes a massive economic disruption, and results in its propagator being fined and put on probation.
- In the visual novel Digital: A Love Story, the Morris worm is portrayed as a cover story for a large-scale attack on ARPANET and several bulletin board systems.
- In the epilogue of his book The Cuckoo's Egg, Stoll details his efforts battling the Morris worm.
- In Halt and Catch Fire, a virus that works in a similar way to the Morris worm is created to gauge the size of the network.
- In Date Time, an indie developed video game, the Morris worm is portrayed as a character in a dating sim.
- In Gori: Cuddly Carnage, a game developed by Angry Demon Studio, a floppy disk can be seen containing the Morris worm.