Creeper and Reaper: The First Worm and the First Antivirus

In the early 1970s, a few dozen computers were connected by a research network called the ARPANET. One of them displayed a strange message: "I'M THE CREEPER : CATCH ME IF YOU CAN". The program that printed it is usually called the first computer worm. It was not malicious, and its creator meant it as an experiment. Yet it started a pattern that every modern site owner now has to deal with.

The ARPANET in 1971

The ARPANET was a network funded by the US Department of Defense's Advanced Research Projects Agency. By 1971 it connected a small number of universities and research firms. One of those firms was Bolt, Beranek and Newman, known as BBN, which helped build the network itself. Many of the machines on the network ran an operating system called TENEX on DEC PDP-10 computers.

This was a friendly environment. Users were researchers who largely knew each other, and the idea of a hostile program crossing the network had not yet become a serious concern.

What Creeper did

Creeper was written by Bob Thomas at BBN. It was an experiment in mobile programs: could a running program move from one computer to another while keeping its state? Creeper did exactly that. It loaded onto a machine, printed its message, then tried to move on to another machine on the network and removed itself from the previous one.

That detail matters. In the usual account, Creeper moved rather than copied itself, so it left behind one running instance and not an ever-growing number. It was therefore not truly a virus, and not quite the self-multiplying worm we know today, but it was the first well-documented program to travel across a network on its own.

Reaper

The next step was a program named Reaper, which was designed to find Creeper and delete it. It is commonly credited to Ray Tomlinson, the BBN engineer who is also famous for bringing email to the ARPANET and choosing the @ sign for addresses. Reaper itself moved from machine to machine, looking for copies of Creeper to remove.

It is sometimes called the first antivirus program. This is a slight stretch, since there was no real harm to defend against, but the idea was the same: one piece of software hunting another. Be aware that some details of these early stories come from later recollections by participants, so exact dates and credits vary between sources.

Why it was harmless and why that mattered

Creeper did no damage. It did not steal data, encrypt files or corrupt anything. It was, in effect, a proof of concept that code could be mobile. But once the concept existed, it could not be un-invented. Within a few years, people were writing programs for other platforms that copied themselves, and by the 1980s the first true viruses were spreading on personal computers.

The terms, explained

• Virus: code that attaches itself to other programs or files and spreads when they are run or shared.
• Worm: code that spreads by itself across a network, without needing a user to run an infected file.
• Trojan: code that pretends to be something useful so that a user installs it.

After Creeper, self-replicating programs appeared in other places and for other reasons. In the early 1980s, a program called Elk Cloner spread among Apple II floppy disks. In 1986 came Brain on the IBM PC. In 1988 the Morris worm showed what a network-aware, self-copying program could do at scale. Each step took the same underlying idea and added speed, reach or hostility.

What changed over time was not the concept but the environment. Early networks had a handful of machines and a community of trusted users. By the late 1980s and 1990s, the number of connected computers had grown by orders of magnitude, and many of them ran identical software with identical flaws. That uniformity is exactly what makes worms effective, and it is still true of popular web platforms today.

The pattern it started

Creeper and Reaper show a cycle that has repeated for more than fifty years. A new capability appears. Someone demonstrates it, often harmlessly. Others adopt it for less friendly ends. A defensive tool follows. The attackers adapt, and the cycle continues.

It also shows something about trust. The early ARPANET was built on the assumption that everyone on it was a colleague. When networks grew to include everyone, that assumption was no longer safe, but a lot of software had been written under it, and some still is.

The lesson for site owners today

Self-spreading code is no longer a curiosity. Modern attacks on websites often rely on automated tools that scan the internet for known weaknesses and exploit them without any human effort. The practical defence is not exotic: keep software patched, remove what you do not use, and make sure that an infection on one part of your system cannot easily spread to the rest.

• Update your CMS, themes and plugins promptly.
• Delete plugins and old sites you no longer use.
• Keep separate sites separated, with their own credentials and permissions.
• Keep recent backups stored away from the live server.

For a wider baseline of measures, see the security page.

Putting it into practice

If you run several sites, isolation between them limits the damage if one is compromised. A VPS gives you your own isolated environment, and Plesk lets you manage separate subscriptions with their own users. Our security page has more on how we think about keeping hosted sites safe.