The Morris Worm of 1988: When the Internet First Caught a Cold

On the evening of 2 November 1988, system administrators at universities and research labs around the United States noticed their machines becoming sluggish. Load averages climbed, and processes multiplied. Within hours, a program that nobody had asked for was running on thousands of computers. It became known as the Morris worm, and it was the first time the internet went through a large-scale security incident.

The author and the intent

The worm was written by Robert Tappan Morris, a graduate student at Cornell University. His father, also named Robert Morris, was a well-known computer scientist who worked on security at the National Security Agency. Morris has said that he meant to gauge the size of the internet and did not intend to cause damage. To disguise where it came from, he released the program from a computer at the Massachusetts Institute of Technology, not from Cornell.

Whatever the intent, the result was serious. The program contained a mistake that made it far more disruptive than planned.

How it got in

The worm used several methods to reach new machines on the network, which at that time ran mostly on Unix variants such as BSD.

• A debug option in sendmail. The mail program allowed a debug mode that could be used to run commands on the remote machine.
• A buffer overflow in fingerd. The finger service read input into a fixed-size buffer without checking the length, and the worm exploited that.
• Trusted hosts and weak passwords. The worm tried to use remote shell trust relationships, and it guessed passwords using a short built-in word list and the system's dictionary.

This combination meant that a system needed to be careless in only one of several ways to be infected.

The bug that caused the harm

The worm was supposed to check whether a machine was already infected, and not install a second copy. But Morris worried that administrators might fake that check to protect themselves. So the program was written to copy itself anyway about one time in seven, even if a copy was already running. On a network where each machine was contacted many times, that small probability led to machines running many copies at once. They ran out of resources, slowed down and in many cases had to be disconnected.

The number most often cited is that roughly ten percent of the machines then connected to the internet were affected, which is in the range of thousands of systems. Estimates of the total cost vary widely, and it is best to treat any single figure with caution.

The response

Administrators at several sites, including Berkeley and Purdue, worked through the night to analyse the worm and share fixes. They communicated by phone and by whatever mail still worked, since many machines were cut off. Within a couple of days the main flaws had been patched and the worm contained.

The incident exposed a gap: there was no standing group to coordinate a response. In the weeks afterwards, the Defense Advanced Research Projects Agency funded the creation of the Computer Emergency Response Team Coordination Center, known as CERT/CC, at Carnegie Mellon University. It became the model for national and organisational incident response teams worldwide.

Inside the worm's design

Analysts who took the program apart in the days afterwards were struck by how carefully it was built. It hid its own files, erased traces after loading and disguised its process name so that it looked like an ordinary shell. It contained an obscured list of common passwords to try and a routine for guessing common choices, such as a user's own name or the name reversed. None of this required unusual skill, but together it showed how many small weaknesses could be chained into something large.

The incident also revealed how thin the defences on shared networks had been. At the time, many administrators left debug features enabled and trusted every machine on the local network. Those habits were reasonable in a small community of researchers. They were not reasonable once the network had grown beyond anyone's ability to know everyone on it.

Prosecution

Morris is often described as the first person convicted under the Computer Fraud and Abuse Act; strictly, his was the first case under the act decided by a jury, as at least one earlier case had already ended in a conviction. He was found guilty in 1990 and sentenced to three years of probation, 400 hours of community service and a fine of $10,050. He later co-founded the web start-up Viaweb with Paul Graham, which was sold to Yahoo, and became a professor of computer science at MIT.

The Morris worm turned the idea of a network-wide attack from theory into history. It prompted more careful programming practices, wider use of password hygiene, and a formal culture of coordinated vulnerability reporting. It also showed how a single flaw, left unpatched in widely deployed software, could spread much faster than people could respond to it.

The lesson for site owners today

Three of the worm's ingredients are still common: a known flaw in a widely used service, weak passwords, and software that was never updated. Modern attacks on websites use exactly these. Attackers scan the whole internet, find sites running a vulnerable version of a popular tool, and attack them in bulk.

1. Apply security updates to your CMS, plugins and server software promptly.
2. Use long, unique passwords and a password manager.
3. Switch off services and features you do not use.
4. Keep backups so that a bad day does not become a lost business.

For a wider baseline of measures, see the security page.

Where to start

Our knowledgebase has guides on routine maintenance tasks, and our security page explains how we think about protecting hosted sites. For a bigger step, a VPS lets you control exactly which services run on your server.