The Morris worm (1988)

What happened

On the evening of November 2, 1988, a self-copying program was released onto the internet from a computer at MIT. Within hours, machines at universities, research labs and government facilities across the United States slowed to a crawl. The program was written by Robert Tappan Morris, then a graduate student at Cornell University. By most accounts it was intended to spread quietly and gauge the size of the internet, not to damage anything. A design mistake turned it into the first internet event to make front-page news.

The internet of 1988 was small: estimates put it at around 60,000 connected computers, mostly Unix systems at universities and research institutions. Contemporary estimates suggested that several thousand of them were affected, although nobody could count precisely.

How it worked

The worm was a "worm" in the technical sense: a program that spreads from computer to computer on its own, without a person opening a file. It used several routes, all of which relied on weaknesses common at the time:

• A debug feature in the sendmail mail program that, when left enabled, allowed commands to be run remotely.
• A buffer overflow in the fingerd service, which answered queries about users. Sending it more data than it expected let the worm run its own code. This was one of the first widely known real-world buffer overflow attacks.
• Weak passwords and trust between machines. The worm tried simple password guesses and used "trusted host" settings that let users log in to other machines without a password.

The fatal flaw was in how it decided whether to infect a machine that was already infected. To avoid being defeated by administrators faking an "already infected" signal, it reinfected anyway a fraction of the time (reportedly one time in seven). Machines ended up running many copies at once, which consumed their processing power and made them unusable.

Impact

System administrators spent days disconnecting machines, analyzing the code and sharing fixes over mailing lists, sometimes struggling because the worm had clogged the very network they needed to communicate. Cost estimates at the time varied enormously and are not reliable, but the disruption to research computing was real and widespread.

Morris became the first person convicted under the US Computer Fraud and Abuse Act of 1986. In 1990 he was sentenced to probation, community service and a fine. He later became a professor at MIT.

What defenders learned

• Coordination needs a home. Within weeks, the US government funded the Computer Emergency Response Team Coordination Center (CERT/CC) at Carnegie Mellon University. The idea of a central team that coordinates vulnerability information and incident response spread worldwide, and today many countries and companies run their own CERTs or CSIRTs.
• Software flaws are security flaws. Buffer overflows went from an obscure bug class to a central concern of secure programming.
• Defaults matter. Debug features left on, weak passwords and blanket trust between machines were all configuration choices.

What it means for you

The Morris worm is a reminder that intent does not limit damage. Code you release, or a test you run, can spread in ways you did not predict. That is why security professionals only test systems they own or have written permission to test, as our guide to legal and ethical boundaries explains.

The practical lessons still apply at home: turn off services you do not use, keep software updated, and do not reuse weak passwords. The worm's password guessing would still work against plenty of devices today, which is exactly what the Mirai botnet showed nearly three decades later.