Not the first virus, but the first big one
The Morris worm is sometimes called the first computer virus. Under the usual definitions, that is not accurate: it was a worm, a program that spreads between computers by itself, and several virus and worm experiments came earlier. It does have a different claim to fame. In November 1988 it became the first program to disrupt a large share of the internet and to attract wide public attention, and it changed how the network community responded to emergencies.
The network in 1988
The internet then was a much smaller place. A frequently cited estimate puts the number of connected computers at about 60,000, mostly Unix machines at universities, research laboratories and military sites. This was a descendant of ARPANET and was run largely on trust. Machines often accepted connections from each other, and many accounts had weak passwords.
Who and when
On the evening of November 2, 1988, the worm was released. Its author was Robert Tappan Morris, then a graduate student at Cornell University. He launched it from a computer at the Massachusetts Institute of Technology, which obscured where it came from. By his account, he intended to gauge the size of the network, not to cause damage.
How it spread
The worm used several weaknesses at once, which is one reason it moved so quickly.
- A mail-program flaw. A widely used mail program had a debugging option left on, which let the worm send commands to a remote machine.
- A flaw in a lookup service. The “finger” service, which tells users who is logged in elsewhere, contained a programming mistake that let an overlong request overwrite memory and run the worm’s code.
- Trust relationships and weak passwords. The worm tried to guess passwords from a small built-in list, plus common words, and used the trust between machines to log in as ordinary users.
Once running on a new machine, it looked for the machines that this one was connected to and tried to repeat the process. It also tried to hide, renaming itself and avoiding leaving files that would identify it easily.
Why it brought machines down
The worm was not designed to delete files. What it did was reproduce too enthusiastically. To avoid being stopped by a single instruction that tells it a machine is already infected, Morris programmed the worm to copy itself anyway in about one case out of seven, even when it detected a copy already running. That ratio turned out to be far too high. Infected computers quickly accumulated multiple copies, each using processor time and memory, until the machine became too slow to use or crashed. Because mail and other services failed, some sites cut their links to the wider network to avoid reinfection.
A commonly quoted figure is that around 6,000 computers were affected, which is about a tenth of the then-connected total. That number is an estimate, made in the days after the outbreak, and later writers have debated it. It is best taken as a rough scale, not a precise count.
The scramble to respond
Within hours, system administrators at universities and laboratories started to share information. Teams at several universities analyzed the code, worked out ways to stop it, such as creating a directory that the worm would see as a sign of infection, and circulated fixes. Communication was hampered because the problem itself disrupted email and because some sites had disconnected. People used the telephone and a few unaffected systems to coordinate.
Morris, realizing the situation had gone wrong, reportedly asked a friend to send an anonymous message with advice for stopping the worm, but the message did not arrive in time, due to the network congestion.
The legal outcome
Morris was identified and prosecuted under the United States Computer Fraud and Abuse Act. In 1990, he was convicted at trial and is generally reported to be the first person convicted under that law for releasing a worm. His sentence did not include prison: it was probation, community service of several hundred hours, and a fine. An appeal against the verdict failed in 1991. He later became a computer science professor and a technology entrepreneur.
Opinion on the case is divided. Some argued that he was a curious student whose experiment went wrong. Others pointed out that unauthorized access to other people’s computers is a wrong regardless of the intent, and that a more careful programmer would have tested it.
Effect on emergency response
The long-term legacy of the incident was organizational. Within weeks, the US defense research agency funded the creation of a computer emergency response team at Carnegie Mellon University to act as a central contact for reporting and handling security incidents. Such teams soon multiplied in other countries, and in 1990 a forum of teams was founded to share information. Today the model of national, company and sector response teams, which publish advisories and coordinate fixes, traces back in part to this event.
It also made operating-system vendors and network administrators more careful about default settings, left-open debugging features and unchecked input. A class of bug, the buffer overflow, became widely known, and remained a major source of vulnerabilities for years.
Lessons
The worm shows how an unintended bug in the program’s own design could cause more harm than its author wanted, how a network of trusting systems can fail at once, and why a standing group is needed to coordinate under pressure. When later worms such as Code Red and Slammer spread across a much larger internet, the response teams that began in 1988 were already in place.