Morris worm

The Morris worm or Internet worm of November 2, 1988, was one of the first computer worms distributed via the Internet, and the first to gain significant mainstream media attention. It also resulted in the first felony conviction in the US under the 1986 Computer Fraud and Abuse Act.[1] It was written by a graduate student at Cornell University, Robert Tappan Morris, and launched on November 2, 1988, from the computer systems of the Massachusetts Institute of Technology.

Architecture
Floppy disk containing the source code for the Morris Worm (also known as The Worm) held at the Computer History Museum

The worm was created by Morris simply to see if it could be done,[2] and was released from the Massachusetts Institute of Technology (MIT) in the hope of suggesting that its creator studied there, instead of Cornell.[3] (Morris would later become a tenured professor at MIT in 2006.)[4] Morris, the creator of the worm, was the son of Robert Morris, a cryptographer who, at the time, was working for the NSA.[5]

The worm exploited several vulnerabilities to gain entry to targeted systems, including:

The worm also functioned through the exploit of weak passwords.[6] Due to reliance on rsh (normally disabled on untrusted networks), fixes to sendmail, finger, the widespread use of network filtering, and improved awareness of the dangers of weak passwords, the exploits Morris used would no longer succeed on a contemporary and properly configured system in the present day.

Though Morris did not intend for the worm to be actively destructive, instead seeking to merely highlight the weaknesses present in many networks of the time, an unintentional consequence of Morris' coding resulted in the worm being more damaging and easily spread than originally planned; programmed to check each computer to determine if the infection was already present, Morris, believing that some system administrators might counter this by instructing the computer to report a false positive, programmed the worm to copy itself 14% of the time, regardless of the status of infection on the computer. This resulted in a computer potentially being infected multiple times, with each additional infection slowing the machine down to the eventual point of being unusable. This would have the same effect as a fork bomb, and crash the computer several times.

The main body of the worm could only infect DEC VAX machines running 4BSD, alongside Sun-3 systems. A portable C "grappling hook" component of the worm was used to pull over (download) the main body parts, and the grappling hook could run on other systems, loading them down and making them peripheral victims.[7]

Coding mistake and resulting issues

Morris' coding mistake, in instructing the worm to replicate itself regardless of a computer's reported infection status, transformed the worm from a potentially harmless intellectual and computing exercise into a viral denial of service attack; Morris' inclusion of the rate of copy within the worm was inspired by Michael Rabin's mantra of "Randomization".[8]

The resulting level of replication proved excessive, with the worm spreading rapidly, infecting some computers a number of times. Rabin would eventually comment that Morris "should have tried it on a simulator first".[9]

Effects of the worm

The U.S. Government Accountability Office put the cost of the damage at $100,000–$10,000,000.[note 1] Clifford Stoll, a systems administrator known for discovering and subsequently tracking the hacker Markus Hess three years earlier, helped fight the worm, writing in 1989 that: "I surveyed the network, and found that two thousand computers were infected within fifteen hours. These machines were dead in the water—useless until disinfected. And removing the virus often took two days". Stoll commented that the worm showed the danger of monoculture, as "If all the systems on the Arpanet ran Berkeley Unix, the virus would have disabled all fifty thousand of them".[10]

It is usually reported that around 6,000 major UNIX machines were infected by the Morris worm; however, Morris' colleague Paul Graham claimed, "I was there when this statistic was cooked up, and this was the recipe: someone guessed that there were about 60,000 computers attached to the Internet, and that the worm might have infected ten percent of them."[11] Stoll estimated that "only a couple thousand" computers were affected, writing that "Rumors have it that [Morris] worked with a friend or two at Harvard's computing department (Harvard student Paul Graham sent him mail asking for 'Any news on the brilliant project')".[10]

The Internet was partitioned for several days, as regional networks disconnected from the NSFNet backbone and from each other to prevent recontamination whilst cleaning their own networks.

The Morris worm prompted DARPA to fund the establishment of the CERT/CC at Carnegie Mellon University, giving experts a central point for coordinating responses to network emergencies.[12] Gene Spafford also created the Phage mailing list to coordinate a response to the emergency.

Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act[13] in United States v. Morris. After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision.[14] The total fine ran to $13,326, which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.

The Morris worm has sometimes been referred to as the "Great Worm", due to the devastating effect it had on the Internet at that time, both in overall system downtime and in psychological impact on the perception of security and reliability of the Internet. The name was derived from the "Great Worms" of Tolkien: Scatha and Glaurung.[15]

  • The 1995 film Hackers features a main character who releases a viral attack bearing several similarities to the Morris worm: the event takes place in 1988, infects over a thousand computers, causes a massive economic disruption, and results in its propagator being fined and put on probation.
  • In the visual novel Digital: A Love Story, the Morris worm is portrayed as a cover story for a large-scale attack on ARPANET and several bulletin board systems.
  • In the epilogue of his book The Cuckoo's Egg, Stoll details his efforts battling the Morris worm.
  • In Halt and Catch Fire, a virus that works in a similar way to the Morris worm is created to gauge the size of the network.

See also

Notes
  1. During the Morris appeal process, the U.S. Court of Appeals estimated the cost of removing the virus from each installation was in the range of $200–53,000. Possibly based on these numbers, Clifford Stoll of Harvard estimated the total economic impact was between $100,000–10,000,000.

References
  1. Dressler, J. (2007). "United States v. Morris". Cases and Materials on Criminal Law. St. Paul, MN: Thomson/West. ISBN 978-0-314-17719-3.
  2. Paul Graham [@paulg] (November 2, 2020). "FWIW the Wikipedia article on the worm is mistaken" (Tweet). Retrieved November 2, 2020 – via Twitter.
  3. Kehoe, Brendan P. (1992). Zen and the Art of the Internet: A Beginner's Guide to the Internet, First Edition.
  4. "Robert Morris". csail. 2007. Archived from the original on August 3, 2008. Retrieved August 23, 2008.
  5. "The Morris Worm Turns 30". Global Knowledge Blog. November 1, 2018. Retrieved January 29, 2019.
  6. "US vs. Morris". Loundy.com. Retrieved 2014-02-05.
  7. Spafford, Eugene (December 8, 1988). "An analysis of the worm" (PDF). Purdue University. Retrieved October 30, 2019.
  8. "Court Appeal of Morris". Retrieved 2014-02-05.
  9. Maynor, David (2011). Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research. Elsevier. p. 218. ISBN 978-0-08-054925-5.
  10. Stoll, Clifford (1989). "Epilogue". The Cuckoo's Egg. Doubleday. ISBN 978-0-307-81942-0.
  11. "The Submarine". Paulgraham.com. Retrieved 2014-02-05.
  12. "Security of the Internet. CERT/CC". Cert.org. 1998-09-01. Retrieved 2014-02-05.
  13. United States v. Morris (1991), 928 F.2d 504, 505 (2d Cir. 1991).
  14. "Computer Intruder is Put on Probation and Fined" by John Markoff, The New York Times.
  15. "Great Worm". catb.org.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.