1988Worm
Morris worm
2 November 1988
The Morris worm was one of the first worms to spread across the internet. It exploited weaknesses in common Unix services, including sendmail and fingerd, and guessed weak passwords. A flaw in how it decided whether to reinfect a machine meant it copied itself far more than intended, overloading systems until they became unusable.
- Victim
- Computers connected to the early internet, largely at universities and research and military sites
- Sector
- Research and academia
- Public attribution
- Written by Robert Tappan Morris, then a Cornell graduate student, who was later convicted under the US Computer Fraud and Abuse Act (FBI).
Impact
Many sites on the then-small internet were slowed to a halt or disconnected from the network while administrators removed it (FBI, RFC 1135).
Root cause
Unpatched service vulnerabilities, debug features left enabled, and weak or guessable passwords on networked Unix systems.
Lessons learned: the controls it teaches
- Patch and disable unnecessary network services and debug options.
- Enforce strong passwords; password guessing was one of its spreading methods.
- Coordinated incident response matters: the outbreak led to the creation of the CERT Coordination Center.