The Morris Worm: A Fifteen-Year Perspective

PUBLISHED BY THE IEEE COMPUTER SOCIETY 1540-7993/03/$17.00 © 2003 IEEE IEEE SECURITY & PRIVACY 35 O n the evening of 2 November 1988, a brush fire got out of control on the Internet and set at least one computer in 20 on fire, figuratively speaking. This was due to an event that was either the Internet’s first mobile agent experiment or a new entry in the annals of computer vandalism: the infamous Morris worm. The work of Robert Tappan Morris, a Cornell graduate student in computer science, the worm caused those connected to the Internet much consternation. System administrators at sites infected by the Morris worm spent at least a day fighting what initially was a mysterious enemy. By early in the morning on 3 November, Unix-based computers had slowed down to only a small percentage of their usual capabilities and email was bogged down in a hopeless mire. As the day wore on, the little information available about the problem was not comforting: a software worm was using the sendmail program for Unix systems (an omnibus application dealing with many aspects of email sending and receiving, especially the Internet SMTP email protocol) and the C compiler to replicate. It loaded code from other computers into itself, and it had more than one method of invasion. No one was sure if it did anything else, if it would do anything else to their computers, or whether it was the work of a single person or a group of attackers. Today, the Morris worm is remembered as the first of many such attacks, as what might have been a wake-up call to system administrators and security researchers, and as the first certain signal to those who still held utopian beliefs about the Internet, that it was not to be a friendly place. What is the Morris worm’s legacy to computer security from a 15-year perspective? In this article, I consider two areas: the development of defensive measures and understanding what, if anything, distinguishes a destructive from a nondestructive worm. The immediate reactions in 1988 to the massive assault on user accounts all over the Internet now seem curiously naïve. Posters to the RISKS Digest (www. risks.org), a forum on computer risks, were outraged that a student had done such a thing. Many called for an emphasis on computer ethics. Was this an example of mischief or research, or had someone confused the two? This was a time of transition for the Internet, and while the Morris worm might not have been a watershed event, it did mark an uneven boundary between the largely trusting Internet of the time and the heterogeneous, dangerous world-wide Internet of today. Since then, firewall and antivirus protection industries have emerged and matured, and a new generation of security experts in industry and academia has come of age. How much influence did the Morris worm have on them and how Internet security is now approached?