Jump to content

Morris worm

From Wikipedia, the free encyclopedia

Morris worm
Original author(s)Robert Tappan Morris
Initial release8:30 pm November 2, 1988
Operating system4BSD
PlatformVAX,Sun-3BBN C70 NOC, BBN C30IMP
TypeComputer worm
Internet history timeline

Early research and development:

Merging the networks and creating the Internet:

Commercialization, privatization, broader access leads to the modern Internet:

Examples of Internet services:

TheMorris wormorInternet worm of November 2, 1988,is one of the oldestcomputer wormsdistributed via theInternet,and the first to gain significant mainstream media attention. It resulted in the firstfelonyconviction in the US under the 1986Computer Fraud and Abuse Act.[1]It was written by a graduate student atCornell University,Robert Tappan Morris,and launched on 8:30 p.m. November 2, 1988, from theMassachusetts Institute of Technologynetwork.

Architecture

[edit]
Floppy diskcontaining the source code for the Morris Worm, at theComputer History Museum

The worm's creator,Robert Tappan Morris,is the son ofcryptographerRobert Morris,who worked at theNSA.[2]A friend of Morris said that he created the worm simply to see if it could be done,[3]and released it from the Massachusetts Institute of Technology (MIT) in the hope of suggesting that its creator studied there, instead of Cornell.[4] Clifford Stoll,author ofThe Cuckoo’s Egg,wrote that "Rumors have it that [Morris] worked with a friend or two at Harvard's computing department (Harvard studentPaul Grahamsent him mail asking for 'Any news on the brilliant project') ".[5]

The worm exploited several vulnerabilities of targeted systems, including:

The worm exploitedweak passwords.[6]Morris's exploits became generally obsolete due to decommissioning rsh (normally disabled on untrusted networks), fixes to sendmail and finger, widespread network filtering, and improved awareness of weak passwords.

Though Morris said that he did not intend for the worm to be actively destructive, instead seeking to merely highlight the weaknesses present in many networks of the time, a consequence of Morris's coding resulted in the worm being more damaging and spreadable than originally planned. It was initially programmed to check each computer to determine if the infection was already present, but Morris believed that somesystem administratorsmight counter this by instructing the computer to report afalse positive.Instead, he programmed the worm to copy itself 14% of the time, regardless of the status of infection on the computer. This resulted in a computer potentially being infected multiple times, with each additional infection slowing the machine down to unusability. This had the same effect as afork bomb,and crashed the computer several times.

The main body of the worm can infect onlyDECVAXmachines running 4BSD,alongsideSun-3systems. A portableC"grappling hook" component of the worm was used to download the main body parts, and the grappling hook runs on other systems, loading them down and making them peripheral victims.[7]

Replication rate

[edit]

Morris' coding instructing the worm to replicate itself regardless of a computer's reported infection status transformed the worm from a potentially harmless intellectual and computing exercise into a viraldenial-of-service attack.Morris's inclusion of the rate of copy within the worm was inspired byMichael Rabin's mantra ofrandomization.[8]

The resulting level of replication proved excessive, with the worm spreading rapidly, infecting some computers several times. Rabin would eventually comment that Morris "should have tried it on a simulator first".[9]

Effects

[edit]

During the Morris appeal process, the US court of appeals estimated the cost of removing the virus from each installation was in the range of $200–$53,000. Possibly based on these numbers, Stoll estimated for the USGovernment Accountability Officethat the total economic impact was between $100,000 and $10,000,000. Stoll, asystems administratorknown for discovering and subsequently tracking the hackerMarkus Hessthree years earlier, helped fight the worm, writing in 1989 that "I surveyed the network, and found that two thousand computers were infected within fifteen hours. These machines were dead in the water—useless until disinfected. And removing the virus often took two days." Stoll commented that the worm showed the danger ofmonoculture,because "If all the systems on theARPANETranBerkeley Unix,the virus would have disabled all fifty thousand of them. "[5]

It is usually reported that around 6,000 major UNIX machines were infected by the Morris worm. Graham claimed, "I was there when this statistic was cooked up, and this was the recipe: someone guessed that there were about 60,000 computers attached to the Internet, and that the worm might have infected ten percent of them".[10]Stoll estimated that "only a couple thousand" computers were affected.[5]

The Internet was partitioned for several days, as regional networks disconnected from theNSFNetbackbone and from each other to prevent recontamination while cleaning their own networks.

The Morris worm promptedDARPAto fund the establishment of theCERT/CCatCarnegie Mellon University,giving experts a central point for coordinating responses to network emergencies.[11]Gene Spaffordalso created the Phage mailing list to coordinate a response to the emergency.

Morris was tried and convicted of violatingUnited States CodeTitle18 (18 U.S.C.§ 1030), theComputer Fraud and Abuse Act,[12]inUnited States v. Morris.After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine ofUS$10,050(equivalent to $22,000 in 2023) plus the costs of his supervision.[13]The total fine ran to $13,326, which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.

The Morris worm has sometimes been referred to as the "Great Worm," due to the devastating effect it had on the Internet at that time, both in overall system downtime and in psychological impact on the perception of security and reliability of the Internet. The name was derived from the "Great Worms" ofTolkien:ScathaandGlaurung.[14]

[edit]
  • The 1995 filmHackersfeatures a main character who releases a viral attack bearing several similarities to the Morris worm. The event takes place in 1988, infects over 1,000 computers, causes a massive economic disruption, and results in its propagator being fined and put on probation.
  • In the visual novelDigital: A Love Story,the Morris worm is portrayed as a cover story for a large-scale attack on ARPANET and severalbulletin board systems.
  • In the epilogue of his bookThe Cuckoo's Egg,Stoll details his efforts battling the Morris worm.
  • InHalt and Catch Fire,a virus that works in a similar way to the Morris worm is created to gauge the size of the network.
  • In 'Date Time', an indie developed video game, the Morris worm is portrayed as a character in a dating sim.
  • In 'Gori: Cuddly Carnage', a game developed by Angry Demon Studio, a floppy disk can be seen containing the Morris worm.
  • In Merryweather Media's webcomic 'Internet Explorer', The Morris Worm is portrayed as a tragic antagonist, who's goal was to map out the size of the internet, but accidentally brought it to near-collapse

See also

[edit]

References

[edit]
  1. ^Dressler, J. (2007). "United States v. Morris".Cases and Materials on Criminal Law.St. Paul, MN: Thomson/West.ISBN978-0-314-17719-3.
  2. ^"The Morris Worm Turns 30".Global Knowledge Blog.November 1, 2018.Archivedfrom the original on January 30, 2019.RetrievedJanuary 29,2019.
  3. ^Graham, Paul [@paulg] (November 2, 2020)."FWIW the Wikipedia article on the worm is mistaken"(Tweet).RetrievedNovember 2,2020– viaTwitter.
  4. ^Kehoe, Brendan P. (1992).Zen and the Art of the Internet: A Beginner's Guide to the Internet, First Edition.
  5. ^abcStoll, Clifford(1989). "Epilogue".The Cuckoo's Egg.Doubleday.ISBN978-0-307-81942-0.
  6. ^"US vs. Morris".Loundy.com.Archivedfrom the original on February 13, 1998.RetrievedFebruary 5,2014.
  7. ^Spafford, Eugene(December 8, 1988)."An analysis of the worm"(PDF).Purdue University.Archived(PDF)from the original on May 1, 2006.RetrievedOctober 30,2019.
  8. ^"Court Appeal of Morris".Archivedfrom the original on May 13, 2010.RetrievedFebruary 5,2014.
  9. ^Maynor, David (2011).Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research.Elsevier. p. 218.ISBN978-0-08-054925-5.
  10. ^"The Submarine".Paulgraham.com.Archivedfrom the original on April 19, 2005.RetrievedFebruary 5,2014.
  11. ^"Security of the Internet. CERT/CC".Cert.org. September 1, 1998.Archivedfrom the original on April 15, 1998.RetrievedFebruary 5,2014.
  12. ^United States v. Morris (1991),928 F.2d 504,505 (2d Cir. 1991),archivedfrom the original.
  13. ^"Computer Intruder is Put on Probation and Fined"ArchivedFebruary 14, 2009, at theWayback Machineby John Markoff,The New York Times.
  14. ^"Great Worm".catb.org.Archivedfrom the original on July 2, 2003.RetrievedNovember 2,2005.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Morris_worm&oldid=1247826069"