The What, Why, and How of the 1988 Internet Worm

There may be a virus loose on the internet.
Andy Sudduth of Harvard, 34 minutes after midnight, Nov. 3, 1988

The above may be the computer understatement of the year. As of the time that Sudduth posted his message, the internet was coming apart. VAX and Sun machines across the country were being overloaded by invisible tasks, preventing users from being able to use the machines effectively, if at all, and eventually forcing system administrators to cut off many of their machines from the internet entirely in an attempt to cut off the source of infection. The culprit of all this chaos is a small (99 line, not including object files) program written by Robert Tappan Morris who was, at the time, a 23 year old doctoral student at Cornell University. This code, or this type of code, has since been given then name, worm.

There has been a great deal of discussion as to whether or not the name "worm" is appropriate. Many still refer to the program which paralyzed the internet in late 1988 as a virus. However, there is a major difference between the average viral program, and the program in question, and for this reason, we will use the term "worm" to describe programs of the type in question, capitalizing when describing the specific Internet Worm launched in November of 1988.

The primary difference between worms and other illicit computer programs (often referred to as viruses) is the method of operation the programs use in order to reproduce and spread. When a standard computer virus enters a computer (almost always via an infected disk) it alters a system file, or some other convenient file which is likely to be used sometime in the near future. The alteration to this file usually is the addition of commands that will activate the virus wherever it is on the computer. The virus will then perform its nefarious deeds. The first major distinction here, at least in comparison with worms, is that, until the user (inadvertently) activates the virus, the virus is dormant on the computer. Moreover, until the altered file is called, the virus is unable to do any activity. The second distinction here is that a virus needs to be carried from one computer to another via shared diskettes. If the owner of a computer is careful to use only disks that they know are safe, the chance of viral infection is virtually nil.

Read More