The Morris Worm
A graduate student's experiment that took down a tenth of the internet
On 2 November 1988 Robert Tappan Morris, a Cornell graduate student, released a self-replicating program that exploited weaknesses in sendmail, the finger daemon and weak passwords. He intended it to measure the size of the internet and included a mechanism to limit duplicate infections.
The mechanism was set wrong. Machines were reinfected repeatedly until they ground to a halt. Roughly 6,000 systems — around a tenth of the connected internet — were affected, and administrators disconnected from the network for days while they worked out what was happening.
The first conviction under the Computer Fraud and Abuse Act, and the reason CERT/CC was created weeks later. It also established the pattern that the most damaging incidents are frequently accidents of scale rather than deliberate destruction.
The Hacker Chronicles
Volume One — Origins
This page is the summary. The chapter — ‘The Worm’ — follows the case properly: what was known at the time, who decided what, and how it actually unfolded rather than how it was later retold.
Two more volumes this year.
Going Geopolitical in October, Going Strategic in December.
Never shared, never sold. One-click unsubscribe.
Or email contact@ronanblake.co.uk
with ‘list’ in the subject.