The Morris Worm – The first self-replicating Malware

The Morris worm was the first self-replicating malware to hit the Internet. On November 2, 1988, approximately 6,000 of the 60,000 servers connected to the network were infected by this computer worm, which led to the creation of the Computer Emergency Response Team (CERT) in response to the needs exposed during the incident.

The worm made systems very slow, created processes and files in temporary folders and this caught the attention of thousands of users who the following day (Thursday, November 3) began to worry about this unusual fact. Since then, this worm is considered the first worm in the history of the Internet, due to its form of propagation based on exploiting vulnerabilities (in that case it only infected VAX and Sun Microsystems systems as well as exploiting vulnerabilities in UNIX mailing software. , sendmail).

It was not programmed with the intention of causing harm, but due to a bug in its code, the effects were catastrophic for the time. It crashed hundreds of computers in universities, corporations, and government labs around the world before it was tracked down and removed. It was the attack of what was called the “Internet Worm,” and the press covered the issue with phrases such as “the largest assault ever carried out against the nation’s systems.” Eradicating it cost almost a million dollars, added to the losses from having almost the entire network stopped, the total losses being estimated at 96 million dollars.

The author was Robert Tappan Morris, a 23 year old student, who claims to have made a mistake spreading the worm. He was arrested when one of his friends spoke with the New York Times computer reporter to try to convince him that it had all been an accident, that the worm was not causing harm and that the author was sorry.

He created a program that was highly reproducible, but never thought it would spread so quickly and widely. His idea was not to make computers slow down, but to have the program copied once on each machine and then hidden on the network.

---