The 1988 Morris Worm: How the Internet Fought Back

Sometime after 10 p.m. on Wednesday, Nov 2, 1988, Pascal Chesnais noticed something eating up a computer at the MIT Media Lab. He and a few colleagues killed the stray processes, saw nothing else wrong, and went out for dinner and ice cream.

By the time they got back they had worked out that the thing was a program, that it was arriving by email, and that it was running on other machines. The lab had already cut itself off from the campus network at 11:40 p.m. At 3:10 a.m. Chesnais typed a notice that would greet anyone who logged in to the lab's computer: "A Virus has been detected on media-lab, we suspect that whole internet is infected by now. The virus is spread via mail of all things..."

He had guessed at the scale from one lab, and the guess ran high: later estimates put the number of infected computers at a fraction of the network. About 60,000 computers were connected to the internet in 1988, mostly at universities and research labs with some military sites mixed in, and a program released only hours earlier was already running on machines from Massachusetts to California.

The program belonged to Robert Tappan Morris, a first-year computer science PhD student at Cornell who had studied at Harvard as an undergraduate. He had talked with other students about network security and his own ability to break into networks. Cornell's mail logs show someone testing an attack on the mail program sendmail from Oct 19 onward, and a run at 5:01:59 p.m. on Nov 2. By the court's later account Morris released the worm that evening from a computer at MIT, chosen to disguise that it came from Morris at Cornell.

The worm had four ways in. Sendmail, which moves email between machines, shipped with a debugging mode that let a remote computer issue commands. A second program, fingerd, which tells you who is logged in on another machine, read incoming text without checking its length, and the worm used that flaw to take over certain VAX computers. A third route ran through "trusted hosts," a convenience that let a user on one computer log in on another without a password. The fourth was guessing. The worm tried an empty password, the account's own name, the name twice, a nickname, the last name and the last name spelled backward. After that it worked through a built-in list of 432 words, then the 24,474 words in the spelling dictionary that shipped with the system.

Morris made one design choice that decided how the night went. Before copying itself to a machine, the worm asked whether a copy was already there, and a "yes" meant it should stop. He worried that someone would protect a machine by making it answer "yes" every time, so he told the worm to copy itself anyway on every seventh "yes." The worm asked far more often than he had expected. Machines filled up with copies, slowed down and, in the court's word, turned "catatonic."

Photo: a beige Sun 3/60 workstation with a keyboard and a three-button mouse on a white table. A Sun 3/60 workstation. The worm ran on Sun-3 machines and on VAX computers. Photo: Emiliano Russo, public domain, via Wikimedia Commons.

Stanford reported infection by 9 p.m., and the worm got to most of its roughly 2,500 campus Unix machines. RAND was hit about then, the University of Maryland at 10:54 p.m. and Berkeley at 11:00. SRI saw it at midnight. Lawrence Livermore National Laboratory had a response team assembling by 2 a.m.

The warning that took two days

By the court's account, Morris realized the worm was spreading much faster than he had planned and contacted a friend at Harvard. At 3:34 a.m. Thursday an anonymous message went out from Harvard telling administrators how to stop the worm: don't run fingerd or fix it, rebuild sendmail without its debug command, and shut off rexecd. The MIT paper identifies the poster as Andy Sudduth, who later wrote that he hadn't wanted to answer questions about how he knew.

The message got stuck in the clogged network it was meant to save, and it reached MIT's Athena system at 5:59 a.m. Saturday. The message headers printed in the MIT paper put that about 50 hours after it was sent at 3:34 a.m. Thursday. The paper's own text describes shorter delays, 20 hours plus 6 hours, which those header times don't match.

Help came from another direction. At 5:58 a.m. Thursday, Keith Bostic at Berkeley posted the first bug fix: rebuild sendmail without the debug command, and rename the system's C compiler and linker so the worm couldn't build itself on new machines. Many sites cut their connections to the internet to protect themselves. A Defense Communications Agency account cited by the GAO called that effective in the short run but a hindrance to passing along word of fixes. Users also didn't know whom to report the worm to, so people used ad hoc methods such as phones and fax machines.

The fingerd hole was the missing piece. At about 6 p.m. Thursday, Ron Hoffmann at MIT watched an attack come from a machine believed to be immune because its sendmail debug mode was off. The attacker's user name was "nobody," and the only service running under that name was finger. Bill Sommerfeld read the source code and found a call to a C function named gets, which reads a line of text without checking how long it is, and to prove it was a real hole he wrote a harmless program that used the hole to send the string "Bozo!" back out over the network.

That night a group of MIT students and staff began taking the worm apart. Stan Zanarotti and Ted Ts'o had captured a copy from a running machine, and by 9 p.m. Ts'o had a program that decoded its hidden text. Mark Eichin led the rest. They decompiled the worm through the night in Building E40, in what Jerry Saltzer of MIT called an analysis "with microscope and tweezers."

At 4:22 a.m. Friday, watching the worm reach for another machine in a new way, Jon Rochlis remarked, "This really feels like the movie Aliens. So where is Sigourney Weaver?" At 5:45 they traded code with Berkeley, where the person who answered Bostic's phone took some convincing that they weren't the bad guy. Some of them went out for breakfast.

The press found them anyway. A Boston TV crew had shown up Thursday night, and by Friday noon MIT's press conference drew about ten camera crews and 25 reporters. They wanted something to film, and the worm had nothing visual to show. Mike Muuss of the Army's Ballistic Research Laboratory told a meeting that his greatest fear was a National Enquirer headline reading "Computer Virus Escapes to Humans, 96 Killed." The Boston Herald printed a picture of the worm's code and had an artist add the tractor-feed holes of old printer paper so it would look like something a computer would produce.

Photo: a floppy disk in a clear display case below a museum label reading The Morris Internet Worm source code. A floppy disk labeled as holding the worm's source code. The placard is signed by the Computer History Museum, and the photo's Wikimedia Commons listing places it at the Museum of Science in Boston. Photo: Go Card USA, CC BY-SA 2.0, via Wikimedia Commons.

The number that stuck

In a TV interview on Thursday night, James Bruce and Jeff Schiller gave the 60,000 hosts on the internet and added a guess that 10 percent of MIT's 2,000 machines were infected. The MIT team later called that 10 percent "a pure guess." Reporters multiplied it out, and "at least 6,000 machines had been hit" went into print and stayed there.

No official count was made. No organization was responsible for counting infections on the whole internet, so the 6,000 stayed an extrapolation from MIT's guess. A Harvard researcher who surveyed users put the total at 1,000 to 3,000 computers, which was also an estimate. GAO reported that the worm did not destroy or alter files or intercept private mail, though a few changes to its code could have done real harm. The court's account puts the estimated cost of dealing with the worm at each installation at $200 to more than $53,000, historical figures from the court record.

In November 1988, the Defense Advanced Research Projects Agency set up the Computer Emergency Response Team at Carnegie Mellon University, a standing place to call when something like this happens. In June 1989 the General Accounting Office, today the Government Accountability Office, issued its report. It found that the internet had no single focal point for security, that vendors weren't always quick to fix holes, and that even when a fix existed, sites might not install it, "through either neglect or lack of expertise."

A federal jury convicted Morris under the Computer Fraud and Abuse Act. On May 16, 1990, the district court entered judgment, and the appeals court's opinion records his sentence as three years of probation, 400 hours of community service, a $10,050 fine and the costs of his supervision. An appeals court upheld the conviction on March 7, 1991.

What it means for you

Start with the update. The sendmail hole was old: the MIT paper says its debug mode was reported to Berkeley during the 4.2BSD release. Once Berkeley published fixes, sites that installed them were protected from the sendmail and fingerd routes. GAO described a similar problem in break-ins that followed the worm: in one, the vendor had supplied a fix, but the site hadn't installed it on the computer the intruders entered. If you or a parent still use a Windows 10 computer, regular security updates stopped on Oct 14, 2025, and the extended ones that remain run through Oct 12, 2027. Our guide to Windows 10 end of support covers what to check.

Passwords did a lot of the worm's work. A University of Utah analysis cited in the GAO report pointed to an earlier study of more than 100 password files, in which up to 30 percent of passwords were guessed using just the account name and a couple of variations. A long, unique password for each account, kept in a password manager if you can't remember them all, closes that door.

Old accounts did the rest. The MIT Statistics Center called for help on Thursday morning because its machines kept reinfecting each other. The worm had come in through a guest account with a weak password and the account of a former staff member. Richard Basch at Athena found logins from old accounts that should have been purged long before. If you run a shop or an office, delete the logins of people who left and turn off remote access you don't use. Keep your logs, too. At MIT, one machine's logs were forwarded to a computer that was down, and its login records had been truncated, so the source of one infection stayed uncertain.

The Morris Worm: How a Grad Student's Program Slowed the Early Internet in 1988

The warning that took two days

The number that stuck

What it means for you

References