Morris Worm
On 2 November 1988 a Cornell student's self-copying program stalled large parts of the early Internet: the first mass attack on the network and the start of organised incident response.
Open in the interactive tree →Robert Tappan Morris's worm used a debug hole in the Unix mail program sendmail, a buffer overflow in the finger service, trusted logins between machines and weak passwords. A common estimate is that it infected about 6,000 of the roughly 60,000 hosts then online, though that figure began as a guess; a bug made it re-infect machines until they stalled. DARPA funded the CERT Coordination Center at Carnegie Mellon in response, and Morris received the first felony conviction under the 1986 Computer Fraud and Abuse Act: three years' probation, 400 hours of community service and a fine of US$10,050.
Prerequisites
- The Internet1969It spread from host to host across the early Internet.
- Unix & the C Language1969It attacked Unix systems.
- E-Mail1971One route in was a debug hole in the sendmail mail program.
Unlocks
- Robust CybersecurityopenThe first Internet-wide attack started organised security response.