Lesson 1 of 819886 min
The Morris worm and the birth of CERT
On the evening of 2 November 1988, Robert Tappan Morris, a computer science graduate student at Cornell, released a small program onto the internet from a machine at MIT. It was built to copy itself from computer to computer, not to delete anything.
Within about a day it had reached roughly 6,000 of the 60,000 or so machines then connected, about one in ten. Many of them slowed to a crawl and stopped. Administrators at universities and research labs spent the next days pulling it apart and cleaning up.
Morris became the first person convicted under the US Computer Fraud and Abuse Act of 1986. The bigger legacy was organisational: the internet discovered it had no one in charge of an emergency.
Four doors and a bug
The worm targeted Berkeley Unix systems and tried several ways in. It abused a debug mode left enabled in the sendmail mail server. It overflowed a buffer in the finger service, a program that answered questions about users and copied input without checking its length. It used trust relationships, where one host let users of another log in through rsh or rexec with no password. And it guessed weak passwords from a short list of common words. None of these were exotic; they were default settings and old habits.
What turned an experiment into an outage was a design decision. The worm asked each machine whether it was already infected, but roughly one time in seven it copied itself anyway. Machines collected copy after copy until they had no processing power left. Each infection was cheap; thousands of them on one host were fatal.
From chaos to coordination
The people who stopped the worm did it through personal networks of email and phone calls, while some sites disconnected from the network altogether. There was no central point to report an incident, share analysis or warn everyone at once. In November 1988 DARPA funded the CERT Coordination Center at Carnegie Mellon's Software Engineering Institute to be exactly that. Today almost every country, large company and university runs its own CSIRT (computer security incident response team), and CERT/CC still coordinates the disclosure of vulnerabilities between the people who find them and the vendors who fix them.
Researcher → Coordinator (CERT/CC): Report a flaw privately
The finder reports to a coordinator instead of publishing straight away.- Patch and harden: turn off debug features and services you do not need.
- Remove implicit trust: no host should accept another's users without authentication.
- Enforce strong passwords, because guessing still works at scale.
- Plan the response in advance, including a way to communicate when the network itself is down.
Key terms
- Worm
- Malware that copies itself across a network without any user action.
- Buffer overflow
- Writing more data into a memory area than it can hold, overwriting what lies next to it.
- Trust relationship
- A configuration in which one system accepts another's users without asking them to authenticate.
- CSIRT
- A team that receives, analyses and coordinates the response to security incidents.
- Coordinated disclosure
- Reporting a flaw privately so a fix exists before the details are made public.
Check what you learned
1.What makes the Morris program a worm rather than a virus?
2.Which organisation was created in direct response to the worm?
3.Why did infected machines grind to a halt?
Practise it for the exam
- Security+ · Threats, Vulnerabilities and MitigationsQuestions on this topic
- CySA+ · Incident Response and ManagementQuestions on this topic
Sources
- The Morris Worm: how a Cornell grad student's program crashed the internet — Cornellians (Cornell University)
- The Robert Morris Internet Worm — MIT CSAIL, course 6.805
- U.S. Department of Homeland Security announces partnership with Carnegie Mellon's CERT Coordination Center — Carnegie Mellon University
- Do you know what the Morris worm is? — Purdue University, CyberTAP