Morris Worm In The Early Days Of the Internet Showed The Cyber Security Risks That Existed

Vintage personal computer on a desktop

In 1988 the internet was a simpler and friendlier place. No more than 100,000 computer were connected to the internet. At this time nobody considered that security measures such as a firewall were required. In this post we will look at one of the early cyber security incidents.

On the evening of November 2nd 1988 this all changed when internet traffic stalled due to a rapidly propagating worm.

The Morris Worm was the brain child of Robert Tappan Morris, a 23 year old Cornell University graduate student. According to reports, this worm was a project that simple got out of hand.

Reports by the FBI showed that in 24 hours of the release of the worm, 10% of the computers that were connected to the internet had been infected. This included machines at Harvard, Princeton, Johns Hopkins University, Stanford & NASA.

First Cyber Security Incident

This worm had targeted the Unix Operating system. This worm attacked from multiple attack vectors.

Some of the attack vectors included an email backdoor, exploiting a bug in the “finger program”, and an easy to guess password. Easy to guess passwords have been a problem throughout the entire lifespan of the internet and is still an issue today.

Morris realizing what happened panicked and contacted 2 friends. He asked them to post any apology message with instructions on how to remove the worm online.

The bulletin board message read as follows:

“There may be a virus loose on the internet. I’m sorry”

This is a typical example of too little, too late. A lot of network computers had been affected by the worm that few people saw the apology or the worm removal instructions.

A friend of Morris called The New York Times and referred to him by his initials RTM. This still gave the reported enough information to identify who created the worm.

Morris became the 1st person to be convicted under the 1986 Computer Fraud & Abuse Act. He was not given a jail sentence, but received a fine, probation & 400 hours of community service.

After this incident, he went on to lead a quiet and low key life as an MIT professor.


Leave a Reply

Your email address will not be published. Required fields are marked *