Clifford Stoll, author of The Cuckoo's Egg, wrote that "Rumors have it that [Morris] worked with a friend or two at Harvard's computing department (Harvard student Paul Graham sent him mail asking for 'Any news on the brilliant project')".
I think part of this might be that as fun as this all is to talk about, it wasn't super fun for Robert Tappan Morris. My friends from back in the day are not OK with me talking about what they did, even though nothing happened to any of them.
For the sake of argument, let's assume that rtm finds the whole episode embarrassing or whatever and would prefer to avoid the topic. If pg is really his close friend, it makes sense that pg would defer from conversing about it (especially in public) simply out of respect for his friend.
2) After he was convicted, he went from Cornell to Harvard to complete his Ph.D.
3) He became an assistant professor at MIT after that.
He had to be really spectacular/have crazy connections to still be able to finish his training at a top program and get a job at the institution he tried to frame.
One of my favourite quiet jokes is the "Editorial Board" list for The Annals of Improbable Research¹ where RTM is listed under Computer Science. Asterisks after each name denote qualifications, RTM's being "Convicted Felon"
Just go pull up his bibliography. Chord, the Click Modular Router (super big deal to me), RON (also a big deal to me), Vivaldi (which made its way into the Hashi products). He had a hand in a lot of stuff. His pre-CSAIL work was very much like that of the LBL Network Research Group (that's Van Jacobsen, Vern Paxson, Steve McCanne) --- he's in that league.
He was and is very smart. This is not disputed. He was 23 at the time. Not exactly a child.
The worm was surprisingly elaborate containing three separate remote exploits.
It probably took a few weeks to build and test.
So sabotaging thousands of at the time very expensive network connected computers was a very deliberate action.
I posit that he likely did it to become famous and perhaps even successful, feeling safe with his dad’s position. And it worked. He did not end up in prison. He ended up cofounding Viaweb and YCombinator.
What confuses me right now is your ongoing very obvious leftist activist stance on HN vs refusing to entertain the thought that he got away with it because of his NSA dad.
A felony conviction, three years probation, 400 hours of community service, and a $25,000 (inflation adjusted) fine for a novel non-violent crime with no personal material benefit isn't exactly "got away with it"
in those days computer crimes weren't punished that harshly. I'm surprised it was that severe, in fact, it sounds like there must have been some heavy hitters on the prosecution side.
That's a values debate, I guess. What is the purpose of punishment? Is it to set an example to others, is it to remove a dangerous person from society, is it to prevent the criminal from reoffending, is it to satisfy society's desire to see wrongdoers punished?
He didn't reoffend (as far as we know), and in fact went on to become a highly-contributing member of society. His crime was not so egregious that recompense was impossible even in principle. I don't see how a harsher punishment for him would have produced an obviously better outcome. I think it would be more productive to argue that people who commit similar crimes should receive similar punishments as this, rather than arguing that he should have received a harsher punishment.
These days "leftist activist" is a complement that means not supporting and protecting pedophiles, and instead demanding the release of the Epstein Files. Why are flattering
tptacek?
There's no need to "insult" people. What I'm seeing in his comments is just a successful tech bro admiring and defending a fellow tech bro, "boys will be boys" style. I don't think it has anything to do with politics.
I talked to the son at one of the early (~2008) YC dinners. Actually found him more approachable than PG or most YC founders; RTM is a nerd in the "cares a whole lot about esoteric mathematics" way, which I found a refreshing change from the "take over the world" vibe that I got from a lot of the rest of YC.
Interesting random factoid: RTM's research in the early 2000s was on Chord [1], one of the earliest distributed hash tables. Chord inspired Kademlia [2], which later went on to power Limewire, Ethereum, and IPFS. So his research at MIT actually has had a bigger impact in terms of collected market cap than most YC startups have.
RTM Jr is a very nice person, obviously very smart, but also has a good sense of humor and is friendly and approachable. We overlapped as C.S. grad students at Harvard for several years.
I did not. That actually makes everything make much more sense. I was even wordering how he got out of jail time for something like this and just thought he had amazing lawyers.
I think the bigger thing was that the Internet just wasn't that big a deal at the time. I got serious access in '93, and into '94-95 there were still netsplits on it (UUNet/NSFNet is the one I remember most). It was a non-remunerative offense, with really unclear intent, that took out a research network. He had good counsel, as you can tell from the reporting about the trial, but the outcome made sense. I doubt his dad had much to do with it.
Yeah, in 1988 the Internet appeared like a research network that connected universities. No money was directly at stake and the systems harmed didn't appear critical. Related to what Thomas says above, part of the response to the incident was to partition the Internet for a few days [2] - I don't know if such a thing would be possible now.
But looking into the specifics again after all these years [1], I read:
"The N.S.A. wanted to clamp a lid on as much of the affair as it could. Within days, the agency’s National Computer Security Center, where the elder Morris worked, asked Purdue University to remove from its computers information about the internal workings of the virus."
and that CERT at CMU was one response to the incident [2].
So there is a whiff of the incident being steered away from public prosecution and towards setting up security institutions.
Robert Morris did get a felony conviction, three years probation, and a $10K fine. As for hn users, aside from pg, Cliff Stoll has a minor role in the story.
> I think the bigger thing was that the Internet just wasn't that big a deal at the time.
Maybe I’m just getting old, but it seems like nothing was such a big deal at the time.
Everything seems to have gotten more uptight in the last few decades. I used to have a metal cutlery set that an international airline gave to every passenger on the plane.
From what I can remember, while there was some public awareness of "computer crime" by 1988 (War Games helped with that), it wasn't exactly a "big deal" to most people yet. My subjective recollection is that things took a marked turn around 1990, with the advent of "Operation Sundevil"[1], the raid on Steve Jackson Games, etc.
And by the mid to late 90's (I'd say about 1997) it was finally becoming "received wisdom" to most hacker that "this is real now: getting caught doing this stuff could mean actual jail time, fines, not getting into college, losing jobs, etc." Now I grew up in a rural part of NC and so we probably lagged other parts of the country in terms of information dispersal, so I expect other people view the timeline differently, so YMMV.
Lots of chaos, but just three arrests. Did any of them proceed to full prosecutions? I'm reasonably sure Bruce Esquibel wasn't charged (at least, there's nothing in PACER to say so). I have no idea who "Tony The Trashman" was.
Barely. In my area around that time, teenagers were causing havoc by breaking into local colleges just so they could get onto IRC and access FTP sites. "Network security" was a pretty new concept.
Ehh? It had only recently been made explicitly criminal by federal statute. If you're thinking of "the Hacker Crackdown" that occurred a few years after the Morris Worm, or of Kevin Mitnick's exploits, it's worth keeping in mind that they were doing pretty crazy shit even relative to today; they were owning up phone switches across the country. And despite that, the penalties were not crazy high.
What you didn't have back then was financial fraud on the scale that happens today, where even nominal damages run into 8-9 figures.
Oooof in light of Aaron Swartz. He plugged directly into a network switch that was in an unlocked and unlabelled room at MIT so he could download faster and faced "charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network".
MIT really didn't lift a finger for this either.
>Swartz's attorneys requested that all pretrial discovery documents be made public, a move which MIT opposed
Agreed, it's hard to see this as some sort of "hacker respect hacker" in light of MIT's other actions.
It's very hard to extract Robert Tappan Morris from the context of his father being an extremely powerful man when trying to figure out how he managed to get away with what he did.
Its the other way around, they throw hackers under the bus. Aaron Swartz, Star Simpson arrested for stupid LED brooch, the list is quite long https://news.ycombinator.com/item?id=7411868
A good account is With Microscope and Tweezers: The Worm from MIT's Perspective [1], published in CACM a few months after the event. Notice it was the worm.
I was an intern at IBM in '88 and they shut-down the (iirc) two internet getaways to their corporate network (vnet) while people figured out what was going on. News moved slowly back then, and the idea of self-replicating software was unusual. Although IBM had had its own replicator the previous year [2].
That day our tech chief at the time came running and told us about the worm, and that apparently our country managed to avoid it because the news spread quickly enough that one guy simply unplugged the whole country from the Internet - there was only a single connection back then. (!)
I was a student part-time administrator/systems programmer at the Purdue Engineering Computer Network at the time. Our OS installs had enough local mods (and we had enough non-VAX, non-Sun architectures) that we were immune to some of the worm's modalities, but the sendmail debug mode exploit at least still caused a lot of consternation.
Diversity is security! I wish more people understood that. It may be more difficult to manage a bunch of diverse systems, but they are much more resilient to attacks.
I don't think that's proven out, like, at all; measure it against the returns on hardening mainstream platforms. The "monoculture" security thing has always been overblown, not least because you're never going to get an ecology where you have enough diversity to matter. Having 3 mainstream desktop or phone options is only marginally better than having just 1, and you're never going to have 20.
Put everything in MicroSoft Active Directory. Wait until it gets hacked. You will lose DNS, DHCP, Email, file servers, web servers, endpoints, etc. Obviously, running a mono-culture is a dumb thing to do if you want to keep your business running.
Maybe instead, run BIND on Linux servers, Apache on OpenBSD servers, have some Chromebooks, some Macs, etc. so everything doesn't go down together.
Really, it's not overblown... it's just common sense to diversify. Like we do with our diet/nutrition, with our financial investments, etc.
It sounds like common sense, but halfhearted diversification --- which is all that's available to mainstream users and enterprises --- can easily reduce security. That's because almost all real world security is logically perimeterized, with a single outward-facing attack surface that's given attention and an implicit premise that post-compromise persistence and pivoting is a given. Nobody survives an internal pentest, not even in 2025.
So by running BIND on Linux and Apache on OpenBSD and trying to tie it all into MSAD, what you're really doing is just expanding your attack surface, and once any of those are broken, attackers won't have to care about the state of the art in vulnerabilities to extend access from there.
The "monoculture" stuff is a product of a time when security pundits worried Microsoft was running the table on corporate IT. We're (generally) SAAS startup people here and very few of us run any Microsoft stuff. Almost all of us are better off extensively hardening a single Linux server environment than we are in deliberately trying to sprinkle NetBSD and Microsoft servers. That's doesn't improve security; it just turns your network into a CTF challenge.
I used to keep a vt100 at the head of my bed, roll over and check on things a few times at night. 3am and everything is screwed. can't really log in anyplace, or start any jobs. The bus doesn't run until 5:30, so I just get dressed and walk across the bridge the to lab. Visitors center isn't open, so I just sneak through the exit by the guardhouse. They're civilian contractors, they either don't see me, or recognize me and don't care.
Since it's all locked up, I just reboot the big vax single user - that takes about 10 minutes so I also start on a couple of the suns. You have to realize that everything including desktops runs sendmail in this era, and when some of these machines come up they are ok for a sec and then sendmail starts really eating into the cpu.
I'm pretty bleary eyed but I walk around restarting everything single and taking sendmail out of the rcs. The TMC applications engineer comes in around 7 and gets me a cup of coffee. He manages to get someone to pick up in Cambridge and they tell him that's happening everywhere.
Everything was slower though. Turkey as a whole country had one 9600bps link to Bitnet at the time. Internet was accessed through Bitnet gateways. Systems (CPUs and I/O in general) were also much slower.
Slower and unstable. I spent a lot of my freshman year in college on Bitnet chat and iirc about every 30 minutes there would be a "netsplit" and a bunch of folks in the chat would disappear. Maybe it was our universities connection, which I think was direct to UIUC. I've posted here before that back then I thought Bitnet chat was magical. Things like being in a chat room with students in Berlin while the wall was falling felt so futuristic to me.
I remember this event as one of the few times that the Internet made the mainstream news in the eighties. After the fact talked with some network people at Michigan and Michigan State and it was not a very good day for them. They also wanted jail time for him which did not happen.
I assume you all know that Robert Morris is one of the YC (and Viaweb) cofounders? [1] Together with Paul Graham, Jessica Livingston, and Trevor Blackwell.
I'm pretty sure Paul Graham was directly involved in this story (not in any bad, culpable way, but enough that, were a film to be made about it, a well-known actor would be cast for his part).
There's contemporaneous reporting. It's in Katie Hafner and John Markoff's book! A friend of Morris', named Paul, has a role in the aftermath of the worm.
I'm not dunking on Paul Graham here. If you know anything about me, if anything, this is a point in his favor. :)
Not sure if that was supposed to be sarcasm[1] or was intended seriously, but for what it's worth Hafner & Markoff have frequently received a lot of criticism for playing fast and loose with the truth in that book. Now most of that is specifically in regards to their treatment of Mitnick, and I'm not making any particular accusation here. Just sharing a thought that "it's in Katie Hafner and John Markoff's book" might not be terribly strong evidence of $WHATEVER.
Nope, no theory at all. Just providing some context for people who might not be as familiar with that book and the authors, and some of the questions that have been raised about it.
I know that the book makes a much bigger deal out of Mitnick than is reasonable (Mitnick was basically the consummate script kid). But I also know that scenesters of the time hated Markoff and thought he was, like, an enemy of the scene.
It's a great read, but to echo what I said above: there have been a lot of questions over the years about the veracity of some of the details of their book. Take that for what it's worth. I enjoyed it enough that I've read it 3 or 4 times, but I do also suggest consulting other books on the same stories - particularly the stuff around K. Mitnick.
The article is from a somewhat reliable source; Wikipedia is not a reliable source (by Wikipedia's own rules). Maybe you should use the article to update Wikipedia?
Currently AI doesn't work very well on hardware separated by hundreds of milliseconds of latency and slow network links. Both the training and inference are slow.
However I think this is a solvable problem, and I started solving it a while ago with decent results:
When someone gets this working well, I could totally see a distributed AI being tasked with expanding it's own pool of compute nodes by worming into things and developing new exploits and sucking up more training data.
>However, the pioneering Morris worm malware wasn’t made with malice, says an FBI retrospective on the “programming error.” It was designed to gauge the size of the Internet, resulting in a classic case of unintended consequences.
had RTM actually RTM the world might be a bit different than it is today.
Well, sort of. RTM underestimated the effect of exponential growth, and thought that he would in effect have an account on all of the connected systems, without permission. He evidently didn't intend to use this power for evil, just to see if it could be done.
He did do us all a service; people back then didn't seem to realize that buffer overflows were a security risk. The model people had then, including my old boss at one of my first jobs in the early 80s, is that if you fed a program invalid input and it crashed, this was your fault because the program had a specification or documentation and you didn't comply with it.
Interestingly, it took another 7 years for stack overflows to be taken seriously, despite a fairly complete proof of concept widely written about. For years, pretty much everybody slept on buffer overflows of all sorts; if you found an IFS expansion bug in an SUID, you'd only talk about it on hushed private mailing lists with vendor security contacts, but nobody gave a shit about overflows.
It was Thomas Lopatic and 8lgm that really lit a fire under this (though likely they were inspired by Morris' work). Lopatic wrote the first public modern stack overflow exploit, for HPUX NCSA httpd, in 1995. Later that year, 8lgm teased (but didn't publish --- which was a big departure for them) a remote stack overflow in Sendmail 8.6.12 (it's important to understand what a big deal Sendmail vectors were at the time).
That 8lgm tease was what set Dave Goldsmith, Elias Levy, San Mehat, and Pieter Zatko (and presumably a bunch of other people I just don't know) off POC'ing the first wave of public stack overflow vulnerabilities. In the 9-18 months surrounding that work, you could look at basically any piece of privileged code, be it a remote service or an SUID binary or a kernel driver, and instantly spot overflows. It was the popularization with model exploits and articles like "Smashing The Stack" that really raised the alarm people took seriously.
That 7 year gap is really wild when you think about it, because during that time period, during which people jealously guarded fairly dumb bugs, like an errant pipe filter input to the calendar manager service that run by default on SunOS shelling out to commands, you could have owned up literally any system on the Internet, so prevalent were the bugs. And people blew them off!
I wrote a thread about this on Twitter back in the day, and Neil Woods from 8lgm responded... with the 8.6.12 exploit!
I was logged into brillig.umd.edu (University of Maryland's Vax 8600) that night, frustrated that my emacs kept getting paged out, rhythmically typing ^A ^E ^A ^E to wiggle the cursor around to keep it paged in while I thought.
I ps aux'ed and saw a hell of a lot of sendmail demons running, but didn't realize till the next morning that we were actively under attack, being repeatedly but unsuccessfully finger daemon gets(3) buffer overflowed, and repeatedly and successfully sendmail daemon DEBUG'ed.
RTM's big mistake was not checking to see if a machine was already infected before re-infecting it and recursing, otherwise nobody would have noticed and he would have owned the entire internet.
What's funny is that UMD was on MILNET via NSA's "secret" IMP 57 at Fort Mead, so RTM's worm was attacking us through his daddy's own MILNET PSN (Packet Switching Node)!
>At the University of Maryland, our network access was through the NSA's "secret" MILNET IMP 57 at Fort Mead. It was pretty obvious that UMD got their network access via NSA, because mimsy.umd.edu had a similar "*.57" IP address as dockmaster, tycho and coins.
>[...] Once I told the guy who answered, "Hi, this is the University of Maryland. Our connection to the NSA IMP seems to be down." He barked back: "You can't say that on the telephone! Are you calling on a blue phone?" (I can't remember the exact color, except that it wasn't red: that I would have remembered). I said, "You can't say NSA??! This is a green phone, but there's a black phone in the other room that I could call you back on, but then I couldn't see the hardware." And he said "No, I mean a voice secure line!" I replied, "You do know that this is a university, don't you? We only have black and green phones."
>[...more stuff about the rumored "Explosive Bolts" that could separate ARPANET and MILNET from Erik Fair and Milo Medin...]
More from Jordan Hubbard about his infamous "rwall" incident, when he accidentally sent an rwall message to almost every machine on the internet. I received and cheerfully replied to it, which he said was nicer than most of the 743 replies he got. Also: Milo Medin's description of Dennis Perry's reaction (head of DARPA/IPTO) to getting his Interleaf windows scribbled on ("absolutely livid"), Mark Crispin's flamed about security, Jordan's response, and Dennis Perry himself replying to Jordan.
From: Dennis G. Perry <PERRY@vax.darpa.mil>
Date: Apr 6, 1987, 3:19 PM
Jordan, you are right in your assumptions that people will get annoyed
that what happened was allowed to happen.
By the way, I am the program manager of the Arpanet in the Information
Science and Technology Office of DARPA, located in Roslin (Arlington), not
the Pentagon. [...]
Chris Torek had hacked our version of fingerd (running on mimsy.umd.edu and its other Vax friends brillig, tove, and gyre) to implement logging, and while he was doing that, he noticed the fixed size buffer, and thoughtfully increased the size of the buffer a bit. Still a fixed size buffer using gets, but at least it was a big enough buffer to mitigate the attack, although the worm got in via sendmail anyway. And we had a nice log of all the attempted fingerd attacks!
The sendmail attack simply sent the "DEBUG" command to sendmail, which, being enabled by default, let you right in to where you could escape to a shell.
Immediately after the attack, "some random guy on the internet" suggested mitigating the sendmail DEBUG attack by editing your sendmail binary (Emacs hackers can do that easily of course, but vi losers had to suck eggs!), searching for the string "DEBUG", and replacing the "D" with a null character, thus disabling the "DEBUG" command.
But unfortunately that cute little hack didn't actually disable the "DEBUG" command: it just renamed the "DEBUG" command to the "" command! Which stopped the Morris worm on purpose, but not me by accident:
I found that out the day after the worm hit, when I routinely needed to check some bouncing email addresses on a mailing list I ran, so I went "telnet sun.com 80" and hit return a couple times like I usually do to clear out the telnet protocol negotiation characters, before sending an "EXPN" command. And the response to the "EXPN" command was a whole flurry of debugging information, since the second newline I sent activated debug mode by entering a blank line!
So I sent a friendly email to postmaster@sun.com reporting the enormous security hole they had introduced by patching the other enormous security hole.
You'd think that the Long Haired Dope Smoking Unix Wizards running the email system at sun.com wouldn't just apply random security patches from "some random guy on the internet" without thinking about the implications, but they did!
>In the sendmail attack, the worm opens a TCP connection to another machine's sendmail (the SMTP port), invokes debug mode, and sends a RCPT TO that requests its data be piped through a shell. That data, a shell script (first-stage bootstrap) creates a temporary second-stage bootstrap file called x$$,l1.c (where '$$' is the current process ID). This is a small (40-line) C program.
>The first-stage bootstrap compiles this program with the local cc and executes it with arguments giving the Internet hostid/socket/password of where it just came from. The second-stage bootstrap (the compiled C program) sucks over two object files, x$$,vax.o and x$$,sun3.ofrom the attacking host. It has an array for 20 file names (presumably for 20 different machines), but only two (vax and sun) were compiled in to this code. It then figures out whether it's running under BSD or SunOS and links the appropriate file against the C library to produce an executable program called /usr/tmp/sh - so it looks like the Bourne shell to anyone who looked there.
>The Fingerd Attack:
>In the fingerd attack, it tries to infiltrate systems via a bug in fingerd, the finger daemon. Apparently this is where most of its success was (not in sendmail, as was originally reported). When fingerd is connected to, it reads its arguments from a pipe, but doesn't limit how much it reads. If it reads more than the internal 512-byte buffer allowed, it writes past the end of its stack. After the stack is a command to be executed ("/usr/ucb/finger") that actually does the work. On a VAX, the worm knew how much further from the stack it had to clobber to get to this command, which it replaced with the command "/bin/sh" (the Bourne shell). So instead of the finger command being executed, a shell was started with no arguments. Since this is run in the context of the finger daemon, stdin and stdout are connected to the network socket, and all the files were sucked over just like the shell that sendmail provided.
It's a little shocking to me that there haven't been more things like this.
While we're much more conscientious and better at security than we were way back then, things are certainly not totally secure.
The best answer I have is the same as what a bio professor told me once about designer plagues: it hasn't happened because nobody's done it. The capability is out there, and the vulnerability is out there.
(Someone will chime in about COVID lab leak theories, but even if that's true that's not what I mean. If that happened it was the worst industrial accident in history, not an intentional designer plague.)
Bill Gates sent out the "Trusted Computing" memo to harden Windows and make it somewhat secure.
Essentially, Windows used to be trivial to exploit, in that Every single service was by default exposed to the web, full of very trivial buffer overflows that dovetailed nicely into remote code execution.
Since then, Windows has stopped exposing everything to the internet by default and added a firewall, fixed most buffer overflows in entry points of these services, and made it substantially harder to turn most vulnerabilities into the kind of remote code execution you would use to make simple worms.
>better at security than we were way back then
In some ways this is dramatically understated. Now the majority of malware comes from getting people to click on links, targeted attacks that drop it, piggyback riding in on infected downloads, and other forms of just getting the victim to run your code. Worms and botnets are either something you "Willingly" install through "free" VPNs, or target absolutely broken and insecure routers.
The days where simply plugging a computer into the internet would result in you immediately trying to infect 100 other computers with no interaction are pretty much gone. For all the bitching about forced updates and UAC and other security measures, they basically work.
To a fairly significant extent, the Morris worm is why there haven't been more; it did prompt something of a culture shift away from trusting users to trusting mechanisms, mostly by prompting people to realise that the internet wasn't only going to be in the hands of a set of people who were one or two degrees of separation apart. It didn't make sense to assume people would treat it with reverence like a giant beautiful shared space.
It's most obviously paralleled by Samy Kamkar's MySpace worm, which exploited fairly similar too-much-trust territory.
I imagine the
- heterogeneity of modern computing environments
- number of 'layers' in any system
- sheer size of the modern Internet
all also make it harder to scale
6,000+, and those machines served many others (back then there were tens of thousands of machines on the Internet, but probably 10x as many that were connected to these by relays that handled email or Usenet traffic).
Also worth remember that especially with Internet-connected computers almost everything was multiuser. You did work on the Internet from a shell on a shared Unix server, not from a laptop.
Hypothetically if the m$ cloud ecosystem got completely oblibetated (including backups) would customers switch? Or is the lockin as complete as it is with the operating system customers?
From the Wikipedia article:
Clifford Stoll, author of The Cuckoo's Egg, wrote that "Rumors have it that [Morris] worked with a friend or two at Harvard's computing department (Harvard student Paul Graham sent him mail asking for 'Any news on the brilliant project')".
Has pg commented on this?
Would you?
I hope he at least leaves it in his will or something. We're all wondering / waiting to know.
If the statute of limitations was long passed and I had fuck you money, why not?
I think part of this might be that as fun as this all is to talk about, it wasn't super fun for Robert Tappan Morris. My friends from back in the day are not OK with me talking about what they did, even though nothing happened to any of them.
For the sake of argument, let's assume that rtm finds the whole episode embarrassing or whatever and would prefer to avoid the topic. If pg is really his close friend, it makes sense that pg would defer from conversing about it (especially in public) simply out of respect for his friend.
Also of all the places he could ever talk about it --- HERE?
top comment of the year
35 years a later, a clout demon like pg would absolutely be patting himself on the back on x.
I find it funny that:
1) He released it from MIT to avoid suspicion.
2) After he was convicted, he went from Cornell to Harvard to complete his Ph.D.
3) He became an assistant professor at MIT after that.
He had to be really spectacular/have crazy connections to still be able to finish his training at a top program and get a job at the institution he tried to frame.
His dad was Bob Morris. Unless that's the joke you're making.
Bob Morris wrote crypt(1), dc(1), crypt(3), libm, co-wrote the rainbow series, and did additional unknown work as a cryptographer for the NSA.
dmr writes about working with Bob Morris here: https://web.archive.org/web/20250121041734/https://www.bell-...
One of my favourite quiet jokes is the "Editorial Board" list for The Annals of Improbable Research¹ where RTM is listed under Computer Science. Asterisks after each name denote qualifications, RTM's being "Convicted Felon"
---
¹Awarders of the Ig Nobel prize
Have you read any of his papers? Morris was not fucking around.
Can you elaborate, or suggest a specific paper?
Just go pull up his bibliography. Chord, the Click Modular Router (super big deal to me), RON (also a big deal to me), Vivaldi (which made its way into the Hashi products). He had a hand in a lot of stuff. His pre-CSAIL work was very much like that of the LBL Network Research Group (that's Van Jacobsen, Vern Paxson, Steve McCanne) --- he's in that league.
Please expand?
He was and is very smart. This is not disputed. He was 23 at the time. Not exactly a child.
The worm was surprisingly elaborate containing three separate remote exploits.
It probably took a few weeks to build and test.
So sabotaging thousands of at the time very expensive network connected computers was a very deliberate action.
I posit that he likely did it to become famous and perhaps even successful, feeling safe with his dad’s position. And it worked. He did not end up in prison. He ended up cofounding Viaweb and YCombinator.
Unironically a great role model for YC. :/
I'm not psychoanalyzing the guy, I'm saying I'm not surprised he had an elite academic career, because he's an elite performer.
What confuses me right now is your ongoing very obvious leftist activist stance on HN vs refusing to entertain the thought that he got away with it because of his NSA dad.
A felony conviction, three years probation, 400 hours of community service, and a $25,000 (inflation adjusted) fine for a novel non-violent crime with no personal material benefit isn't exactly "got away with it"
Yes, that is getting away with it for someone with means and clout.
in those days computer crimes weren't punished that harshly. I'm surprised it was that severe, in fact, it sounds like there must have been some heavy hitters on the prosecution side.
That's a values debate, I guess. What is the purpose of punishment? Is it to set an example to others, is it to remove a dangerous person from society, is it to prevent the criminal from reoffending, is it to satisfy society's desire to see wrongdoers punished?
He didn't reoffend (as far as we know), and in fact went on to become a highly-contributing member of society. His crime was not so egregious that recompense was impossible even in principle. I don't see how a harsher punishment for him would have produced an obviously better outcome. I think it would be more productive to argue that people who commit similar crimes should receive similar punishments as this, rather than arguing that he should have received a harsher punishment.
I don't think this is as much about the purpose of punishment as it is about the monkeys with the grapes and the cucumbers.
Hold on, I need to capture and circulate this claim that I'm a "very obvious leftist" to my friends and acquaintances. Thanks, this made my day.
These days "leftist activist" is a complement that means not supporting and protecting pedophiles, and instead demanding the release of the Epstein Files. Why are flattering tptacek?
(Not USA:ian.)
> Why are flattering tptacek?
?
There's no need to "insult" people. What I'm seeing in his comments is just a successful tech bro admiring and defending a fellow tech bro, "boys will be boys" style. I don't think it has anything to do with politics.
In this corner: leftist activist!
And in this corner: successful tech bro!
You know his dad ran research at the NSA right?
His dad's also a badass and super fun to talk to. Never talked to the son though, but I'd love to some day.
I talked to the son at one of the early (~2008) YC dinners. Actually found him more approachable than PG or most YC founders; RTM is a nerd in the "cares a whole lot about esoteric mathematics" way, which I found a refreshing change from the "take over the world" vibe that I got from a lot of the rest of YC.
Interesting random factoid: RTM's research in the early 2000s was on Chord [1], one of the earliest distributed hash tables. Chord inspired Kademlia [2], which later went on to power Limewire, Ethereum, and IPFS. So his research at MIT actually has had a bigger impact in terms of collected market cap than most YC startups have.
[1] https://en.wikipedia.org/wiki/Chord_(peer-to-peer)
[2] https://en.wikipedia.org/wiki/Kademlia
RTM Jr is a very nice person, obviously very smart, but also has a good sense of humor and is friendly and approachable. We overlapped as C.S. grad students at Harvard for several years.
I did not. That actually makes everything make much more sense. I was even wordering how he got out of jail time for something like this and just thought he had amazing lawyers.
I think the bigger thing was that the Internet just wasn't that big a deal at the time. I got serious access in '93, and into '94-95 there were still netsplits on it (UUNet/NSFNet is the one I remember most). It was a non-remunerative offense, with really unclear intent, that took out a research network. He had good counsel, as you can tell from the reporting about the trial, but the outcome made sense. I doubt his dad had much to do with it.
Yeah, in 1988 the Internet appeared like a research network that connected universities. No money was directly at stake and the systems harmed didn't appear critical. Related to what Thomas says above, part of the response to the incident was to partition the Internet for a few days [2] - I don't know if such a thing would be possible now.
But looking into the specifics again after all these years [1], I read:
"The N.S.A. wanted to clamp a lid on as much of the affair as it could. Within days, the agency’s National Computer Security Center, where the elder Morris worked, asked Purdue University to remove from its computers information about the internal workings of the virus."
and that CERT at CMU was one response to the incident [2].
So there is a whiff of the incident being steered away from public prosecution and towards setting up security institutions.
Robert Morris did get a felony conviction, three years probation, and a $10K fine. As for hn users, aside from pg, Cliff Stoll has a minor role in the story.
[1] https://archive.nytimes.com/www.nytimes.com/times-insider/20...
[2] https://en.wikipedia.org/wiki/Morris_worm#Effects
> I think the bigger thing was that the Internet just wasn't that big a deal at the time.
Maybe I’m just getting old, but it seems like nothing was such a big deal at the time.
Everything seems to have gotten more uptight in the last few decades. I used to have a metal cutlery set that an international airline gave to every passenger on the plane.
Organizations naturally accrue regulations in response to incidents as time goes by.
> I think the bigger thing was that the Internet just wasn't that big a deal at the time.
”Computer crime” definitely was though.
From what I can remember, while there was some public awareness of "computer crime" by 1988 (War Games helped with that), it wasn't exactly a "big deal" to most people yet. My subjective recollection is that things took a marked turn around 1990, with the advent of "Operation Sundevil"[1], the raid on Steve Jackson Games, etc.
And by the mid to late 90's (I'd say about 1997) it was finally becoming "received wisdom" to most hacker that "this is real now: getting caught doing this stuff could mean actual jail time, fines, not getting into college, losing jobs, etc." Now I grew up in a rural part of NC and so we probably lagged other parts of the country in terms of information dispersal, so I expect other people view the timeline differently, so YMMV.
[1]: https://en.wikipedia.org/wiki/Operation_Sundevil
Lots of chaos, but just three arrests. Did any of them proceed to full prosecutions? I'm reasonably sure Bruce Esquibel wasn't charged (at least, there's nothing in PACER to say so). I have no idea who "Tony The Trashman" was.
Barely. In my area around that time, teenagers were causing havoc by breaking into local colleges just so they could get onto IRC and access FTP sites. "Network security" was a pretty new concept.
Ehh? It had only recently been made explicitly criminal by federal statute. If you're thinking of "the Hacker Crackdown" that occurred a few years after the Morris Worm, or of Kevin Mitnick's exploits, it's worth keeping in mind that they were doing pretty crazy shit even relative to today; they were owning up phone switches across the country. And despite that, the penalties were not crazy high.
What you didn't have back then was financial fraud on the scale that happens today, where even nominal damages run into 8-9 figures.
> tried to frame.
MIT really respects good hacks and good hackers. It was probably more effective than sending in some PDF of a paper.
>MIT really respects good hacks and good hackers.
Oooof in light of Aaron Swartz. He plugged directly into a network switch that was in an unlocked and unlabelled room at MIT so he could download faster and faced "charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network".
MIT really didn't lift a finger for this either.
>Swartz's attorneys requested that all pretrial discovery documents be made public, a move which MIT opposed
https://en.wikipedia.org/wiki/Aaron_Swartz
Agreed, it's hard to see this as some sort of "hacker respect hacker" in light of MIT's other actions.
It's very hard to extract Robert Tappan Morris from the context of his father being an extremely powerful man when trying to figure out how he managed to get away with what he did.
At the same time, it's easy to believe that MIT of 2013 is very different than MIT of 1988.
While that's entirely possible, MIT was established in 1861. I think the old boys club was established long before 1988.
Its the other way around, they throw hackers under the bus. Aaron Swartz, Star Simpson arrested for stupid LED brooch, the list is quite long https://news.ycombinator.com/item?id=7411868
MIT faulted over its support for students https://www.bostonglobe.com/metro/2014/02/14/mit/9VBBq9pBQ1z... https://news.ycombinator.com/item?id=7411312
A good account is With Microscope and Tweezers: The Worm from MIT's Perspective [1], published in CACM a few months after the event. Notice it was the worm.
I was an intern at IBM in '88 and they shut-down the (iirc) two internet getaways to their corporate network (vnet) while people figured out what was going on. News moved slowly back then, and the idea of self-replicating software was unusual. Although IBM had had its own replicator the previous year [2].
[1] https://www.cs.columbia.edu/~gskc/security/rochlis89microsco...
[2] https://en.wikipedia.org/wiki/Christmas_Tree_EXEC
I followed his course 6.5840 on distributed systems (https://pdos.csail.mit.edu/6.824/, YouTube videos at https://youtube.com/playlist?list=PLrw6a1wE39_tb2fErI4-WkMbs...) and completed the labs. One day, out of curiosity, I looked up his name. Then I realized what a legend he is.
Great course by the way.
Would be cool if he adds a session on how to hack distributed system in 1988...
In 1988? Just stick random semicolons in things.
> Would be cool if he adds a session on how to hack distributed system in 1988..
username: field
password: technician
I am also doing the course now in my freetime. Even I wasn't aware who he is.
On a sidenote, what did you do after the course?
It is an amazing course though!
I went here next: https://www.youtube.com/@CMUDatabaseGroup
PG has said that he made up the 10% figure. It was a guess, but it was not correct.
The term "worm" came from the 1975 (sci-fi) novel The Shockwave Rider:
* https://en.wikipedia.org/wiki/The_Shockwave_Rider
The worm in shockwave rider released secret information to the public. Turns out a worm was not needed for this, just wikileaks.
That was one scary exciting day (source: was running machines at MIT at the time)
I remember that day was sooooooooooo quiet on Usenet.
Not much was happening in the Eng and CS buildings on campus (except for those that had to deal with the worm).
That day our tech chief at the time came running and told us about the worm, and that apparently our country managed to avoid it because the news spread quickly enough that one guy simply unplugged the whole country from the Internet - there was only a single connection back then. (!)
WPI was immune, the main machines on the net at time were an Encore Multimax and a DEC-20.
Good times, good times. I was in a Stanford computer lab when everything started to get very, very slow.
Thankfully the security holes in C that have allowed Morris worm to exist, have been taken care by WG14 since then.
I was a student part-time administrator/systems programmer at the Purdue Engineering Computer Network at the time. Our OS installs had enough local mods (and we had enough non-VAX, non-Sun architectures) that we were immune to some of the worm's modalities, but the sendmail debug mode exploit at least still caused a lot of consternation.
Diversity is security! I wish more people understood that. It may be more difficult to manage a bunch of diverse systems, but they are much more resilient to attacks.
I don't think that's proven out, like, at all; measure it against the returns on hardening mainstream platforms. The "monoculture" security thing has always been overblown, not least because you're never going to get an ecology where you have enough diversity to matter. Having 3 mainstream desktop or phone options is only marginally better than having just 1, and you're never going to have 20.
Do you do anything besides post on HN ;)
Put everything in MicroSoft Active Directory. Wait until it gets hacked. You will lose DNS, DHCP, Email, file servers, web servers, endpoints, etc. Obviously, running a mono-culture is a dumb thing to do if you want to keep your business running.
Maybe instead, run BIND on Linux servers, Apache on OpenBSD servers, have some Chromebooks, some Macs, etc. so everything doesn't go down together.
Really, it's not overblown... it's just common sense to diversify. Like we do with our diet/nutrition, with our financial investments, etc.
It sounds like common sense, but halfhearted diversification --- which is all that's available to mainstream users and enterprises --- can easily reduce security. That's because almost all real world security is logically perimeterized, with a single outward-facing attack surface that's given attention and an implicit premise that post-compromise persistence and pivoting is a given. Nobody survives an internal pentest, not even in 2025.
So by running BIND on Linux and Apache on OpenBSD and trying to tie it all into MSAD, what you're really doing is just expanding your attack surface, and once any of those are broken, attackers won't have to care about the state of the art in vulnerabilities to extend access from there.
The "monoculture" stuff is a product of a time when security pundits worried Microsoft was running the table on corporate IT. We're (generally) SAAS startup people here and very few of us run any Microsoft stuff. Almost all of us are better off extensively hardening a single Linux server environment than we are in deliberately trying to sprinkle NetBSD and Microsoft servers. That's doesn't improve security; it just turns your network into a CTF challenge.
Was KSB there at the time? That dude was fun.
I used to keep a vt100 at the head of my bed, roll over and check on things a few times at night. 3am and everything is screwed. can't really log in anyplace, or start any jobs. The bus doesn't run until 5:30, so I just get dressed and walk across the bridge the to lab. Visitors center isn't open, so I just sneak through the exit by the guardhouse. They're civilian contractors, they either don't see me, or recognize me and don't care.
Since it's all locked up, I just reboot the big vax single user - that takes about 10 minutes so I also start on a couple of the suns. You have to realize that everything including desktops runs sendmail in this era, and when some of these machines come up they are ok for a sec and then sendmail starts really eating into the cpu.
I'm pretty bleary eyed but I walk around restarting everything single and taking sendmail out of the rcs. The TMC applications engineer comes in around 7 and gets me a cup of coffee. He manages to get someone to pick up in Cambridge and they tell him that's happening everywhere.
> the internet in 1988
60k computers ( mostly at institutions ) in 20 countries
Everything was slower though. Turkey as a whole country had one 9600bps link to Bitnet at the time. Internet was accessed through Bitnet gateways. Systems (CPUs and I/O in general) were also much slower.
Slower and unstable. I spent a lot of my freshman year in college on Bitnet chat and iirc about every 30 minutes there would be a "netsplit" and a bunch of folks in the chat would disappear. Maybe it was our universities connection, which I think was direct to UIUC. I've posted here before that back then I thought Bitnet chat was magical. Things like being in a chat room with students in Berlin while the wall was falling felt so futuristic to me.
Much slower. Most campuses in the US were connected with 56K dedicated lines. The NSF backbone had just upgraded to T1.
ftp.wustl.edu would manage about 1 KBps and I was sitting one hop away from it at UIUC.
Insomnia paid off a lot back then.
I expected some info on its functioning. The goal was to gauge the size of the Internet, how? Why did it fail? I guess Wikipedia for the rescue.
I remember this event as one of the few times that the Internet made the mainstream news in the eighties. After the fact talked with some network people at Michigan and Michigan State and it was not a very good day for them. They also wanted jail time for him which did not happen.
I assume you all know that Robert Morris is one of the YC (and Viaweb) cofounders? [1] Together with Paul Graham, Jessica Livingston, and Trevor Blackwell.
[1] https://en.wikipedia.org/wiki/Robert_Tappan_Morris
He also is (or was) an HN user. No comments in quite some time though. I wish he did post here more.
https://news.ycombinator.com/user?id=rtm
I'm pretty sure Paul Graham was directly involved in this story (not in any bad, culpable way, but enough that, were a film to be made about it, a well-known actor would be cast for his part).
https://news.ycombinator.com/item?id=38020635
Out of curiosity, why do you think this?
There's contemporaneous reporting. It's in Katie Hafner and John Markoff's book! A friend of Morris', named Paul, has a role in the aftermath of the worm.
I'm not dunking on Paul Graham here. If you know anything about me, if anything, this is a point in his favor. :)
It's in Katie Hafner and John Markoff's book!
Not sure if that was supposed to be sarcasm[1] or was intended seriously, but for what it's worth Hafner & Markoff have frequently received a lot of criticism for playing fast and loose with the truth in that book. Now most of that is specifically in regards to their treatment of Mitnick, and I'm not making any particular accusation here. Just sharing a thought that "it's in Katie Hafner and John Markoff's book" might not be terribly strong evidence of $WHATEVER.
[1]: https://en.wikipedia.org/wiki/Poe%27s_law
I mean, sure, it's not my favorite book either, but what's your theory here, that they just made up a Paul?
Nope, no theory at all. Just providing some context for people who might not be as familiar with that book and the authors, and some of the questions that have been raised about it.
I know that the book makes a much bigger deal out of Mitnick than is reasonable (Mitnick was basically the consummate script kid). But I also know that scenesters of the time hated Markoff and thought he was, like, an enemy of the scene.
Def know lots about you and def didn't think you were dunking on Paul, hence my curiosity, because it was specifically you Mr. Ptacek. :)
Thanks for the answer, I'll check out the book.
Thanks for the answer, I'll check out the book.
It's a great read, but to echo what I said above: there have been a lot of questions over the years about the veracity of some of the details of their book. Take that for what it's worth. I enjoyed it enough that I've read it 3 or 4 times, but I do also suggest consulting other books on the same stories - particularly the stuff around K. Mitnick.
This one is before my time, but I remember the blaster worm very clearly.
I remember that the Boston Museum of Science used to have a floppy disk on display with the Morris worm on it.
That exhibit is shown in the article.
Wikipedia says the Morris worm went out on 1998 Nov 2. No idea why they would publish the article on 2025 Nov 4 with that title.
https://en.wikipedia.org/wiki/Morris_worm
1988
A quick search shows:
- a github repo containing "the original, de-compiled source code for the Morris Worm" - see https://github.com/agiacalone/morris-worm-malware
- a high level report about the worm - see https://www.ee.torontomu.ca/~elf/hack/internet-worm.html
Both of those agree that is was '88...
I strongly suspect 1998 was a typo by OP and he was actually pointing out the discrepancy between 2 Nov and 4 Nov WRT “this day”.
However the article has been updated so only the HN title has this flaw.
Sounds like the type of mistake I always make: Notice someone being off by two days, and in haste, post a correction that is off by ten years.
I think his question was whether it was Nov 2 or Nov 4...
The article is from a somewhat reliable source; Wikipedia is not a reliable source (by Wikipedia's own rules). Maybe you should use the article to update Wikipedia?
I’m still waiting for the first runaway autonomous botnet.
Currently AI doesn't work very well on hardware separated by hundreds of milliseconds of latency and slow network links. Both the training and inference are slow.
However I think this is a solvable problem, and I started solving it a while ago with decent results:
https://github.com/Hello1024/shared-tensor
When someone gets this working well, I could totally see a distributed AI being tasked with expanding it's own pool of compute nodes by worming into things and developing new exploits and sucking up more training data.
I might have 10% of the internet from 1988 on my Apple Watch.
This Week in 1988 rather.
https://neal.fun/internet-artifacts/morris-worm/
>However, the pioneering Morris worm malware wasn’t made with malice, says an FBI retrospective on the “programming error.” It was designed to gauge the size of the Internet, resulting in a classic case of unintended consequences.
had RTM actually RTM the world might be a bit different than it is today.
Well, sort of. RTM underestimated the effect of exponential growth, and thought that he would in effect have an account on all of the connected systems, without permission. He evidently didn't intend to use this power for evil, just to see if it could be done.
He did do us all a service; people back then didn't seem to realize that buffer overflows were a security risk. The model people had then, including my old boss at one of my first jobs in the early 80s, is that if you fed a program invalid input and it crashed, this was your fault because the program had a specification or documentation and you didn't comply with it.
Interestingly, it took another 7 years for stack overflows to be taken seriously, despite a fairly complete proof of concept widely written about. For years, pretty much everybody slept on buffer overflows of all sorts; if you found an IFS expansion bug in an SUID, you'd only talk about it on hushed private mailing lists with vendor security contacts, but nobody gave a shit about overflows.
It was Thomas Lopatic and 8lgm that really lit a fire under this (though likely they were inspired by Morris' work). Lopatic wrote the first public modern stack overflow exploit, for HPUX NCSA httpd, in 1995. Later that year, 8lgm teased (but didn't publish --- which was a big departure for them) a remote stack overflow in Sendmail 8.6.12 (it's important to understand what a big deal Sendmail vectors were at the time).
That 8lgm tease was what set Dave Goldsmith, Elias Levy, San Mehat, and Pieter Zatko (and presumably a bunch of other people I just don't know) off POC'ing the first wave of public stack overflow vulnerabilities. In the 9-18 months surrounding that work, you could look at basically any piece of privileged code, be it a remote service or an SUID binary or a kernel driver, and instantly spot overflows. It was the popularization with model exploits and articles like "Smashing The Stack" that really raised the alarm people took seriously.
That 7 year gap is really wild when you think about it, because during that time period, during which people jealously guarded fairly dumb bugs, like an errant pipe filter input to the calendar manager service that run by default on SunOS shelling out to commands, you could have owned up literally any system on the Internet, so prevalent were the bugs. And people blew them off!
I wrote a thread about this on Twitter back in the day, and Neil Woods from 8lgm responded... with the 8.6.12 exploit!
https://x.com/tqbf/status/1328433106563588097
I was logged into brillig.umd.edu (University of Maryland's Vax 8600) that night, frustrated that my emacs kept getting paged out, rhythmically typing ^A ^E ^A ^E to wiggle the cursor around to keep it paged in while I thought.
I ps aux'ed and saw a hell of a lot of sendmail demons running, but didn't realize till the next morning that we were actively under attack, being repeatedly but unsuccessfully finger daemon gets(3) buffer overflowed, and repeatedly and successfully sendmail daemon DEBUG'ed.
RTM's big mistake was not checking to see if a machine was already infected before re-infecting it and recursing, otherwise nobody would have noticed and he would have owned the entire internet.
What's funny is that UMD was on MILNET via NSA's "secret" IMP 57 at Fort Mead, so RTM's worm was attacking us through his daddy's own MILNET PSN (Packet Switching Node)!
https://news.ycombinator.com/item?id=18376750
>At the University of Maryland, our network access was through the NSA's "secret" MILNET IMP 57 at Fort Mead. It was pretty obvious that UMD got their network access via NSA, because mimsy.umd.edu had a similar "*.57" IP address as dockmaster, tycho and coins.
>[...] Once I told the guy who answered, "Hi, this is the University of Maryland. Our connection to the NSA IMP seems to be down." He barked back: "You can't say that on the telephone! Are you calling on a blue phone?" (I can't remember the exact color, except that it wasn't red: that I would have remembered). I said, "You can't say NSA??! This is a green phone, but there's a black phone in the other room that I could call you back on, but then I couldn't see the hardware." And he said "No, I mean a voice secure line!" I replied, "You do know that this is a university, don't you? We only have black and green phones."
>[...more stuff about the rumored "Explosive Bolts" that could separate ARPANET and MILNET from Erik Fair and Milo Medin...]
More from Jordan Hubbard about his infamous "rwall" incident, when he accidentally sent an rwall message to almost every machine on the internet. I received and cheerfully replied to it, which he said was nicer than most of the 743 replies he got. Also: Milo Medin's description of Dennis Perry's reaction (head of DARPA/IPTO) to getting his Interleaf windows scribbled on ("absolutely livid"), Mark Crispin's flamed about security, Jordan's response, and Dennis Perry himself replying to Jordan.
https://news.ycombinator.com/item?id=31822138
Here's my story of The Night of The Worm:https://news.ycombinator.com/item?id=29250313
DonHopkins on Nov 17, 2021 | parent | context | favorite | on: .plan
Yeah, 4.2 BSD fingerd was calling "gets" to read the name of who you were fingering into a small fixed size buffer on the stack.
https://man7.org/linux/man-pages/man3/gets.3.html
Chris Torek had hacked our version of fingerd (running on mimsy.umd.edu and its other Vax friends brillig, tove, and gyre) to implement logging, and while he was doing that, he noticed the fixed size buffer, and thoughtfully increased the size of the buffer a bit. Still a fixed size buffer using gets, but at least it was a big enough buffer to mitigate the attack, although the worm got in via sendmail anyway. And we had a nice log of all the attempted fingerd attacks!
The sendmail attack simply sent the "DEBUG" command to sendmail, which, being enabled by default, let you right in to where you could escape to a shell.
Immediately after the attack, "some random guy on the internet" suggested mitigating the sendmail DEBUG attack by editing your sendmail binary (Emacs hackers can do that easily of course, but vi losers had to suck eggs!), searching for the string "DEBUG", and replacing the "D" with a null character, thus disabling the "DEBUG" command.
But unfortunately that cute little hack didn't actually disable the "DEBUG" command: it just renamed the "DEBUG" command to the "" command! Which stopped the Morris worm on purpose, but not me by accident:
I found that out the day after the worm hit, when I routinely needed to check some bouncing email addresses on a mailing list I ran, so I went "telnet sun.com 80" and hit return a couple times like I usually do to clear out the telnet protocol negotiation characters, before sending an "EXPN" command. And the response to the "EXPN" command was a whole flurry of debugging information, since the second newline I sent activated debug mode by entering a blank line!
So I sent a friendly email to postmaster@sun.com reporting the enormous security hole they had introduced by patching the other enormous security hole.
You'd think that the Long Haired Dope Smoking Unix Wizards running the email system at sun.com wouldn't just apply random security patches from "some random guy on the internet" without thinking about the implications, but they did!
https://www.ee.torontomu.ca/~elf/hack/internet-worm.html
>The Sendmail Attack:
>In the sendmail attack, the worm opens a TCP connection to another machine's sendmail (the SMTP port), invokes debug mode, and sends a RCPT TO that requests its data be piped through a shell. That data, a shell script (first-stage bootstrap) creates a temporary second-stage bootstrap file called x$$,l1.c (where '$$' is the current process ID). This is a small (40-line) C program.
>The first-stage bootstrap compiles this program with the local cc and executes it with arguments giving the Internet hostid/socket/password of where it just came from. The second-stage bootstrap (the compiled C program) sucks over two object files, x$$,vax.o and x$$,sun3.ofrom the attacking host. It has an array for 20 file names (presumably for 20 different machines), but only two (vax and sun) were compiled in to this code. It then figures out whether it's running under BSD or SunOS and links the appropriate file against the C library to produce an executable program called /usr/tmp/sh - so it looks like the Bourne shell to anyone who looked there.
>The Fingerd Attack:
>In the fingerd attack, it tries to infiltrate systems via a bug in fingerd, the finger daemon. Apparently this is where most of its success was (not in sendmail, as was originally reported). When fingerd is connected to, it reads its arguments from a pipe, but doesn't limit how much it reads. If it reads more than the internal 512-byte buffer allowed, it writes past the end of its stack. After the stack is a command to be executed ("/usr/ucb/finger") that actually does the work. On a VAX, the worm knew how much further from the stack it had to clobber to get to this command, which it replaced with the command "/bin/sh" (the Bourne shell). So instead of the finger command being executed, a shell was started with no arguments. Since this is run in the context of the finger daemon, stdin and stdout are connected to the network socket, and all the files were sucked over just like the shell that sendmail provided.
It's a little shocking to me that there haven't been more things like this.
While we're much more conscientious and better at security than we were way back then, things are certainly not totally secure.
The best answer I have is the same as what a bio professor told me once about designer plagues: it hasn't happened because nobody's done it. The capability is out there, and the vulnerability is out there.
(Someone will chime in about COVID lab leak theories, but even if that's true that's not what I mean. If that happened it was the worst industrial accident in history, not an intentional designer plague.)
Here's a whole list of "more things".
https://en.wikipedia.org/wiki/Botnet#Historical_list_of_botn...
After things like
https://en.wikipedia.org/wiki/Blaster_(computer_worm)
https://en.wikipedia.org/wiki/SQL_Slammer
https://en.wikipedia.org/wiki/Sasser_(computer_worm)
Bill Gates sent out the "Trusted Computing" memo to harden Windows and make it somewhat secure.
Essentially, Windows used to be trivial to exploit, in that Every single service was by default exposed to the web, full of very trivial buffer overflows that dovetailed nicely into remote code execution.
Since then, Windows has stopped exposing everything to the internet by default and added a firewall, fixed most buffer overflows in entry points of these services, and made it substantially harder to turn most vulnerabilities into the kind of remote code execution you would use to make simple worms.
>better at security than we were way back then
In some ways this is dramatically understated. Now the majority of malware comes from getting people to click on links, targeted attacks that drop it, piggyback riding in on infected downloads, and other forms of just getting the victim to run your code. Worms and botnets are either something you "Willingly" install through "free" VPNs, or target absolutely broken and insecure routers.
The days where simply plugging a computer into the internet would result in you immediately trying to infect 100 other computers with no interaction are pretty much gone. For all the bitching about forced updates and UAC and other security measures, they basically work.
your mention of designer plagues reminded me of the russian bioweapons anthrax leak in 1979
https://pubmed.ncbi.nlm.nih.gov/7973702/
To a fairly significant extent, the Morris worm is why there haven't been more; it did prompt something of a culture shift away from trusting users to trusting mechanisms, mostly by prompting people to realise that the internet wasn't only going to be in the hands of a set of people who were one or two degrees of separation apart. It didn't make sense to assume people would treat it with reverence like a giant beautiful shared space.
It's most obviously paralleled by Samy Kamkar's MySpace worm, which exploited fairly similar too-much-trust territory.
I imagine the - heterogeneity of modern computing environments - number of 'layers' in any system - sheer size of the modern Internet all also make it harder to scale
they're just better at hiding now.
So like 10 computers, then I suppose?
6,000+, and those machines served many others (back then there were tens of thousands of machines on the Internet, but probably 10x as many that were connected to these by relays that handled email or Usenet traffic).
Also worth remember that especially with Internet-connected computers almost everything was multiuser. You did work on the Internet from a shell on a shared Unix server, not from a laptop.
Serverless remote workspaces as you might call them now.
Hypothetically if the m$ cloud ecosystem got completely oblibetated (including backups) would customers switch? Or is the lockin as complete as it is with the operating system customers?