The Morris Worm, First Computer Virus (episode 365)

Automatic Shownotes

Chapters

Transcript

Jake:
[0:05] Welcome to Hub History, where we go far beyond the freedom trail to share our favorite stories from the history of Boston, the hub of the universe.

The First Computer Virus

Jake:
[0:16] This is episode 365, The First Computer Virus. Hi, I’m Jake. This week, I’m talking about a deceptively simple program that was executed on a single MIT terminal 38 years ago this month. Though it was simple, it brought the early internet grinding to a halt, and it effectively launched the modern field of cybersecurity. In this episode, we explore the story of the world’s first computer virus, or maybe worm, one that resulted in the first known distributed denial-of-service attack. What began as an unbridled and quite possibly poorly thought-out experiment by a 23-year-old Cornell graduate student rapidly spiraled into a nationwide digital gridlock, disabling thousands of university, NASA, and Pentagon computers, and landing its creator as the first person prosecuted under the Computer Fraud and Abuse Act. We’ll call on contemporary news reports, Usenet transcripts, and post-mortem technical papers to trace how a loose collective of late-80s system administrators reverse-engineered the code, while the media panicked over the threat of, computer viruses.

Jake:
[1:34] And of course, we’ll ask the question that still surrounds this case decades later. Was the creator of this worm a malicious hacker, a noble security researcher who got in over his head, or just an unfocused academic who unleashed an unprecedented digital attack out of sheer boredom?

A Podcast Farewell Party

Jake:
[1:53] But before we get into the topic of the world’s first DDoS attack, I just want to pause and talk about our upcoming event at Old North Church on Friday, November 13th. I’m going to record a live episode of Hub History with independent scholar Lori Rogers Stokes and UMass Boston professor emeritus Jonathan Chu, talking about the legacy of the Puritans in Boston and how the most conservative British North American colony evolved into the most progressive American state as the congregational church and civil society in Massachusetts evolved over nearly 400 years.

Jake:
[2:31] If you’ve been listening regularly, you’ve probably heard me promoting the live show as our 10th anniversary party for the podcast. If you missed last week’s brief bonus episode, though, you might not have heard that this live episode will also be our podcast wrap party. That’s right, after a decade of making hub history, I’m hanging up the microphone and winding down the show this fall. I’ve absolutely loved making this podcast since 2016, and I’m sure it’s the most meaningful contribution I’ll ever make to the history of this city that I love. But it’s time to say goodbye. So for this live episode, let’s make it a send-off party. We’ll open the doors at 5.30, I’ll record with Jonathan and Lori at about 6, and then And when the interview wraps up at about 7, there’ll be light refreshments at the gift shop at Old North. So that’ll give us a chance to hang out. And I can finally meet some of the listeners who I’ve just been imagining on the other end of the microphone for the past 10 years. Tickets for the event are free, but I’m asking folks to register so I know what refreshments to buy and generally what to expect for the night.

Jake:
[3:46] You can find all the details and the link to our Eventbrite registration page in the show notes this week. And at hubhistory.com slash live. Again, register for our free 10th anniversary live podcast episode and wrap party on November 13th at Old North Church at hubhistory.com slash live.

Cybersecurity Begins

Jake:
[4:10] When I’m not busy talking to you about Boston history, my day job is working in electronic health records, and these days, cybersecurity is one of our main focuses. We harden networks against attack, we make sure that employees only have access to the systems and resources that they need to do their jobs, and we deal with endless fake phishing attempts from our security team that train us to recognize the real thing. If you also do work that mostly takes place behind a computer screen, you probably have a similar experience. All that started 38 years ago this month with a deceptively simple program that somebody ran on a single computer at MIT. Decades later, cybersecurity experts still argue over whether we should call those few lines of code a virus or an internetworm, and whether it was the work of a malicious attacker or a well-meaning security researcher who just got in over his head.

Jake:
[5:09] A list of famous cases maintained by the FBI contains this brief summary. At about 8.30 p.m. on November 2, 1988, a maliciously clever program was unleashed on the Internet from a computer at the Massachusetts Institute of Technology. Shortly after the attack, a dismayed programmer contacted two friends, admitting that he’d launched the worm and despairing that it had spiraled dangerously out of control. He asked one friend to relay an anonymous message across the internet on his behalf with a brief apology and guidance for removing the program. Ironically, few received the message in time because the network had been so damaged by the worm. The programmer who wrote this clever program may not have known or even intended it. He had just launched the internet’s first DDoS attack. DDoS stands for Distributed Denial of Service, and these days they’re one of the most common online threats. Think of a DDoS attack like a coordinated rush-hour traffic jam artificially created to paralyze a target website.

Jake:
[6:21] The highway, of course, is normally a quick way to get around, but it slows down due to the volume of traffic at rush hour. In a DDoS attack, a malicious hacker floods the highway with thousands or millions of cars, and he tells them to all get off at the same exit at the same time. The exit ramp backs up, and traffic on the highway grinds to a halt. In this analogy, the highway is the internet, and the exit is the website targeted by hackers. The cars are hijacked computers all around the world Sending junk traffic to the same server at the same time, Overwhelming it with more requests per second than it was designed to handle Until the targeted website slows to a crawl or just crashes entirely Effectively locking out legitimate users until this digital gridlock gets cleared, The first hint that something was wrong on the internet which was then a brand new invention that only a few certified nerds at government agencies and the

Jake:
[7:19] world’s best technical universities interacted with, came at 3.30 a.m. Eastern Time on November 3rd, 1988.

The Worm’s First Warning

Jake:
[7:29] A message was posted to a Usenet group about computer protocols that seemed to come from the email address foo at bar dot arpa. Foo and bar are the digital equivalent of the lorem ipsum placeholder text used by printers since the time of Gutenberg. These particular placeholders date back to mid-20th century military slang and early MIT hacker culture, used whenever a developer needed to write sample code, test a concept, or demonstrate a function without tying it to a real-world variable or specific data. They hold no technical meaning on their own, but they’re instantly recognizable, so anybody who was on the internet in 1988 would have known that foo at bar.arpa, was a fake email address. The source of the message, while mysterious at the time, was later revealed to be Harvard student Andy Suttoth, who then turned out to be a friend whom the hacker had called after seeing how quickly the worm was spreading. Since that first message was sent at 3.30 a.m., not that many people were awake to see it or to realize the damage that was happening while the world slept.

Jake:
[8:44] A couple of hours later, early BSD Unix engineer Keith Bostic sent another message to the same Usenet group at 5.56 a.m. This one got more attention. He said, There’s a virus running around. The salient facts. A bug in SendMail has been used to introduce a virus into a lot of internet Unix systems. It has not been observed to damage the host system. However, it’s incredibly virulent, attempting to introduce itself into every system it can find. It appears to use RSH, broken passwords, and send mail to introduce itself into the target system. The field of cybersecurity was born that morning. Until November 1988, computer viruses and network worms had been the stuff of science fiction.

Black Thursday

Jake:
[9:36] Now they became reality, and the insular world of computer and network engineers mobilized to neutralize this new threat.

Jake:
[9:45] The first step was to understand what was happening, an effort that was slowed down by the very gridlock that was introduced by the attack. This program collected host, network, and user information, then broke into other machines using flaws present in those systems’ software. After breaking in, the program would replicate itself, and the replica would also attempt to infect other systems, Although the program would only infect Sun Microsystems’ Sun 3 systems, and VAX computers running variants of 4BSD Unix The program spread quickly, as did the confusion and consternation of system administrators and users As they discovered that their systems had been invaded Another paper, this one published a few months after the attack in February 1989 by computer scientist Don Seeley, describes what those system administrators were faced with as they woke up and logged in on the morning after the attack. November 3rd, 1988 is already coming to be known as Black Thursday. System administrators around the country came to work on that day and discovered that their networks of computers were laboring under a huge load.

Jake:
[11:01] If they were able to log in and generate a system status listing, they saw what appeared to be dozens or hundreds of shell processes. If they tried to kill the processes, they found that new processes appeared faster than they could kill them. Rebooting the computer seemed to have no effect. Within minutes after starting up again, the machine was overloaded by these mysterious processes. University computer labs at Berkeley and MIT and Caltech were some of the first to be hit but they weren’t the most sensitive, When research labs operated by the Pentagon and NASA reported intrusions the media sat up and paid attention, The earliest news story that I could find covering the incident was a November 3rd article in the New York Times, In the largest ever intrusion of the nation’s computers a Department of Defense data network has been disrupted since Wednesday night by a rapidly spreading virus software program. The program reproduced itself through the computer network, making hundreds of copies in each machine it reached. It clogged systems linking thousands of military, corporate, and university computers around the country, preventing them from doing additional work. The virus was not thought to have destroyed any files.

Jake:
[12:23] The big issue is that a relatively benign software program can virtually bring our computing community to its knees and keep it there for some time, said Chuck Cole, deputy computer security manager at Lawrence Livermore Laboratory in Livermore, California, one of the sites affected by the intrusion. Quote, The cost is going to be staggering. Now, you’ll notice that the New York Times called this malicious program a virus. But that was not a universally accepted term at the time.

Virus or Worm?

Jake:
[12:55] In his analysis of the attack, Gene Spafford spares a few lines for terminology and concludes that virus was not the right term for what happened in November 1988.

Jake:
[13:08] There seems to be considerable variation in the names applied to the program described in this paper. I use the term worm instead of virus based on its behavior. A worm is a program that can run by itself and can propagate a fully working version of itself to other machines. It’s derived from the word tapeworm, a parasitic organism that lives inside a host and saps its resources to maintain itself. A virus is a piece of code that adds itself to other programs, including operating systems. It cannot run independently. It requires that its host program be run to activate it.

Jake:
[13:50] As such, it has a clear analog to biological viruses. Those viruses are not considered alive in the usual sense. Instead, they invade host cells and corrupt them, causing them to produce new viruses. Thus, the program that was loosed on the internet was clearly a worm. In this episode, I’ll use both terms interchangeably, but mostly I’ll refer to this malicious program as a virus, because that’s the term that’s now almost universally understood. We’ve all clicked on a link we shouldn’t have and worried that we had downloaded a virus, like the ones that power the botnets used for modern, far more sophisticated DDoS attacks. Virus was also the preferred term in the lay press at the time, no doubt annoying the heck out of the few nerds who knew the difference.

Jake:
[14:42] The Boston Globe covered this virus in a front-page story on November 4th, accompanied by a picture of a very annoyed-looking MIT grad student glaring at a computer terminal. A computer virus unleashed Wednesday night ran amok yesterday in research computers of many of the country’s major universities and government research facilities, causing most of them to shut down research operations temporarily. Several researchers said it appeared to be the most widespread example yet of the growing menace of computer viruses, which are bits of computer programming that can be deliberately slipped into computer systems to duplicate themselves and spread from computer to computer through shared software, electronic mail, or electronic bulletin boards. Some viruses have been known to destroy valuable files or programs. The virus that spread rapidly around the Internet in November 1988 did not steal or destroy files, even when it eventually infected highly sensitive systems. Like the Defense Department or the Space Program.

Jake:
[15:48] A report describing the impact on NASA’s Ames Research Center notes, the FBI wanted to know if a trap could be set up and how much damage this virus was causing in time and money. The FBI also wanted to know if malicious damage had been done. No files were altered or deleted, so no damage was done to the system except for lost CPU time. Even as a cusper, A member of that micro-generation on the cusp of Gen X and millennials. The folks who grew up immersed in the internet revolution. It’s hard to remember life before we were all connected. I was young in 1988, but as far as I can remember, I had never heard of the internet at that time. I was probably still playing games on our Commodore 64 in 1988, blissfully unaware of the internet and the worms, or viruses, lurking on it.

Jake:
[16:45] The author of that Globe article adds this helpful context for readers who, like me, had probably never heard of the Internet in 1988. The infectious code itself was disseminated nationally through an electronic mail system, known as the Internet, to computers that were running on the Unix operating system. An operating system is a basic program that runs the computer’s own operations and controls all other programs working on the computer.

Jake:
[17:15] Internet is a network that allows computers throughout the country to communicate with each other.

Tracing the Attack

Jake:
[17:21] Inside the media labs at the nation’s elite technical universities, engineers had heard of the Internet, and they were hard at work figuring out how to protect it from this new threat. Gene Spafford writes, By late Wednesday night, personnel at the University of California at Berkeley and at MIT had captured copies of the program and began to analyze it. People at other sites also began to study the program or were developing methods of eradicating it. A common fear was that the program was somehow tampering with system resources in a way that could not be readily detected. That while a cure was being sought, system files were being altered or information destroyed. Two days after the virus was released, MIT admitted to the Boston Globe that the virus had been released from one of their Unix systems. But they still argued that it was introduced from outside onto their systems.

Jake:
[18:22] At some research labs at Massachusetts Institute of Technology, the virus was traced yesterday to a program on its own computers that distributes electronic mail from one computer to another, and it was eliminated in those particular computers. The MIT program, in turn, was thought to have picked up the virus from a national electronic mail network that apparently infected scores of other computers nationwide. why. It turned out, however, that the call was coming from inside the house. Or so it seemed. The virus had been launched from MIT, and the first tip to its existence came from a Harvard grad student. So researchers and journalists assumed that Boston was ground zero for the attack.

Jake:
[19:09] It didn’t take long, however, for the mystery around the attack to evaporate. With the New York Times reporting on the morning after the virus was released.

Jake:
[19:19] The virus introduced Wednesday was apparently the result of an experiment by a computer science grad student trying to sneak what he thought was a harmless virus into the ARPANET computer network, which is used by universities, military contractors, and the Pentagon, where the software program would remain undetected. A man who said he was an associate of the student said in a telephone call to the New York Times that the experiment went awry because of a small programming mistake that caused the virus to multiply around the military network hundreds of times faster than planned. Computer experts who disassembled the program said that it was written with remarkable skill that it exploited three security flaws in the ARPANET network. The virus’s design included a program designed to steal passwords, then masqueraded as a legitimate user to copy itself to a remote machine. Once the hacker who released the virus called a friend, and the friend posted that warning on Usenet from the foo bar email address, it didn’t take long for researchers and criminal investigators to unravel the mystery of the hacker’s identity.

Unmasking the Hacker

Jake:
[20:29] And, unlike some of the newspaper articles that stopped one step short of calling the author of the virus a computer genius, Gene Spafford came to another conclusion, writing.

Jake:
[20:42] An examination of the reverse-engineered code of the worm is instructive. Although it’s not the same as reading the original code, it does reveal some characteristics of the author. One conclusion that may surprise some people is that the quality of the code is mediocre and might even be considered poor. The program could have been much more virulent had the author been more experienced or less rushed in his or her coding. However, it seems likely that this code had been developed over a long period of time So the only conclusion that could be drawn is that the author was sloppy or careless Or both And perhaps the release of the worm was premature, The hacker wasn’t just sloppy with his code He was also sloppy with his operational security, Seeing the chaos he was causing He reached out to friends who knew his real identity and had them contact law enforcement, the press, and some of the hackers who were trying to fix the damage he’d unleashed. Unfortunately for the author, Ben Franklin had it right when he wrote in Poor Richard’s Almanac, three people can keep a secret if two of them are dead.

Jake:
[21:55] We already heard how the hacker’s friend Andy Suttoth tried to warn sysadmins, But the FBI famous case’s profile of this incident outlines how another well-meaning friend accidentally revealed the hacker’s identity.

Jake:
[22:11] Independently, the other friend made an anonymous call to the New York Times, which would soon splash news of the attack across its front pages. The friend told a reporter that he knew who built the program, saying it was meant as a harmless experiment and that its spread was the result of a programming error. In a follow-up conversation with the reporter, the friend inadvertently referred to the worm’s author by his initials, R.T.M. Using that information, the Times soon confirmed and publicly reported that the culprit was 23-year-old Cornell University graduate student Robert Tappan Morris. This is the point where I have to reveal that this story’s connection to Boston is tenuous at best. The virus was launched from a computer lab at MIT, and the first warnings came from a friend at Harvard. But the attacker himself turned out to be nowhere near Boston or Cambridge. Robert Tappan Morris was a grad student at Cornell, 300 miles away in Ithaca, New York. It turns out that Cornell produces irresponsible hackers as well as alleged gang rapists. Great school.

Accident, Experiment, or Attack?

Jake:
[23:29] Almost as soon as the hacker’s identity was revealed, his motives were debated, both in the press and at research universities and FBI field offices. The Boston Globe reported on November 4th, From all appearances, said MIT Media Lab researcher Pascal Chennai, the person who designed the virus was just trying to show that there is this big security hole that existed in the mail program. He thought he was being clever, but all he was being is annoying. That’s the most gracious possible interpretation of Morris’ actions. Not everyone agreed that he was a clever but annoying helpful researcher. Some people still believe that the Morris worm was an attempt to steal national secrets that didn’t exactly work. And others believe that even if the worm was meant to reveal weaknesses in Unix security, the way it was unleashed upon the world was criminally negligent. A report written just over a year after the virus attack gets to the latter point.

Jake:
[24:34] Two lines have been drawn in the computer community in the aftermath of the Internet worm of November 1988. One group contends that the release of the worm program was a naive accident, and that the worm escaped during testing. Yet, when the worm program was unleashed, it was obvious it was spreading unchecked. Another group argues that the worm was deliberately released to blatantly point out security defects to a community that was aware of the problems, but were complacent about fixing them. Yet, one does not necessarily need to deliberately disrupt the entire world in order to report a problem.

Jake:
[25:14] Gene Spafford’s analysis of the Morris worm concludes that, whatever the goals Morris had in mind, the program he wrote was malicious in its very design. It is clear from the code that the worm was deliberately designed to do two things, infect as many machines as possible, and be difficult to track and stop. There can be no question that this was in any way an accident, though its release may have been premature.

Jake:
[25:43] Other analysts concluded that Robert Morris was, well, kind of a putz.

Jake:
[25:51] An investigative report commissioned by Cornell University concluded, It may simply have been the unfocused intellectual meandering of a hacker completely absorbed with his creation and unharnessed by considerations of explicit purpose or potential effect. He may have been malicious. He may have been a putz. But the Boston Globe revealed on November 13, 1988, that Robert Morris was carrying on the family business. Perhaps it’s only fitting, given the Oedipal struggle between two generations of hackers in which new computers and new system defenses traditionally evolve, that the alleged author of this virus attack is also the son of a legendary computer system designer. Robert T. Morris, one of the co-designers of Unix, a major computer operating system, is now the chief scientist at the NSA’s National Computer Security Center. The virus released by his son was specifically designed to discover and exploit a series of subtle weaknesses, some known, some new, in many Unix computers, and it could make a multi-million dollar difference in the sale of Unix systems.

The First Cybercrime Prosecution

Jake:
[27:03] The FBI was not disposed to give the younger Morris the benefit of any doubts, and he soon found himself indicted under 18 U.S. Code Section 1030, better known as the Computer Fraud and Abuse Act. He was the first person to face prosecution under the law that still governs most cybercrime investigations in the U.S..

Jake:
[27:26] During his trial, Morris argued that his intentions weren’t malicious. His goal, he stated, was simply to highlight the glaring vulnerabilities in current network security by exploiting the back doors that he’d uncovered. His argument proved unconvincing. In December 1990, Morris was sentenced to three years of probation, 400 hours of community service, and ordered to pay a fine of $10,050, alongside supervision costs. He appealed the verdict, but his conviction was upheld the following spring. By 1994, he had officially served his sentence. Once the sentence was behind him, Morris returned to Harvard to finish his PhD. While working on his doctorate, he co-founded an early e-commerce startup that built software for online storefronts. Yahoo eventually bought it at the height of the dot-com bubble for $49 million.

Jake:
[28:27] A year after selling his company, Morris completed his Ph.D. In 1999, earning a Ph.D. in Applied Sciences, with a dissertation focused on scalable TCP congestion control. That very same year, the Massachusetts Institute of Technology hired him on as an assistant professor. In 2005, he co-founded Y Combinator, the controversial startup accelerator that would go on to launch companies like Airbnb, DoorDash, and Dropbox. Online commentators have joked that Y Combinator has done more harm to the internet than the Morris worm ever could have.

Further Reading and Farewell

Jake:
[29:07] To learn more about the Morris worm and the first DDoS attack, check out this week’s show notes at hubhistory.com slash 365. I’ll have links to papers about the worm from Gene Spafford, Jay Reynolds, Purdue, Cornell, MIT, NASA’s Ames Research Center, and the FBI. I’ll also include links to news stories that I quoted from The Globe, The New York Times, the San Francisco Chronicle, and the San Francisco Examiner. And remember, come out and see me at our 10th anniversary live episode and podcast wrap party at Old North Church on the evening of November 13th. More information and the registration link do you need at hubhistory.com slash live. I sure hope I see you there.

Jake:
[29:59] If you’d like to get in touch with us, you can email podcast at hubhistory.com. I still maintain profiles for Hub History on Twitter, Facebook, Instagram, and as at hubhistoryatbetter.boston if you’re a Mastodon user. For now, the only social media site that I regularly update and where I like to interact with listeners is Blue Sky. You can find me on Blue Sky as Hub History or just search for hubhistory.com. If none of that’s up your alley, simply go to hubhistory.com and click on the Contact Us link. While you’re on the site, hit the subscribe link and be sure that you never miss an episode. If you subscribe on Apple Podcasts, please consider writing us a brief review. If you do, drop me a line and I’d love to send you a Hub History sticker as a token of appreciation. That’s all for now. Stay safe out there, listeners.