the Morris Worm

securityops culture

The 1988 self-replicating program that became the first worm to disrupt the early internet at scale.

Written by Cornell student Robert Tappan Morris, it exploited holes in sendmail, fingerd, and weak passwords, and a flawed reinfection check made it replicate so aggressively that it crippled thousands of machines. Morris became the first person convicted under the Computer Fraud and Abuse Act, and the incident spurred the creation of the first CERT.

At around 8:30 in the evening on 2 November 1988, a Cornell graduate student named Robert Tappan Morris released a self-replicating program onto the internet, launching it from an MIT machine to obscure its origin. Within a day it had reached roughly six thousand of the sixty thousand computers then connected.

The damage came from a design decision rather than a payload. The worm carried nothing destructive; it was meant to spread quietly and measure the network. But Morris anticipated that administrators might defend by making machines claim to be already infected, so he had it reinfect anyway a fraction of the time. That fraction was far too high, machines accumulated copies until they were unusable, and the thing that was supposed to be invisible became a nationwide outage.

The consequences outlived the incident by decades. Morris became the first person convicted under the Computer Fraud and Abuse Act, receiving probation, community service and a fine rather than prison, and the case established that releasing code causing unauthorized access could be criminal even without malicious intent. More lastingly, the response gap it exposed led directly to the founding of CERT at Carnegie Mellon, which is where organized incident response as a discipline begins.

Also known as: Internet Worm, Morris worm, the Great Worm

← All glossary entries