By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Backdoor found in popular WordPress plugin Slick Popup
    Backdoor found in popular WordPress plugin Slick Popup
    12 months ago
    Vulnerability in Tatsu Builder WordPress Plugin Under Attack – Hacker
    Vulnerability in Tatsu Builder WordPress Plugin Under Attack – Hacker
    10 months ago
    All In One SEO Pack Vulnerabilities Impacting 3 Million Sites Patched
    All In One SEO Pack Vulnerabilities Impacting 3 Million Sites Patched
    7 months ago
    Latest News
    Two privilege escalation vulnerability in Simple Membership Plugin
    13 hours ago
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    7 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    1 week ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Cloudflare Introduces User Friendly CAPTCHA Alternative Called Turnstile
    12 months ago
    Windows 10 build 19044.1947 (KB5016688) outs as preview
    12 months ago
    How to disable WiFi or Ethernet network adapter on Windows 11
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    How to get the latest Windows 11 innovations
    16 hours ago
    Dynamic Lighting is now available on Windows 11
    16 hours ago
    Writing poems using LLama 2 on Workers AI
    Writing poems using LLama 2 on Workers AI
    16 hours ago
    serverless GPU-powered inference on Cloudflare’s global network
    serverless GPU-powered inference on Cloudflare’s global network
    16 hours ago
    You can now use WebGPU in Cloudflare Workers
    You can now use WebGPU in Cloudflare Workers
    16 hours ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    Improving Recording Quality from Voice Recorder on iPhone
    11 months ago
    How to make GIF from Youtube video?
    11 months ago
    How to check if a resource is available in Russia?
    11 months ago
    Latest News
    How to install September 2023 update with 23H2 features for Windows 11
    21 hours ago
    How to uninstall September update (KB5030310) from Windows 11
    21 hours ago
    How to remove the quiet mode icon in the corner of the iPhone 15 screen ProiPhone 15 Pro and iPhone
    2 days ago
    Sberbank has figured out how to effectively catch scammers – it will listen to everything you
    2 days ago
  • Glossary
  • My Bookmarks
Reading: Morris Worm Turns 25
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
ThreatsWordpress Threats

Morris Worm Turns 25

Vitus White
Last updated: 13 October
Vitus White 12 months ago
Share
5 Min Read

This weekend we had a memorable date. It marked 25 years since the publication of the first computer malware that was widespread enough to be featured in the news. The famous Morris Worm, written by a Cornell University student, infected about 10% of Internet-connected computers up to date. To be more specific, it infected about 6 out of every 60 thousand computers, which might sound ludicrously small today, but this “prehistoric” case is actually very important because it combined DDoS, exploits, stealth technologies, password bruteforcing and other techniques that are widely used in modern malware now. Moreover, it ended with the first conviction in the US under the 1986 Computer Fraud and Abuse Act.

Photo Credit: Intel Free Press
The floppy disk with the source code of the Morris worm is now kept in the Boston Museum of Science

Thanks to Youtube, we can watch how TV told this story back in 1986…

…And now we can tell this story from a security standpoint.

A student at Cornell University called Robert Tappan Morris decided “to gauge the size of the Internet.” To accomplish this task, he wrote a quite complicated program, which was able to replicate itself over the network and prevent third-party attempts to stop it. This functionality matches with the definition of Computer Worm exactly, thus its name. Morris Worm wasn’t developed to cause any harm, however, a programming mistake led to multiple infections of a single computer, causing the server to become overloaded and non-responsive. Sounds like DDoS, doesn’t it?

To spread itself over the Internet, the worm used the same technology as its modern great-grandchildren, by exploiting vulnerabilities. In the case of Morris worm, there were three different vulnerabilities exploited. The implementation of Finger and Sendmail bugs in the popular Unix-based systems allowed remote code execution. If the tactic was not successful, Worm tried to utilize rsh (remote shell) typically used for remote administration. Login and password are required to use rsh, so Morris Worm brutforced them. An impressively high success rate was achieved using only a small dictionary of 400 words, plus some obvious options like having passwords identical to usernames or consisting of the same letters in reverse order. It’s still not obvious to many people today that strong passwords are essential, so 25 years ago even system administrators were unaware of this.

Upon successful computer penetration, the worm changed its process name, deleted temporary files and took some other measures to prevent its revelation, e.g. encrypting its data in memory. On of the first actions upon launch was to check and see if the computer was already infected. When other copy was discovered, two copies “rolled a dice” to decide which one should self-destruct. Maybe it was Morris’ mistake, or maybe it was a measure to counteract easy “vaccination,” nevertheless one of seven copies eventually stopped playing “survival game” and continued its operation regardless of other copies. It was this decision that led to the DDoS effect. Coefficient of 1/7 turned out to be excessively high and many computers became infected dozens times.

Despite not being ready for worm, both technically and conceptually, system administrators over the USA acted quickly. Two working groups were established in MIT and UC Berkley and it took only two days to find and fix vulnerabilities utilized by worm and disassembled worm itself. In general, it was the end of the worm. However, the cost of infection removal was estimated to be between $100 thousand to $10 million.

Quite interestingly, Morris’ effort to remain anonymous was successful. The person who changed that was actually his father, Robert Morris, UNIX OS co-author and chief scientist at NSA’s National Computer Security Center. He convinced his son to confess. The court took this in account, and the sentence for Morris junior was a soft 3 years of probation, $10 thousand fine and 400 hours of community service. This lesson turned to be useful for Morris. He became a respected member of the computer society. Among his achievements are the creation of one of the first e-commerce platforms, Viaweb (later sold to Yahoo and rebranded as Yahoo Store), the creation of the startup fund Y Combinator, the participation in the development of new programming languages and he earned a PHD at MIT.

 


Source: kaspersky.com

Translate this article

TAGGED: Malware, Remote shell, Security, Source code, Threats, Vulnerabilities, YouTube
Vitus White October 13, 2022 October 7, 2022
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Two privilege escalation vulnerability in Simple Membership Plugin
Two privilege escalation vulnerability in Simple Membership Plugin
Wordpress Threats 16 hours ago
How to get the latest Windows 11 innovations
Windows 16 hours ago
Dynamic Lighting is now available on Windows 11
Windows 16 hours ago
Writing poems using LLama 2 on Workers AI
Writing poems using LLama 2 on Workers AI
Apps 16 hours ago
serverless GPU-powered inference on Cloudflare’s global network
serverless GPU-powered inference on Cloudflare’s global network
Apps 16 hours ago

You Might Also Like

Two privilege escalation vulnerability in Simple Membership Plugin
Wordpress Threats

Two privilege escalation vulnerability in Simple Membership Plugin

16 hours ago
Windows

How to get the latest Windows 11 innovations

16 hours ago
Writing poems using LLama 2 on Workers AI
Apps

Writing poems using LLama 2 on Workers AI

16 hours ago
You can now use WebGPU in Cloudflare Workers
Apps

You can now use WebGPU in Cloudflare Workers

16 hours ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

You can now use WebGPU in Cloudflare Workers
How to install September 2023 update with 23H2 features for Windows 11
How to uninstall September update (KB5030310) from Windows 11
Traffic anomalies and notifications with Cloudflare Radar
Sippy helps you avoid egress fees while incrementally migrating data from S3 to R2
the modern way to connect and protect your clouds, networks, applications and users
Previous Next
Hot News
Two privilege escalation vulnerability in Simple Membership Plugin
How to get the latest Windows 11 innovations
Dynamic Lighting is now available on Windows 11
Writing poems using LLama 2 on Workers AI
serverless GPU-powered inference on Cloudflare’s global network
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?