Eugene Spafford
Communications of the ACM 32, 6 pp.678-687
June 1989
Download PDF (1.13Mb) (You need to be registered on forum)The Internet computer network was attacked on Nov 2, 1988, by a computer worm. Although the program affected only Sun Microsystems Sun-3 workstations and VAX computers running a variant of version 4 of the Berkeley Unix, the program spread over a huge section of the network. Early the following day a number of methods for containing and eradicating the virus had been discovered and published. It was discovered that the worm exploited flaws in the Unix operating system's security routines and used some of Unix's own utilities to propagate itself. A complete description of the workings of the worm and its methods of entry into Unix systems are discussed. The aftermath of the infection and the motives of Robert T. Morris, its author, are also discussed.