The Morris worm: a program is copied to stifle machines

On November 2, 1988, a program began to circulate between computers connected to the Internet. It reproduces and looks for other machines. Very quickly, systems slow down or stop responding. The event is associated with the name of its author: Robert Tappan Morris.

The worm combines several pathways of entry, including software weaknesses and testing insufficiently protected identifiers. It does not depend on each new victim manually downloading a file. An affected machine can become a starting point for others.

Repeating the infection helps saturate the resources. The program can be installed again instead of leaving an already busy machine alone. Additional copies then consume the capacity necessary for the normal operation of the system.

Administrators and researchers observe anomalies, analyze code, and exchange patches. Cutting links can help limit the spread, but also complicates the sharing of solutions. The crisis reveals a need for organization as important as the need to repair some software.

The investigation led to Morris and a 1990 conviction under the U.S. Computer Fraud Act. The case has become a legal landmark. It should not be said as the first malicious use of any computer in history.

What is still striking in this episode is the proximity between repetition and disaster. Each machine performs a small series of operations; their multiplication transforms the network into an amplifier of the defect.