[COFF] Happy birthday, Morris Worm!

[COFF] Happy birthday, Morris Worm!

[dave]

The infamous Morris Worm was released in 1988; making use of known 
vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a 
metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was 
accidental, but the idiot hadn't tested it on an isolated network first). A 
temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".

Another fix was to move the C compiler elsewhere.

-- Dave

[COFF] [TUHS] Happy birthday, Morris Worm!

[crossd]

On Fri, Nov 1, 2019 at 4:37 PM Dave Horsfall <dave at horsfall.org> wrote:

> The infamous Morris Worm was released in 1988; making use of known
> vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a
> metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
> accidental, but the idiot hadn't tested it on an isolated network first).
> A
> temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".
>
> Another fix was to move the C compiler elsewhere.
>

This comes up every year, but could I ask that you please stop referring to
Robert T. Morris as an idiot? He acted foolishly and destructively, yes,
but he was quite young at the time and he paid for his mistake. He's gone
on to do very good work in systems and have a productive career; there
really is no need to continue to castigate him in this manner for a mistake
he made 31 years ago.

        - Dan C.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191101/db93b531/attachment.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[a.phillip.garcia]

On Fri, Nov 1, 2019, 4:37 PM Dave Horsfall <dave at horsfall.org> wrote:

> The infamous Morris Worm was released in 1988; making use of known
> vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a
> metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
> accidental, but the idiot hadn't tested it on an isolated network first).
> A
> temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".
>
> Another fix was to move the C compiler elsewhere.
>
> -- Dave
>

One of my comp sci professors was a grad student at Cornell when this
happened. He shared a small office with Morris and some other students. He
said that he had to explain that he had absolutely nothing to do with it on
quite a few occasions.

Morris was caught partly because he used the Unix crypt command to encrypt
his source code. The command was a computer model of the Enigma machine,
and its output could be and indeed was cracked, after retrieving the
encrypted code from a backup tape.

It's interesting that the worm was quickly detected. The reason was that it
kept infecting the same machines, and as you referred to, it contained a
password cracker, which slowed those machines to a crawl because of the
multiple instances running.

>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191101/91afb82d/attachment-0001.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[clemc]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1572 bytes --]

+1.  Well said Dan.

We all have made and will make mistakes in the future.  It was an error and
we all learned from it.  It’s not helpful to continue to hark back on it.

On Fri, Nov 1, 2019 at 2:13 PM Dan Cross <crossd at gmail.com> wrote:

> On Fri, Nov 1, 2019 at 4:37 PM Dave Horsfall <dave at horsfall.org> wrote:
>
>> The infamous Morris Worm was released in 1988; making use of known
>> vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out
>> a
>> metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
>> accidental, but the idiot hadn't tested it on an isolated network first).
>> A
>> temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".
>>
>> Another fix was to move the C compiler elsewhere.
>>
>
> This comes up every year, but could I ask that you please stop referring
> to Robert T. Morris as an idiot? He acted foolishly and destructively, yes,
> but he was quite young at the time and he paid for his mistake. He's gone
> on to do very good work in systems and have a productive career; there
> really is no need to continue to castigate him in this manner for a mistake
> he made 31 years ago.
>
>         - Dan C.
>
> _______________________________________________
> COFF mailing list
> COFF at minnie.tuhs.org
> https://minnie.tuhs.org/cgi-bin/mailman/listinfo/coff
>
-- 
Sent from a handheld expect more typos than usual
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191101/f44bae60/attachment.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[a.phillip.garcia]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1926 bytes --]

On Fri, Nov 1, 2019, 5:56 PM Clem Cole <clemc at ccc.com> wrote:

> +1.  Well said Dan.
>
> We all have made and will make mistakes in the future.  It was an error
> and we all learned from it.  It’s not helpful to continue to hark back on
> it.
>
> On Fri, Nov 1, 2019 at 2:13 PM Dan Cross <crossd at gmail.com> wrote:
>
>> On Fri, Nov 1, 2019 at 4:37 PM Dave Horsfall <dave at horsfall.org> wrote:
>>
>>> The infamous Morris Worm was released in 1988; making use of known
>>> vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out
>>> a
>>> metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
>>> accidental, but the idiot hadn't tested it on an isolated network
>>> first). A
>>> temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".
>>>
>>> Another fix was to move the C compiler elsewhere.
>>>
>>
>> This comes up every year, but could I ask that you please stop referring
>> to Robert T. Morris as an idiot? He acted foolishly and destructively, yes,
>> but he was quite young at the time and he paid for his mistake. He's gone
>> on to do very good work in systems and have a productive career; there
>> really is no need to continue to castigate him in this manner for a mistake
>> he made 31 years ago.
>>
>>         - Dan C.
>>
>
The father of the person who wrote the worm was a Unix pioneer, Bob Morris.
He coauthored a paper on Unix password security with Ken Thompson. He was
working for the NSA when the worm was unleashed. As told in The Cuckoo's
Egg, Cliff Stoll was an early suspect, and it caused Bob Morris no small
amount of embarrassment and angst to discover that the culprit was his own
son. I'm sure that Bob was proud of his son's accomplishments -- but not
that one.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191101/3d3fcf15/attachment-0001.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[wlc]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2067 bytes --]

Whoa!  Let’s rethink the defamatory ad hominem remarks here.  We were all kids once.  Moreover, my examination of this subject showed that some of our greatest computer scientists, at the time, went to bat for young Morris.  Moreover, calling RTM a nasty name like that is a shoe that simply doesn’t fit.  My goodness RTM is a professor at MIT.   It’s inarguable that the Morris Worm helped his career far more than it hurt it.  Plus, indeed, there was a genuine re-Morris from RTM.

Bill Corcoran

On Nov 1, 2019, at 5:49 PM, A. P. Garcia <a.phillip.garcia at gmail.com<mailto:a.phillip.garcia at gmail.com>> wrote:



On Fri, Nov 1, 2019, 4:37 PM Dave Horsfall <dave at horsfall.org<mailto:dave at horsfall.org>> wrote:
The infamous Morris Worm was released in 1988; making use of known
vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a
metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
accidental, but the idiot hadn't tested it on an isolated network first). A
temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".

Another fix was to move the C compiler elsewhere.

-- Dave

One of my comp sci professors was a grad student at Cornell when this happened. He shared a small office with Morris and some other students. He said that he had to explain that he had absolutely nothing to do with it on quite a few occasions.

Morris was caught partly because he used the Unix crypt command to encrypt his source code. The command was a computer model of the Enigma machine, and its output could be and indeed was cracked, after retrieving the encrypted code from a backup tape.

It's interesting that the worm was quickly detected. The reason was that it kept infecting the same machines, and as you referred to, it contained a password cracker, which slowed those machines to a crawl because of the multiple instances running.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191102/579c57da/attachment.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[wlc]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2255 bytes --]

My comments were not directed to A. P. Garcia.

I regret my error.

Bill Corcoran



On Nov 2, 2019, at 2:36 AM, William Corcoran <wlc at jctaylor.com<mailto:wlc at jctaylor.com>> wrote:

Whoa!  Let’s rethink the defamatory ad hominem remarks here.  We were all kids once.  Moreover, my examination of this subject showed that some of our greatest computer scientists, at the time, went to bat for young Morris.  Moreover, calling RTM a nasty name like that is a shoe that simply doesn’t fit.  My goodness RTM is a professor at MIT.   It’s inarguable that the Morris Worm helped his career far more than it hurt it.  Plus, indeed, there was a genuine re-Morris from RTM.

Bill Corcoran

On Nov 1, 2019, at 5:49 PM, A. P. Garcia <a.phillip.garcia at gmail.com<mailto:a.phillip.garcia at gmail.com>> wrote:



On Fri, Nov 1, 2019, 4:37 PM Dave Horsfall <dave at horsfall.org<mailto:dave at horsfall.org>> wrote:
The infamous Morris Worm was released in 1988; making use of known
vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a
metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was
accidental, but the idiot hadn't tested it on an isolated network first). A
temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".

Another fix was to move the C compiler elsewhere.

-- Dave

One of my comp sci professors was a grad student at Cornell when this happened. He shared a small office with Morris and some other students. He said that he had to explain that he had absolutely nothing to do with it on quite a few occasions.

Morris was caught partly because he used the Unix crypt command to encrypt his source code. The command was a computer model of the Enigma machine, and its output could be and indeed was cracked, after retrieving the encrypted code from a backup tape.

It's interesting that the worm was quickly detected. The reason was that it kept infecting the same machines, and as you referred to, it contained a password cracker, which slowed those machines to a crawl because of the multiple instances running.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191102/8e767e0c/attachment.html>

[COFF] [TUHS] Happy birthday, Morris Worm!

[a.phillip.garcia]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

On Sat, Nov 2, 2019, 2:44 AM William Corcoran <wlc at jctaylor.com> wrote:

> My comments were not directed to A. P. Garcia.
>
> I regret my error.
>
> Bill Corcoran
>
>
>
> On Nov 2, 2019, at 2:36 AM, William Corcoran <wlc at jctaylor.com> wrote:
>
> Whoa!  Let’s rethink the defamatory ad hominem remarks here.  We were all
> kids once.  Moreover, my examination of this subject showed that some of
> our greatest computer scientists, at the time, went to bat for young
> Morris.  Moreover, calling RTM a nasty name like that is a shoe that simply
> doesn’t fit.  My goodness RTM is a professor at MIT.   It’s inarguable that
> the Morris Worm helped his career far more than it hurt it.  Plus, indeed,
> there was a genuine re-Morris from RTM.
>
> Bill Corcoran
>
> <snip>

No worries. It's worth mentioning on a Unix mailing list that RTM
coauthored xv6, an x86 reimplementation of the v6 kernel. It sort of
carries the torch of the Lions book by teaching future generations about
the internals of operating systems and the Unix way. And that is a
beautiful thing.

>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://minnie.tuhs.org/pipermail/coff/attachments/20191102/6e5cccfe/attachment.html>

[COFF] Happy birthday, Morris Worm!

[dave]

On Thu, 1 Nov 2018, Nemo Nusquam wrote:

> Must have certainly embarrased his father.

It certainly did :-)  I understand he received a stern "talk"...

-- Dave

[COFF] Happy birthday, Morris Worm!

[cym224]

On 11/01/18 15:55, Dave Horsfall wrote:
> The infamous Morris Worm was released in 1988; making use of known
> vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out
> a metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it
> was accidental, but the idiot hadn't tested it on an isolated network
> first).

Must have certainly embarrased his father.

N.

> A temporary "condom" was discovered by Rich Kulawiec with "mkdir
> /tmp/sh".
>
> Another fix was to move the C compiler elsewhere.
>
> -- Dave
> _______________________________________________
> COFF mailing list
> COFF at minnie.tuhs.org
> https://minnie.tuhs.org/cgi-bin/mailman/listinfo/coff

[COFF] Happy birthday, Morris Worm!

[dave]

The infamous Morris Worm was released in 1988; making use of known 
vulnerabilities in Sendmail/finger/RSH (and weak passwords), it took out a 
metric shitload of SUN-3s and 4BSD Vaxen (the author claimed that it was 
accidental, but the idiot hadn't tested it on an isolated network first). A 
temporary "condom" was discovered by Rich Kulawiec with "mkdir /tmp/sh".

Another fix was to move the C compiler elsewhere.

-- Dave