The Morris worm or Internet worm of November 2, , is one of the oldest computer worms distributed via the Internet , and the first to gain significant mainstream media attention. November 2, , from the Massachusetts Institute of Technology network. The worm exploited weak passwords. Though Morris said that he did not intend for the worm to be actively destructive, instead seeking to merely highlight the weaknesses present in many networks of the time, a consequence of Morris's coding resulted in the worm being more damaging and spreadable than originally planned.
It was initially programmed to check each computer to determine if the infection was already present, but Morris believed that some system administrators might counter this by instructing the computer to report a false positive.
This resulted in a computer potentially being infected multiple times, with each additional infection slowing the machine down to unusability. This had the same effect as a fork bomb , and crashed the computer several times. A portable C "grappling hook" component of the worm was used to download the main body parts, and the grappling hook runs on other systems, loading them down and making them peripheral victims.
By instructing the worm to replicate itself regardless of a computer's reported infection status, Morris transformed the worm from a potentially harmless intellectual and computing exercise into a viral denial-of-service attack. Morris's inclusion of the rate of copy within the worm was inspired by Michael Rabin 's mantra of randomization. The resulting level of replication proved excessive, with the worm spreading rapidly, infecting some computers several times.
Rabin would eventually comment that Morris "should have tried it on a simulator first". Stoll helped fight the worm, writing in that "I surveyed the network, and found that two thousand computers were infected within fifteen hours.
