On the evening of 2 November 1988, system administrators across American universities began noticing their machines slowing down. Then stopping. Then, after a reboot, slowing down again within minutes.
The internet at the time consisted of roughly sixty thousand connected computers, mostly at universities, research labs and military sites. Within about a day, something like six thousand of them — a tenth of the entire network — had been effectively disabled.
The cause was a program written by Robert Tappan Morris, a 23-year-old graduate student at Cornell. He had not intended to damage anything. He had intended to count.
The experiment
Morris wanted to measure the size of the internet. The idea was simple: write a program that copies itself from machine to machine, leaving no damage, and see how far it spreads.
To move between machines it needed a way in, and Morris knew several. The worm used three:
- A debugging feature accidentally left enabled in
sendmail, the program that handled email on most Unix systems, which allowed commands to be executed remotely. - A buffer overflow in
fingerd, the service that let you look up which users were logged in. Sending it more data than it expected let an attacker overwrite memory and run their own code — one of the first widely-known uses of a technique that would dominate security for the next thirty years. - Weak and reused passwords, guessed from a built-in list of a few hundred common ones plus words from the system dictionary. It also exploited the trust relationships between machines that let a user hop between systems without re-authenticating.
None of these were secret. That was rather the point of the era: the network was built by a small research community who mostly knew each other, and security was a matter of etiquette rather than architecture.
The line that changed everything
Morris anticipated one obvious problem. If the worm reinfected machines it had already infected, copies would pile up. So he added a check: ask the machine whether it is already running the worm, and if so, do not install another copy.
Then he anticipated a second problem. If administrators worked out the check, they could inoculate their systems by making them always answer yes — a trivial defence that would end the experiment.
So he added a counter-measure. Even when a machine answered yes, the worm would install itself anyway one time in seven.
That number is the entire disaster. One in seven was far too aggressive. Machines on the early internet were being probed constantly by the spreading worm, and each probe carried a one-in-seven chance of another copy. Copies multiplied, consumed all available processing power, and the machine ground to a halt. Reboot, and within minutes it was reinfected.
A program designed to be invisible became a denial-of-service attack on the entire network, purely through a badly chosen probability.
The aftermath
Morris realised what was happening and asked a friend to post an anonymous apology, with instructions on how to defend against the worm. It went nowhere useful — the network was too congested for the message to circulate.
He became the first person convicted under the United States Computer Fraud and Abuse Act, receiving three years of probation, four hundred hours of community service and a fine. There is a persistent irony in the story: his father was a well-known cryptographer at the National Security Agency.
Morris went on to co-found an early e-commerce company, became a professor at MIT, and later co-founded the startup accelerator Y Combinator. It is one of the few stories in this field where the person responsible for the disaster went on to a distinguished career, largely because everyone accepted that he had not meant it.
The lasting institutional consequence was CERT — the Computer Emergency Response Team, established at Carnegie Mellon within weeks of the incident. Before the worm there was no organisation whose job was to coordinate a response to a network-wide security event. Every incident response team that exists today descends from that decision.
What it established
Three ideas entered common understanding in November 1988 and have not left.
A network is only as trustworthy as its least-maintained machine. The worm did not need to break the strongest system. It needed one unpatched sendmail per site, and then the trust relationships carried it onward.
Automated attacks do not scale like human ones. A person breaking into computers manages a handful a day. A program manages thousands, does not sleep, and does not get bored. Everything since — worms, botnets, mass credential stuffing, internet-wide scanning — is the same principle with better bandwidth.
Convenience features are attack surface. The debug mode was there because it was useful. The trust relationships existed because typing passwords repeatedly is tedious. Neither was a mistake in isolation. Together they were a highway.
That last one is the part worth carrying into your own setup. Every service you leave reachable, every credential reused across sites, every "remember this device" is a small trade of security for convenience. Individually reasonable, and collectively the thing that automated tools count on.
The internet in 1988 was sixty thousand machines run by people who broadly trusted each other, and it took one graduate student and one wrong constant to take down a tenth of it. The network today is billions of devices run by nobody in particular, and the scanners never stopped running.