Robert Tappan Morris, born on November 8, 1965, is an American computer scientist and entrepreneur best known for creating the Morris worm in 1988. This self-replicating computer program is widely considered the first computer worm to spread across the internet, marking a significant, albeit controversial, milestone in digital history. Morris's actions led to the first felony conviction under the 1986 Computer Fraud and Abuse Act in the U.S., underscoring
the legal ramifications of unauthorized computer access and disruption. His story is a complex blend of academic curiosity, unintended consequences, and pioneering legal precedent.
Academic Background and the Worm's Conception
Robert Tappan Morris was a graduate student at Cornell University when he developed the Morris worm in 1988. His father, Robert Morris, was a cryptographer who worked at the NSA, suggesting a background steeped in computer science and security. According to a friend, Morris's primary motivation for creating the worm was to explore the feasibility of such a program, driven by a desire to understand and test the boundaries of network security. To avoid the worm being directly traced back to Cornell, where he was a Ph.D. student, he launched it from the Massachusetts Institute of Technology (MIT) network.
The worm was meticulously designed to exploit several known vulnerabilities in Unix systems. These included a flaw in the debug mode of the Unix sendmail program, a buffer overflow in the finger network service, and the reliance on transitive trust through remote execution (rexec) with Remote Shell (rsh), which allowed network logins without password requirements. The worm also targeted weak passwords, such as common dictionary words or simple patterns like a username, its reverse, or a repeated username, demonstrating an understanding of common security oversights.
The Unforeseen Spread and Its Impact
Despite Morris's stated intention that the worm not be actively destructive, a critical design choice led to its widespread and damaging effects. The worm was initially programmed to check if a computer was already infected. However, Morris anticipated that system administrators might try to trick the worm by making their systems report a false positive. To counter this, he programmed the worm to copy itself 14% of the time, regardless of the infection status. This decision proved to be a significant flaw.
This aggressive replication strategy caused many computers to become infected multiple times. Each additional infection consumed system resources, progressively slowing machines down to the point of unusability and often causing them to crash. This behavior was akin to a fork bomb, overwhelming the targeted systems. The worm primarily affected DEC VAX machines running 4BSD and Sun-3 systems, though a portable C "grappling hook" component could run on other systems, burdening them as peripheral victims. The incident highlighted the fragility of early internet infrastructure and the potential for even experimental programs to cause widespread disruption.
