2 Nov
2019
2 Nov
'19
8:12 p.m.
Full disclosure: I served as a character witness at Robert Morris's trial.
Before the trial, the judge was quite incredulous that the prosecutor
was pursuing a felony charge and refused to let the trial go forward
without confirmation from the prosecutor's superiors in Washington.
I'm sure that Bob was proud of his son's
accomplishments -- but not
that one.
As Bob ut it, "It {being the father] is not a great career move."
Robert confessed to Bob as soon as he realized the folly of loosing
an exponential, even with a tiny growth rate per generation. I
believe that what brought computers to their knees was the
overwhelming number of attacks, not the cost of cecryption. The
worm did assure that only one copy would be allowed to proceed
at a time.
During high school, Robert worked as a summer employee for Fred
Grampp. He got high marks for finding and correcting an exploit.
making use of known vulnerabilities
Buffer overflows were known to cause misbehavior, but few people
at the time were conscious that the misbehavior could be controlled.
I do not know whether Berkeley agonized before distributing the
"debug" feature that allowed remote super-user access via sendmail.
But they certainly messed up by not documenting it.
Doug
3 Nov
3 Nov
2:12 a.m.
New subject: Happy birthday Morris worm
On Sat, Nov 2, 2019 at 8:13 AM Doug McIlroy <doug(a)cs.dartmouth.edu> wrote:
Full disclosure: I served as a character witness at
Robert Morris's trial.
Before the trial, the judge was quite incredulous that the prosecutor
was pursuing a felony charge and refused to let the trial go forward
without confirmation from the prosecutor's superiors in Washington.
Yes. The reason people freaked out when the worm came out was because it
was the first one to hit the scene. The exploints that allowed it to
propagate were known to a few, but the notion of a self propagating thing
was quite novel (even if it had been theoretically discussed in many places
prior to the worm, and even though others had proven it via slower moving
vectors of BBS). It caught a lot of people off guard with their pants down,
and it took a bunch of time to rectify (because it would reinfect if you
weren't careful). That's why people wanted to prosecute on felony charges.
But there was no intent to cause harm, and there was, at the time, no
applicable law that could be used to charge as a felony anyway (apart from
vague denial of property statues, which were at best a stretch).
In hindsight people like to point at it and what a terrible thing it was,
but Robert just got there first. Any number of people could have written it
given the extremely lax security profiles of the time (things are better
today, but we are not immune to buffer overflows or privilege escalation
attacks).
Warner
I'm sure that Bob was proud of his
son's accomplishments -- but not
that one.
As Bob ut it, "It {being the father] is not a great career move."
Robert confessed to Bob as soon as he realized the folly of loosing
an exponential, even with a tiny growth rate per generation. I
believe that what brought computers to their knees was the
overwhelming number of attacks, not the cost of cecryption. The
worm did assure that only one copy would be allowed to proceed
at a time.
During high school, Robert worked as a summer employee for Fred
Grampp. He got high marks for finding and correcting an exploit.
making use of known vulnerabilities
Buffer overflows were known to cause misbehavior, but few people
at the time were conscious that the misbehavior could be controlled.
I do not know whether Berkeley agonized before distributing the
"debug" feature that allowed remote super-user access via sendmail.
But they certainly messed up by not documenting it.
11:12 p.m.
New subject: Happy birthday Morris worm
On 11/2/19, Warner Losh <imp(a)bsdimp.com> wrote:
the notion of a self propagating thing
was quite novel (even if it had been theoretically discussed in many places
prior to the worm, and even though others had proven it via slower moving
vectors of BBS).
Novel to the Internet community, perhaps, but an idea that dates back
to the 1960s in IBM mainframe circles. Self-submitting OS/360 JCL
jobs, which eventually caused a crash by filling the queue files with
jobs, were well-known in the raised-floor world.
In hindsight people like to point at it and what a
terrible thing it was,
but Robert just got there first.
Again, first on the Internet. Back in 1980 I accidentally took down
DEC's internal engineering network (about 100 nodes, mostly VAX/VMS,
at the time) with a worm. The network used DECnet Phase 2, which
didn't have built-in packet routing. If you wanted to talk to a
machine that wasn't physically connected to yours, you had to
explicitly specify the packet route. Network topology maps were thus
very valuable.
All of the VAXen on the network were configured with an unprivileged
default DECnet account that was used for any connection that didn't
explicitly specify a username/password. One could copy arbitrary DCL
command procedures (VMS's equivalent of shell scripts) to a machine
and execute them there. I wrote a script to collect the raw
information for making a network topology map. The script did this:
[1] Display the local DECnet connections and send this information
back over the network link.
[2] For each adjacent network node:
[2a] Copy the script to that node.
[2b] Execute the remote copy, sending its info back over the network link.
The problem, of course, is I had forgotten that network adjacency is
commutative. I ran the script on node A, which told me that A is
connected to B and C. It then told me that B was connected to A, D,
and E. Then that A is connected to B and C.... I realized what had
happened immediately, but it was already too late. The network had to
be taken down, the nodes cleared of the scripts, and then reconnected.
We learned the hard way that although the non-privileged default
DECnet accounts couldn't damage the system, they could be exploited
for what we now call DDoS attacks.
Robert Morris worked as an intern one summer in DEC's compiler group.
The Fortran project leader told Morris about my 1980 worm incident.
So he certainly had heard of the concept before he fashioned his
UNIX/Internet-based worm a few years later.
-Paul W.
1655
days inactive
1656
days old
2 comments
3 participants
participants (3)
-
Doug McIlroy -
Paul Winalski -
Warner Losh