The Morris Worm Was Built to Go Unnoticed. A One-in-Seven Rule Crashed Computers Across the Internet.

On 2 November 1988, Robert Tappan Morris released the program now known as the Morris worm. He wanted it, a federal appeals court later wrote, “to spread widely without drawing attention to itself,” and it “was supposed to occupy little computer operation time.” Instead, many machines around the country “either crashed or became ‘catatonic.’” By the court’s account, what brought them down was a rule Morris had written to keep the worm alive.

Morris was then a first-year Ph.D. student in computer science at Cornell University. He launched the worm from a computer at the Massachusetts Institute of Technology (MIT), chosen, the court said, “to disguise the fact that the worm came from Morris at Cornell.” Within hours, according to a chronology compiled by MIT researchers, it had reached Stanford, the University of Maryland and the University of California, Berkeley.

For all the disruption, the worm did not destroy or alter files, intercept private mail or reveal passwords, according to a 1989 report by the U.S. General Accounting Office (GAO), the investigative arm of Congress.

One time in seven

Morris had planned for crowding. “Multiple copies of the worm on a computer would make the worm easier to detect,” the court wrote, and enough of them could bog a system down until it crashed. So he designed the worm to “ask” each computer whether it already had a copy.

Then he planned for defenders. Morris “was concerned that other programmers could kill the worm by programming their own computers to falsely respond ‘yes,’” so he made the worm copy itself anyway “every seventh time it received a ‘yes’ response.” As it turned out, the court wrote, Morris “underestimated the number of times a computer would be asked the question,” and “his one-out-of-seven ratio resulted in far more copying than he had anticipated.”

In the code, the “question” was a check between copies on the same machine: a new copy tried to reach an existing one through port 23357 on the local computer. MIT’s analysis, which calls the program a virus, describes the escape hatch in one line: “On a one-in-seven chance, it won’t even try to test for another virus.”

Infected computers kept attacking their neighbors, so the same machine was hit again and again, and roughly one new copy in seven stayed no matter how many were already running. Each one took a share of the processor. Morris had also designed the worm to be killed whenever a computer was shut down, which the court says typically happened “once every week or two.” That design would have kept copies from piling up on one computer, the court wrote, had Morris correctly estimated the likely rate of reinfection.

A warning stuck in the jam

Morris soon found that the worm “was replicating and reinfecting machines at a much faster rate than he had anticipated,” according to the court. He and a friend at Harvard sent an anonymous message explaining how to kill the worm and prevent reinfection. It “did not get through until it was too late,” the court wrote, because “the network route was clogged.”

MIT’s chronology identifies the sender as Andy Sudduth of Harvard, who posted the message at 3:34 a.m. on 3 November. The message took more than two days to reach MIT, where its copy is stamped 5:59 a.m. on Saturday, 5 November. By then Keith Bostic of Berkeley had long since posted the first fix, and many sites had simply disconnected from the network. The GAO found that the worm was gone from most computers within 48 hours of its appearance.

The famous numbers were guesses

Retellings still say the worm infected about 6,000 machines, a tenth of the Internet. Cornell’s alumni magazine wrote in 2023 that “about 6,000 of those Internet-connected machines screeched to a dramatic halt.” The GAO’s report gave the same figure, saying the worm “reportedly infected up to 6,000 computers” out of more than 60,000. The report also explained that the number was “reportedly based on an MIT estimate that 10 percent of its machines had been infected,” scaled up from MIT to the whole network. A Harvard researcher cited by the GAO put the count at 1,000 to 3,000.

Paul Graham, a friend of Morris’s, has written that he “was there when it was cooked up”: someone guessed that about 60,000 computers were on the Internet and that the worm might have infected ten percent of them. “Actually no one knows how many computers the worm infected,” he added, because rebooting erased the traces.

The cost estimates are just as soft. The same Harvard researcher “estimated dollar losses to be between $100,000 and $10 million,” the GAO reported, so $10 million is the top of one person’s range. The court put the cost of dealing with the worm at each installation at “$200 to more than $53,000.”

Even the word “virus” is a compromise; the GAO used it “in deference to popular use.” Morris’s program was a worm, which runs on its own and copies itself across a network instead of hiding inside other programs. It was not the first worm either: John Shoch and Jon Hupp of Xerox’s Palo Alto Research Center (PARC) described experimental worm programs in 1982. The Computer History Museum calls Morris’s creation “the first worm to have a major effect on real-world computer systems.”

The motive is the least settled part. The court described the goal as “to demonstrate the inadequacies of current security measures on computer networks.” The Computer History Museum says that when Morris apologized in 2008, he said he had sought to estimate the Internet’s size, not to cause harm.

A conviction and a new kind of team

A jury found Morris guilty under the Computer Fraud and Abuse Act of 1986, a U.S. federal computer-crime law. He was sentenced to three years of probation, 400 hours of community service, a $10,050 fine and the costs of his supervision, and the same federal appeals court upheld the conviction in March 1991.

The government moved within weeks. In mid-November 1988, the GAO reported, the Defense Advanced Research Projects Agency (DARPA) established the Computer Emergency Response Team, or CERT, at Carnegie Mellon University’s Software Engineering Institute, built around a five-person coordination center. DARPA, the report added, viewed CERT as “a prototype effort for similar organizations in other computer communities.”

What actually went wrong

Morris did plan for failure. He knew too many copies would expose the worm and could crash machines, so he wrote a check. Then he wrote an exception to protect the worm from defenders who might lie, and the exception applied on every reinfection attempt, however many there were.

A rule that fires one time in seven sounds cautious. Its real cost is the odds multiplied by how often the question is asked and by how many machines ask it, set against how fast anything removes the extra copies. The same arithmetic sits inside retries, reconnect loops and health checks today. Which rule in your system sounds rare but runs on every request?

Explore

Stay connected