Crisis and Aftermath

On the evening of November 2, 1988 the Internet came under attack from within. Sometime after 5 p.m.,’ a program was execuied on one or more hosts connected to the Internet. Tha,. program collected host, network, and user information, then used that information to break into other machines using flaws present in those systems’ software. After breaking in, the program would replicate itse1.f and the replica would attempt to infect other systems in the same manner. Although the program would only infect Sun Microsystems’ Sun 3 systems and VAX@ computers running variants of 4 BSD UNIX,@ the program spread quickly, as did i.he confusion an.d consternation of system administrators and uszmrs as they discovered the invasion of their systems. Tht? scope of the break-ins came as a great surprise to aln.ost everyone, despite the fact that UNIX has long been kn.own to have some security weaknesses (cf. [4, 12, ,131). The program was mysterious to users at sites where it appeared. Unusual files were left in the /usr/tmp directories of some machines, and strange messages appeared in the log :‘iles of some of the utilities, such as the sendmail mail handling agent. The most noticeable effect, however, was that systems became more and more loaded wih running processes as they became repeatedly infected. As time went on, some of these machines bec:.me so loaded that they were unable to continue any processing; some machines failed completely when th ?ir swap space or process tables were exhausted. By early Thursday. morning, November 3, personnel at the IJniversity of California at Berkeley and Massachusetts Institute of Technology (MIT) had “captured” copies of the program and began to analyze it. People at other sites also bega:r to study the program and were developing methods of eradicating it. A common fear