28 ms·

Morris Worm Decompiled (1988)

63 points by paran 16y ago

RodgerTheGreat 16y ago
If anybody's curious: http://en.wikipedia.org/wiki/Morris_Worm http://en.wikipedia.org/wiki/Morris_Worm
- wdaher 16y ago
  More hilarious, though, is the local news coverage of the event: http://www.youtube.com/watch?v=G2i_6j55bS0 http://www.youtube.com/watch?v=G2i_6j55bS0
  - RodgerTheGreat 16y ago
    The footage of E.T. for the Atari 2600 was a nice, if utterly nonsensical, touch.
  - percept 16y ago
    I love the taglines (somebody make this movie!): "The students were safe. Their computers weren't." "The suspect, somewhere, a dark genius." "I suspect it's an 'A' student. A good 'A' student."
jey 16y ago
This looks like it's not the original source code and was just reconstructed by hand from a disassembly/"decompile" of the worm.
- gnosis 16y ago
  Just out of curiosity, what makes you think that?
  - sparky 16y ago
    The comments, mostly. For example: object objects[69]; /* Don't know how many... */ /* This report a sucessful breakin by sending a single byte to "128.32.137.13" * (whoever that is). */ /* This appears to be a structure unique to this program. It doesn't seem that * the blank slots are really an array of characters for the hostname, but * maybe they are. */ /* There are pieces of "stub" code, presumably from something like this to get rid of error messages */
    - percept 16y ago
      >>(whoever that is) Berkeley, apparently.
  - bl4k 16y ago
    the offset is there as a comment next to each declaration.
- wdaher 16y ago
  Yep, that's correct--as far as I know, the original source code isn't actually available anywhere. Three independent groups, at Berkeley, MIT, and Purdue disassembled the .o and poked at its contents, slowly figuring it out. Mark Eichin's timeline (http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html) is a fun read, written from the MIT viewpoint, that chronicles how the Unix nerd community basically sprung up to dissect and deal with the worm, and contains a section on their attempts to disassemble the worm.
- tzury 16y ago
  here is the original source code: http://en.wikipedia.org/wiki/File:Morris_Worm.jpg http://en.wikipedia.org/wiki/File:Morris_Worm.jpg
  - wdaher 16y ago
    That's a picture of a floppy disk in a museum, though -- and it too probably contains the disassembled source code :) If I had to guess, the only people who had access to the original source are rtm, whoever he gave it to, and whoever accessed his account at Cornell when they looked through his homedir. And it's unlikely that any of them would have distributed it. Remember, at the time this code was potentially really dangerous; this was essentially a new type of attack that folks weren't really ready or prepared to defend against.
jluxenberg 16y ago
Excerpt from the Wikipeida article about the worm's author: Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham. http://en.wikipedia.org/wiki/Robert_Tappan_Morris http://en.wikipedia.org/wiki/Robert_Tappan_Morris
- pg 16y ago
  He also wrote a good chunk of the code you used to post this comment.
  - deleted 16y ago
    [deleted]
  - brfox 16y ago
    http://news.ycombinator.com/user?id=rtm http://news.ycombinator.com/user?id=rtm
- djcapelis 16y ago
  He also worked on Chord, which became a basis for distributed hash tables and a few other things. He is as successful as a researcher as he has been with the whole gaining tenure and doing viaweb/ycombinator with pg thing. Frankly he's up there with Steve Jobs and maybe Fabrice Bellard in terms of "people who I'd like to know what it is they're doing so right so consistently." It's the consistency that tends to surprise me.
- dustingetz 16y ago
  "Robert Morris was tried and convicted of violating the 1986 Computer Fraud and Abuse Act. After appeals he was sentenced to three years probation, 400 hours of community service, and a fine of $10,000.[6]"
  - deleted 16y ago
    [deleted]
tylernol 16y ago
@gnosis and sparky, text offsets are also put in comments next to the function declarations. For example: "h_clean() /* 0x31f0 */"
- generalk 16y ago
  @tylernol: you know this is a threaded conversation forum, right? Click "reply" (right under the comment you want to discuss) next time, and your comment will be nested properly.
- sparky 16y ago
  Indeed. Those I figured were from a tool, but the ones with confused-sounding prose were dead giveaways.
cloudwalking 16y ago
I wonder how he devised (or found) the list of potential passwords (cracksome.c.txt)
siegler 16y ago
tar ball http://www.foo.be/docs-free/morris-worm/worm-src.tar.gz http://www.foo.be/docs-free/morris-worm/worm-src.tar.gz
allenbrunson 16y ago
according to legend, this was supposed to be merely a proof of concept, but a bug in the code caused it to replicate uncontrollably. does anybody know what that bug was?
- jackowayed 16y ago
  > The worm could have determined whether to invade a new computer by asking if there was already a copy running. But just doing this would have made it trivially easy to kill; everyone could just run a process that would answer "yes" when asked if there was already a copy, and the worm would stay away. The defense against this was inspired by Michael Rabin's mantra, "Randomization." To compensate for this possibility, Morris directed the worm to copy itself even if the response is "yes", 1 out of 7 times.[2] This level of replication proved excessive and the worm spread rapidly, infecting some computers multiple times. Morris remarked, when he heard of the mistake, that he "should have tried it on a simulator first." -http://en.wikipedia.org/wiki/Morris_worm http://en.wikipedia.org/wiki/Morris_worm
  - m-photonic 16y ago
    "One in seven?! rtm, you jerk! Why seven?" Excerpted from the book Cyberpunk: Outlaws and Hackers on the Computer Frontier (published 1991). The quoted speaker is Paul Graham.
bluesmoon 16y ago
Don't forget his father Robert T. Morris Sr., who wrote the passwd program for Unix and worked at the NSA when the worm got loose.
bediger 16y ago
This isn't the actual source code. As far as I know, only a small piece of the real worm's code ever got published, and that was in the Cornell Report, Cornell University's post mortem. This isn't the code in the Cornell Report. Someone in 1989 or 1990 ran an ad in the back of "2600" magazine, selling the source code on paper. I bought a copy back then, I can remember the date because of the apartment I was in when I read the code. I think the "2600" version is the same as this one, but with someone different header comments. I have a copy of this code from a tar archive with date of 1991-06-05 on it, so it's been floating around the Internet for almost 20 years at this point.

63 points by paran 16y ago

RodgerTheGreat 16y ago

If anybody's curious: http://en.wikipedia.org/wiki/Morris_Worm http://en.wikipedia.org/wiki/Morris_Worm

wdaher 16y ago
More hilarious, though, is the local news coverage of the event: http://www.youtube.com/watch?v=G2i_6j55bS0 http://www.youtube.com/watch?v=G2i_6j55bS0
- RodgerTheGreat 16y ago
  The footage of E.T. for the Atari 2600 was a nice, if utterly nonsensical, touch.
- percept 16y ago
  I love the taglines (somebody make this movie!): "The students were safe. Their computers weren't." "The suspect, somewhere, a dark genius." "I suspect it's an 'A' student. A good 'A' student."

jey 16y ago

This looks like it's not the original source code and was just reconstructed by hand from a disassembly/"decompile" of the worm.

gnosis 16y ago
Just out of curiosity, what makes you think that?
- sparky 16y ago
  The comments, mostly. For example: object objects[69]; /* Don't know how many... */ /* This report a sucessful breakin by sending a single byte to "128.32.137.13" * (whoever that is). */ /* This appears to be a structure unique to this program. It doesn't seem that * the blank slots are really an array of characters for the hostname, but * maybe they are. */ /* There are pieces of "stub" code, presumably from something like this to get rid of error messages */
  - percept 16y ago
    >>(whoever that is) Berkeley, apparently.
- bl4k 16y ago
  the offset is there as a comment next to each declaration.
wdaher 16y ago
Yep, that's correct--as far as I know, the original source code isn't actually available anywhere. Three independent groups, at Berkeley, MIT, and Purdue disassembled the .o and poked at its contents, slowly figuring it out. Mark Eichin's timeline (http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html) is a fun read, written from the MIT viewpoint, that chronicles how the Unix nerd community basically sprung up to dissect and deal with the worm, and contains a section on their attempts to disassemble the worm.
tzury 16y ago
here is the original source code: http://en.wikipedia.org/wiki/File:Morris_Worm.jpg http://en.wikipedia.org/wiki/File:Morris_Worm.jpg
- wdaher 16y ago
  That's a picture of a floppy disk in a museum, though -- and it too probably contains the disassembled source code :) If I had to guess, the only people who had access to the original source are rtm, whoever he gave it to, and whoever accessed his account at Cornell when they looked through his homedir. And it's unlikely that any of them would have distributed it. Remember, at the time this code was potentially really dangerous; this was essentially a new type of attack that folks weren't really ready or prepared to defend against.

jluxenberg 16y ago

Excerpt from the Wikipeida article about the worm's author: Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham. http://en.wikipedia.org/wiki/Robert_Tappan_Morris http://en.wikipedia.org/wiki/Robert_Tappan_Morris

pg 16y ago
He also wrote a good chunk of the code you used to post this comment.
- deleted 16y ago
  [deleted]
- brfox 16y ago
  http://news.ycombinator.com/user?id=rtm http://news.ycombinator.com/user?id=rtm
djcapelis 16y ago
He also worked on Chord, which became a basis for distributed hash tables and a few other things. He is as successful as a researcher as he has been with the whole gaining tenure and doing viaweb/ycombinator with pg thing. Frankly he's up there with Steve Jobs and maybe Fabrice Bellard in terms of "people who I'd like to know what it is they're doing so right so consistently." It's the consistency that tends to surprise me.
dustingetz 16y ago
"Robert Morris was tried and convicted of violating the 1986 Computer Fraud and Abuse Act. After appeals he was sentenced to three years probation, 400 hours of community service, and a fine of $10,000.[6]"
- deleted 16y ago
  [deleted]

tylernol 16y ago

@gnosis and sparky, text offsets are also put in comments next to the function declarations. For example: "h_clean() /* 0x31f0 */"

generalk 16y ago
@tylernol: you know this is a threaded conversation forum, right? Click "reply" (right under the comment you want to discuss) next time, and your comment will be nested properly.
sparky 16y ago
Indeed. Those I figured were from a tool, but the ones with confused-sounding prose were dead giveaways.

cloudwalking 16y ago

I wonder how he devised (or found) the list of potential passwords (cracksome.c.txt)

siegler 16y ago

tar ball http://www.foo.be/docs-free/morris-worm/worm-src.tar.gz http://www.foo.be/docs-free/morris-worm/worm-src.tar.gz

allenbrunson 16y ago

according to legend, this was supposed to be merely a proof of concept, but a bug in the code caused it to replicate uncontrollably. does anybody know what that bug was?

jackowayed 16y ago
> The worm could have determined whether to invade a new computer by asking if there was already a copy running. But just doing this would have made it trivially easy to kill; everyone could just run a process that would answer "yes" when asked if there was already a copy, and the worm would stay away. The defense against this was inspired by Michael Rabin's mantra, "Randomization." To compensate for this possibility, Morris directed the worm to copy itself even if the response is "yes", 1 out of 7 times.[2] This level of replication proved excessive and the worm spread rapidly, infecting some computers multiple times. Morris remarked, when he heard of the mistake, that he "should have tried it on a simulator first." -http://en.wikipedia.org/wiki/Morris_worm http://en.wikipedia.org/wiki/Morris_worm
- m-photonic 16y ago
  "One in seven?! rtm, you jerk! Why seven?" Excerpted from the book Cyberpunk: Outlaws and Hackers on the Computer Frontier (published 1991). The quoted speaker is Paul Graham.

bluesmoon 16y ago

Don't forget his father Robert T. Morris Sr., who wrote the passwd program for Unix and worked at the NSA when the worm got loose.

bediger 16y ago

This isn't the actual source code. As far as I know, only a small piece of the real worm's code ever got published, and that was in the Cornell Report, Cornell University's post mortem. This isn't the code in the Cornell Report. Someone in 1989 or 1990 ran an ad in the back of "2600" magazine, selling the source code on paper. I bought a copy back then, I can remember the date because of the apartment I was in when I read the code. I think the "2600" version is the same as this one, but with someone different header comments. I have a copy of this code from a tar archive with date of 1991-06-05 on it, so it's been floating around the Internet for almost 20 years at this point.