The-Human-Side-of-Hacking

Unpacking real-world vulnerabilities for everyone.

View on GitHub

The Morris Worm

🐛 What Is a Worm in Cybersecurity?

A worm is a type of malware that can spread itself from one computer to another without needing to be opened or attached to a file.

🧠 Imagine this:

You drop a letter in one mailbox, and that letter magically duplicates itself into every mailbox in the neighborhood without anyone touching it. Now every mailbox starts doing the same. Chaos, right?
That’s what a worm does on a network.

Let’s get the basics straight:

📄 Is a worm actually a file?

Yes, a worm is typically a program file (like .exe, .py, .sh, etc.) containing: scanners, exploits, replication logic, payloads(like backdoors, spyware, etc). The Morris worm was only about 99 lines of C code and 900 lines of shell script
But once it’s running, it often copies itself in memory or across disk locations, without needing help from users.
Floppy Disk

🚨 How is a worm attack started?

To start a worm attack, the attacker typically:

🔥 What Can a Worm Do?

🧬 What Is Inside a Worm?

A worm spreads by exploiting vulnerabilities in systems and networks, allowing it to replicate itself automatically, without any help from users.
A worm is a malicious program that contains:

  1. Code to identify targets (like scanning IP ranges or local networks)
  2. Exploit code to break into vulnerable systems
  3. Replication logic to copy itself onto new machines
  4. (Optional) Payloads – it may carry additional malicious functions (like ransomware or backdoors)

⚙️ How Does It Spread?

1. Scanning for Victims

The worm scans a network (local or global) to find systems that are:

2. Exploiting Vulnerabilities

Once it finds a weak system, it uses:

What Is A Buffer Overflow? Imagine you pour too much water into a glass, it overflows onto the table. In computing, that overflow can overwrite nearby memory, which hackers can use to run their own code or crash the program.

❓ What Does “Exploitation” Actually Mean? Exploitation is the process of taking advantage of a vulnerability in a system, application, or service to gain control, steal data, or execute arbitrary code.

It’s like finding an open window in a house and climbing in, not just knowing it’s open (that’s scanning), but actually going inside (that’s exploiting).

🔍 What Happens During Exploitation?

🔓 Step-by-Step Process:

  1. Reconnaissance: You gather information: IP addresses, open ports, software versions, OS details.
  2. Vulnerability Identification: You identify a weakness, for example, a web server running an outdated version with a known bug.
  3. Choose an Exploit: You choose a piece of code (an exploit) that can take advantage of that weakness.
  4. Deliver the Exploit: You send that code to the target (via a network packet, form submission, file upload)
  5. Payload Execution: The exploit typically delivers a payload, this is the code that does something useful for the attacker:
    • Opens a reverse shell
    • Creates a new user
    • Dumps passwords
    • Downloads malware
  6. Post-Exploitation: Once inside, the attacker may:
    • Escalate privileges (from user to admin)
    • Move laterally (to other machines)
    • Hide traces
    • Exfiltrate data
🔧 What Tools Are Used to Exploit Vulnerabilities?

There are many tools used in cybersecurity to identify and exploit vulnerabilities, some manual, others automated. Here are the most common categories: Metasploit Framework, ExploitDB, MSFvenom(part of Metasploit), SQLmap, etc.

3. Self-Replication

After gaining access, the worm:

4. Optional Payload Activation

Some worms also:

But replication is their core feature!

🧪 Real-World Analogy Imagine a person who walks into a building, clones themselves inside, and each clone walks into another building and does the same thing over and over again.

That’s a worm in action!

🧨 How was the Morris Worm attack started?

In 1988, Robert Tappan Morris uploaded the worm to a server at MIT to disguise its true origin. From there, the worm executed on that machine, scanned the ARPANET for other Unix machines, and started exploiting:

The worm was designed to spread quietly, but a bug made it replicate too aggressively, infecting systems multiple times, causing them to slow down or crash.

🧠 Simple Explanation of ARPANET: Think of ARPANET as the “grandparent” of the Internet. It was a small network that connected a few universities and research centers, allowing them to send messages and share data electronically, long before the World Wide Web(WWW) existed.

📬 What Is Sendmail? Sendmail is a mail transfer agent (MTA), a program used to send, receive, and route email between computers on a network. It was one of the earliest and most widely used email servers, especially on Unix systems.
🧠 Simple Explanation:
Think of Sendmail as the post office of the Internet in its early days. When you sent an email, Sendmail was the one that:a ccepted the message from you, figured out where to deliver it, passed it on to the next server or final destination. It didn’t store emails like Gmail, it just moved them from place to place.

⚠️ Why Was It Vulnerable? In the 1980s, Sendmail had a security flaw in how it handled debug commands. Attackers (like the Morris Worm) could abuse this flaw to trick Sendmail into executing system commands, even without permission.
💡 Imagine a mailman who, instead of just delivering a letter, reads a note inside and starts following its instructions.

☎️ What Is Finger Daemon?
The Finger Daemon (fingerd) is a network service used in early Unix systems to get information about users logged into a computer. It worked alongside the finger command, which allowed someone to remotely ask things like: Who is currently logged in? What time did they log in? What is their username and real name?

⚠️ Why Was It Vulnerable?
The problem was that the Finger Daemon didn’t properly check input. If someone sent malicious input, it could lead to a buffer overflow,allowing the attacker to execute their own code on the target machine.

🔐 What Are rsh(Remote Shell) and rexec(Remote Execution)?
Imagine you’re sitting at your computer, and with one line of text, you can tell another computer: “Hey, run this command for me.” You don’t have to go to it, log in, or type a password, as long as it trusts you. That’s what rsh and rexec do.
Terminal Unix

The Morris Worm took advantage of this by: checking if a machine had rsh or rexec enabled, pretending to be a trusted host, running commands to copy and launch itself on the new machine. They’ve been replaced by SSH (Secure Shell), which encrypts communication and uses stronger authentication.
💡 It’s like a neighbor leaving their door open for you, but someone else sneaks in pretending to be you.

What were the intentions of the Morris attack?

Robert Tappan Morris did not intend to cause damage. According to his own statements and court records, he launched the worm to: “Gauge the size of the Internet.”. He wanted to see how many machines were connected by writing a worm that would self-replicate and report back.

😬 What Went Wrong:

🎓 What Did He Gain?

He was sentenced to:

Ironically, Morris went on to become a respected computer science professor at MIT(Massachusetts Institute of Technology).

🛡️ How Could People Defend Against the Morris Worm?

Back in 1988, cybersecurity was still in its early days. Most systems weren’t built with strong defenses. But even then, there were a few actions that could stop or slow the worm:

🧯 Emergency Response:
Some system administrators, desperate to contain the spread, physically disconnected their machines from the network to stop the worm from reaching them.
💡 In a world with no antivirus, firewalls, or intrusion detection systems, unplugging the machine was the ultimate defense.

🔍 What If It Happened Today?

If a worm like Morris was launched today:

💡 Key Lessons from the Morris Worm

1. Input Validation The finger daemon accepted unfiltered user input and passed it to system functions, a classic case of missing input validation. This allowed the worm to inject malicious data, leading to remote code execution. 💡 Lesson: Always validate and sanitize inputs to prevent unexpected or dangerous behavior.

2. Security by Design Protocols like rsh and rexec were built for convenience, not security, they trusted connections based on hostnames or IPs, without strong authentication. The worm exploited this trust to move freely between systems. 💡 Lesson: Build systems with security in mind from the start, not as an afterthought.

3. Patching Vulnerabilities The worm took advantage of known bugs in sendmail and other Unix tools, vulnerabilities that had been reported but not patched on many systems. 💡 Lesson: Regular patching is critical. Unpatched systems become easy targets, even for simple worms.