Live data from Hacker News

Morris Worm Decompiled (1988)

foo.be

11–20 of 30 posts

Re: Morris Worm Decompiled (1988)

#11

Excerpt from the Wikipeida article about the worm's author: Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham. http://en.wikipedia.org/wiki/Robert_Tappan_Morris

"Robert Morris was tried and convicted of violating the 1986 Computer Fraud and Abuse Act. After appeals he was sentenced to three years probation, 400 hours of community service, and a fine of $10,000.[6]"

[deleted]

Re: Morris Worm Decompiled (1988)

#13

Excerpt from the Wikipeida article about the worm's author: Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham. http://en.wikipedia.org/wiki/Robert_Tappan_Morris

He also wrote a good chunk of the code you used to post this comment.

Re: Morris Worm Decompiled (1988)

#14
post #13

Excerpt from the Wikipeida article about the worm's author: Morris is an American professor at Massachusetts Institute of Technology. He co-founded the online store Viaweb, one of the first web-based applications, with Paul Graham. http://en.wikipedia.org/wiki/Robert_Tappan_Morris

He also wrote a good chunk of the code you used to post this comment.

[deleted]

Re: Morris Worm Decompiled (1988)

#15
post #3

This looks like it's not the original source code and was just reconstructed by hand from a disassembly/"decompile" of the worm.

Yep, that's correct--as far as I know, the original source code isn't actually available anywhere.

Three independent groups, at Berkeley, MIT, and Purdue disassembled the .o and poked at its contents, slowly figuring it out.

Mark Eichin's timeline (http://web.mit.edu/user/e/i/eichin/www/virus/chronology.html) is a fun read, written from the MIT viewpoint, that chronicles how the Unix nerd community basically sprung up to dissect and deal with the worm, and contains a section on their attempts to disassemble the worm.

Re: Morris Worm Decompiled (1988)

#18
post #17
post #3

This looks like it's not the original source code and was just reconstructed by hand from a disassembly/"decompile" of the worm.

here is the original source code: http://en.wikipedia.org/wiki/File:Morris_Worm.jpg

That's a picture of a floppy disk in a museum, though -- and it too probably contains the disassembled source code :)

If I had to guess, the only people who had access to the original source are rtm, whoever he gave it to, and whoever accessed his account at Cornell when they looked through his homedir.

And it's unlikely that any of them would have distributed it. Remember, at the time this code was potentially really dangerous; this was essentially a new type of attack that folks weren't really ready or prepared to defend against.

Re: Morris Worm Decompiled (1988)

#19
post #16

If anybody's curious: http://en.wikipedia.org/wiki/Morris_Worm

More hilarious, though, is the local news coverage of the event: http://www.youtube.com/watch?v=G2i_6j55bS0

The footage of E.T. for the Atari 2600 was a nice, if utterly nonsensical, touch.

Re: Morris Worm Decompiled (1988)

#20
post #7

@gnosis and sparky, text offsets are also put in comments next to the function declarations. For example: "h_clean() /* 0x31f0 */"

@tylernol: you know this is a threaded conversation forum, right? Click "reply" (right under the comment you want to discuss) next time, and your comment will be nested properly.
Post reply on HN