This week in 1988, Robert Morris unleashed his eponymous worm

Post by tptacek » Wed, Nov 05, 2025, 1:20 AM UTC

aleks224 wrote: post #131

tptacek wrote: post #58

Earlier quoted context omitted.

Interestingly, it took another 7 years for stack overflows to be taken seriously, despite a fairly complete proof of concept widely written about. For years, pretty much everybody slept on buffer overflows of all sorts; if you found an IFS expansion bug in an SUID, you'd only talk about it on hushed private mailing lists with vendor security contacts, but nobody gave a shit about overflows. It was Thomas Lopatic and…

This was great to read. Related: Morris also discovered the predictable TCP sequence number bug and described it in his paper in 1985 http://nil.lcs.mit.edu/rtm/papers/117.pdf . Kevin Mitnick describes how he met some Israeli hackers with a working exploit only in only in 1994 (9 years later) in his book "Ghost in the Wires" (chapter 33). I tried to chronicle the events here (including the Jon Postel's RFC that did n…

Post by angled » Wed, Nov 05, 2025, 1:23 AM UTC

rootusrootus wrote: post #150

wkat4242 wrote: post #146

Earlier quoted context omitted.

Yeah and a 'host' back then wasn't a cheap PC or something, they tended to be $30000 workstations or $300000 servers. At tech companies and Universities only, and mostly in the US. 60k sounds like a lot for those days. It grew massively from the early 90s. Even UUCP was still really fringe and those weren't actually connected hosts on tcp/ip. They had their own dialup mail exchange protocol similar to fidonet.

Those were the days. I still remember my fido number. And I still remember just how painful it was to get uucp working properly. Ugh. But my mother had an email address years before any of her contemporaries. Being a geek was fun then.

Post by typs » Wed, Nov 05, 2025, 1:34 AM UTC

georgemcbay wrote: post #141

iwontberude wrote: post #138

Earlier quoted context omitted.

I suppose the notion that you could just distribute untested software onto an unlimited amount of other peoples computers without consent wasn't yet considered unethical so therefore the worm was perceived to be absolutely harmless by rtm and pg. Just some minor details they couldn't possibly have seen back then.

> I suppose the notion that you could just distribute untested software onto an unlimited amount of other peoples computers without consent wasn't yet considered unethical As someone who is old enough to have been a teenage hacker back in this timeframe and who spent his time on old Diversi Dial dialup systems which lead to early internet systems via gnu/fsf's open access policy, which lead to bitnet relay, and who w…

Post by tptacek » Wed, Nov 05, 2025, 2:10 AM UTC

mindcrime wrote: post #156

tptacek wrote: post #151

Earlier quoted context omitted.

Mitnick's use of the sequence number spoofing exploit was a super big deal at the time; it's half of the centerpiece of his weird dramatic struggle with Tsutomu Shimomura, whose server he broke into with that exploit (the other half was Shimomura helping use radio triangulation to find him). Mitnick didn't write any of this tooling --- presumably someone in jsz's circle did --- but it also wasn't super easy to use; s…

"Your security technique will be defeated. Your technique is no good"

Post by euroderf » Wed, Nov 05, 2025, 3:17 AM UTC

angled wrote: post #153

rootusrootus wrote: post #150

Earlier quoted context omitted.

Those were the days. I still remember my fido number. And I still remember just how painful it was to get uucp working properly. Ugh. But my mother had an email address years before any of her contemporaries. Being a geek was fun then.

foo@baz!quux, those were the days.