Morris worm

The Morris Worm was a self-replicating Unix worm released in November 1988 by Robert Tappan Morris and is widely regarded as the first major Internet worm. It propagated automatically across interconnected university, government, military, and research systems on the early Internet, causing widespread disruption by exhausting system resources and rendering many hosts unusable. Estimates commonly place the number of affected systems at roughly 6,000, a significant share of the Internet-connected population at the time.

The worm spread by exploiting multiple weaknesses and trust relationships in networked Unix environments, including a flaw in the finger daemon, weaknesses in SENDMAIL, trusted-host mechanisms, and password guessing. Its design aimed to move broadly while avoiding easy detection, but a flawed reinfection mechanism caused it to replicate far more aggressively than intended, leading to denial of service conditions on infected machines. The malware is historically associated with early exploitation of a stack buffer overflow in the finger service.

The Morris Worm is notable less for data theft than for autonomous propagation and operational disruption. It demonstrated how insecure network services and implicit trust between systems could enable rapid compromise at Internet scale, and it became a foundational case in both incident response history and U.S. cybercrime law. Robert Tappan Morris became the first person convicted under the Computer Fraud and Abuse Act in connection with releasing the worm. The incident helped drive lasting changes in vulnerability management, network defense, and coordinated handling of major cyber incidents.