📸 Photo

at the University of California at Berkeley, at MIT in Massachusetts and at Purdue. Their task was to capture a copy of the program and analyze it. Other groups assembled at other sites to seek methods to eradicate it.

It was first believed that all the 60,000-plus computers on the besieged networks were at risk. But it quickly became apparent that the rogue program was attacking only particular models: Sun Microsystems Sun 3 machines and VAX computers running variants of the UNIX operating system.² On infected machines unusual messages appeared in the files of some utilities, particularly the electronic mail handling agent, called Sendmail. But what was most apparent was that the rogue program was multiplying at devastating speed, spreading from computer to computer, reinfecting machines over and over. As the reinfections multiplied the systems became bogged down; then the machines ran out of space and crashed.

On the morning of Thursday 3 November, Gene Spafford, a computer science professor at Purdue University, messaged his colleagues: ‘All of our Vaxen³ and some of our Suns here were infected with the virus. The virus [makes] repeated copies of itself as it tries to spread itself, and the load averages on the infected machines skyrocketed. In fact, it got to the point that some of the machines ran out of . . . space . . . , preventing log-in to even see what was going on!’ Spafford did manage to capture part of the rogue program, but only the half that controlled its spread. The other half, the main operating system within the program, erased itself as it moved from computer to computer, so as not to leave any evidence. This information heightened a common fear: that the rogue program may somehow have been tampering with systems, altering files or destroying information as the various teams were looking for a cure.

The rogue program, it was subsequently discovered, moved from computer to computer by exploiting flaws in the Berkeley version of UNIX. The principal flaw was in Sendmail, the program designed to send electronic mail between computers in the interlinked networks. A trap-door on Sendmail would allow commands (as opposed to electronic mail) to be sent from computer to computer. Those commands were the rogue program. Once into one computer through Sendmail, it would collect information on other machines in the