📸 Photo

system to which it could jump, and then infect those machines in turn.

In addition to the Sendmail flaw, the rogue program tried to guess the passwords to jump to target computers. Its password routine used three methods: it tried simple permutations of known users’ names, it tried a list of 432 frequently used passwords and it also tried names from the host computer’s own dictionary.⁴ If one method didn’t work, it would try another and then another until it managed to prise open the door of the target computer. An early analysis of the program – made at 4 a.m. on the Thursday morning after the initial attack – described it as ‘high quality’. Some twelve hours after its release, it was estimated that some 6,200 computers on Internet had been infected. The costs, in downtime and personnel, were mounting.

It was at 5 a.m. that the Berkeley team sent out the first, interim set of instructions designed to halt the spread. By that time the initial fears that the rogue program might destroy information or systems had proved unfounded. The program, it was discovered, was designed to do nothing more than propagate. It contained no destructive elements apart from its ability to multiply and reinfect to such an extent that it would take over all space on a target computer.

Later on Thursday the team at Purdue sent out another electronic bulletin that catalogued methods to eradicate the program. And at Berkeley they isolated the trap-doors it had used and published procedures for closing them.

Once the commotion had died down and computer managers had cleared out the memories on their machines and checked all the software, their thoughts turned to the reasons for the attack. That it was deliberate was certain: the rogue program had been a cleverly engineered code that had exploited little-known flaws in UNIX; it had erased evidence of its intrusions on computers it had infected; it was also encrypted (written in code) to make it more difficult to tear apart. And there was little doubt in anyone’s mind that the program was the work of a virus writer, probably a very clever one, perhaps a young man who had some grudge against the system, or ARPANET, or the universities. He could be a computer freak outside the mainstream, an outsider attempting to get back on the establishment. He was certainly not an insider.