November 2nd, around 6:00 p.m. Pacific

Standard Time, the worm is unleashed on

an MIT computer. Within the hour, the

University of Pittsburgh receives the

worm. Within 3 hours, Stanford and the

University of Minnesota has the worm.

Within 4 hours, Berkeley, Princeton,

University of North Carolina, and the

University of Maryland has the worm.

Within 5 hours, MIT, University of

Maryland, Dartmouth, and the University

of Utah are infected. By midnight,

University of Arizona, Princeton main

computer, and the University of

Delaware, UCLA at 1:00 a.m., Harvard at

2:00 a.m., University of Chicago by 3:00

a.m. it got fingered. Colorado State and

Purdue were next to fall, then finally

Georgia Tech. All of this within 13

hours. That represents about 10% of all

connected computers. To put this into

perspective, if that happened today,

that'd be about 1 billion computers and

smartphones infected within 13 hours.

This was a massive event in 1988. The

world's smartest people from Harvard,

Stanford, MIT, and NASA got together,

decompiled the worm, and understood how

it worked, which led to the arrest of

Robert Tappan Morris 6 months later. And

6 months after that led to the very

first arrest of the Computer Fraud and

Abuse Act. Now, you're probably

thinking, "Okay, Morris, he must have

been like tossed in Arkham Asylum at

this point." Infecting 10% of the

world's computers? No, actually, he just

got a little bit of probation, started

doing startups with Paul Graham, and

co-founded one of the biggest worms of

all time, Y Combinator, spreading

through the minds of young,

impressionable founders. At the time of

the worm, not everybody was impressed by

what actually happened. In fact, some

people said that Morris, kind of a

rookie. Many people have stated that the

author of this code must have been a

computer geniuses of some sort. I have

been bothered by that supposition since

first hearing it. And after having

examined the code in some depth, I am

convinced that the program is not

evidence to support any such claims. The

code was apparently unfinished and done

by someone clever, but not particularly

gifted, at least in the way we usually

associated with talented programmers and

designers. Bro, this guy is legitimately

this meme right here, okay? Man infects

10% of all connected computers, and the

guy's like, "Yo, that [ __ ] guy sucks.

He doesn't even know what he's doing."

Incredible. So, we're going to break

down the worm actually going to go over

all the code because it is spectacular.

I cannot believe how amazing the code

actually is and what it does. It's so

incredibly simple and so easy to

understand, yet at the same time just

blows my rookie mind. And yes, I am

technically impressed. There's

deception. There's some of the funniest

things ever. There are bugs that make

the worm worse for the people that get

infected. It's hilarious.

But before we break down this worm, we

got to break down the sponsor. Thank

you, sponsor. Did you know that I've

done a lot of weird stuff that's

difficult to explain to my

father-in-law, such as building a tower

defense game in a water tower,

pretending to be Mark Zuckerberg in a

social network parody in SF, by the way,

stands for San Francisco, or even did a

live Super Smash Brothers event at

OpenSauce?

>> [cheering]

>> Well, if you didn't know those things,

you should just go check out the

Terminal channel. That's where I do all

the fun group videos. Check it out.

Links in the description. All right, so

to begin, I think it's best to say, why

is it called a worm, right? Because we

hear this term worm, but have you ever

thought about why is it called a worm?

Well, it actually comes from a novel

called Shockwave Riders in 1975.

In the novel, it had this idea of

tapeworms that would go through the net.

Effectively, if you killed part of the

program on one computer, the worm, the

tapeworm, could survive because it would

replicate itself across of other

computers. And so, you couldn't just

kill one of them. You had to kill all of

them to kill it. And that's exactly what

this famous Morris worm is. To put it in

a nutshell, there is a small program

that runs and all it really does is

first decides, do I need population

control? It figures out if it needs to

kill itself or not. Next, it's simply

going to go and try to find all the

things that are connected to it so it

can go and spread itself. Then it's also

going to do some local password cracking

of accounts that exist on the system and

see if it can kind of just guess some

passwords. And it just sits there and

does these two in a loop over and over

again if it wasn't killed by the

population control. But who cares about

the diagrams, okay? We want to look at

some C. That's what everybody has always

said to me. It's the famous phrase,

"Just show me the C already." All right,

so the worm effectively has a main loop.

The main loop you can think of like a

game loop. It just goes and it does a

series of actions, restarts and does a

series of actions. The first thing the

worm does is attempts to spread itself.

This makes sense because if it gets

caught pretty quickly, it wants to have

a chance to jump to another machine. So

whenever you see HG or HL or HA, any of

those weird H functions, just know

that's it going and attempting to spread

itself. The second thing it does is it

goes and sees, "Do I need to do

population control?" Now, population

control is extremely clever. So the

first thing it checks is, "Hey, random

one out of seven chance, you're an

immortal worm. You don't get killed

unless if somebody kills the program.

You just exist." Now, if it's not one of

the lucky one out of seven, the chosen

worms, instead it attempts to connect to

a local server on port 23357.

Obviously, you should be able to clearly

see that. I mean, if you're not doing

hexadecimal conversions in your head

instantaneously, you're not going to

make it. For whatever reason, if it

can't connect, it just simply closes

down and it continues on. But if it does

connect, it then does a little battle

royale with the worm that it connect to.

Now, this local server is just another

worm. There's a server worm and then

there's client worm. To make the battle

royale easy, I made this quick little

animation. Effectively, they exchange

keys to prove who they are. Client sends

a random number, server sends a random

number. Both the client and the server

add the two numbers together, and if the

number is odd, the server goes, "Oh, I'm

the one that needs to die." If the

number is even, the client goes, "Oh,

I'm the one that needs to die." And

that's what all this code is right here,

the exchange of the two keys and the two

random numbers, the two comparisons in

determining, "Do I or do I not quit?"

Funny little bug number one, if any of

these operations fail, the worm becomes

immortal. It just simply returns, never

checks to see should it kill itself ever

again, and the worm becomes immortal.

This is one of the reasons why the worm

infected faster than Morris intended.

The surviving client worm will then go

and attempt to become the server itself.

If becoming the server fails, which by

the way, reconnecting and recreating a

server within 5 seconds, that can often

fail cuz the port could be busy.

Therefore, accidental immortal worms

again. And this is effectively just how

population control works. Either one out

of seven worms makes it, or a client and

server battle royale and just one of

them lives. That way, it doesn't go too

fast. It doesn't spread super, super

fast. And this makes sense. Remember how

I told you the first thing it does is

attempts to go and infect other host

right away. You can imagine you have a

server that goes and hits the client,

and then this thing creates a new worm,

which then connects to the server and

creates new worm, which connects to the

client, which creates a new worm, which

connects to the server, and creates a

new worm. So, there needs to be a way in

which these worms don't just

instantaneously go to like a kajillion.

That's why there's the one out of seven

chance for worm immortality. So, after

the worm survives, it does just the

funniest thing. Now, this was clearly

used to kind of trick people. This

report bit break-in, which I believe the

original function's name was send

message, it would just send a single

byte diagram, one out of 15 chance, to a

address called ernie.berkeley.edu.

That way when people decompiled the

program they're like, "Who's that son of

a [ __ ] Ernie over at Berkeley? We got

to go find Ernie and we're going to go

arrest his ass." Ernie had nothing to do

with it. This is just a fake little way

for the worm to phone home but not

actually phone home at all because when

you inspect the code you will notice

that it doesn't send the proper packets.

It creates a TCP connection and sends a

UDP packet. Thus not working at all.

Still one of my favorite parts of the

code. Absolutely love this. It's so

funny to put in some like smoke and

mirrors into the code so that the

decompilers actually go on a wild goose

chase. And dude, pour one out for Ernie.

Ernie, respect. After the worm is done

phoning home, it then goes and attempts

to crack some local passwords. Now it

just has a big old table of about 432

uh favorite basic uh passwords including

the classic banks and bananas. Uh and

Aztec and as you were, is that

Microsoft? By the way, the password list

reminds me of my favorite PR of all

time. Remove my password from the list

so hackers won't be able to hack me.

Dolphins.

Dude, I love it. I love this so

I love this PR so much cuz I really do

hope that this is not somebody trolling

but it's actually somebody being

serious. Like, "Bro, why would you put

my password in this list? Okay, I want

the dolphins are mine, buddy." I mean, I

know it's not that but in my heart of

hearts I kind of hope it is. Either way,

it just did a little bit of password

cracking. Now it didn't try to crack all

the passwords because back then and even

today when it's running the cryptography

and running against stuff it actually

takes a little bit of time and it

actually takes quite a bit of CPU. So

cracking one password could take up to 5

seconds per attempt. So it didn't want

to just block and cause a whole bunch of

CPU threads. So it would do a couple at

a time. And it would back off and okay,

I am I'm doing any of that. And you can

see that right After it cracked a few

passwords, it would just go to sleep.

I'm not I'm not causing any problems,

sir. Mister Mister, it's not me. If you

happen to hit top at that point, you

just wouldn't see the worm at all. Now,

time for the main loop. The main loop,

of course, starts off with little local

password cracking. The reason why this

would happen is that it needed to store

up a list of username and passwords that

it had cracked because it could

potentially be used on remote machines,

thus making spreading faster and easier.

Next, it would fork itself and then exit

the current process. Now, the reason why

it would do this is that way the PID

would constantly be changing. Every few

minutes, a new PID would be added to the

system and the current PID would be

killed. So, any kind of looking at past

CPU usage would show a program that no

longer existed. Extremely smart. Then

again, it does this remote checking.

Now, I think I should probably dive into

this remote checking here for a second,

but you can imagine the remote checking,

you know, it needs to figure out how to

hack stuff. Now, back in the day,

there's this thing called remote shell.

Effectively, if you were Berkeley and

you wanted to go and talk to MIT, you

could just simply remote shell over

there. They were trusted laboratories

with each other. Imagine SSH and having

an RSA key, except for it works for like

an entire department. And so, the worm

would often take advantage of remote

shell and start a remote shell on some

sort of client far away. If that didn't

work, it'd use something called fingerd.

This is something to go look up some

information about a user, but it turns

out if you sent an extra 24 bytes and a

new line, it would end up turning

fingerd into a shell session. And

lastly, if that didn't work, it'd use

sendmail. And if sendmail in debug mode

works, because most sendmail at that

time was actually compiled to have debug

mode on, you could send some debug

commands and just spawn a shell

effectively for yourself right away. So,

that is how the worm spread, which was

mostly through trust. Like people had

debug things up. People had remote shell

just sitting there where anybody could

log into any system.

You could see why Morris could easily

take advantage of things. Again, to make

itself look like it's not doing

anything, it sleeps for 2 minutes, makes

sure it's really quiet, nice and quiet,

and then lastly, it will automatically

quit if it was part of the kill command

or the population control. But you'll

notice that there's this net W right

here. Well, it turns out that if it

hasn't cracked 10 passwords, then it

wouldn't kill itself. So, it actually

minimally does a couple checks before it

kills itself. So, the worms would last

for a while before actually killing

themselves. All right. So, now we need

to go back into this cuz I've kind of

glossed over this whole like just go and

spread yourself time, right? Cuz this is

actually where it gets so freaking cool.

Holy cow. So, there's this line inside

the server. Once it finds a way to

create a remote shell that it can send

commands to, it sends this command right

here. It compiles a very small C program

on the client. So, I'm going to use the

term client meaning the thing the worm

connected to and server being the worm

itself. So, if you look right here, it

does the compilation of this little

script. The next thing it does is it

actually executes the script and says

like, "Hey, this is where I'm located as

the server. This is the port you need to

connect to, and here's the magic number

you need to provide me so I know it's

you and not somebody trying to figure

out how it all works." When this thing

gets done executing, it will remove any

evidence of itself, and then finally, it

will actually do this little echo done

right here saying, "Hey, I'm done

executing." After sending over this

command, the server, the server worm,

the one that's spawning the new worm,

just waits for done to happen, which

means that this program right here needs

to get done executing. Now, how does

that work? This is kind of the confusing

and also part of the super awesome part.

So, we jump over to this little worm

file. This is not the actual worm, it's

the worm spawning program. This is part

of the reason why I said it's so

awesome. So, the first thing it does

when the worm spawns, is it unlinks the

executable that created it to run in the

first place. The next thing it does is

it forks itself. That way, there's

actually two of these little header

programs running to be able to spawn the

main worm. If it failed forking, it

exits with an a good exit code. Hey,

that's good programming right there.

Just letting everybody know, whoopsie

poopsies, the worm failed to worm. Else,

if you're the one that forked the

program, you'll actually get an I

greater than one. Therefore, the forker

is the one that kills itself. Now, by

killing itself, you may remember the

waiting for done can happen because this

little program right here quits running.

We then delete all the evidence, and

then we echo done. This thing receives

the done, and now it can do this wait

hit part. Wait hit simply already has a

server running, and it's ready to send

the worm to whoever asks for it. So, the

little header worm on the client machine

goes, connects to the server that it

received as part of its arguments. It

then proceeds to zero out all of its

arguments, so you couldn't just like PS

aux it, so you wouldn't even know that

there was arguments there. It then

connects to the server, and then

replaces standard in and standard out

with the TCP in and out. So, it can

actually communicate to the server via

its standard out. It then writes out the

magic string, so that way the server

goes, oh yeah, okay, you're a real worm.

I know who you are. And then proceeds to

read until it receives all the C program

required to be able to run the real

worm. And And this is where it does

something that's so cool. Remember, it

has a TCP connection. It has then made

its standard in and standard out hooked

up to the TCP connection, and then it

does this exact L. What exact L

effectively does is it replaces the

current running process with whatever

you give it. So, in this case, it

actually spawns a shell, and this

process becomes the shell, and then the

in and out is already hooked up to the

TCP connection. So, the server can now

run commands against this running shell.

Tell me that's not pretty cool. Come on.

That's pretty dang cool. So, what does

the server do? Hey, go run that worm I

sent you, buddy. And boom, we're back

into the main loop. We're going to go

check for some remote hosts. We're going

to go check, do we need to do population

control? We're going to go call Ernie.

Poor Ernie just getting absolutely

bamboozled here, man. Again, pour one

out for poor Ernie. And that's how the

worm works. This was just a miracle. I

cannot believe it works. It is just It's

like out of science fiction. And the

code is relatively easy to understand.

If you want to go check out the code

itself, you should definitely jump over

here onto the Morris worm malware. Don't

ask Fable though to convert it to rust

for maximum safety because

that's unsafe to convert the worm that

everybody knows about from 1988 into

rust, buddy. What are you, a hacker?

Huh? You hacking, buddy? Don't make me

write you a formal citation. A lot of

the research and understanding of the

worm actually comes from this beautiful

PDF, which you can go download and will

be linked down below, called the tour of

the worm by Don Seeley. Incredible work.

Now, if you like this video, then you

should press the like button or press

the subscribe button. The reason why is

that I see metrics and I can see that

people really enjoy this. I enjoy making

this video. Do you enjoy watching this

video? Cuz I enjoy making this video.

So, send me the signals, people. The

name is I can't believe the exact L

part. That part just blew me away the

most by hooking up the TCP connections,

wiping out all the previous file

descriptors, and then converting

yourself into a shell program, you allow

the server to effectively have shell

access. Kaboom! That was absolutely

incredible.

Ajen.