The Morris Worm source code in C – decompiled version

github.com

81 points·tbodt··10 comments

A nice analysis of the worm that was published shortly after the incident is "With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988" by Eichin and Rochlis [1].

I was an intern at IBM UK at the time and I remember it caused quite a lot of interest, and perhaps confusion. The gateway between IBM's corporate network (VNET, mainly) and and the (then) academic-only internet was shut down for a few days while people got a grip on exactly what was going on. Simpler times.

[1] http://www.ece.cmu.edu/~ece845/docs/eichin.pdf

"and I remember it caused quite a lot of interest, and perhaps confusion"

To be clear, by "it" I was referring to the work incident, not the paper.

This appears to be a decompilation, not the original source.

However, it appears to be a very old decompilation, perhaps done while the worm was still live: https://github.com/arialdomartini/morris-worm/blob/master/st...

Ok we changed the title to say that. Thanks!

It does contain comments, though. Like this: https://github.com/arialdomartini/morris-worm/blob/master/wo...

But they're not RTM's comments; they're clearly from someone analyzing the worm.

Morris is at YC, can't he just post the source?

Apparently he's pretty sensitive about this and prefers to keep private about it.

I'd imagine the people that had to clean up after him were a lot more sensitive about it. Posting the source for historical reasons would be one way to make amends.

Jeez, has it been 30 years already?!?

I remember some folks in Berkeley (Bostic?) posting a patch to fix the bug in the worm! The worm was discovered because it kept infecting the same machines again and again; the patch fixed this bug. Ah, good times.

Reply on news.ycombinator.com