The Morris Worm source code in C – decompiled version

[tbodt]

https://github.com/arialdomartini/morris-worm

[andyjohnson0]

A nice analysis of the worm that was published shortly after the incident is "With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988" by Eichin and Rochlis [1].

I was an intern at IBM UK at the time and I remember it caused quite a lot of interest, and perhaps confusion. The gateway between IBM's corporate network (VNET, mainly) and and the (then) academic-only internet was shut down for a few days while people got a grip on exactly what was going on. Simpler times.

[1] http://www.ece.cmu.edu/~ece845/docs/eichin.pdf

[andyjohnson0 → andyjohnson0]

"and I remember it caused quite a lot of interest, and perhaps confusion"

To be clear, by "it" I was referring to the work incident, not the paper.

[raldi]

This appears to be a decompilation, not the original source.

However, it appears to be a very old decompilation, perhaps done while the worm was still live: https://github.com/arialdomartini/morris-worm/blob/master/st...

[danesparza → raldi]

It does contain comments, though. Like this: https://github.com/arialdomartini/morris-worm/blob/master/wo...

[raldi → danesparza]

But they're not RTM's comments; they're clearly from someone analyzing the worm.

[dang → raldi]

Ok we changed the title to say that. Thanks!

[jacquesm]

Morris is at YC, can't he just post the source?

[apengwin → jacquesm]

Apparently he's pretty sensitive about this and prefers to keep private about it.

[jacquesm → apengwin]

I'd imagine the people that had to clean up after him were a lot more sensitive about it. Posting the source for historical reasons would be one way to make amends.

[1024core]

Jeez, has it been 30 years already?!?

I remember some folks in Berkeley (Bostic?) posting a patch to fix the bug in the worm! The worm was discovered because it kept infecting the same machines again and again; the patch fixed this bug. Ah, good times.