Message-ID: <3A4DABAA.2020209@sympatico.ca> From: Georges User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.17 i586; en-US; m18) Gecko/20001107 Netscape6/6.0 X-Accept-Language: en, fr-ca MIME-Version: 1.0 Newsgroups: alt.folklore.computers Subject: Morris Worm Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Lines: 16 Date: Sat, 30 Dec 2000 09:32:29 GMT NNTP-Posting-Host: 64.229.233.214 X-Trace: news20.bellglobal.com 978168749 64.229.233.214 (Sat, 30 Dec 2000 04:32:29 EST) NNTP-Posting-Date: Sat, 30 Dec 2000 04:32:29 EST Organization: Sympatico Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!tungurahua!news-ge.switch.ch!news.maxwell.syr.edu!howland.erols.net!news3.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:71821 Hi everybody, I have just finished to read the MIT paper and the Lowell Paper about the Moris Worm/Virus. And I must confess, I read them with as many pleasure and fascination as I read J. Eyroll's Black Dahlia. Does somebody knows if there is some more stuff aviable on that story ? Thank you Georges PS : I'm pascal programmer and have no real knowledge on socket programming even if, I can understand some of the concepts... Futhermore I apologize, if my message hurts people who were involved in the story. However since the events belongs to the (H)istory ... ###### From: Peter N. M. Hansteen Newsgroups: alt.folklore.computers Subject: Re: Morris Worm Date: 30 Dec 2000 20:40:02 +0100 Organization: Datadokumentasjon A/S Lines: 18 Sender: peter@tosh Message-ID: <87snn5ofzh.fsf@bgnett.no> References: <3A4DABAA.2020209@sympatico.ca> NNTP-Posting-Host: dppp061.bgnett.no (194.54.100.189) X-Trace: fu-berlin.de 978205371 8089758 194.54.100.189 (16 [67457]) Original-Sender: peter@bgnett.no X-Newsreader: Gnus v5.7/Emacs 20.7 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!tungurahua!news-ge.switch.ch!news-fra1.dfn.de!fu-berlin.de!uni-berlin.de!dppp061.bgnett.NO!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:71862 Georges writes: > I have just finished to read the MIT paper and the Lowell Paper about > the Moris Worm/Virus. And I must confess, I read them with as many > pleasure and fascination as I read J. Eyroll's Black Dahlia. Does > somebody knows if there is some more stuff aviable on that story ? A google search turns up url:http://www.goldinc.com/html/maloy/SECURITY/morris_worm.html This contains links to a number of authentic-looking documents. -- SPECIAL OFFER! I proofread unsolicited commercial email sent to this address at a rate of US $500.00 per incident! Include billing address in your message and save US $500.00 per hour off ordinary address resolution and tracking charge! ###### Message-ID: <3A517009.5020507@sympatico.ca> From: Georges User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.17 i586; en-US; m18) Gecko/20001107 Netscape6/6.0 X-Accept-Language: en, fr-ca MIME-Version: 1.0 Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <87snn5ofzh.fsf@bgnett.no> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Lines: 22 Date: Tue, 02 Jan 2001 06:05:00 GMT NNTP-Posting-Host: 64.229.235.226 X-Trace: news20.bellglobal.com 978415500 64.229.235.226 (Tue, 02 Jan 2001 01:05:00 EST) NNTP-Posting-Date: Tue, 02 Jan 2001 01:05:00 EST Organization: Sympatico Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!news.tesion.net!news.belwue.de!news-stu1.dfn.de!news-mue1.dfn.de!news-was.dfn.de!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!howland.erols.net!news3.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72016 Great Thank you very much Peter N. M. Hansteen wrote: > Georges writes: > > >> I have just finished to read the MIT paper and the Lowell Paper about >> the Moris Worm/Virus. And I must confess, I read them with as many >> pleasure and fascination as I read J. Eyroll's Black Dahlia. Does >> somebody knows if there is some more stuff aviable on that story ? > > > A google search turns up > > url:http://www.goldinc.com/html/maloy/SECURITY/morris_worm.html > > This contains links to a number of authentic-looking documents. ###### From: mwandel@nortel.ca (Markus Wandel) Newsgroups: alt.folklore.computers Subject: Re: Morris Worm Date: 4 Jan 2001 13:54:21 GMT Organization: Nortel Lines: 28 Message-ID: <931vad$cc5$1@bcarh8ab.ca.nortel.com> References: <3A4DABAA.2020209@sympatico.ca> NNTP-Posting-Host: wcars0mc.ca.nortel.com Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news-fra1.dfn.de!news.tele.dk!4.1.16.34!cpk-news-hub1.bbnplanet.com!news.gtei.net!sunqbc.risq.qc.ca!torn!qcarh002.nortelnetworks.com!bcarh189.ca.nortel.com!bmerhc5e.ca.nortel.com!bcarh8ab.ca.nortel.com!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72322 In article <3A4DABAA.2020209@sympatico.ca>, Georges wrote: >I have just finished to read the MIT paper and the Lowell Paper about >the Moris Worm/Virus. And I must confess, I read them with as many >pleasure and fascination as I read J. Eyroll's Black Dahlia. Does >somebody knows if there is some more stuff aviable on that story ? How about the worm's source code? I spent a few hours with search engines last year to dig it up. It was surprisingly hard to find. None of the FTP directories with the learned papers, etc. included it, none of the web pages pointed to it. Eventually I found it here: ftp://coast.cs.purdue.edu/pub/tools/unix/worm-src.tar.gz But I just checked and it's no longer there. What's the big deal about this? By today's Unix security standards this thing is as harmless as a nerf gun. And it's an important piece of internet history. I still have the file of course, but I'd rather have an URL on the net where I can point to. Does anyone have one? Better yet, one with the the *real* source code (what I found above was a decompilation). Markus ###### Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <931vad$cc5$1@bcarh8ab.ca.nortel.com> Organization: Plethora . Net - More Net, Less Spam! X-Newsreader: trn 4.0-test74 (May 26, 2000) From: seebs@plethora.net (Peter Seebach) Originator: seebs@plethora.net (Peter Seebach) Date: 04 Jan 2001 18:13:18 GMT Lines: 17 Message-ID: <3a54bd3e$0$16022$3c090ad1@news.plethora.net> NNTP-Posting-Host: 81146b01.news.plethora.net X-Trace: 978631998 gemini.plethora.net 16022 seebs@205.166.146.8 X-Complaints-To: abuse@plethora.net Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!news.tesion.net!news.belwue.de!news-stu1.dfn.de!news-koe1.dfn.de!news-fra1.dfn.de!news.tele.dk!209.98.98.64!hermes.visi.com!news-out.visi.com!gemini-int.visi.com.MISMATCH!gemini.plethora.net.POSTED!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72360 In article <931vad$cc5$1@bcarh8ab.ca.nortel.com>, Markus Wandel wrote: >I still have the file of course, but I'd rather have an URL on the net >where I can point to. Does anyone have one? Better yet, one with the >the *real* source code (what I found above was a decompilation). I don't know, but if someone finds one, I could probably be persuaded to host a copy on a web page. That said, I notice that a paper on it was written by Donn Seeley. I am lucky enough to share an @-sign with him, so I think I'll drop him a line. -s -- Copyright 2000, All rights reserved. Peter Seebach / seebs@plethora.net C/Unix wizard, Pro-commerce radical, Spam fighter. Boycott Spamazon! Consulting & Computers: http://www.plethora.net/ ###### Sender: prep@k9.prep.synonet.com Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <931vad$cc5$1@bcarh8ab.ca.nortel.com> <3a54bd3e$0$16022$3c090ad1@news.plethora.net> From: Paul Repacholi Date: 05 Jan 2001 05:29:46 +0800 Message-ID: <877l4b57lh.fsf@k9.prep.synonet.com> Lines: 14 User-Agent: Gnus/5.0807 (Gnus v5.8.7) Emacs/20.7 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii NNTP-Posting-Host: 083.d03.pe.iqnet.net.au X-Trace: 5 Jan 2001 06:46:50 +0800, 083.d03.pe.iqnet.net.au Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!news.tesion.net!news.belwue.de!news-stu1.dfn.de!news-koe1.dfn.de!news-was.dfn.de!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news-peer.gip.net!news.gsl.net!gip.net!enews.sgi.com!harbinger.cc.monash.edu.au!news.mel.connect.com.au!news.per.connect.com.au!newsfeed.iinet.net.au!news.waia.asn.au!usenet.per.paradox.net.au!127.0.0.1!nobody Xref: chonsp.franklin.ch alt.folklore.computers:72326 seebs@plethora.net (Peter Seebach) writes: > share an @-sign with him Some one should have used this before now, but I can't remember ever seeing it. Or has Peter coined a new phrase? -- Paul Repacholi 1 Crescent Rd., +61 (08) 9257-1001 Kalamunda. West Australia 6076 Raw, Cooked or Well-done, it's all half baked. ###### Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <931vad$cc5$1@bcarh8ab.ca.nortel.com> <3a54bd3e$0$16022$3c090ad1@news.plethora.net> <877l4b57lh.fsf@k9.prep.synonet.com> Organization: Plethora . Net - More Net, Less Spam! X-Newsreader: trn 4.0-test74 (May 26, 2000) From: seebs@plethora.net (Peter Seebach) Originator: seebs@plethora.net (Peter Seebach) Date: 05 Jan 2001 01:09:34 GMT Lines: 20 Message-ID: <3a551ecd$0$16038$3c090ad1@news.plethora.net> NNTP-Posting-Host: 1280ec8b.news.plethora.net X-Trace: 978656974 gemini.plethora.net 16038 seebs@205.166.146.8 X-Complaints-To: abuse@plethora.net Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.maxwell.syr.edu!hermes.visi.com!news-out.visi.com!gemini-int.visi.com.MISMATCH!gemini.plethora.net.POSTED!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72364 In article <877l4b57lh.fsf@k9.prep.synonet.com>, Paul Repacholi wrote: >seebs@plethora.net (Peter Seebach) writes: >> share an @-sign with him >Some one should have used this before now, but I can't remember >ever seeing it. Or has Peter coined a new phrase? I believe I have. At least, I don't recall seeing it before. I wanted to express something similar to "work at the same company", but I couldn't find a good way to do it. FWIW, someone sent me a tarball of the decompiled source. I am not yet sure about a redistribution scheme. -s -- Copyright 2000, All rights reserved. Peter Seebach / seebs@plethora.net C/Unix wizard, Pro-commerce radical, Spam fighter. Boycott Spamazon! Consulting & Computers: http://www.plethora.net/ ###### From: genew@shuswap.net (Gene Wirchenko) Newsgroups: alt.folklore.computers Subject: Re: Morris Worm Date: Sun, 07 Jan 2001 04:25:46 GMT Organization: Okanagan Internet Junction Lines: 30 Message-ID: <3a578c45.803976@news.shuswap.net> References: <3A4DABAA.2020209@sympatico.ca> <931vad$cc5$1@bcarh8ab.ca.nortel.com> <3a54bd3e$0$16022$3c090ad1@news.plethora.net> <877l4b57lh.fsf@k9.prep.synonet.com> <3a551ecd$0$16038$3c090ad1@news.plethora.net> Reply-To: genew@shuswap.net NNTP-Posting-Host: salmonarm3-17.shuswap.net X-Trace: news.junction.net 978841285 27417 139.142.177.147 (7 Jan 2001 04:21:25 GMT) X-Complaints-To: usenet@news.junction.net NNTP-Posting-Date: Sun, 7 Jan 2001 04:21:25 +0000 (UTC) X-Newsreader: Forte Free Agent 1.1/32.230 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.maxwell.syr.edu!cyclone.bc.net!news.junction.net!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72447 seebs@plethora.net (Peter Seebach) wrote: >In article <877l4b57lh.fsf@k9.prep.synonet.com>, >Paul Repacholi wrote: >>seebs@plethora.net (Peter Seebach) writes: >>> share an @-sign with him > >>Some one should have used this before now, but I can't remember >>ever seeing it. Or has Peter coined a new phrase? > >I believe I have. At least, I don't recall seeing it before. I wanted to I think you have, too. >express something similar to "work at the same company", but I couldn't >find a good way to do it. It didn't mean that to me. I interpreted it as "have the same ISP". [snip] Sincerely, Gene Wirchenko Computerese Irregular Verb Conjugation: I have preferences. You have biases. He/She has prejudices. ###### Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <877l4b57lh.fsf@k9.prep.synonet.com> <3a551ecd$0$16038$3c090ad1@news.plethora.net> <3a578c45.803976@news.shuswap.net> Organization: Plethora . Net - More Net, Less Spam! X-Newsreader: trn 4.0-test74 (May 26, 2000) From: seebs@plethora.net (Peter Seebach) Originator: seebs@plethora.net (Peter Seebach) Date: 08 Jan 2001 00:31:59 GMT Lines: 18 Message-ID: <3a590a7e$0$40756$3c090ad1@news.plethora.net> NNTP-Posting-Host: a5a71e55.news.plethora.net X-Trace: 978913919 gemini.plethora.net 40756 seebs@205.166.146.8 X-Complaints-To: abuse@plethora.net Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!News.Amsterdam.UnisourceCS!skynet.be!hermes.visi.com!news-out.visi.com!gemini-int.visi.com.MISMATCH!gemini.plethora.net.POSTED!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:72631 In article <3a578c45.803976@news.shuswap.net>, Gene Wirchenko wrote: >>express something similar to "work at the same company", but I couldn't >>find a good way to do it. > It didn't mean that to me. I interpreted it as "have the same >ISP". Ahh. In this case, no. It's the more general "we have email addresses with the same RHS". In this case, it's work address, not ISP. (Very few people are so lucky as to have a plethora.net address, although we keep planning to fix this.) -s -- Copyright 2001, All rights reserved. Peter Seebach / seebs@plethora.net C/Unix wizard, Pro-commerce radical, Spam fighter. Boycott Spamazon! Consulting & Computers: http://www.plethora.net/ ###### Sender: prep@k9.prep.synonet.com Newsgroups: alt.folklore.computers Subject: Re: Morris Worm References: <3A4DABAA.2020209@sympatico.ca> <877l4b57lh.fsf@k9.prep.synonet.com> <3a551ecd$0$16038$3c090ad1@news.plethora.net> <3a578c45.803976@news.shuswap.net> <3a590a7e$0$40756$3c090ad1@news.plethora.net> From: Paul Repacholi Date: 09 Jan 2001 11:59:51 +0800 Message-ID: <878zolqsso.fsf@k9.prep.synonet.com> Lines: 16 User-Agent: Gnus/5.0807 (Gnus v5.8.7) Emacs/20.7 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii NNTP-Posting-Host: 195.d02.pe.iqnet.net.au X-Trace: 9 Jan 2001 21:35:58 +0800, 195.d02.pe.iqnet.net.au Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!newscore.univie.ac.at!194.25.134.126.MISMATCH!newsfeed01.sul.t-online.de!t-online.de!newsfeed.germany.net!news.tele.dk!128.230.129.106!news.maxwell.syr.edu!newsxfer.interpacket.net!feed-out.newsfeeds.com!newsfeeds.com!feed.newsfeeds.com!newsfeeds.com!newsfeed.iinet.net.au!news.waia.asn.au!usenet.per.paradox.net.au!127.0.0.1!nobody Xref: chonsp.franklin.ch alt.folklore.computers:72624 seebs@plethora.net (Peter Seebach) writes: > (Very few > people are so lucky as to have a plethora.net address, although we keep ^^^^^^^^ > planning to fix this.) But that would loose the, well, 'netishness' of it. A plethora of one. or a few anyway. -- Paul Repacholi 1 Crescent Rd., +61 (08) 9257-1001 Kalamunda. West Australia 6076 Raw, Cooked or Well-done, it's all half baked.