Morris worm

The Morris Worm was a self-propagating Unix worm released in November 1988 by Robert Tappan Morris and is widely regarded as one of the first major Internet-wide malware outbreaks. It targeted networked Unix systems on the early Internet and spread autonomously across university, government, military, and research networks, ultimately disrupting thousands of hosts and causing widespread service degradation and system crashes.

Its propagation relied on multiple intrusion mechanisms, including exploitation of a buffer overflow in the finger daemon, abuse of a SENDMAIL weakness, trusted-host relationships, and password guessing. The worm was intended to spread broadly while avoiding easy detection, but a flawed reinfection control mechanism caused infected systems to be repeatedly reinfected, consuming CPU and memory resources until many machines became unusable or unstable. The malware is therefore notable both for unauthorized access and for destructive resource exhaustion caused by uncontrolled replication.

The Morris Worm is historically significant because it demonstrated how interconnected trusted systems could rapidly amplify compromise at Internet scale. It prompted major changes in incident response and computer security practice and led to the first prominent criminal conviction under the U.S. Computer Fraud and Abuse Act for release of network-propagating malware. The worm primarily affected Unix environments connected to the early Internet rather than modern consumer platforms or enterprise Windows ecosystems.