⟦75bb1df9b⟧

TextFile

%!PS-Adobe-1.0
%%Creator: delwin:jon (Jon Rochlis,,E40-311,6172534101,6173217086,)
%%Title: stdin (ditroff)
%%CreationDate: Fri Dec  9 17:40:08 1988
%%EndComments
% lib/psdit.pro -- prolog for psdit (ditroff) files
% Copyright (c) 1984, 1985 Adobe Systems Incorporated. All Rights Reserved.
% last edit: shore Sat Nov 23 20:28:03 1985
% RCSID: $Header: psdit.pro,v 2.1 85/11/24 12:19:43 shore Rel $

/$DITroff 140 dict def $DITroff begin
/fontnum 1 def /fontsize 10 def /fontheight 10 def /fontslant 0 def
/xi {0 72 11 mul translate 72 resolution div dup neg scale 0 0 moveto
  /fontnum 1 def /fontsize 10 def /fontheight 10 def /fontslant 0 def F
  /pagesave save def}def
/PB{save /psv exch def currentpoint translate 
  resolution 72 div dup neg scale 0 0 moveto}def
/PE{psv restore}def
/arctoobig 90 def /arctoosmall .05 def
/m1 matrix def /m2 matrix def /m3 matrix def /oldmat matrix def
/tan{dup sin exch cos div}def
/point{resolution 72 div mul}def
/dround	{transform round exch round exch itransform}def
/xT{/devname exch def}def
/xr{/mh exch def /my exch def /resolution exch def}def
/xp{}def
/xs{docsave restore end}def
/xt{}def
/xf{/fontname exch def /slotno exch def fontnames slotno get fontname eq not
 {fonts slotno fontname findfont put fontnames slotno fontname put}if}def
/xH{/fontheight exch def F}def
/xS{/fontslant exch def F}def
/s{/fontsize exch def /fontheight fontsize def F}def
/f{/fontnum exch def F}def
/F{fontheight 0 le {/fontheight fontsize def}if
   fonts fontnum get fontsize point 0 0 fontheight point neg 0 0 m1 astore
   fontslant 0 ne{1 0 fontslant tan 1 0 0 m2 astore m3 concatmatrix}if
   makefont setfont .04 fontsize point mul 0 dround pop setlinewidth}def
/X{exch currentpoint exch pop moveto show}def
/N{3 1 roll moveto show}def
/Y{exch currentpoint pop exch moveto show}def
/S{show}def
/ditpush{}def/ditpop{}def
/AX{3 -1 roll currentpoint exch pop moveto 0 exch ashow}def
/AN{4 2 roll moveto 0 exch ashow}def
/AY{3 -1 roll currentpoint pop exch moveto 0 exch ashow}def
/AS{0 exch ashow}def
/MX{currentpoint exch pop moveto}def
/MY{currentpoint pop exch moveto}def
/MXY{moveto}def
/cb{pop}def	% action on unknown char -- nothing for now
/n{}def/w{}def
/p{pop showpage pagesave restore /pagesave save def}def
/abspoint{currentpoint exch pop add exch currentpoint pop add exch}def
/distance{dup mul exch dup mul add sqrt}def
/dstroke{currentpoint stroke moveto}def
/Dl{2 copy gsave rlineto stroke grestore rmoveto}def
/arcellipse{/diamv exch def /diamh exch def oldmat currentmatrix pop
 currentpoint translate 1 diamv diamh div scale /rad diamh 2 div def
 currentpoint exch rad add exch rad -180 180 arc oldmat setmatrix}def
/Dc{dup arcellipse dstroke}def
/De{arcellipse dstroke}def
/Da{/endv exch def /endh exch def /centerv exch def /centerh exch def
 /cradius centerv centerv mul centerh centerh mul add sqrt def
 /eradius endv endv mul endh endh mul add sqrt def
 /endang endv endh atan def
 /startang centerv neg centerh neg atan def
 /sweep startang endang sub dup 0 lt{360 add}if def
 sweep arctoobig gt
 {/midang startang sweep 2 div sub def /midrad cradius eradius add 2 div def
  /midh midang cos midrad mul def /midv midang sin midrad mul def
  midh neg midv neg endh endv centerh centerv midh midv Da
  currentpoint moveto Da}
 {sweep arctoosmall ge
  {/controldelt 1 sweep 2 div cos sub 3 sweep 2 div sin mul div 4 mul def
  centerv neg controldelt mul centerh controldelt mul
  endv neg controldelt mul centerh add endh add
  endh controldelt mul centerv add endv add
  centerh endh add centerv endv add rcurveto dstroke}
 {centerh endh add centerv endv add rlineto dstroke}ifelse}ifelse}def

/Barray 200 array def % 200 values in a wiggle
/D~{mark}def
/D~~{counttomark Barray exch 0 exch getinterval astore /Bcontrol exch def pop
 /Blen Bcontrol length def Blen 4 ge Blen 2 mod 0 eq and
 {Bcontrol 0 get Bcontrol 1 get abspoint /Ycont exch def /Xcont exch def
  Bcontrol 0 2 copy get 2 mul put Bcontrol 1 2 copy get 2 mul put
  Bcontrol Blen 2 sub 2 copy get 2 mul put
  Bcontrol Blen 1 sub 2 copy get 2 mul put
  /Ybi /Xbi currentpoint 3 1 roll def def 0 2 Blen 4 sub
  {/i exch def
   Bcontrol i get 3 div Bcontrol i 1 add get 3 div
   Bcontrol i get 3 mul Bcontrol i 2 add get add 6 div
   Bcontrol i 1 add get 3 mul Bcontrol i 3 add get add 6 div
   /Xbi Xcont Bcontrol i 2 add get 2 div add def
   /Ybi Ycont Bcontrol i 3 add get 2 div add def
   /Xcont Xcont Bcontrol i 2 add get add def
   /Ycont Ycont Bcontrol i 3 add get add def
   Xbi currentpoint pop sub Ybi currentpoint exch pop sub rcurveto
  }for dstroke}if}def
end
/ditstart{$DITroff begin
 /nfonts 60 def			% NFONTS makedev/ditroff dependent!
 /fonts[nfonts{0}repeat]def
 /fontnames[nfonts{()}repeat]def
/docsave save def
}def

% character outcalls
/oc {/pswid exch def /cc exch def /name exch def
   /ditwid pswid fontsize mul resolution mul 72000 div def
   /ditsiz fontsize resolution mul 72 div def
   ocprocs name known{ocprocs name get exec}{name cb}
   ifelse}def
/fractm [.65 0 0 .6 0 0] def
/fraction
 {/fden exch def /fnum exch def gsave /cf currentfont def
  cf fractm makefont setfont 0 .3 dm 2 copy neg rmoveto
  fnum show rmoveto currentfont cf setfont(\244)show setfont fden show 
  grestore ditwid 0 rmoveto} def
/oce {grestore ditwid 0 rmoveto}def
/dm {ditsiz mul}def
/ocprocs 50 dict def ocprocs begin
(14){(1)(4)fraction}def
(12){(1)(2)fraction}def
(34){(3)(4)fraction}def
(13){(1)(3)fraction}def
(23){(2)(3)fraction}def
(18){(1)(8)fraction}def
(38){(3)(8)fraction}def
(58){(5)(8)fraction}def
(78){(7)(8)fraction}def
(sr){gsave 0 .06 dm rmoveto(\326)show oce}def
(is){gsave 0 .15 dm rmoveto(\362)show oce}def
(->){gsave 0 .02 dm rmoveto(\256)show oce}def
(<-){gsave 0 .02 dm rmoveto(\254)show oce}def
(==){gsave 0 .05 dm rmoveto(\272)show oce}def
end

% an attempt at a PostScript FONT to implement ditroff special chars
% this will enable us to 
%	cache the little buggers
%	generate faster, more compact PS out of psdit
%	confuse everyone (including myself)!
50 dict dup begin
/FontType 3 def
/FontName /DIThacks def
/FontMatrix [.001 0 0 .001 0 0] def
/FontBBox [-260 -260 900 900] def% a lie but ...
/Encoding 256 array def
0 1 255{Encoding exch /.notdef put}for
Encoding
 dup 8#040/space put %space
 dup 8#110/rc put %right ceil
 dup 8#111/lt put %left  top curl
 dup 8#112/bv put %bold vert
 dup 8#113/lk put %left  mid curl
 dup 8#114/lb put %left  bot curl
 dup 8#115/rt put %right top curl
 dup 8#116/rk put %right mid curl
 dup 8#117/rb put %right bot curl
 dup 8#120/rf put %right floor
 dup 8#121/lf put %left  floor
 dup 8#122/lc put %left  ceil
 dup 8#140/sq put %square
 dup 8#141/bx put %box
 dup 8#142/ci put %circle
 dup 8#143/br put %box rule
 dup 8#144/rn put %root extender
 dup 8#145/vr put %vertical rule
 dup 8#146/ob put %outline bullet
 dup 8#147/bu put %bullet
 dup 8#150/ru put %rule
 dup 8#151/ul put %underline
 pop
/DITfd 100 dict def
/BuildChar{0 begin
 /cc exch def /fd exch def
 /charname fd /Encoding get cc get def
 /charwid fd /Metrics get charname get def
 /charproc fd /CharProcs get charname get def
 charwid 0 fd /FontBBox get aload pop setcachedevice
 2 setlinejoin 40 setlinewidth
 newpath 0 0 moveto gsave charproc grestore
 end}def
/BuildChar load 0 DITfd put
%/UniqueID 5 def
/CharProcs 50 dict def
CharProcs begin
/space{}def
/.notdef{}def
/ru{500 0 rls}def
/rn{0 840 moveto 500 0 rls}def
/vr{0 800 moveto 0 -770 rls}def
/bv{0 800 moveto 0 -1000 rls}def
/br{0 750 moveto 0 -1000 rls}def
/ul{0 -140 moveto 500 0 rls}def
/ob{200 250 rmoveto currentpoint newpath 200 0 360 arc closepath stroke}def
/bu{200 250 rmoveto currentpoint newpath 200 0 360 arc closepath fill}def
/sq{80 0 rmoveto currentpoint dround newpath moveto
    640 0 rlineto 0 640 rlineto -640 0 rlineto closepath stroke}def
/bx{80 0 rmoveto currentpoint dround newpath moveto
    640 0 rlineto 0 640 rlineto -640 0 rlineto closepath fill}def
/ci{500 360 rmoveto currentpoint newpath 333 0 360 arc
    50 setlinewidth stroke}def

/lt{0 -200 moveto 0 550 rlineto currx 800 2cx s4 add exch s4 a4p stroke}def
/lb{0 800 moveto 0 -550 rlineto currx -200 2cx s4 add exch s4 a4p stroke}def
/rt{0 -200 moveto 0 550 rlineto currx 800 2cx s4 sub exch s4 a4p stroke}def
/rb{0 800 moveto 0 -500 rlineto currx -200 2cx s4 sub exch s4 a4p stroke}def
/lk{0 800 moveto 0 300 -300 300 s4 arcto pop pop 1000 sub
    0 300 4 2 roll s4 a4p 0 -200 lineto stroke}def
/rk{0 800 moveto 0 300 s2 300 s4 arcto pop pop 1000 sub
    0 300 4 2 roll s4 a4p 0 -200 lineto stroke}def
/lf{0 800 moveto 0 -1000 rlineto s4 0 rls}def
/rf{0 800 moveto 0 -1000 rlineto s4 neg 0 rls}def
/lc{0 -200 moveto 0 1000 rlineto s4 0 rls}def
/rc{0 -200 moveto 0 1000 rlineto s4 neg 0 rls}def
end

/Metrics 50 dict def Metrics begin
/.notdef 0 def
/space 500 def
/ru 500 def
/br 0 def
/lt 416 def
/lb 416 def
/rt 416 def
/rb 416 def
/lk 416 def
/rk 416 def
/rc 416 def
/lc 416 def
/rf 416 def
/lf 416 def
/bv 416 def
/ob 350 def
/bu 350 def
/ci 750 def
/bx 750 def
/sq 750 def
/rn 500 def
/ul 500 def
/vr 0 def
end

DITfd begin
/s2 500 def /s4 250 def /s3 333 def
/a4p{arcto pop pop pop pop}def
/2cx{2 copy exch}def
/rls{rlineto stroke}def
/currx{currentpoint pop}def
/dround{transform round exch round exch itransform} def
end
end
/DIThacks exch definefont pop
ditstart
(psc)xT
576 1 1 xr
1(Times-Roman)xf 1 f
2(Times-Italic)xf 2 f
3(Times-Bold)xf 3 f
4(Times-BoldItalic)xf 4 f
5(Helvetica)xf 5 f
6(Helvetica-Bold)xf 6 f
7(Courier)xf 7 f
8(Courier-Bold)xf 8 f
9(Symbol)xf 9 f
10(DIThacks)xf 10 f
10 s
1 f
xi
%%EndProlog

%%Page: 1 1
10 s 0 xH 0 xS 1 f
3 f
12 s
2003 1356(A)N
2096(Tour)X
2328(of)X
2432(the)X
2584(Worm)X
2 f
10 s
2225 1536(Donn)N
2423(Seeley)X
1 f
1889 1671(Department)N
2288(of)X
2375(Computer)X
2715(Science)X
2126 1761(University)N
2484(of)X
2571(Utah)X
2 f
2238 1986(ABSTRACT)N
1 f
9 s
715 2147(On)N
829(the)X
943(evening)X
1197(of)X
1283(November)X
1613(2,)X
1693(1988,)X
1881(a)X
1939(self-replicating)X
2401(program)X
2671(was)X
2809(released)X
3070(upon)X
3239(the)X
3352(Internet)X
6 s
3576 2119(1)N
9 s
2147(.)Y
3661(This)X
3814(program)X
4083(\(a)X
2 f
715 2228(worm)N
1 f
(\))S
924(invaded)X
1173(VAX)X
1350(and)X
1475(Sun-3)X
1668(computers)X
1989(running)X
2234(versions)X
2494(of)X
2574(Berkeley)X
2854(U)X
7 s
(NIX)S
9 s
3005(,)X
3043(and)X
3167(used)X
3319(their)X
3471(resources)X
3763(to)X
3839(attack)X
4031(still)X
715 2323(more)N
883(computers)X
6 s
1183 2295(2)N
9 s
2323(.)Y
1263(Within)X
1483(the)X
1590(space)X
1769(of)X
1848(hours)X
2027(this)X
2150(program)X
2413(had)X
2536(spread)X
2743(across)X
2942(the)X
3049(U.S.,)X
3214(infecting)X
3489(hundreds)X
3772(or)X
3851(thousands)X
715 2404(of)N
797(computers)X
1118(and)X
1243(making)X
1480(many)X
1661(of)X
1742(them)X
1907(unusable)X
2184(due)X
2309(to)X
2386(the)X
2495(burden)X
2716(of)X
2797(its)X
2886(activity.)X
3159(This)X
3308(paper)X
3489(provides)X
3758(a)X
3811(chronology)X
715 2485(for)N
824(the)X
937(outbreak)X
1213(and)X
1341(presents)X
1601(a)X
1657(detailed)X
1909(description)X
2253(of)X
2337(the)X
2449(internals)X
2721(of)X
2805(the)X
2917(worm,)X
3127(based)X
3315(on)X
3411(a)X
3467(C)X
3539(version)X
3775(produced)X
4067(by)X
715 2566(decompiling.)N
3 f
10 s
555 2722(1.)N
655(Introduction)X
1 f
9 s
715 2836(There)N
912(is)X
989(a)X
1050(\256ne)X
1187(line)X
1324(between)X
1593(helping)X
1838(administrators)X
2279(protect)X
2508(their)X
2669(systems)X
2926(and)X
3059(providing)X
3368(a)X
3429(cookbook)X
3741(for)X
3853(bad)X
3985(guys.)X
715 2917([Grampp)N
993(and)X
1115(Morris,)X
1347(``U)X
7 s
(NIX)S
9 s
1564(Operating)X
1870(System)X
2100(Security''])X
10 s
755 3073(November)N
1114(3,)X
1194(1988)X
1374(is)X
1447(already)X
1704(coming)X
1964(to)X
2046(be)X
2142(known)X
2380(as)X
2467(Black)X
2674(Thursday.)X
3037(System)X
3292(administrators)X
3770(around)X
4013(the)X
555 3163(country)N
820(came)X
1010(to)X
1092(work)X
1277(on)X
1377(that)X
1517(day)X
1653(and)X
1789(discovered)X
2157(that)X
2297(their)X
2464(networks)X
2778(of)X
2865(computers)X
3219(were)X
3396(laboring)X
3683(under)X
3886(a)X
3942(huge)X
4118(load.)X
555 3253(If)N
629(they)X
787(were)X
964(able)X
1118(to)X
1200(log)X
1322(in)X
1404(and)X
1540(generate)X
1833(a)X
1889(system)X
2131(status)X
2333(listing,)X
2572(they)X
2730(saw)X
2875(what)X
3051(appeared)X
3362(to)X
3444(be)X
3540(dozens)X
3783(or)X
3870(hundreds)X
4184(of)X
555 3343(``shell'')N
834(\(command)X
1197(interpreter\))X
1579(processes.)X
1947(If)X
2021(they)X
2179(tried)X
2346(to)X
2428(kill)X
2554(the)X
2672(processes,)X
3020(they)X
3178(found)X
3385(that)X
3525(new)X
3679(processes)X
4007(appeared)X
555 3433(faster)N
754(than)X
912(they)X
1070(could)X
1268(kill)X
1394(them.)X
1614(Rebooting)X
1967(the)X
2085(computer)X
2408(seemed)X
2669(to)X
2751(have)X
2923(no)X
3023(effect\320within)X
3511(minutes)X
3784(after)X
3952(starting)X
4212(up)X
555 3523(again,)N
769(the)X
887(machine)X
1179(was)X
1324(overloaded)X
1701(by)X
1801(these)X
1986(mysterious)X
2357(processes.)X
755 3646(These)N
967(systems)X
1240(had)X
1376(been)X
1548(invaded)X
1822(by)X
1922(a)X
2 f
1978(worm)X
1 f
2160(.)X
2220(A)X
2298(worm)X
2505(is)X
2578(a)X
2634(program)X
2926(that)X
3066(propagates)X
3434(itself)X
3614(across)X
3835(a)X
3891(network,)X
555 3736(using)N
748(resources)X
1072(on)X
1172(one)X
1308(machine)X
1600(to)X
1682(attack)X
1894(other)X
2079(machines.)X
2442(\(A)X
2547(worm)X
2754(is)X
2827(not)X
2949(quite)X
3129(the)X
3247(same)X
3432(as)X
3519(a)X
2 f
3575(virus)X
1 f
(,)S
3775(which)X
3991(is)X
4064(a)X
4120(pro-)X
555 3826(gram)N
740(fragment)X
1050(that)X
1190(inserts)X
1419(itself)X
1599(into)X
1743(other)X
1928(programs.\))X
2298(The)X
2443(worm)X
2650(had)X
2786(taken)X
2980(advantage)X
3326(of)X
3413(lapses)X
3629(in)X
3711(security)X
3985(on)X
4085(sys-)X
555 3916(tems)N
726(that)X
866(were)X
1043(running)X
1312(4.2)X
1432(or)X
1519(4.3)X
1639(BSD)X
1814(U)X
8 s
1872(NIX)X
10 s
2005(or)X
2092(derivatives)X
2464(like)X
2604(SunOS.)X
2890(These)X
3102(lapses)X
3318(allowed)X
3592(it)X
3656(to)X
3738(connect)X
4008(to)X
555 4006(machines)N
878(across)X
1099(a)X
1155(network,)X
1458(bypass)X
1696(their)X
1863(login)X
2047(authentication,)X
2541(copy)X
2717(itself)X
2897(and)X
3033(then)X
3191(proceed)X
3466(to)X
3548(attack)X
3760(still)X
3899(more)X
555 4096(machines.)N
918(The)X
1063(massive)X
1341(system)X
1583(load)X
1741(was)X
1886(generated)X
2219(by)X
2319(multitudes)X
2676(of)X
2763(worms)X
3001(trying)X
3212(to)X
3294(propagate)X
3631(the)X
3749(epidemic.)X
755 4219(The)N
900(Internet)X
1170(had)X
1306(never)X
1505(been)X
1677(attacked)X
1965(in)X
2047(this)X
2182(way)X
2336(before,)X
2582(although)X
2882(there)X
3063(had)X
3199(been)X
3371(plenty)X
3591(of)X
3678(speculation)X
4063(that)X
4203(an)X
555 4309(attack)N
767(was)X
912(in)X
994(store.)X
1210(Most)X
1394(system)X
1636(administrators)X
2114(were)X
2291(unfamiliar)X
2645(with)X
2807(the)X
2925(concept)X
3195(of)X
3282(worms)X
3520(\(as)X
3634(opposed)X
3921(to)X
4003(viruses,)X
555 4399(which)N
771(are)X
890(a)X
946(major)X
1153(af\257iction)X
1462(of)X
1549(the)X
1667(PC)X
1784(world\))X
2018(and)X
2154(it)X
2218(took)X
2380(some)X
2569(time)X
2731(before)X
2957(they)X
3115(were)X
3292(able)X
3446(to)X
3528(establish)X
3828(what)X
4004(was)X
555 4489(going)N
757(on)X
857(and)X
993(how)X
1151(to)X
1233(deal)X
1387(with)X
1549(it.)X
1653(This)X
1815(paper)X
2014(is)X
2087(intended)X
2383(to)X
2465(let)X
2565(people)X
2799(know)X
2997(exactly)X
3249(what)X
3425(happened)X
3753(and)X
3889(how)X
4047(it)X
4111(came)X
555 4579(about,)N
773(so)X
864(that)X
1004(they)X
1162(will)X
1306(be)X
1402(better)X
1605(prepared)X
1907(when)X
2101(it)X
2165(happens)X
2448(the)X
2566(next)X
2724(time.)X
2926(The)X
3071(behavior)X
3372(of)X
3459(the)X
3577(worm)X
3784(will)X
3928(be)X
4024(exam-)X
555 4669(ined)N
713(in)X
795(detail,)X
1013(both)X
1175(to)X
1257(show)X
1446(exactly)X
1698(what)X
1874(it)X
1938(did)X
2060(and)X
2196(didn't)X
2407(do,)X
2527(and)X
2663(to)X
2745(show)X
2934(the)X
3052(dangers)X
3322(of)X
3409(future)X
3621(worms.)X
3899(The)X
4044(epi-)X
555 4759(graph)N
758(above)X
970(is)X
1043(now)X
1201(ironic,)X
1428(for)X
1542(the)X
1660(author)X
1885(of)X
1972(the)X
2090(worm)X
2297(used)X
2464(information)X
2862(in)X
2944(that)X
3084(paper)X
3283(to)X
3365(attack)X
3577(systems.)X
3890(Since)X
4088(the)X
555 4849(information)N
953(is)X
1026(now)X
1184(well)X
1342(known,)X
1600(by)X
1700(virtue)X
1907(of)X
1994(the)X
2112(fact)X
2253(that)X
2393(thousands)X
2733(of)X
2820(computers)X
3174(now)X
3332(have)X
3504(copies)X
3729(of)X
3816(the)X
3934(worm,)X
4161(it)X
555 4939(seems)N
771(unlikely)X
1053(that)X
1193(this)X
1328(paper)X
1527(can)X
1659(do)X
1759(similar)X
2001(damage,)X
2291(but)X
2413(it)X
2477(is)X
2550(de\256nitely)X
2872(a)X
2928(troubling)X
3241(thought.)X
3545(Opinions)X
3858(on)X
3958(this)X
4093(and)X
555 5029(other)N
740(matters)X
996(will)X
1140(be)X
1236(offered)X
1489(below.)X
8 s
10 f
555 5275(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N
5 s
1 f
727 5353(1)N
8 s
763 5378(The)N
878(Internet)X
1092(is)X
1151(a)X
1195(logical)X
1385(network)X
1610(made)X
1764(up)X
1844(of)X
1913(many)X
2071(physical)X
2300(networks,)X
2566(all)X
2646(running)X
2861(the)X
2955(IP)X
3028(class)X
3168(of)X
3237(network)X
3462(protocols.)X
5 s
727 5456(2)N
8 s
771 5481(VAX)N
933(and)X
1049(Sun-3)X
1226(are)X
1327(models)X
1536(of)X
1613(computers)X
1903(built)X
2045(by)X
2133(Digital)X
2335(Equipment)X
2640(Corp.)X
2808(and)X
2924(Sun)X
3048(Microsystems)X
3431(Inc.,)X
3568(respectively.)X
3932(U)X
6 s
3978(NIX)X
8 s
4088(is)X
4155(a)X
4207(Re-)X
555 5553(gistered)N
773(Bell)X
896(of)X
965(AT&T)X
1155(Trademark)X
1450(Laboratories.)X

2 p
%%Page: 2 2
8 s 0 xH 0 xS 1 f
3 f
10 s
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(2)X
555 762(2.)N
655(Chronology)X
1 f
9 s
715 876(Remember,)N
1074(when)X
1255(you)X
1388(connect)X
1637(with)X
1790(another)X
2031(computer,)X
2346(you're)X
2559(connecting)X
2900(to)X
2981(every)X
3166(computer)X
3463(that)X
3595(computer)X
3891(has)X
4011(con-)X
715 957(nected)N
921(to.)X
1031([Dennis)X
1277(Miller,)X
1493(on)X
1583(NBC's)X
2 f
1801(Saturday)X
2079(Night)X
2257(Live)X
1 f
2381(])X
715 1078(Here)N
877(is)X
947(the)X
1057(gist)X
1183(of)X
1265(a)X
1319(message)X
1585(I)X
1631(got:)X
1764(I'm)X
1889(sorry.)X
2094([Andy)X
2299(Sudduth,)X
2578(in)X
2655(an)X
2744(anonymous)X
3097(posting)X
3330(to)X
3407(the)X
3516(TCP-IP)X
3757(list)X
3866(on)X
3959(behalf)X
715 1159(of)N
793(the)X
899(author)X
1101(of)X
1179(the)X
1285(worm,)X
1489(11/3/88])X
10 s
755 1315(Many)N
962(details)X
1191(of)X
1278(the)X
1396(chronology)X
1781(of)X
1868(the)X
1986(attack)X
2198(are)X
2317(not)X
2439(yet)X
2557(available.)X
2907(The)X
3052(following)X
3383(list)X
3500(represents)X
3846(dates)X
4031(and)X
555 1405(times)N
748(that)X
888(we)X
1002(are)X
1121(currently)X
1431(aware)X
1644(of.)X
1771(Times)X
1991(have)X
2163(all)X
2263(been)X
2435(rendered)X
2737(in)X
2819(Paci\256c)X
3057(Standard)X
3362(Time)X
3551(for)X
3665(convenience.)X
555 1528(11/2:)N
739(1800)X
919(\(approx.\))X
999 1618(This)N
1161(date)X
1315(and)X
1451(time)X
1613(were)X
1790(seen)X
1953(on)X
2053(worm)X
2260(\256les)X
2413(found)X
2620(on)X
2 f
2720(prep.ai.mit.edu)X
1 f
3207(,)X
3247(a)X
3303(VAX)X
3497(11/750)X
3739(at)X
3817(the)X
3935(MIT)X
999 1708(Arti\256cial)N
1308(Intelligence)X
1707(Laboratory.)X
2124(The)X
2269(\256les)X
2422(were)X
2599(removed)X
2900(later,)X
3083(and)X
3219(the)X
3337(precise)X
3585(time)X
3747(was)X
3892(lost.)X
4067(Sys-)X
999 1798(tem)N
1139(logging)X
1403(on)X
2 f
1503(prep)X
1 f
1670(had)X
1806(been)X
1978(broken)X
2221(for)X
2335(two)X
2475(weeks.)X
2736(The)X
2881(system)X
3123(doesn't)X
3379(run)X
3506(accounting)X
3878(and)X
4014(the)X
4132(disks)X
999 1888(aren't)N
1207(backed)X
1455(up)X
1555(to)X
1637(tape:)X
1813(a)X
1869(perfect)X
2113(target.)X
2356(A)X
2434(number)X
2699(of)X
2786(``tourist'')X
3118(users)X
3303(\(individuals)X
3705(using)X
3898(public)X
999 1978(accounts\))N
1327(were)X
1504(reported)X
1792(to)X
1874(be)X
1970(active)X
2182(that)X
2322(evening.)X
2636(These)X
2848(users)X
3033(would)X
3253(have)X
3425(appeared)X
3736(in)X
3818(the)X
3936(session)X
999 2068(logging,)N
1283(but)X
1405(see)X
1528(below.)X
555 2191(11/2:)N
739(1824)X
999(First)X
1165(known)X
1403(West)X
1588(Coast)X
1790(infection:)X
2 f
2117(rand.org)X
1 f
2419(at)X
2497(Rand)X
2686(Corp.)X
2886(in)X
2968(Santa)X
3166(Monica.)X
555 2314(11/2:)N
739(1904)X
2 f
999(csgw.berkeley.edu)X
1 f
1608(is)X
1681(infected.)X
2000(This)X
2162(machine)X
2454(is)X
2527(a)X
2583(major)X
2790(network)X
3073(gateway)X
3361(at)X
3439(UC)X
3570(Berkeley.)X
3920(Mike)X
999 2404(Karels)N
1229(and)X
1365(Phil)X
1513(Lapsley)X
1787(discover)X
2079(the)X
2197(infection)X
2502(shortly)X
2744(afterward.)X
555 2527(11/2:)N
739(1954)X
2 f
999(mimsy.umd.edu)X
1 f
1518(is)X
1591(attacked)X
1879(through)X
2148(its)X
2 f
2243(\256nger)X
1 f
2450(server.)X
2707(This)X
2869(machine)X
3161(is)X
3234(at)X
3312(the)X
3430(University)X
3788(of)X
3875(Maryland)X
999 2617(College)N
1268(Park)X
1435(Computer)X
1775(Science)X
2045(Department.)X
555 2740(11/2:)N
739(2000)X
919(\(approx.\))X
999 2830(Suns)N
1174(at)X
1252(the)X
1370(MIT)X
1537(AI)X
1642(Lab)X
1787(are)X
1906(attacked.)X
555 2953(11/2:)N
739(2028)X
999(First)X
2 f
1165(sendmail)X
1 f
1474(attack)X
1686(on)X
1786(mimsy.)X
555 3076(11/2:)N
739(2040)X
999(Berkeley)X
1309(staff)X
1472(\256gure)X
1679(out)X
1801(the)X
2 f
1919(sendmail)X
1 f
2228(and)X
2 f
2364(rsh)X
1 f
2486(attacks,)X
2749(notice)X
2 f
2965(telnet)X
1 f
3163(and)X
2 f
3299(\256nger)X
1 f
3506(peculiarities,)X
3938(and)X
4074(start)X
999 3166(shutting)N
1276(these)X
1461(services)X
1740(off.)X
555 3289(11/2:)N
739(2049)X
2 f
999(cs.utah.edu)X
1 f
1384(is)X
1457(infected.)X
1776(This)X
1938(VAX)X
2132(8600)X
2312(is)X
2385(the)X
2503(central)X
2742(Computer)X
3082(Science)X
3352(Department)X
3751(machine)X
4043(at)X
4121(the)X
999 3379(University)N
1357(of)X
1444(Utah.)X
1660(The)X
1805(next)X
1963(several)X
2211(entries)X
2445(follow)X
2674(documented)X
3086(events)X
3311(at)X
3389(Utah)X
3565(and)X
3701(are)X
3820(representative)X
999 3469(of)N
1086(other)X
1271(infections)X
1607(around)X
1850(the)X
1968(country.)X
555 3592(11/2:)N
739(2109)X
999(First)X
2 f
1165(sendmail)X
1 f
1474(attack)X
1686(at)X
2 f
1764(cs.utah.edu)X
1 f
2129(.)X
555 3715(11/2:)N
739(2121)X
999(The)X
1144(load)X
1302(average)X
1573(on)X
2 f
1673(cs.utah.edu)X
1 f
2058(reaches)X
2320(5.)X
2420(The)X
2565(``load)X
2777 0.3906(average'')AX
3102(is)X
3175(a)X
3231(system-generated)X
3813(value)X
4007(that)X
999 3805(represents)N
1345(the)X
1463(average)X
1734(number)X
1999(of)X
2086(jobs)X
2239(in)X
2321(the)X
2439(run)X
2566(queue)X
2778(over)X
2941(the)X
3059(last)X
3190(minute;)X
3454(a)X
3510(load)X
3668(of)X
3755(5)X
3815(on)X
3915(a)X
3971(VAX)X
999 3895(8600)N
1179(noticeably)X
1533(degrades)X
1839(response)X
2140(times,)X
2353(while)X
2551(a)X
2607(load)X
2765(over)X
2928(20)X
3028(is)X
3101(a)X
3157(drastic)X
3391(degradation.)X
3830(At)X
3930(9)X
3990(PM,)X
4145(the)X
999 3985(load)N
1157(is)X
1230(typically)X
1530(between)X
1818(0.5)X
1938(and)X
2074(2.)X
555 4108(11/2:)N
739(2141)X
999(The)X
1144(load)X
1302(average)X
1573(on)X
2 f
1673(cs.utah.edu)X
1 f
2058(reaches)X
2320(7.)X
555 4231(11/2:)N
739(2201)X
999(The)X
1144(load)X
1302(average)X
1573(on)X
2 f
1673(cs.utah.edu)X
1 f
2058(reaches)X
2320(16.)X
555 4354(11/2:)N
739(2206)X
999(The)X
1144(maximum)X
1488(number)X
1753(of)X
1840(distinct)X
2095(runnable)X
2396(processes)X
2724(\(100\))X
2918(is)X
2991(reached)X
3262(on)X
2 f
3362(cs.utah.edu)X
1 f
3727(;)X
3769(the)X
3887(system)X
4129(is)X
999 4444(unusable.)N
555 4567(11/2:)N
739(2220)X
999(Jeff)X
1140(Forys)X
1342(at)X
1420(Utah)X
1596(kills)X
1753(off)X
1867(worms)X
2105(on)X
2 f
2205(cs.utah.edu)X
1 f
2570(.)X
2630(Utah)X
2806(Sun)X
2950(clusters)X
3215(are)X
3334(infected.)X
555 4690(11/2:)N
739(2241)X
999(Re-infestation)X
1473(causes)X
1703(the)X
1821(load)X
1979(average)X
2250(to)X
2332(reach)X
2527(27)X
2627(on)X
2 f
2727(cs.utah.edu)X
1 f
3092(.)X
555 4813(11/2:)N
739(2249)X
999(Forys)X
1201(shuts)X
1385(down)X
2 f
1583(cs.utah.edu)X
1 f
1948(.)X
555 4936(11/3:)N
739(2321)X
999(Re-infestation)X
1473(causes)X
1703(the)X
1821(load)X
1979(average)X
2250(to)X
2332(reach)X
2527(37)X
2627(on)X
2 f
2727(cs.utah.edu)X
1 f
3092(,)X
3132(despite)X
3379(continuous)X
3750(efforts)X
3980(by)X
4080(Forys)X
999 5026(to)N
1081(kill)X
1207(worms.)X
555 5149(11/2:)N
739(2328)X
999(Peter)X
1184(Yee)X
1334(at)X
1412(NASA)X
1650(Ames)X
1857(Research)X
2172(Center)X
2406(posts)X
2590(a)X
2646(warning)X
2929(to)X
3011(the)X
3129(TCP-IP)X
3393(mailing)X
3657(list:)X
3796(``We)X
3982(are)X
999 5239(currently)N
1309(under)X
1512(attack)X
1724(from)X
1900(an)X
1996(Internet)X
2266(VIRUS.)X
2566(It)X
2635(has)X
2762(hit)X
2866(UC)X
2997(Berkeley,)X
3327(UC)X
3458(San)X
3598(Diego,)X
3834(Lawrence)X
999 5329(Livermore,)N
1378(Stanford,)X
1694(and)X
1830(NASA)X
2068(Ames.'')X
2349(He)X
2463(suggests)X
2754(turning)X
3005(off)X
2 f
3119(telnet)X
1 f
3297(,)X
2 f
3337(ftp)X
1 f
3421(,)X
2 f
3461(\256nger)X
1 f
3648(,)X
2 f
3688(rsh)X
1 f
3810(and)X
3946(SMTP)X
4174(ser-)X
999 5419(vices.)N
1224(He)X
1338(does)X
1505(not)X
1627(mention)X
2 f
1909(rexec)X
1 f
2084(.)X
2144(Yee)X
2294(is)X
2367(actually)X
2641(at)X
2719(Berkeley)X
3029(working)X
3316(with)X
3478(Keith)X
3676(Bostic,)X
3920(Mike)X
999 5509(Karels)N
1229(and)X
1365(Phil)X
1513(Lapsley.)X
555 5632(11/3:)N
739(0034)X
999(At)X
1099(another's)X
1418(prompting,)X
1791(Andy)X
1989(Sudduth)X
2275(of)X
2362(Harvard)X
2646(anonymously)X
3097(posts)X
3281(a)X
3337(warning)X
3620(to)X
3702(the)X
3820(TCP-IP)X
4084(list:)X
999 5722(``There)N
1261(may)X
1419(be)X
1515(a)X
1571(virus)X
1751(loose)X
1940(on)X
2040(the)X
2158(internet.'')X
2497(This)X
2659(is)X
2732(the)X
2850(\256rst)X
2994(message)X
3286(that)X
3426(\(brie\257y\))X
3709(describes)X
4028(how)X
4186(the)X

3 p
%%Page: 3 3
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(3)X
2 f
999 762(\256nger)N
1 f
1206(attack)X
1418(works,)X
1654(describes)X
1973(how)X
2131(to)X
2213(defeat)X
2430(the)X
2548(SMTP)X
2776(attack)X
2988(by)X
3088(rebuilding)X
2 f
3437(sendmail)X
1 f
3726(,)X
3766(and)X
3902(explicitly)X
999 852(mentions)N
1312(the)X
2 f
1430(rexec)X
1 f
1625(attack.)X
1877(Unfortunately)X
2347(Sudduth's)X
2691(message)X
2983(is)X
3056(blocked)X
3330(at)X
2 f
3408(relay.cs.net)X
1 f
3798(while)X
3996(that)X
4136(gate-)X
999 942(way)N
1153(is)X
1226(shut)X
1379(down)X
1577(to)X
1659(combat)X
1915(the)X
2033(worm,)X
2260(and)X
2396(it)X
2460(does)X
2627(not)X
2749(get)X
2867(delivered)X
3186(for)X
3300(almost)X
3533(two)X
3673(days.)X
3880(Sudduth)X
999 1032(acknowledges)N
1474(authorship)X
1832(of)X
1919(the)X
2037(message)X
2329(in)X
2411(a)X
2467(subsequent)X
2843(message)X
3135(to)X
3217(TCP-IP)X
3481(on)X
3581(Nov.)X
3759(5.)X
555 1155(11/3:)N
739(0254)X
999(Keith)X
1197(Bostic)X
1421(sends)X
1619(a)X
1675(\256x)X
1779(for)X
2 f
1893(sendmail)X
1 f
2202(to)X
2284(the)X
2402(newsgroup)X
2774(comp.bugs.4bsd.ucb-\256xes)X
3628(and)X
3764(to)X
3846(the)X
3964(TCP-IP)X
999 1245(mailing)N
1263(list.)X
1420(These)X
1632(\256xes)X
1803(\(and)X
1966(later)X
2129(ones\))X
2323(are)X
2442(also)X
2591(mailed)X
2829(directly)X
3094(to)X
3176(important)X
3507(system)X
3749(administrators)X
999 1335(around)N
1242(the)X
1360(country.)X
555 1458(11/3:)N
739(early)X
920(morning)X
999 1548(The)N
2 f
1144(wtmp)X
1 f
1337(session)X
1588(log)X
1710(is)X
1783(mysteriously)X
2216(removed)X
2517(on)X
2 f
2617(prep.ai.mit.edu)X
1 f
3104(.)X
555 1671(11/3:)N
739(0507)X
999(Edward)X
1269(Wang)X
1481(at)X
1559(Berkeley)X
1869(\256gures)X
2107(out)X
2229(and)X
2365(reports)X
2608(the)X
2 f
2726(\256nger)X
1 f
2933(attack,)X
3165(but)X
3287(his)X
3400(message)X
3692(doesn't)X
3948(come)X
4142(to)X
999 1761(Mike)N
1188(Karels')X
1445(attention)X
1745(for)X
1859(12)X
1959(hours.)X
555 1884(11/3:)N
739(0900)X
999(The)X
1144(annual)X
1378(Berkeley)X
1688(Unix)X
1868(Workshop)X
2222(commences)X
2621(at)X
2699(UC)X
2830(Berkeley.)X
3180(40)X
3280(or)X
3367(so)X
3458(important)X
3789(system)X
999 1974(administrators)N
1477(and)X
1613(hackers)X
1879(are)X
1998(in)X
2080(town)X
2260(to)X
2342(attend,)X
2578(while)X
2776(disaster)X
3041(erupts)X
3257(at)X
3335(home.)X
3573(Several)X
3834(people)X
4068(who)X
999 2064(had)N
1135(planned)X
1409(to)X
1491(\257y)X
1595(in)X
1677(on)X
1777(Thursday)X
2100(morning)X
2391(are)X
2510(trapped)X
2771(by)X
2871(the)X
2989(crisis.)X
3218(Keith)X
3416(Bostic)X
3640(spends)X
3878(much)X
4076(of)X
4163(the)X
999 2154(day)N
1135(on)X
1235(the)X
1353(phone)X
1569(at)X
1647(the)X
1765(Computer)X
2105(Systems)X
2391(Research)X
2706(Group)X
2931(of\256ces)X
3165(answering)X
3515(calls)X
3682(from)X
3858(panicked)X
4168(sys-)X
999 2244(tem)N
1139(administrators)X
1617(from)X
1793(around)X
2036(the)X
2154(country.)X
555 2367(11/3:)N
739(1500)X
919(\(approx.\))X
999 2457(The)N
1144(team)X
1320(at)X
1398(MIT)X
1565(Athena)X
1817(calls)X
1984(Berkeley)X
2294(with)X
2456(an)X
2552(example)X
2844(of)X
2931(how)X
3089(the)X
2 f
3207(\256nger)X
1 f
3414(server)X
3631(bug)X
3771(works.)X
555 2580(11/3:)N
739(1626)X
999(Dave)X
1189(Pare)X
1352(arrives)X
1591(at)X
1669(Berkeley)X
1979(CSRG)X
2207(of\256ces;)X
2463(disassembly)X
2874(and)X
3010(decompiling)X
3430(start)X
3588(shortly)X
3830(afterward)X
999 2670(using)N
1192(Pare's)X
1413(special)X
1656(tools.)X
555 2793(11/3:)N
739(1800)X
919(\(approx.\))X
999 2883(The)N
1144(Berkeley)X
1454(group)X
1661(sends)X
1859(out)X
1981(for)X
2095(calzones.)X
2432(People)X
2670(arrive)X
2878(and)X
3014(leave;)X
3226(the)X
3344(of\256ces)X
3578(are)X
3697(crowded,)X
4014(there's)X
999 2973(plenty)N
1219(of)X
1306(excitement.)X
1718(Parallel)X
1983(work)X
2168(is)X
2241(in)X
2323(progress)X
2615(at)X
2693(MIT)X
2860(Athena;)X
3134(the)X
3252(two)X
3392(groups)X
3630(swap)X
3815(code.)X
555 3096(11/3:)N
739(1918)X
999(Keith)X
1197(Bostic)X
1421(posts)X
1605(a)X
1661(\256x)X
1765(for)X
1879(the)X
2 f
1997(\256nger)X
1 f
2204(server.)X
555 3219(11/4:)N
739(0600)X
999(Members)X
1322(of)X
1409(the)X
1527(Berkeley)X
1837(team,)X
2033(with)X
2195(the)X
2313(worm)X
2520(almost)X
2753(completely)X
3129(disassembled)X
3576(and)X
3712(largely)X
3955(decom-)X
999 3309(piled,)N
1199(\256nally)X
1423(take)X
1577(off)X
1691(for)X
1805(a)X
1861(couple)X
2095(hours')X
2320(sleep)X
2505(before)X
2731(returning)X
3045(to)X
3127(the)X
3245(workshop.)X
555 3432(11/4:)N
739(1236)X
999(Theodore)X
1327(Ts'o)X
1494(of)X
1581(Project)X
1828(Athena)X
2080(at)X
2158(MIT)X
2325(publicly)X
2607(announces)X
2966(that)X
3106(MIT)X
3273(and)X
3409(Berkeley)X
3719(have)X
3891(completely)X
999 3522(disassembled)N
1446(the)X
1564(worm.)X
555 3645(11/4:)N
739(1700)X
919(\(approx.\))X
999 3735(A)N
1077(short)X
1257(presentation)X
1669(on)X
1769(the)X
1887(worm)X
2094(is)X
2167(made)X
2361(at)X
2439(the)X
2557(end)X
2693(of)X
2780(the)X
2898(Berkeley)X
3208(U)X
8 s
3266(NIX)X
10 s
3399(Workshop.)X
555 3858(11/8:)N
999(National)X
1295(Computer)X
1635(Security)X
1922(Center)X
2156(meeting)X
2434(to)X
2516(discuss)X
2767(the)X
2885(worm.)X
3132(There)X
3340(are)X
3459(about)X
3657(50)X
3757(attendees.)X
555 3981(11/11:)N
779(0038)X
999(Fully)X
1187(decompiled)X
1581(and)X
1717(commented)X
2111(worm)X
2318(source)X
2548(is)X
2621(installed)X
2912(at)X
2990(Berkeley.)X
3 f
555 4167(3.)N
655(Overview)X
1 f
755 4290(What)N
949(exactly)X
1201(did)X
1323(the)X
1441(worm)X
1648(do)X
1748(that)X
1888(led)X
2006(it)X
2070(to)X
2152(cause)X
2351(an)X
2447(epidemic?)X
2817(The)X
2962(worm)X
3169(consists)X
3442(of)X
3529(a)X
3585(99-line)X
3832(bootstrap)X
4150(pro-)X
555 4380(gram)N
740(written)X
987(in)X
1069(the)X
1187(C)X
1260(language,)X
1590(plus)X
1743(a)X
1799(large)X
1980(relocatable)X
2353(object)X
2569(\256le)X
2691(that)X
2831(comes)X
3056(in)X
3138(VAX)X
3332(and)X
3468(Sun-3)X
3679(\257avors.)X
3957(Internal)X
555 4470(evidence)N
861(showed)X
1126(that)X
1266(the)X
1384(object)X
1600(\256le)X
1722(was)X
1867(generated)X
2200(from)X
2376(C)X
2449(sources,)X
2730(so)X
2821(it)X
2885(was)X
3030(natural)X
3273(to)X
3355(decompile)X
3709(the)X
3827(binary)X
555 4560(machine)N
847(language)X
1157(into)X
1301(C;)X
1396(we)X
1510(now)X
1668(have)X
1840(over)X
2003(3200)X
2183(lines)X
2354(of)X
2441(commented)X
2835(C)X
2908(code)X
3080(which)X
3296(recompiles)X
3668(and)X
3804(is)X
3877(mostly)X
4114(com-)X
555 4650(plete.)N
771(We)X
903(shall)X
1074(start)X
1232(the)X
1350(tour)X
1499(of)X
1586(the)X
1704(worm)X
1911(with)X
2073(a)X
2129(quick)X
2327(overview)X
2646(of)X
2733(the)X
2851(basic)X
3036(goals)X
3225(of)X
3312(the)X
3430(worm,)X
3657(followed)X
3962(by)X
4062(discus-)X
555 4740(sion)N
708(in)X
790(depth)X
988(of)X
1075(the)X
1193(worm's)X
1458(various)X
1714(behaviors)X
2046(as)X
2133(revealed)X
2426(by)X
2526(decompilation.)X
755 4863(The)N
900(activities)X
1209(of)X
1296(the)X
1414(worm)X
1621(break)X
1820(down)X
2018(into)X
2162(the)X
2280(categories)X
2626(of)X
2713(attack)X
2925(and)X
3061(defense.)X
3367(Attack)X
3601(consists)X
3874(of)X
3961(locating)X
555 4953(hosts)N
739(\(and)X
902(accounts\))X
1230(to)X
1312(penetrate,)X
1647(then)X
1805(exploiting)X
2149(security)X
2423(holes)X
2612(on)X
2712(remote)X
2955(systems)X
3228(to)X
3310(pass)X
3468(across)X
3689(a)X
3745(copy)X
3921(of)X
4008(the)X
555 5043(worm)N
762(and)X
898(run)X
1025(it.)X
1129(The)X
1274(worm)X
1481(obtains)X
1732(host)X
1885(addresses)X
2213(by)X
2313(examining)X
2671(the)X
2789(system)X
3031(tables)X
2 f
3238(/etc/hosts.equiv)X
1 f
3754(and)X
2 f
3890(/.rhosts)X
1 f
4127(,)X
555 5133(user)N
709(\256les)X
862(like)X
2 f
1002(.forward)X
1 f
1299(and)X
2 f
1435(.rhosts)X
1 f
1650(,)X
1690(dynamic)X
1986(routing)X
2237(information)X
2635(produced)X
2954(by)X
3054(the)X
2 f
3172(netstat)X
1 f
3405(program,)X
3717(and)X
3853(\256nally)X
4077(ran-)X
555 5223(domly)N
779(generated)X
1112(host)X
1265(addresses)X
1593(on)X
1693(local)X
1869(networks.)X
2223(It)X
2292(ranks)X
2486(these)X
2671(by)X
2771(order)X
2961(of)X
3048 0.3625(preference,)AX
3429(trying)X
3640(a)X
3696(\256le)X
3818(like)X
2 f
555 5313(/etc/hosts.equiv)N
1 f
1071(\256rst)X
1215(because)X
1490(it)X
1554(contains)X
1841(names)X
2066(of)X
2153(local)X
2329(machines)X
2652(that)X
2792(are)X
2911(likely)X
3113(to)X
3195(permit)X
3424(unauthenticated)X
3952(connec-)X
555 5403(tions.)N
770(Penetration)X
1155(of)X
1242(a)X
1298(remote)X
1541(system)X
1783(can)X
1915(be)X
2011(accomplished)X
2472(in)X
2554(any)X
2690(of)X
2777(three)X
2958(ways.)X
3183(The)X
3328(worm)X
3535(can)X
3667(take)X
3821(advantage)X
4167(of)X
4254(a)X
555 5493(bug)N
695(in)X
777(the)X
2 f
895(\256nger)X
1 f
1102(server)X
1319(that)X
1459(allows)X
1688(it)X
1752(to)X
1834(download)X
2170(code)X
2342(in)X
2424(place)X
2614(of)X
2701(a)X
2757(\256nger)X
2964(request)X
3216(and)X
3352(trick)X
3519(the)X
3637(server)X
3854(into)X
3998(execut-)X
555 5583(ing)N
677(it.)X
781(The)X
926(worm)X
1133(can)X
1265(use)X
1392(a)X
1448(``trap)X
1647(door'')X
1868(in)X
1950(the)X
2 f
2068(sendmail)X
1 f
2377(SMTP)X
2605(mail)X
2767(service,)X
3035(exercising)X
3385(a)X
3441(bug)X
3581(in)X
3663(the)X
3781(debugging)X
4139(code)X
555 5673(that)N
695(allows)X
924(it)X
988(to)X
1070(execute)X
1336(a)X
1392(command)X
1728(interpreter)X
2083(and)X
2219(download)X
2555(code)X
2727(across)X
2948(a)X
3004(mail)X
3166(connection.)X
3578(If)X
3652(the)X
3770(worm)X
3977(can)X
555 5763(penetrate)N
870(a)X
926(local)X
1102(account)X
1372(by)X
1472(guessing)X
1772(its)X
1867(password,)X
2210(it)X
2274(can)X
2406(use)X
2533(the)X
2 f
2651(rexec)X
1 f
2846(and)X
2 f
2982(rsh)X
1 f
3104(remote)X
3347(command)X
3683(interpreter)X
4038(services)X

4 p
%%Page: 4 4
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(4)X
1 f
555 762(to)N
637(attack)X
849(hosts)X
1033(that)X
1173(share)X
1363(that)X
1503(account.)X
1813(In)X
1900(each)X
2068(case)X
2227(the)X
2345(worm)X
2552(arranges)X
2845(to)X
2927(get)X
3045(a)X
3101(remote)X
3344(command)X
3680(interpreter)X
4035(which)X
4251(it)X
555 852(can)N
687(use)X
814(to)X
896(copy)X
1072(over,)X
1255(compile)X
1533(and)X
1669(execute)X
1935(the)X
2053(99-line)X
2300(bootstrap.)X
2658(The)X
2803(bootstrap)X
3121(sets)X
3261(up)X
3361(its)X
3456(own)X
3614(network)X
3897(connection)X
555 942(with)N
717(the)X
835(local)X
1011(worm)X
1218(and)X
1354(copies)X
1579(over)X
1742(the)X
1860(other)X
2045(\256les)X
2198(it)X
2262(needs,)X
2485(and)X
2621(using)X
2814(these)X
2999(pieces)X
3220(a)X
3276(remote)X
3519(worm)X
3726(is)X
3799(built)X
3965(and)X
4101(the)X
555 1032(infection)N
860(procedure)X
1202(starts)X
1391(over)X
1554(again.)X
755 1155(Defense)N
1039(tactics)X
1264(fall)X
1391(into)X
1535(three)X
1716(categories:)X
2084(preventing)X
2447(the)X
2565(detection)X
2879(of)X
2966(intrusion,)X
3290(inhibiting)X
3620(the)X
3738(analysis)X
4016(of)X
4103(the)X
555 1245(program,)N
867(and)X
1003(authenticating)X
1477(other)X
1662(worms.)X
1940(The)X
2085(worm's)X
2350(simplest)X
2636(means)X
2861(of)X
2948(hiding)X
3172(itself)X
3352(is)X
3425(to)X
3507(change)X
3755(its)X
3850(name.)X
4084(When)X
555 1335(it)N
619(starts)X
808(up,)X
928(it)X
992(clears)X
1200(its)X
1295(argument)X
1618(list)X
1735(and)X
1871(sets)X
2011(its)X
2106(zeroth)X
2327(argument)X
2650(to)X
2 f
2732(sh)X
1 f
2803(,)X
2843(allowing)X
3143(it)X
3207(to)X
3289(masquerade)X
3693(as)X
3780(an)X
3876(innocuous)X
555 1425(command)N
891(interpreter.)X
1286(It)X
1355(uses)X
2 f
1513(fork)X
1 f
1642(\(\))X
1716(to)X
1798(change)X
2046(its)X
2141(process)X
2402(I.D.,)X
2567(never)X
2766(staying)X
3017(too)X
3139(long)X
3301(at)X
3379(one)X
3515(I.D.)X
3680(These)X
3892(two)X
4032(tactics)X
555 1515(are)N
674(intended)X
970(to)X
1052(disguise)X
1334(the)X
1452(worm's)X
1717(presence)X
2019(on)X
2119(system)X
2361(status)X
2563(listings.)X
2853(The)X
2998(worm)X
3205(tries)X
3363(to)X
3445(leave)X
3635(as)X
3722(little)X
3888(trash)X
4064(lying)X
555 1605(around)N
798(as)X
885(it)X
949(can,)X
1101(so)X
1192(at)X
1270(start-up)X
1535(it)X
1599(reads)X
1789(all)X
1889(its)X
1984(support)X
2244(\256les)X
2397(into)X
2541(memory)X
2828(and)X
2964(deletes)X
3207(the)X
3325(tell-tale)X
3590(\256lesystem)X
3934(copies.)X
4199(It)X
555 1695(turns)N
735(off)X
849(the)X
967(generation)X
1326(of)X
2 f
1413(core)X
1 f
1576(\256les,)X
1749(so)X
1840(if)X
1909(the)X
2027(worm)X
2234(makes)X
2459(a)X
2515(mistake,)X
2804(it)X
2868(doesn't)X
3124(leave)X
3314(evidence)X
3620(behind)X
3858(in)X
3940(the)X
4058(form)X
555 1785(of)N
642(core)X
801(dumps.)X
1074(The)X
1219(latter)X
1404(tactic)X
1598(is)X
1671(also)X
1820(designed)X
2125(to)X
2207(block)X
2405(analysis)X
2683(of)X
2770(the)X
2888(program\320it)X
3304(prevents)X
3596(an)X
3692(administrator)X
4139(from)X
555 1875(sending)N
824(a)X
880(software)X
1177(signal)X
1388(to)X
1470(the)X
1588(worm)X
1795(to)X
1877(force)X
2063(it)X
2127(to)X
2209(dump)X
2411(a)X
2467(core)X
2626(\256le.)X
2788(There)X
2996(are)X
3115(other)X
3300(ways)X
3485(to)X
3567(get)X
3685(a)X
3741(core)X
3900(\256le,)X
4042(how-)X
555 1965(ever,)N
734(so)X
825(the)X
943(worm)X
1150(carefully)X
1456(alters)X
1650(character)X
1966(data)X
2120(in)X
2202(memory)X
2489(to)X
2571(prevent)X
2832(it)X
2896(from)X
3072(being)X
3270(extracted)X
3585(easily.)X
3832(Copies)X
4074(of)X
4161(disk)X
555 2055(\256les)N
708(are)X
827(encoded)X
1115(by)X
1215(repeatedly)X
1570(exclusive-or'ing)X
2116(a)X
2172(ten-byte)X
2455(code)X
2627(sequence;)X
2964(static)X
3153(strings)X
3386(are)X
3505(encoded)X
3793(byte-by-byte)X
555 2145(by)N
655(exclusive-or'ing)X
1201(with)X
1363(the)X
1481(hexadecimal)X
1907(value)X
2101(81,)X
2221(except)X
2451(for)X
2565(a)X
2621(private)X
2864(word)X
3049(list)X
3166(which)X
3382(is)X
3455(encoded)X
3743(with)X
3905(hexade-)X
555 2235(cimal)N
753(80)X
853(instead.)X
1140(If)X
1214(the)X
1332(worm's)X
1597(\256les)X
1750(are)X
1869(somehow)X
2196(captured)X
2493(before)X
2719(the)X
2837(worm)X
3044(can)X
3176(delete)X
3388(them,)X
3588(the)X
3706(object)X
3922(\256les)X
4075(have)X
555 2325(been)N
727(loaded)X
961(in)X
1043(such)X
1210(a)X
1266(way)X
1420(as)X
1507(to)X
1589(remove)X
1850(most)X
2025(non-essential)X
2468(symbol)X
2723(table)X
2899(entries,)X
3153(making)X
3413(it)X
3477(harder)X
3703(to)X
3785(guess)X
3983(at)X
4061(the)X
555 2415(purposes)N
860(of)X
947(worm)X
1154(routines)X
1432(from)X
1608(their)X
1775(names.)X
2040(The)X
2185(worm)X
2392(also)X
2541(makes)X
2766(a)X
2822(trivial)X
3033(effort)X
3232(to)X
3314(stop)X
3467(other)X
3652(programs)X
3975(from)X
4151(tak-)X
555 2505(ing)N
677(advantage)X
1023(of)X
1110(its)X
1205(communications;)X
1776(in)X
1858(theory)X
2083(a)X
2139(well-prepared)X
2606(site)X
2737(could)X
2935(prevent)X
3196(infection)X
3501(by)X
3601(sending)X
3870(messages)X
4193(to)X
555 2595(ports)N
735(that)X
875(the)X
993(worm)X
1200(was)X
1345(listening)X
1640(on,)X
1760(so)X
1851(the)X
1969(worm)X
2176(is)X
2249(careful)X
2493(to)X
2575(test)X
2706(connections)X
3109(using)X
3302(a)X
3358(short)X
3538(exchange)X
3862(of)X
3949(random)X
555 2685(``magic)N
825(numbers''.)X
755 2808(When)N
967(studying)X
1262(a)X
1318(tricky)X
1525(program)X
1817(like)X
1957(this,)X
2112(it's)X
2234(just)X
2369(as)X
2456(important)X
2787(to)X
2869(establish)X
3169(what)X
3345(the)X
3463(program)X
2 f
3755(does)X
3922(not)X
1 f
4044(do)X
4144(as)X
555 2898(what)N
731(it)X
795(does)X
962(do.)X
1102(The)X
1247(worm)X
2 f
1454(does)X
1621(not)X
1743(delete)X
1955(a)X
2015(system's)X
2307(\256les)X
1 f
2436(:)X
2478(it)X
2542(only)X
2704(removes)X
2996(\256les)X
3149(that)X
3289(it)X
3353(created)X
3606(in)X
3688(the)X
3806(process)X
4067(of)X
555 2988(bootstrapping.)N
1055(The)X
1200(program)X
1492(does)X
1659(not)X
1781(attempt)X
2041(to)X
2123(incapacitate)X
2527(a)X
2583(system)X
2825(by)X
2925(deleting)X
3203(important)X
3534(\256les,)X
3707(or)X
3794(indeed)X
4028(any)X
555 3078(\256les.)N
748(It)X
817(does)X
984(not)X
1106(remove)X
1367(log)X
1489(\256les)X
1642(or)X
1729(otherwise)X
2061(interfere)X
2354(with)X
2516(normal)X
2763(operation)X
3086(other)X
3271(than)X
3429(by)X
3529(consuming)X
3900(system)X
555 3168(resources.)N
919(The)X
1064(worm)X
2 f
1271(does)X
1438(not)X
1560(modify)X
1798(existing)X
2067(\256les)X
1 f
2196(:)X
2238(it)X
2302(is)X
2375(not)X
2497(a)X
2553(virus.)X
2773(The)X
2918(worm)X
3125(propagates)X
3493(by)X
3593(copying)X
3871(itself)X
4051(and)X
555 3258(compiling)N
899(itself)X
1079(on)X
1179(each)X
1347(system;)X
1611(it)X
1675(does)X
1842(not)X
1964(modify)X
2215(other)X
2400(programs)X
2723(to)X
2805(do)X
2905(its)X
3000(work)X
3185(for)X
3299(it.)X
3403(Due)X
3557(to)X
3639(its)X
3734(method)X
3994(of)X
4081(infec-)X
555 3348(tion,)N
719(it)X
783(can't)X
964(count)X
1162(on)X
1262(suf\256cient)X
1580(privileges)X
1916(to)X
1998(be)X
2094(able)X
2248(to)X
2330(modify)X
2581(programs.)X
2944(The)X
3089(worm)X
2 f
3296(does)X
3463(not)X
3585(install)X
3804(trojan)X
4019(horses)X
1 f
4228(:)X
555 3438(its)N
650(method)X
910(of)X
997(attack)X
1209(is)X
1282(strictly)X
1524(active,)X
1756(it)X
1820(never)X
2019(waits)X
2208(for)X
2322(a)X
2378(user)X
2532(to)X
2614(trip)X
2745(over)X
2908(a)X
2964(trap.)X
3149(Part)X
3298(of)X
3385(the)X
3503(reason)X
3733(for)X
3847(this)X
3982(is)X
4055(that)X
4195(the)X
555 3528(worm)N
762(can't)X
943(afford)X
1160(to)X
1242(waste)X
1445(time)X
1607(waiting)X
1867(for)X
1981(trojan)X
2188(horses\320it)X
2537(must)X
2712(reproduce)X
3054(before)X
3280(it)X
3344(is)X
3417(discovered.)X
3825(Finally,)X
4091(the)X
555 3618(worm)N
2 f
762(does)X
929(not)X
1051(record)X
1285(or)X
1376(transmit)X
1662(decrypted)X
1999(passwords)X
1 f
2336(:)X
2378(except)X
2608(for)X
2722(its)X
2817(own)X
2975(static)X
3164(list)X
3281(of)X
3368(favorite)X
3638(passwords,)X
4012(the)X
555 3708(worm)N
762(does)X
929(not)X
1051(propagate)X
1388(cracked)X
1659(passwords)X
2013(on)X
2113(to)X
2195(new)X
2349(worms)X
2587(nor)X
2714(does)X
2881(it)X
2945(transmit)X
3227(them)X
3407(back)X
3579(to)X
3661(some)X
3850(home)X
4048(base.)X
555 3798(This)N
717(is)X
790(not)X
912(to)X
994(say)X
1121(that)X
1261(the)X
1379(accounts)X
1680(that)X
1820(the)X
1938(worm)X
2145(penetrated)X
2500(are)X
2619(secure)X
2845(merely)X
3088(because)X
3363(the)X
3481(worm)X
3688(did)X
3810(not)X
3932(tell)X
4054(anyone)X
555 3888(what)N
731(their)X
898(passwords)X
1252(were,)X
1449(of)X
1536(course\320if)X
1895(the)X
2013(worm)X
2220(can)X
2352(guess)X
2550(an)X
2646(account's)X
2974(password,)X
3317(certainly)X
3618(others)X
3834(can)X
3966(too.)X
4128(The)X
555 3978(worm)N
2 f
762(does)X
929(not)X
1051(try)X
1160(to)X
1242(capture)X
1507(superuser)X
1843(privileges)X
1 f
2159(:)X
2201(while)X
2399(it)X
2463(does)X
2630(try)X
2739(to)X
2821(break)X
3020(into)X
3164(accounts,)X
3485(it)X
3549(doesn't)X
3805(depend)X
4057(on)X
555 4068(having)N
793(particular)X
1121(privileges)X
1457(to)X
1539(propagate,)X
1896(and)X
2032(never)X
2231(makes)X
2456(special)X
2699(use)X
2826(of)X
2913(such)X
3080(privileges)X
3416(if)X
3485(it)X
3549(somehow)X
3876(gets)X
4025(them.)X
555 4158(The)N
700(worm)X
2 f
907(does)X
1074(not)X
1196(propagate)X
1545(over)X
1708(uucp)X
1 f
1884(or)X
1971(X.25)X
2149(or)X
2236(DECNET)X
2572(or)X
2659(BITNET:)X
2986(it)X
3050(speci\256cally)X
3435(requires)X
3714(TCP/IP.)X
4013(The)X
555 4248(worm)N
2 f
762(does)X
929(not)X
1051(infect)X
1249(System)X
1492(V)X
1561(systems)X
1 f
1826(unless)X
2046(they)X
2204(have)X
2376(been)X
2548(modi\256ed)X
2852(to)X
2934(use)X
3061(Berkeley)X
3371(network)X
3654(programs)X
3977(like)X
2 f
4117(send-)X
555 4338(mail)N
1 f
697(,)X
2 f
737(\256ngerd)X
1 f
984(and)X
2 f
1120(rexec)X
1 f
1295(.)X
3 f
555 4524(4.)N
655(Internals)X
1 f
755 4647(Now)N
931(for)X
1045(some)X
1234(details:)X
1485(we)X
1599(shall)X
1770(follow)X
1999(the)X
2117(main)X
2297(thread)X
2518(of)X
2605(control)X
2852(in)X
2934(the)X
3052(worm,)X
3279(then)X
3437(examine)X
3729(some)X
3918(of)X
4005(the)X
555 4737(worm's)N
820(data)X
974(structures)X
1306(before)X
1532(working)X
1819(through)X
2088(each)X
2256(phase)X
2459(of)X
2546(activity.)X
3 f
555 4923(4.1.)N
715(The)X
868(thread)X
1115(of)X
1202(control)X
1 f
755 5046(When)N
967(the)X
1085(worm)X
1292(starts)X
1481(executing)X
1813(in)X
2 f
1895(main)X
1 f
(\(\),)S
2149(it)X
2213(takes)X
2398(care)X
2553(of)X
2640(some)X
2829(initializations,)X
3304(some)X
3493(defense)X
3759(and)X
3895(some)X
555 5136(cleanup.)N
865(The)X
1010(very)X
1173(\256rst)X
1317(thing)X
1501(it)X
1565(does)X
1732(is)X
1805(to)X
1887(change)X
2135(its)X
2230(name)X
2424(to)X
2 f
2506(sh)X
1 f
2577(.)X
2637(This)X
2799(shrinks)X
3050(the)X
3168(window)X
3446(during)X
3675(which)X
3891(the)X
4009(worm)X
4216(is)X
555 5226(visible)N
788(in)X
870(a)X
926(system)X
1168(status)X
1370(listing)X
1589(as)X
1676(a)X
1732(process)X
1993(with)X
2155(an)X
2251(odd)X
2391(name)X
2585(like)X
2 f
2725(x9834753)X
1 f
3041(.)X
3101(It)X
3170(then)X
3328(initializes)X
3659(the)X
3777(random)X
4042(number)X
555 5316(generator,)N
899(seeding)X
1164(it)X
1228(with)X
1390(the)X
1508(current)X
1756(time,)X
1938(turns)X
2118(off)X
2232(core)X
2391(dumps,)X
2644(and)X
2780(arranges)X
3073(to)X
3155(die)X
3273(when)X
3467(remote)X
3710(connections)X
4113(fail.)X
555 5406(With)N
735(this)X
870(out)X
992(of)X
1079(the)X
1197(way,)X
1371(the)X
1489(worm)X
1696(processes)X
2024(its)X
2119(argument)X
2442(list.)X
2599(It)X
2668(\256rst)X
2812(looks)X
3005(for)X
3119(an)X
3215(option)X
3 f
9 f
3439(-)X
3441(-)X
3 f
3485(p)X
2 f
3549($$)X
1 f
(,)S
3669(where)X
2 f
3886($$)X
1 f
555 5496(represents)N
901(the)X
1019(process)X
1280(I.D.)X
1425(of)X
1512(its)X
1607(parent)X
1828(process;)X
2111(this)X
2246(option)X
2470(indicates)X
2775(to)X
2857(the)X
2975(worm)X
3182(that)X
3322(it)X
3386(must)X
3561(take)X
3715(care)X
3870(to)X
3952(clean)X
4142(up)X
555 5586(after)N
723(itself.)X
943(It)X
1012(proceeds)X
1318(to)X
1400(read)X
1559(in)X
1641(each)X
1809(of)X
1896(the)X
2014(\256les)X
2167(it)X
2231(was)X
2376(given)X
2574(as)X
2661(arguments;)X
3037(if)X
3106(cleaning)X
3398(up,)X
3518(it)X
3582(removes)X
3874(each)X
4042(\256le)X
555 5676(after)N
723(it)X
787(reads)X
977(it.)X
1081(If)X
1155(the)X
1273(worm)X
1480(wasn't)X
1714(given)X
1912(the)X
2030(bootstrap)X
2348(source)X
2578(\256le)X
2 f
2700(l1.c)X
1 f
2838(as)X
2925(an)X
3021(argument,)X
3364(it)X
3428(exits)X
3599(silently;)X
3876(this)X
4011(is)X
555 5766(perhaps)N
825(intended)X
1121(to)X
1203(slow)X
1374(down)X
1572(people)X
1806(who)X
1964(are)X
2083(experimenting)X
2566(with)X
2728(the)X
2846(worm.)X
3093(If)X
3167(cleaning)X
3459(up,)X
3579(the)X
3697(worm)X
3904(then)X
4062(closes)X

5 p
%%Page: 5 5
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(5)X
1 f
555 762(its)N
650(\256le)X
772(descriptors,)X
1164(temporarily)X
1558(cutting)X
1800(itself)X
1980(off)X
2094(from)X
2270(its)X
2365(remote)X
2608(parent)X
2829(worm,)X
3056(and)X
3192(removes)X
3484(some)X
3673(\256les.)X
3866(\(One)X
4047(of)X
4134(these)X
555 852(\256les,)N
2 f
728(/tmp/.dumb)X
1 f
1090(,)X
1130(is)X
1203(never)X
1402(created)X
1655(by)X
1755(the)X
1873(worm)X
2080(and)X
2216(the)X
2334(unlinking)X
2660(seems)X
2876(to)X
2958(be)X
3054(left)X
3181(over)X
3344(from)X
3520(an)X
3616(earlier)X
3842(stage)X
4027(of)X
555 942(development.\))N
1036(The)X
1181(worm)X
1388(then)X
1546(zeroes)X
1772(out)X
1894(its)X
1989(argument)X
2312(list,)X
2449(again)X
2643(to)X
2725(foil)X
2856(the)X
2974(system)X
3216(status)X
3418(program)X
2 f
3710(ps)X
1 f
3781(.)X
3841(The)X
3986(next)X
4144(step)X
555 1032(is)N
628(to)X
710(initialize)X
1010(the)X
1128(worm's)X
1393(list)X
1510(of)X
1597(network)X
1880(interfaces;)X
2235(these)X
2420(interfaces)X
2753(are)X
2872(used)X
3039(to)X
3121(\256nd)X
3265(local)X
3441(networks)X
3755(and)X
3891(to)X
3973(check)X
4181(for)X
555 1122(alternate)N
852(addresses)X
1180(of)X
1267(the)X
1385(current)X
1633(host.)X
1826(Finally,)X
2092(if)X
2161(cleaning)X
2453(up)X
2553(the)X
2671(worm)X
2878(resets)X
3081(its)X
3176(process)X
3437(group)X
3644(and)X
3780(kills)X
3937(the)X
4055(process)X
555 1212(that)N
695(helped)X
929(to)X
1011(bootstrap)X
1329(it.)X
1433(The)X
1578(worm's)X
1843(last)X
1974(act)X
2088(in)X
2 f
2170(main)X
1 f
(\(\))S
2404(is)X
2477(to)X
2559(call)X
2695(a)X
2751(function)X
3038(we)X
3152(named)X
2 f
3386(doit)X
1 f
3510(\(\),)X
3604(which)X
3820(contains)X
4107(the)X
555 1302(main)N
735(loop)X
897(of)X
984(the)X
1102(worm.)X
2 f
755 1425(doit)N
1 f
879(\(\))X
953(runs)X
1111(a)X
1167(short)X
1347(prologue)X
1652(before)X
1878(actually)X
2152(starting)X
2412(the)X
2530(main)X
2710(loop.)X
2912(It)X
2981(\(redundantly\))X
3438(seeds)X
3632(the)X
3750(random)X
4015(number)X
555 1515(generator)N
879(with)X
1041(the)X
1159(current)X
1407(time,)X
1589(saving)X
1818(the)X
1936(time)X
2098(so)X
2189(that)X
2329(it)X
2393(can)X
2525(tell)X
2647(how)X
2805(long)X
2967(it)X
3031(has)X
3158(been)X
3330(running.)X
3639(The)X
3784(worm)X
3991(then)X
555 1605(attempts)N
846(its)X
941(\256rst)X
1085(infection.)X
1430(It)X
1499(initially)X
1767(attacks)X
2010(gateways)X
2329(that)X
2469(it)X
2533(found)X
2740(with)X
2902(the)X
2 f
3020(netstat)X
1 f
3253(network)X
3536(status)X
3738(program;)X
4052(if)X
4121(it)X
555 1695(can't)N
736(infect)X
939(one)X
1075(of)X
1162(these)X
1347(hosts,)X
1551(then)X
1709(it)X
1773(checks)X
2012(random)X
2277(host)X
2430(numbers)X
2726(on)X
2826(local)X
3002(networks,)X
3336(then)X
3494(it)X
3558(tries)X
3716(random)X
3981(host)X
555 1785(numbers)N
851(on)X
951(networks)X
1265(that)X
1405(are)X
1524(on)X
1624(the)X
1742(far)X
1852(side)X
2001(of)X
2088(gateways,)X
2427(in)X
2509(each)X
2677(case)X
2836(stopping)X
3131(if)X
3200(it)X
3264(succeeds.)X
3610(\(Note)X
3813(that)X
3953(this)X
555 1875(sequence)N
870(of)X
957(attacks)X
1200(differs)X
1430(from)X
1606(the)X
1724(sequence)X
2039(the)X
2157(worm)X
2364(uses)X
2522(after)X
2690(it)X
2754(has)X
2881(entered)X
3138(the)X
3256(main)X
3436(loop.\))X
755 1998(After)N
945(this)X
1080(initial)X
1286(attempt)X
1546(at)X
1624(infection,)X
1949(the)X
2067(worm)X
2274(calls)X
2441(the)X
2559(routine)X
2 f
2806(checkother)X
1 f
3159(\(\))X
3233(to)X
3315(check)X
3523(for)X
3637(another)X
3898(worm)X
555 2088(already)N
812(on)X
912(the)X
1030(local)X
1206(machine.)X
1538(In)X
1625(this)X
1760(check)X
1968(the)X
2086(worm)X
2293(acts)X
2438(as)X
2525(a)X
2581(client)X
2779(to)X
2861(an)X
2957(existing)X
3230(worm)X
3437(which)X
3653(acts)X
3798(as)X
3885(a)X
3941(server;)X
555 2178(they)N
713(may)X
871(exchange)X
1195(``population)X
1611(control'')X
1912(messages,)X
2255(after)X
2423(which)X
2639(one)X
2775(of)X
2862(the)X
2980(two)X
3120(worms)X
3358(will)X
3502(eventually)X
3856(shut)X
4009(down.)X
755 2301(One)N
909(odd)X
1049(routine)X
1296(is)X
1369(called)X
1581(just)X
1716(before)X
1942(entering)X
2225(the)X
2343(main)X
2523(loop.)X
2725(We)X
2857(named)X
3091(this)X
3226(routine)X
2 f
3473(send_message)X
1 f
3932(\(\),)X
4026(but)X
4148(it)X
555 2391(really)N
758(doesn't)X
1014(send)X
1181(anything)X
1481(at)X
1559(all.)X
1699(It)X
1768(looks)X
1961(like)X
2101(it)X
2165(was)X
2310(intended)X
2606(to)X
2688(cause)X
2887(1)X
2947(in)X
3029(15)X
3129(copies)X
3354(of)X
3441(the)X
3559(worm)X
3766(to)X
3848(send)X
4015(a)X
4071(1-byte)X
555 2481(datagram)N
874(to)X
956(a)X
1012(port)X
1161(on)X
1261(the)X
1379(host)X
2 f
1532 0.1912(ernie.berkeley.edu)AX
1 f
2126(,)X
2166(which)X
2382(is)X
2455(located)X
2707(in)X
2789(the)X
2907(Computer)X
3247(Science)X
3517(Department)X
3916(at)X
3994(UC)X
555 2571(Berkeley.)N
905(It)X
974(has)X
1101(been)X
1273(suggested)X
1609(that)X
1749(this)X
1884(was)X
2029(a)X
2085(feint,)X
2272(designed)X
2577(to)X
2659(draw)X
2840(attention)X
3140(to)X
2 f
3222(ernie)X
1 f
3407(and)X
3543(away)X
3733(from)X
3909(the)X
4027(author's)X
12 s
10 f
555 2775(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N
1 f
1035 3072(doit\(\))N
1273({)X
2 f
1227 3180(seed)N
1422(the)X
1564(random)X
1886(number)X
2203(generator)X
2606(with)X
2796(the)X
2938(time)X
1227 3288(attack)N
1487(hosts:)X
1740(gateways,)X
2146(local)X
2363(nets,)X
2566(remote)X
2857(nets)X
1 f
1227 3396(checkother\(\);)N
1227 3504(send_message\(\);)N
1227 3612(for)N
1363(\(;;\))X
1505({)X
1419 3720(cracksome\(\);)N
1419 3828(other_sleep\(30\);)N
1419 3936(cracksome\(\);)N
2 f
1419 4044(change)N
1721(our)X
1878(process)X
2195(ID)X
1419 4152(attack)N
1679(hosts:)X
1932(gateways,)X
2338(known)X
2613(hosts,)X
1611 4260(remote)N
1902(nets,)X
2105(local)X
2322(nets)X
1 f
1419 4368(other_sleep\(120\);)N
2 f
1419 4476(if)N
1497(12)X
1617(hours)X
1859(have)X
2065(passed,)X
1611 4584(reset)N
1822(hosts)X
2043(table)X
1 f
1419 4692(if)N
1502(\(pleasequit)X
1949(&&)X
2123(nextw)X
2382(>)X
2460(10\))X
1611 4800(exit\(0\);)N
1227 4908(})N
1035 5016(})N
3 f
1612 5232(``C'')N
1833(pseudo-code)X
2363(for)X
2510(the)X
2 f
2662(doit)X
3 f
2812(\(\))X
2900(function)X
1 f
10 f
555 5448(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N

6 p
%%Page: 6 6
12 s 0 xH 0 xS 10 f
10 s
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(6)X
1 f
555 762(real)N
696(host.)X
889(Since)X
1087(the)X
1205(routine)X
1452(has)X
1579(a)X
1635(bug)X
1775(\(it)X
1866(sets)X
2006(up)X
2106(a)X
2162(TCP)X
2328(socket)X
2553(but)X
2675(tries)X
2833(to)X
2915(send)X
3082(a)X
3138(UDP)X
3318(packet\),)X
3595(nothing)X
3859(gets)X
4008(sent)X
4157(at)X
555 852(all.)N
695(It's)X
822(possible)X
1104(that)X
1244(this)X
1379(was)X
1524(a)X
1580(deeper)X
1815(feint,)X
2002(designed)X
2307(to)X
2389(be)X
2485(uncovered)X
2840(only)X
3002(by)X
3102(decompilers;)X
3536(if)X
3605(so,)X
3716(this)X
3851(wouldn't)X
4160(be)X
555 942(the)N
673(only)X
835(deliberate)X
1172(impediment)X
1574(that)X
1714(the)X
1832(author)X
2057(put)X
2179(in)X
2261(our)X
2388(way.)X
2582(In)X
2669(any)X
2805(case,)X
2984(administrators)X
3462(at)X
3540(Berkeley)X
3850(never)X
555 1032(detected)N
843(any)X
979(process)X
1240(listening)X
1535(at)X
1613(port)X
1762(11357)X
1982(on)X
2082(ernie,)X
2283(and)X
2419(we)X
2533(found)X
2740(no)X
2840(code)X
3012(in)X
3094(the)X
3212(worm)X
3419(that)X
3559(listens)X
3783(at)X
3861(that)X
4001(port,)X
555 1122(regardless)N
901(of)X
988(the)X
1106(host.)X
755 1245(The)N
900(main)X
1080(loop)X
1242(begins)X
1471(with)X
1633(a)X
1689(call)X
1825(to)X
1907(a)X
1963(function)X
2250(named)X
2 f
2484(cracksome)X
1 f
2828(\(\))X
2902(for)X
3016(some)X
3205(password)X
3528(cracking.)X
3865(Password)X
555 1335(cracking)N
852(is)X
925(an)X
1021(activity)X
1281(that)X
1421(the)X
1539(worm)X
1746(is)X
1819(constantly)X
2168(working)X
2455(at)X
2533(in)X
2615(an)X
2711(incremental)X
3110(fashion.)X
3406(It)X
3475(takes)X
3660(a)X
3716(break)X
3915(for)X
4029(30)X
555 1425(seconds)N
829(to)X
911(look)X
1073(for)X
1187(intruding)X
1500(copies)X
1725(of)X
1812(the)X
1930(worm)X
2137(on)X
2237(the)X
2355(local)X
2531(host,)X
2704(and)X
2840(then)X
2998(goes)X
3165(back)X
3337(to)X
3419(cracking.)X
3756(After)X
3946(this)X
4081(ses-)X
555 1515(sion,)N
728(it)X
792(forks)X
977(\(creates)X
1248(a)X
1304(new)X
1458(process)X
1719(running)X
1988(with)X
2150(a)X
2206(copy)X
2382(of)X
2469(the)X
2587(same)X
2772(image\))X
3015(and)X
3151(the)X
3269(old)X
3391(process)X
3652(exits;)X
3845(this)X
3980(serves)X
4201(to)X
555 1605(turn)N
704(over)X
867(process)X
1128(I.D.)X
1273(numbers)X
1569(and)X
1705(makes)X
1930(it)X
1994(harder)X
2220(to)X
2302(track)X
2483(the)X
2601(worm)X
2808(with)X
2970(the)X
3088(system)X
3330(status)X
3532(program)X
2 f
3824(ps)X
1 f
3895(.)X
3955(At)X
4055(this)X
555 1695(point)N
739(the)X
857(worm)X
1064(goes)X
1231(back)X
1403(to)X
1485(its)X
1580(infectious)X
1916(stage,)X
2121(trying)X
2332(\(in)X
2441(order)X
2631(of)X
2718 0.4000(preference\))AX
3106(gateways,)X
3445(hosts)X
3629(listed)X
3822(in)X
3904(system)X
555 1785(tables)N
762(like)X
2 f
902(/etc/hosts.equiv)X
1 f
1398(,)X
1438(random)X
1703(host)X
1856(numbers)X
2152(on)X
2252(the)X
2370(far)X
2480(side)X
2629(of)X
2716(gateways)X
3035(and)X
3171(random)X
3436(hosts)X
3620(on)X
3720(local)X
3896(networks.)X
555 1875(As)N
664(before,)X
910(if)X
979(it)X
1043(succeeds)X
1349(in)X
1431(infecting)X
1736(a)X
1792(new)X
1946(host,)X
2119(it)X
2183(marks)X
2399(that)X
2539(host)X
2692(in)X
2774(a)X
2830(list)X
2947(and)X
3083(leaves)X
3304(the)X
3422(infection)X
3727(phase)X
3930(for)X
4044(the)X
555 1965(time)N
717(being.)X
955(After)X
1145(infection,)X
1470(the)X
1588(worm)X
1795(spends)X
2033(two)X
2173(minutes)X
2446(looking)X
2710(for)X
2824(new)X
2978(local)X
3154(copies)X
3379(of)X
3466(the)X
3584(worm)X
3791(again;)X
4007(this)X
4142(is)X
555 2055(done)N
731(here)X
890(because)X
1165(a)X
1221(newly)X
1437(infected)X
1716(remote)X
1959(host)X
2112(may)X
2270(try)X
2379(to)X
2461(reinfect)X
2727(the)X
2845(local)X
3021(host.)X
3214(If)X
3288(12)X
3388(hours)X
3586(have)X
3758(passed)X
3992(and)X
4128(the)X
555 2145(worm)N
762(is)X
835(still)X
974(alive,)X
1170(it)X
1234(assumes)X
1521(that)X
1661(it)X
1725(has)X
1852(had)X
1988(bad)X
2124(luck)X
2282(due)X
2418(to)X
2500(networks)X
2814(or)X
2901(hosts)X
3085(being)X
3283(down,)X
3501(and)X
3637(it)X
3701(reinitializes)X
4095(its)X
555 2235(table)N
731(of)X
818(hosts)X
1002(so)X
1093(that)X
1233(it)X
1297(can)X
1429(start)X
1587(over)X
1750(from)X
1926(scratch.)X
2214(At)X
2314(the)X
2432(end)X
2568(of)X
2655(the)X
2773(main)X
2953(loop)X
3115(the)X
3233(worm)X
3440(checks)X
3679(to)X
3761(see)X
3884(if)X
3953(it)X
4017(is)X
555 2325(scheduled)N
896(to)X
978(die)X
1096(as)X
1183(a)X
1239(result)X
1437(of)X
1524(its)X
1619(population)X
1981(control)X
2228(features,)X
2523(and)X
2659(if)X
2728(it)X
2792(is,)X
2885(and)X
3021(if)X
3090(it)X
3154(has)X
3281(done)X
3457(a)X
3513(suf\256cient)X
3831(amount)X
4091(of)X
555 2415(work)N
740(cracking)X
1037(passwords,)X
1411(it)X
1475(exits.)X
3 f
555 2601(4.2.)N
715(Data)X
900(structures)X
1 f
755 2724(The)N
900(worm)X
1107(maintains)X
1438(at)X
1516(least)X
1683(four)X
1837(interesting)X
2195(data)X
2349(structures,)X
2701(and)X
2837(each)X
3005(is)X
3078(associated)X
3428(with)X
3590(a)X
3646(set)X
3755(of)X
3842(support)X
4102(rou-)X
555 2814(tines.)N
755 2937(The)N
2 f
900(object)X
1 f
1116(structure)X
1417(is)X
1490(used)X
1657(to)X
1739(hold)X
1901(copies)X
2126(of)X
2213(\256les.)X
2406(Files)X
2581(are)X
2700(encrypted)X
3037(using)X
3230(the)X
3348(function)X
2 f
3635(xorbuf)X
1 f
3844(\(\))X
3918(while)X
4116(in)X
555 3027(memory,)N
862(so)X
953(that)X
1093(dumps)X
1326(of)X
1413(the)X
1531(worm)X
1738(won't)X
1945(reveal)X
2162(anything)X
2462(interesting.)X
2860(The)X
3005(\256les)X
3158(are)X
3277(copied)X
3511(to)X
3593(disk)X
3746(on)X
3846(a)X
3902(remote)X
4145(sys-)X
555 3117(tem)N
695(before)X
921(starting)X
1181(a)X
1237(new)X
1391(worm,)X
1618(and)X
1754(new)X
1908(worms)X
2146(read)X
2305(the)X
2423(\256les)X
2576(into)X
2720(memory)X
3007(and)X
3143(delete)X
3355(the)X
3473(disk)X
3626(copies)X
3851(as)X
3938(part)X
4083(of)X
555 3207(their)N
722(start-up)X
987(duties.)X
1238(Each)X
1419(structure)X
1720(contains)X
2007(a)X
2063(name,)X
2277(a)X
2333(length)X
2553(and)X
2689(a)X
2745(pointer)X
2992(to)X
3074(a)X
3130(buffer.)X
3387(The)X
3532(function)X
2 f
3819(getobject-)X
555 3297(byname)N
1 f
805(\(\))X
879(retrieves)X
1176(a)X
1232(pointer)X
1479(to)X
1561(a)X
1617(named)X
1851(object)X
2067(structure;)X
2390(for)X
2504(some)X
2693(reason,)X
2943(it)X
3007(is)X
3080(only)X
3242(used)X
3409(to)X
3491(call)X
3627(up)X
3727(the)X
3845(bootstrap)X
555 3387(source)N
785(\256le.)X
755 3510(The)N
2 f
900(interface)X
1 f
1205(structure)X
1506(contains)X
1793(information)X
2191(about)X
2389(the)X
2507(current)X
2755(host's)X
2966(network)X
3249(interfaces.)X
3622(This)X
3784(is)X
3857(mainly)X
4099(used)X
555 3600(to)N
637(check)X
845(for)X
959(local)X
1135(attached)X
1423(networks.)X
1777(It)X
1846(contains)X
2133(a)X
2189(name,)X
2403(a)X
2459(network)X
2742(address,)X
3023(a)X
3079(subnet)X
3308(mask)X
3497(and)X
3633(some)X
3822(\257ags.)X
4033(The)X
555 3690(interface)N
857(table)X
1033(is)X
1106(initialized)X
1446(once)X
1618(at)X
1696(start-up)X
1961(time.)X
755 3813(The)N
2 f
900(host)X
1 f
1053(structure)X
1354(is)X
1427(used)X
1594(to)X
1676(keep)X
1848(track)X
2029(of)X
2116(the)X
2234(status)X
2436(and)X
2572(addresses)X
2900(of)X
2987(hosts.)X
3211(Hosts)X
3413(are)X
3532(added)X
3744(to)X
3826(this)X
3961(list)X
555 3903(dynamically,)N
991(as)X
1078(the)X
1196(worm)X
1403(encounters)X
1771(new)X
1925(sources)X
2186(of)X
2273(host)X
2426(names)X
2651(and)X
2787(addresses.)X
3155(The)X
3300(list)X
3417(can)X
3549(be)X
3645(searched)X
3947(for)X
4061(a)X
4117(par-)X
555 3993(ticular)N
780(address)X
1041(or)X
1128(name,)X
1342(with)X
1504(an)X
1600(option)X
1824(to)X
1906(insert)X
2104(a)X
2160(new)X
2314(entry)X
2499(if)X
2568(no)X
2668(matching)X
2986(entry)X
3171(is)X
3244(found.)X
3491(Flag)X
3653(bits)X
3788(are)X
3907(used)X
4074(to)X
555 4083(indicate)N
829(whether)X
1108(the)X
1226(host)X
1379(is)X
1452(a)X
1508(gateway,)X
1816(whether)X
2095(it)X
2159(was)X
2304(found)X
2511(in)X
2593(a)X
2649(system)X
2891(table)X
3067(like)X
2 f
3207(/etc/hosts.equiv)X
1 f
3703(,)X
3743(whether)X
4022(the)X
555 4173(worm)N
762(has)X
889(found)X
1096(it)X
1160(impossible)X
1526(to)X
1608(attack)X
1820(the)X
1938(host)X
2091(for)X
2205(some)X
2394(reason,)X
2644(and)X
2780(whether)X
3059(the)X
3177(host)X
3330(has)X
3457(already)X
3714(been)X
3886(successfully)X
555 4263(infected.)N
874(The)X
1019(bits)X
1154(for)X
1268(``can't)X
1503(infect'')X
1760(and)X
1896(``infected'')X
2283(are)X
2402(cleared)X
2655(every)X
2854(12)X
2954(hours,)X
3172(and)X
3308(low)X
3448(priority)X
3708(hosts)X
3892(are)X
4011(deleted,)X
555 4353(to)N
637(be)X
733(accumulated)X
1159(again)X
1353(later.)X
1556(The)X
1701(structure)X
2002(contains)X
2289(up)X
2389(to)X
2471(12)X
2571(names)X
2796(\(aliases\))X
3084(and)X
3220(up)X
3320(to)X
3402(6)X
3462(distinct)X
3717(network)X
555 4443(addresses)N
883(for)X
997(each)X
1165(host.)X
755 4566(In)N
842(our)X
969(sources,)X
1250(what)X
1426(we've)X
1643(called)X
1855(the)X
2 f
1973(muck)X
1 f
2163(structure)X
2464(is)X
2537(used)X
2704(to)X
2786(keep)X
2958(track)X
3139(of)X
3226(accounts)X
3527(for)X
3641(the)X
3759(purpose)X
4033(of)X
4120(pass-)X
555 4656(word)N
740(cracking.)X
1077(\(It)X
1173(was)X
1318(awarded)X
1611(the)X
1729(name)X
2 f
1923(muck)X
1 f
2113(for)X
2227(sentimental)X
2616(reasons,)X
2897(although)X
2 f
3197(pw)X
1 f
3310(or)X
2 f
3397(acct)X
1 f
3551(might)X
3757(be)X
3853(more)X
555 4746(mnemonic.\))N
960(Each)X
1141(structure)X
1442(contains)X
1729(an)X
1825(account)X
2095(name,)X
2309(an)X
2405(encrypted)X
2742(password,)X
3085(a)X
3141(decrypted)X
3478(password)X
3801(\(if)X
3897(available\))X
555 4836(plus)N
708(the)X
826(home)X
1024(directory)X
1334(and)X
1470(personal)X
1762(information)X
2160(\256elds)X
2353(from)X
2529(the)X
2647(password)X
2970(\256le.)X
3 f
555 5022(4.3.)N
715(Population)X
1107(growth)X
1 f
755 5145(The)N
900(worm)X
1107(contains)X
1394(a)X
1450(mechanism)X
1835(that)X
1975(seems)X
2191(to)X
2273(be)X
2369(designed)X
2674(to)X
2756(limit)X
2926(the)X
3044(number)X
3309(of)X
3396(copies)X
3621(of)X
3708(the)X
3826(worm)X
4033(running)X
555 5235(on)N
655(a)X
711(given)X
909(system,)X
1171(but)X
1293(beyond)X
1549(that)X
1689(our)X
1816(current)X
2064(understanding)X
2538(of)X
2625(the)X
2743(design)X
2972(goals)X
3161(is)X
3234(itself)X
3414(limited.)X
3700(It)X
3769(clearly)X
4008(does)X
4175(not)X
555 5325(prevent)N
816(a)X
872(system)X
1114(from)X
1290(being)X
1488(overloaded,)X
1885(although)X
2185(it)X
2249(does)X
2416(appear)X
2651(to)X
2733(pace)X
2901(the)X
3019(infection)X
3324(so)X
3415(that)X
3555(early)X
3736(copies)X
3961(can)X
4093(go)X
555 5415(undetected.)N
963(It)X
1032(has)X
1159(been)X
1331(suggested)X
1667(that)X
1807(a)X
1863(simulation)X
2220(of)X
2307(the)X
2425(worm's)X
2690(population)X
3052(control)X
3299(features)X
3574(might)X
3780(reveal)X
3997(more)X
555 5505(about)N
753(its)X
848(design,)X
1097(and)X
1233(we)X
1347(are)X
1466(interested)X
1798(writing)X
2049(such)X
2216(a)X
2272(simulation.)X
755 5628(The)N
900(worm)X
1107(uses)X
1265(a)X
1321 0.1953(client-and-server)AX
1886(technique)X
2218(to)X
2300(control)X
2547(the)X
2665(number)X
2930(of)X
3017(copies)X
3242(executing)X
3574(on)X
3674(the)X
3792(current)X
555 5718(machine.)N
887(A)X
965(routine)X
2 f
1212(checkother)X
1 f
1565(\(\))X
1639(is)X
1712(run)X
1839(at)X
1917(start-up)X
2182(time.)X
2384(This)X
2546(function)X
2833(tries)X
2991(to)X
3073(connect)X
3343(to)X
3425(a)X
3481(server)X
3698(listening)X
3993(at)X
4071(TCP)X

7 p
%%Page: 7 7
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(7)X
1 f
555 762(port)N
704(23357.)X
964(The)X
1109(connection)X
1481(attempt)X
1741(returns)X
1984(immediately)X
2404(if)X
2473(no)X
2573(server)X
2790(is)X
2863(present,)X
3135(but)X
3257(blocks)X
3486(if)X
3555(one)X
3691(is)X
3764(available)X
4074(and)X
555 852(busy;)N
748(a)X
804(server)X
1021(worm)X
1228(periodically)X
1631(runs)X
1789(its)X
1884(server)X
2101(code)X
2273(during)X
2502(time-consuming)X
3042(operations)X
3396(so)X
3487(that)X
3627(the)X
3745(queue)X
3957(of)X
4044(connec-)X
555 942(tions)N
730(does)X
897(not)X
1019(grow)X
1204(large.)X
1425(After)X
1615(the)X
1733(client)X
1931(exchanges)X
2286(magic)X
2502(numbers)X
2798(with)X
2960(the)X
3078(server)X
3295(as)X
3382(a)X
3438(trivial)X
3649(form)X
3825(of)X
3912(authentica-)X
555 1032(tion,)N
719(the)X
837(client)X
1035(and)X
1171(the)X
1289(server)X
1506(roll)X
1637(dice)X
1791(to)X
1873(see)X
1996(who)X
2154(gets)X
2303(to)X
2385(survive.)X
2681(If)X
2755(the)X
2873(exclusive-or)X
3290(of)X
3377(the)X
3495(respective)X
3841(low)X
3981(bits)X
4116(of)X
555 1122(the)N
673(client's)X
929(and)X
1065(the)X
1183(server's)X
1458(random)X
1723(numbers)X
2019(is)X
2092(1,)X
2172(the)X
2290(server)X
2507(wins,)X
2698(otherwise)X
3030(the)X
3148(client)X
3346(wins.)X
3557(The)X
3702(loser)X
3878(sets)X
4018(a)X
4074(\257ag)X
2 f
555 1212(pleasequit)N
1 f
904(that)X
1044(eventually)X
1398(allows)X
1627(it)X
1691(to)X
1773(exit)X
1913(at)X
1991(the)X
2109(bottom)X
2355(of)X
2442(the)X
2560(main)X
2740(loop.)X
2942(If)X
3016(at)X
3094(any)X
3230(time)X
3392(a)X
3448(problem)X
3735(occurs\320a)X
4081(read)X
555 1302(from)N
731(the)X
849(server)X
1066(fails,)X
1244(or)X
1331(the)X
1449(wrong)X
1674(magic)X
1890(number)X
2155(is)X
2228(returned\320the)X
2694(client)X
2892(worm)X
3099(returns)X
3342(from)X
3518(the)X
3636(function,)X
3943(becoming)X
555 1392(a)N
611(worm)X
818(that)X
958(never)X
1157(acts)X
1302(as)X
1389(a)X
1445(server)X
1662(and)X
1798(hence)X
2006(does)X
2173(not)X
2295(engage)X
2543(in)X
2625(population)X
2987(control.)X
3274(Perhaps)X
3548(as)X
3635(a)X
3691(precaution)X
4050(against)X
555 1482(a)N
611(cataleptic)X
939(server,)X
1176(a)X
1232(test)X
1363(at)X
1441(the)X
1559(top)X
1681(of)X
1768(the)X
1886(function)X
2173(causes)X
2403(1)X
2463(in)X
2545(7)X
2605(worms)X
2843(to)X
2925(skip)X
3078(population)X
3440(control.)X
3727(Thus)X
3907(the)X
4025(worm)X
555 1572(\256nishes)N
819(the)X
937(population)X
1299(game)X
1493(in)X
2 f
1575(checkother)X
1 f
1928(\(\))X
2002(in)X
2084(one)X
2220(of)X
2307(three)X
2488(states:)X
2708(scheduled)X
3049(to)X
3131(die)X
3249(after)X
3417(some)X
3606(time,)X
3788(with)X
2 f
3950(pleasequit)X
1 f
555 1662(set;)N
686(running)X
955(as)X
1042(a)X
1098(server,)X
1335(with)X
1497(the)X
1615(possibility)X
1967(of)X
2054(losing)X
2269(the)X
2387(game)X
2581(later;)X
2766(and)X
2902(immortal,)X
3235(safe)X
3385(from)X
3561(the)X
3679(gamble)X
3935(of)X
4022(popula-)X
555 1752(tion)N
699(control.)X
755 1875(A)N
833(complementary)X
1352(routine)X
2 f
1599(other_sleep)X
1 f
1973(\(\))X
2047(executes)X
2344(the)X
2462(server)X
2679(function.)X
3006(It)X
3075(is)X
3148(passed)X
3382(a)X
3438(time)X
3600(in)X
3682(seconds,)X
3976(and)X
4112(it)X
555 1965(uses)N
713(the)X
831(Berkeley)X
2 f
1141(select)X
1 f
1324(\(\))X
1398(system)X
1640(call)X
1776(to)X
1858(wait)X
2016(for)X
2130(that)X
2270(amount)X
2530(of)X
2617(time)X
2779(accepting)X
3107(connections)X
3510(from)X
3686(clients.)X
3955(On)X
4073(entry)X
555 2055(to)N
637(the)X
755(function,)X
1062(it)X
1126(tests)X
1288(to)X
1370(see)X
1493(whether)X
1772(it)X
1836(has)X
1963(a)X
2019(communications)X
2568(port)X
2717(with)X
2879(which)X
3095(to)X
3177(accept)X
3403(connections;)X
3828(if)X
3897(not,)X
4039(it)X
4103(sim-)X
555 2145(ply)N
677(sleeps)X
893(for)X
1007(the)X
1125(speci\256ed)X
1430(amount)X
1690(of)X
1777(time)X
1939(and)X
2075(returns.)X
2358(Otherwise)X
2708(it)X
2772(loops)X
2965(on)X
2 f
3065(select)X
1 f
3248(\(\),)X
3342(decrementing)X
3799(its)X
3894(time)X
555 2235(remaining)N
900(after)X
1068(serving)X
1324(a)X
1380(client)X
1578(until)X
1744(no)X
1844(more)X
2029(time)X
2191(is)X
2264(left)X
2391(and)X
2527(the)X
2645(function)X
2932(returns.)X
3215(When)X
3427(the)X
3545(server)X
3762(acquires)X
4050(a)X
555 2325(client,)N
773(it)X
837(performs)X
1147(the)X
1265(inverse)X
1517(of)X
1604(the)X
1722(client's)X
1978(protocol,)X
2285(eventually)X
2639(deciding)X
2935(whether)X
3214(to)X
3296(proceed)X
3571(or)X
3658(to)X
3740(quit.)X
2 f
555 2415(other_sleep)N
1 f
929(\(\))X
1003(is)X
1076(called)X
1288(from)X
1464(many)X
1662(different)X
1959(places)X
2180(in)X
2262(the)X
2380(code,)X
2572(so)X
2663(that)X
2803(clients)X
3032(are)X
3151(not)X
3273(kept)X
3431(waiting)X
3691(too)X
3813(long.)X
755 2538(Given)N
971(the)X
1089(worm's)X
1354(elaborate)X
1669(scheme)X
1930(for)X
2044(controlling)X
2415(re-infection,)X
2830(what)X
3006(led)X
3124(it)X
3188(to)X
3270(reproduce)X
3612(so)X
3703(quickly)X
3963(on)X
4063(an)X
555 2628(individual)N
899(machine)X
1191(that)X
1331(it)X
1395(could)X
1593(swamp)X
1840(it?)X
1960(One)X
2114(culprit)X
2343(is)X
2416(the)X
2534(1)X
2594(in)X
2676(7)X
2736(test)X
2867(in)X
2 f
2949(checkother)X
1 f
3302(\(\):)X
3398(worms)X
3636(that)X
3776(skip)X
3929(the)X
4047(client)X
555 2718(phase)N
758(become)X
1028(immortal,)X
1361(and)X
1497(thus)X
1650(don't)X
1839(risk)X
1979(being)X
2177(eliminated)X
2535(by)X
2635(a)X
2691(roll)X
2822(of)X
2909(the)X
3027(dice.)X
3221(Another)X
3504(source)X
3734(of)X
3821(system)X
4063(load-)X
555 2808(ing)N
677(is)X
750(the)X
868(problem)X
1155(that)X
1295(when)X
1489(a)X
1545(worm)X
1752(decides)X
2013(it)X
2077(has)X
2204(lost,)X
2359(it)X
2423(can)X
2555(still)X
2694(do)X
2794(a)X
2850(lot)X
2954(of)X
3041(work)X
3226(before)X
3452(it)X
3516(actually)X
3790(exits.)X
4001(The)X
555 2898(client)N
753(routine)X
1000(isn't)X
1162(even)X
1334(run)X
1461(until)X
1627(the)X
1745(newly)X
1961(born)X
2128(worm)X
2335(has)X
2462(attempted)X
2798(to)X
2880(infect)X
3083(at)X
3161(least)X
3328(one)X
3464(remote)X
3707(host,)X
3880(and)X
4016(even)X
4188(if)X
4257(a)X
555 2988(worm)N
762(loses)X
942(the)X
1060(roll,)X
1211(it)X
1275(continues)X
1602(executing)X
1934(to)X
2016(the)X
2134(bottom)X
2380(of)X
2467(the)X
2585(main)X
2765(loop,)X
2947(and)X
3083(even)X
3255(then)X
3413(it)X
3477(won't)X
3684(exit)X
3824(unless)X
4044(it)X
4108(has)X
555 3078(gone)N
731(through)X
1000(the)X
1118(main)X
1298(loop)X
1460(several)X
1708(times,)X
1921(limited)X
2167(by)X
2267(its)X
2362(progress)X
2654(in)X
2736(cracking)X
3033(passwords.)X
3427(Finally,)X
3693(new)X
3847(worms)X
4085(lose)X
555 3168(all)N
655(of)X
742(the)X
860(history)X
1102(of)X
1189(infection)X
1494(that)X
1634(their)X
1801(parents)X
2053(had,)X
2209(so)X
2300(the)X
2418(children)X
2701(of)X
2788(a)X
2844(worm)X
3051(are)X
3170(constantly)X
3519(trying)X
3730(to)X
3812(re-infect)X
4105(the)X
555 3258(parent's)N
834(host,)X
1007(as)X
1094(well)X
1252(as)X
1339(the)X
1457(other)X
1642(children's)X
1983(hosts.)X
2207(Put)X
2333(all)X
2433(of)X
2520(these)X
2705(factors)X
2944(together)X
3227(and)X
3363(it)X
3427(comes)X
3652(as)X
3739(no)X
3839(surprise)X
4113(that)X
555 3348(within)N
779(an)X
875(hour)X
1042(or)X
1129(two)X
1269(after)X
1437(infection,)X
1762(a)X
1818(machine)X
2110(may)X
2268(be)X
2364(entirely)X
2629(devoted)X
2903(to)X
2985(executing)X
3317(worms.)X
3 f
555 3534(4.4.)N
715(Locating)X
1037(new)X
1195(hosts)X
1388(to)X
1475(infect)X
1 f
755 3657(One)N
909(of)X
996(the)X
1114(characteristics)X
1594(of)X
1681(the)X
1799(worm)X
2006(is)X
2079(that)X
2219(all)X
2319(of)X
2406(its)X
2501(attacks)X
2744(are)X
2863(active,)X
3095(never)X
3294(passive.)X
3590(A)X
3668(consequence)X
4099(of)X
555 3747(this)N
690(is)X
763(that)X
903(the)X
1021(worm)X
1228(can't)X
1409(wait)X
1567(for)X
1681(a)X
1737(user)X
1891(to)X
1973(take)X
2127(it)X
2191(over)X
2354(to)X
2436(another)X
2697(machine)X
2989(like)X
3129(gum)X
3291(on)X
3391(a)X
3447(shoe\320it)X
3738(must)X
3913(search)X
4139(out)X
555 3837(hosts)N
739(on)X
839(its)X
934(own.)X
755 3960(The)N
900(worm)X
1107(has)X
1234(a)X
1290(very)X
1453(distinct)X
1708(list)X
1825(of)X
1912(priorities)X
2221(when)X
2415(hunting)X
2679(for)X
2793(hosts.)X
3017(Its)X
3117(favorite)X
3387(hosts)X
3571(are)X
3690(gateways;)X
4031(the)X
2 f
4149(hg)X
1 f
(\(\))S
555 4050(routine)N
802(tries)X
960(to)X
1042(infect)X
1245(each)X
1413(of)X
1500(the)X
1618(hosts)X
1802(it)X
1866(believes)X
2149(to)X
2231(be)X
2327(gateways.)X
2686(Only)X
2866(when)X
3060(all)X
3160(of)X
3247(the)X
3365(gateways)X
3684(are)X
3803(known)X
4041(to)X
4123(be)X
555 4140(infected)N
834(or)X
921(infection-proof)X
1427(does)X
1594(the)X
1712(worm)X
1919(go)X
2019(on)X
2119(to)X
2201(other)X
2386(hosts.)X
2 f
2610(hg)X
1 f
(\(\))S
2764(calls)X
2931(the)X
2 f
3049(rt_init)X
1 f
3248(\(\))X
3322(function)X
3609(to)X
3691(get)X
3809(a)X
3865(list)X
3982(of)X
4069(gate-)X
555 4230(ways;)N
762(this)X
897(list)X
1014(is)X
1087(derived)X
1348(by)X
1448(running)X
1717(the)X
2 f
1835(netstat)X
1 f
2068(network)X
2351(status)X
2553(program)X
2845(and)X
2981(parsing)X
3237(its)X
3332(output.)X
3596(The)X
3741(worm)X
3948(is)X
4021(careful)X
555 4320(to)N
637(skip)X
790(the)X
908(loopback)X
1222(device)X
1452(and)X
1588(any)X
1724(local)X
1900(interfaces)X
2233(\(in)X
2342(the)X
2460(event)X
2654(that)X
2794(the)X
2912(current)X
3160(host)X
3313(is)X
3386(a)X
3442(gateway\);)X
3779(when)X
3973(it)X
555 4410(\256nishes,)N
839(it)X
903(randomizes)X
1293(the)X
1411(order)X
1601(of)X
1688(the)X
1806(list)X
1923(and)X
2059(adds)X
2226(the)X
2344(\256rst)X
2488(20)X
2588(gateways)X
2907(to)X
2989(the)X
3107(host)X
3260(table)X
3436(to)X
3518(speed)X
3721(up)X
3821(the)X
3939(initial)X
555 4500(searches.)N
888(It)X
957(then)X
1115(tries)X
1273(each)X
1441(gateway)X
1729(in)X
1811(sequence)X
2126(until)X
2292(it)X
2356(\256nds)X
2531(a)X
2587(host)X
2740(that)X
2880(can)X
3012(be)X
3108(infected,)X
3407(or)X
3494(it)X
3558(runs)X
3716(out)X
3838(of)X
3925(hosts.)X
755 4623(After)N
945(taking)X
1165(care)X
1320(of)X
1407(gateways,)X
1746(the)X
1864(worm's)X
2129(next)X
2287(priority)X
2547(is)X
2620(hosts)X
2804(whose)X
3029(names)X
3254(were)X
3431(found)X
3638(in)X
3720(a)X
3776(scan)X
3939(of)X
4026(system)X
555 4713(\256les.)N
748(At)X
848(the)X
966(start)X
1124(of)X
1211(password)X
1534(cracking,)X
1851(the)X
1969(\256les)X
2 f
2122(/etc/hosts.equiv)X
1 f
2638(\(which)X
2881(contains)X
3168(names)X
3393(of)X
3480(hosts)X
3664(to)X
3746(which)X
3962(the)X
4080(local)X
555 4803(host)N
708(grants)X
924(user)X
1078(permissions)X
1480(without)X
1744(authentication\))X
2245(and)X
2 f
2381(/.rhosts)X
1 f
2638(\(which)X
2881(contains)X
3168(names)X
3393(of)X
3480(hosts)X
3664(from)X
3840(which)X
4056(the)X
555 4893(local)N
731(host)X
884(permits)X
1144(remote)X
1387(privileged)X
1732(logins\))X
1974(are)X
2093(examined,)X
2445(as)X
2532(are)X
2651(all)X
2751(users')X
2 f
2963(.forward)X
1 f
3260(\256les)X
3413(\(which)X
3656(list)X
3773(hosts)X
3957(to)X
4039(which)X
555 4983(mail)N
717(is)X
790(forwarded)X
1141(from)X
1317(the)X
1435(current)X
1683(host\).)X
1903(These)X
2115(hosts)X
2299(are)X
2418(\257agged)X
2674(so)X
2765(that)X
2905(they)X
3063(can)X
3195(be)X
3291(scanned)X
3570(earlier)X
3796(than)X
3954(the)X
4072(rest.)X
555 5073(The)N
2 f
700(hi)X
1 f
762(\(\))X
836(function)X
1123(is)X
1196(then)X
1354(responsible)X
1739(for)X
1853(attacking)X
2167(these)X
2352(hosts.)X
755 5196(When)N
967(the)X
1085(most)X
1260(pro\256table)X
1587(hosts)X
1771(have)X
1943(been)X
2115(used)X
2282(up,)X
2402(the)X
2520(worm)X
2727(starts)X
2916(looking)X
3180(for)X
3294(hosts)X
3478(that)X
3618(aren't)X
3826(recorded)X
4128(in)X
555 5286(\256les.)N
748(The)X
893(routine)X
2 f
1140(hl)X
1 f
1202(\(\))X
1276(checks)X
1515(local)X
1691(networks:)X
2027(it)X
2091(runs)X
2249(through)X
2518(the)X
2636(local)X
2812(host's)X
3023(addresses,)X
3371(masking)X
3662(off)X
3776(the)X
3894(host)X
4047(part)X
555 5376(and)N
691(substituting)X
1083(a)X
1139(random)X
1404(value.)X
2 f
1638(ha)X
1 f
(\(\))S
1792(does)X
1959(the)X
2077(same)X
2262(job)X
2384(for)X
2498(remote)X
2741(hosts,)X
2945(checking)X
3255(alternate)X
3552(addresses)X
3880(of)X
3967(gateways.)X
555 5466(Special)N
811(code)X
983(handles)X
1248(the)X
1366(ARPAnet)X
1697(practice)X
1972(of)X
2059(putting)X
2305(the)X
2423(IMP)X
2585(number)X
2850(in)X
2932(the)X
3050(low)X
3190(host)X
3343(bits)X
3478(and)X
3614(the)X
3732(actual)X
3944(IMP)X
4106(port)X
555 5556(\(representing)N
999(the)X
1117(host\))X
1297(in)X
1379(the)X
1497(high)X
1659(host)X
1812(bits.)X
1987(The)X
2132(function)X
2419(that)X
2559(runs)X
2717(these)X
2902(random)X
3167(probes,)X
3421(which)X
3637(we)X
3751(named)X
2 f
555 5646(hack_netof)N
1 f
907(\(\),)X
1001(seems)X
1217(to)X
1299(have)X
1471(a)X
1527(bug)X
1667(that)X
1807(prevents)X
2099(it)X
2163(from)X
2339(attacking)X
2653(hosts)X
2837(on)X
2937(local)X
3113(networks;)X
3449(this)X
3584(may)X
3742(be)X
3838(due)X
3974(to)X
4056(our)X
555 5736(own)N
713(misunderstanding,)X
1322(of)X
1409(course,)X
1659(but)X
1781(in)X
1863(any)X
1999(case)X
2158(the)X
2276(check)X
2484(of)X
2571(hosts)X
2755(from)X
2931(system)X
3173(\256les)X
3326(should)X
3559(be)X
3655(suf\256cient)X
3973(to)X
4055(cover)X

8 p
%%Page: 8 8
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(8)X
1 f
555 762(all)N
655(or)X
742(nearly)X
963(all)X
1063(of)X
1150(the)X
1268(local)X
1444(hosts)X
1628(anyway.)X
755 885(Password)N
1082(cracking)X
1379(is)X
1452(another)X
1713(generator)X
2037(of)X
2124(host)X
2277(names,)X
2522(but)X
2644(since)X
2829(this)X
2964(is)X
3037(handled)X
3311(separately)X
3657(from)X
3833(the)X
3951(usual)X
4140(host)X
555 975(attack)N
767(scheme)X
1028(presented)X
1356(here,)X
1535(it)X
1599(will)X
1743(be)X
1839(discussed)X
2166(below)X
2382(with)X
2544(the)X
2662(other)X
2847(material)X
3130(on)X
3230(passwords.)X
3 f
555 1161(4.5.)N
715(Security)X
1020(holes)X
1 f
9 s
715 1275(The)N
850(\256rst)X
985(fact)X
1116(to)X
1195(face)X
1338(is)X
1409(that)X
1540(Unix)X
1707(was)X
1842(not)X
1957(developed)X
2275(with)X
2425(security,)X
2693(in)X
2771(any)X
2897(realistic)X
3147(sense,)X
3343(in)X
3421(mind...)X
3663([Dennis)X
3913(Ritchie,)X
715 1356(``On)N
869(the)X
975(Security)X
1233(of)X
1311(Unix''])X
10 s
755 1512(This)N
917(section)X
1164(discusses)X
1482(the)X
1600(TCP)X
1766(services)X
2045(used)X
2212(by)X
2312(the)X
2430(worm)X
2637(to)X
2719(penetrate)X
3034(systems.)X
3347(It's)X
3474(a)X
3530(touch)X
3728(unfair)X
3940(to)X
4022(use)X
4149(the)X
555 1602(quote)N
753(above)X
965(when)X
1159(the)X
1277(implementation)X
1799(of)X
1886(the)X
2004(services)X
2283(we're)X
2487(about)X
2685(to)X
2767(discuss)X
3018(was)X
3163(distributed)X
3525(by)X
3625(Berkeley)X
3935(rather)X
4143(than)X
555 1692(Bell)N
708(Labs,)X
904(but)X
1026(the)X
1144(sentiment)X
1475(is)X
1548(appropriate.)X
1974(For)X
2105(a)X
2161(long)X
2323(time)X
2485(the)X
2603(balance)X
2869(between)X
3157(security)X
3431(and)X
3567(convenience)X
3989(on)X
4089(Unix)X
555 1782(systems)N
828(has)X
955(been)X
1127(tilted)X
1311(in)X
1393(favor)X
1583(of)X
1670(convenience.)X
2132(As)X
2241(Brian)X
2439(Reid)X
2610(has)X
2737(said)X
2886(about)X
3084(the)X
3202(break-in)X
3490(at)X
3568(Stanford)X
3864(two)X
4004(years)X
555 1872(ago:)N
713(``Programmer)X
1188(convenience)X
1610(is)X
1683(the)X
1801(antithesis)X
2123(of)X
2210(security,)X
2504(because)X
2779(it)X
2843(is)X
2916(going)X
3118(to)X
3200(become)X
3470(intruder)X
3744(convenience)X
4166(if)X
555 1962(the)N
673(programmer's)X
1148(account)X
1418(is)X
1491(ever)X
1650(compromised.'')X
2180(The)X
2325(lesson)X
2545(from)X
2721(that)X
2861(experience)X
3230(seems)X
3446(to)X
3528(have)X
3700(been)X
3872(forgotten)X
4186(by)X
555 2052(most)N
730(people,)X
984(but)X
1106(not)X
1228(by)X
1328(the)X
1446(author)X
1671(of)X
1758(the)X
1876(worm.)X
3 f
555 2238(4.5.1.)N
775(Rsh)X
928(and)X
1076(rexec)X
1 f
9 s
715 2352(These)N
906(notes)X
1077(describe)X
1336(how)X
1479(the)X
1586(design)X
1793(of)X
1872(TCP/IP)X
2107(and)X
2230(the)X
2337(4.2BSD)X
2586(implementation)X
3057(allow)X
3235(users)X
3401(on)X
3491(untrusted)X
3777(and)X
3899(possibly)X
715 2433(very)N
871(distant)X
1091(hosts)X
1267(to)X
1351(masquerade)X
1722(as)X
1809(users)X
1984(on)X
2083(trusted)X
2306(hosts.)X
2517([Robert)X
2764(T.)X
2853(Morris,)X
3094(``A)X
3221(Weakness)X
3540(in)X
3623(the)X
3738(4.2BSD)X
3995(Unix)X
715 2514(TCP/IP)N
949(Software''])X
2 f
10 s
755 2670(Rsh)N
1 f
895(and)X
2 f
1031(rexec)X
1 f
1226(are)X
1345(network)X
1628(services)X
1907(which)X
2123(offer)X
2300(remote)X
2543(command)X
2879(interpreters.)X
2 f
3305(Rexec)X
1 f
3518(uses)X
3676(password)X
3999(authenti-)X
555 2760(cation;)N
2 f
793(rsh)X
1 f
915(relies)X
1109(on)X
1209(a)X
1265(``privileged'')X
1718(originating)X
2089(port)X
2238(and)X
2374(permissions)X
2776(\256les.)X
2969(Two)X
3136(vulnerabilities)X
3614(are)X
3733(exploited)X
4051(by)X
4151(the)X
555 2850(worm\320the)N
940(likelihood)X
1284(that)X
1424(a)X
1480(remote)X
1723(machine)X
2015(that)X
2155(has)X
2282(an)X
2378(account)X
2648(for)X
2762(a)X
2818(local)X
2994(user)X
3148(will)X
3292(have)X
3464(the)X
3582(same)X
3767(password)X
4090(as)X
4177(the)X
555 2940(local)N
731(account,)X
1021(allowing)X
1321(penetration)X
1702(through)X
2 f
1971(rexec)X
1 f
2146(,)X
2186(and)X
2322(the)X
2440(likelihood)X
2784(that)X
2924(such)X
3091(a)X
3147(remote)X
3390(account)X
3660(will)X
3804(include)X
4060(the)X
555 3030(local)N
731(host)X
884(in)X
966(its)X
2 f
1061(rsh)X
1 f
1183(permissions)X
1585(\256les.)X
1778(Both)X
1953(of)X
2040(these)X
2225(vulnerabilities)X
2703(are)X
2822(really)X
3025(problems)X
3343(with)X
3505(laxness)X
3761(or)X
3848(convenience)X
555 3120(for)N
669(users)X
854(and)X
990(system)X
1232(administrators)X
1710(rather)X
1918(than)X
2076(actual)X
2288(bugs,)X
2479(but)X
2601(they)X
2759(represent)X
3074(avenues)X
3353(for)X
3467(infection)X
3772(just)X
3907(like)X
4047(inad-)X
555 3210(vertent)N
798(security)X
1072(bugs.)X
755 3333(The)N
900(\256rst)X
1044(use)X
1171(of)X
2 f
1258(rsh)X
1 f
1380(by)X
1480(the)X
1598(worm)X
1805(is)X
1878(fairly)X
2072(simple:)X
2327(it)X
2391(looks)X
2584(for)X
2698(a)X
2754(remote)X
2997(account)X
3267(with)X
3429(the)X
3547(same)X
3732(name)X
3926(as)X
4013(the)X
4131(one)X
555 3423(that)N
695(is)X
768(\(unsuspectingly\))X
1322(running)X
1591(the)X
1709(worm)X
1916(on)X
2016(the)X
2134(local)X
2310(machine.)X
2642(This)X
2804(test)X
2935(is)X
3008(part)X
3153(of)X
3240(the)X
3358(standard)X
3650(menu)X
3848(of)X
3935(hacks)X
4138(con-)X
555 3513(ducted)N
789(for)X
903(each)X
1071(host;)X
1246(if)X
1315(it)X
1379(fails,)X
1557(the)X
1675(worm)X
1882(falls)X
2040(back)X
2212(upon)X
2 f
2392(\256nger)X
1 f
2579(,)X
2619(then)X
2 f
2777(sendmail)X
1 f
3066(.)X
3126(Many)X
3333(sites,)X
3515(including)X
3837(Utah,)X
4033(already)X
555 3603(were)N
732(protected)X
1051(from)X
1227(this)X
1362(trivial)X
1573(attack)X
1785(by)X
1885(not)X
2007(providing)X
2338(remote)X
2581(shells)X
2783(for)X
2897(pseudo-users)X
3336(like)X
2 f
3476(daemon)X
1 f
3750(or)X
2 f
3837(nobody)X
1 f
4073(.)X
755 3726(A)N
833(more)X
1018(sophisticated)X
1456(use)X
1583(of)X
1670(these)X
1855(services)X
2134(is)X
2207(found)X
2414(in)X
2496(the)X
2614(password)X
2937(cracking)X
3234(routines.)X
3552(After)X
3742(a)X
3798(password)X
4121(is)X
555 3816(successfully)N
967(guessed,)X
1261(the)X
1379(worm)X
1586(immediately)X
2006(tries)X
2164(to)X
2246(penetrate)X
2561(remote)X
2804(hosts)X
2988(associated)X
3338(with)X
3500(the)X
3618(broken)X
3861(account.)X
4171(It)X
555 3906(reads)N
745(the)X
863(user's)X
2 f
1075(.forward)X
1 f
1372(\256le)X
1494(\(which)X
1737(contains)X
2024(an)X
2120(address)X
2381(to)X
2463(which)X
2679(mail)X
2841(is)X
2914(forwarded\))X
3292(and)X
2 f
3428(.rhosts)X
1 f
3663(\256le)X
3785(\(which)X
4028(contains)X
555 3996(a)N
611(list)X
728(of)X
815(hosts)X
999(and)X
1135(optionally)X
1479(user)X
1633(names)X
1858(on)X
1958(those)X
2147(hosts)X
2331(which)X
2547(are)X
2666(granted)X
2927(permission)X
3298(to)X
3380(access)X
3606(the)X
3724(local)X
3900(machine)X
555 4086(with)N
2 f
717(rsh)X
1 f
839(bypassing)X
1179(the)X
1297(usual)X
1486(password)X
1809(authentication\),)X
2330(trying)X
2541(these)X
2726(hostnames)X
3084(until)X
3250(it)X
3314(succeeds.)X
3660(Each)X
3841(target)X
4044(host)X
4197(is)X
555 4176(attacked)N
843(in)X
925(two)X
1065(ways.)X
1290(The)X
1435(worm)X
1642(\256rst)X
1786(contacts)X
2069(the)X
2187(remote)X
2430(host's)X
2 f
2641(rexec)X
1 f
2836(server)X
3053(and)X
3189(sends)X
3387(it)X
3451(the)X
3569(account)X
3839(name)X
4033(found)X
555 4266(in)N
637(the)X
2 f
755(.forward)X
1 f
1052(or)X
2 f
1139(.rhosts)X
1 f
1374(\256les)X
1527(followed)X
1832(by)X
1932(the)X
2050(guessed)X
2324(password.)X
2687(If)X
2761(this)X
2896(fails,)X
3074(the)X
3192(worm)X
3399(connects)X
3700(to)X
3782(the)X
3900(local)X
2 f
4076(rexec)X
1 f
555 4356(server)N
772(with)X
934(the)X
1052(local)X
1228(account)X
1498(name)X
1692(and)X
1828(uses)X
1986(that)X
2126(to)X
2208(contact)X
2460(the)X
2578(target's)X
2 f
2839(rsh)X
1 f
2961(server.)X
3218(The)X
3363(remote)X
2 f
3606(rsh)X
1 f
3728(server)X
3945(will)X
4089(permit)X
555 4446(the)N
673(connection)X
1045(provided)X
1350(the)X
1468(name)X
1662(of)X
1749(the)X
1867(local)X
2043(host)X
2196(appears)X
2462(in)X
2544(either)X
2747(the)X
2 f
2865(/etc/hosts.equiv)X
1 f
3381(\256le)X
3503(or)X
3590(the)X
3708(user's)X
3920(private)X
2 f
555 4536(.rhosts)N
1 f
790(\256le.)X
755 4659(Strengthening)N
1224(these)X
1409(network)X
1692(services)X
1971(is)X
2044(far)X
2154(more)X
2339(problematic)X
2742(than)X
2900(\256xing)X
2 f
3106(\256nger)X
1 f
3313(and)X
2 f
3449(sendmail)X
1 f
3738(,)X
3778(unfortunately.)X
555 4749(Users)N
758(don't)X
947(like)X
1087(the)X
1205(inconvenience)X
1689(of)X
1776(typing)X
2000(their)X
2167(password)X
2490(when)X
2684(logging)X
2948(in)X
3030(on)X
3130(a)X
3186(trusted)X
3424(local)X
3600(host,)X
3773(and)X
3909(they)X
4067(don't)X
555 4839(want)N
731(to)X
813(remember)X
1159(different)X
1456(passwords)X
1810(for)X
1924(each)X
2092(of)X
2179(the)X
2297(many)X
2495(hosts)X
2679(they)X
2837(may)X
2995(have)X
3167(to)X
3249(deal)X
3403(with.)X
3605(Some)X
3807(of)X
3894(the)X
4012(solu-)X
555 4929(tions)N
730(may)X
888(be)X
984(worse)X
1196(than)X
1354(the)X
1472(disease\320for)X
1898(example,)X
2210(a)X
2266(user)X
2420(who)X
2578(is)X
2651(forced)X
2877(to)X
2959(deal)X
3113(with)X
3275(many)X
3473(passwords)X
3827(is)X
3900(more)X
4085(likely)X
555 5019(to)N
637(write)X
822(them)X
1002(down)X
1200(somewhere.)X
3 f
555 5205(4.5.2.)N
775(Finger)X
1 f
2 f
9 s
715 5319(gets)N
1 f
851(was)X
983(removed)X
1255(from)X
1415(our)X
1531([C)X
1623(library])X
1859(a)X
1911(couple)X
2123(days)X
2274(ago.)X
2433([Bill)X
2584(Cheswick)X
2887(at)X
2958(AT&T)X
3173(Bell)X
3312(Labs)X
3471(Research,)X
3772(private)X
3991(com-)X
715 5400(munication,)N
1075(11/9/88])X
10 s
755 5556(Probably)N
1064(the)X
1182(neatest)X
1425(hack)X
1597(in)X
1679(the)X
1797(worm)X
2004(is)X
2077(its)X
2172(co-opting)X
2499(of)X
2586(the)X
2704(TCP)X
2 f
2870(\256nger)X
1 f
3077(service)X
3325(to)X
3407(gain)X
3565(entry)X
3750(to)X
3832(a)X
3888(system.)X
2 f
555 5646(Finger)N
1 f
793(reports)X
1036(information)X
1434(about)X
1632(a)X
1688(user)X
1842(on)X
1942(a)X
1998(host,)X
2171(usually)X
2422(including)X
2744(things)X
2959(like)X
3099(the)X
3217(user's)X
3429(full)X
3560(name,)X
3774(where)X
3991(their)X

9 p
%%Page: 9 9
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4259(9)X
1 f
555 778(of\256ce)N
758(is,)X
851(the)X
969(number)X
1234(of)X
1321(their)X
1488(phone)X
1704(extension)X
2031(and)X
2167(so)X
2258(on.)X
2398(The)X
2543(Berkeley)X
7 s
2833 746(3)N
10 s
2881 778(version)N
3137(of)X
3224(the)X
2 f
3342(\256nger)X
1 f
3549(server)X
3766(is)X
3839(a)X
3895(really)X
4098(trivial)X
555 868(program:)N
869(it)X
933(reads)X
1123(a)X
1179(request)X
1431(from)X
1607(the)X
1725(originating)X
2096(host,)X
2269(then)X
2427(runs)X
2585(the)X
2703(local)X
2 f
2879(\256nger)X
1 f
3086(program)X
3378(with)X
3540(the)X
3658(request)X
3910(as)X
3997(an)X
4093(argu-)X
555 958(ment)N
735(and)X
871(ships)X
1055(the)X
1173(output)X
1397(back.)X
1609(Unfortunately)X
2079(the)X
2 f
2197(\256nger)X
1 f
2404(server)X
2621(reads)X
2811(the)X
2929(remote)X
3172(request)X
3424(with)X
2 f
3586(gets)X
1 f
3715(\(\),)X
3809(a)X
3865(standard)X
4157(C)X
555 1048(library)N
789(routine)X
1036(that)X
1176(dates)X
1361(from)X
1537(the)X
1655(dawn)X
1849(of)X
1936(time)X
2098(and)X
2234(which)X
2450(does)X
2617(not)X
2739(check)X
2947(for)X
3061(over\257ow)X
3366(of)X
3453(the)X
3571(server's)X
3846(512)X
3986(byte)X
555 1138(request)N
807(buffer)X
1024(on)X
1124(the)X
1242(stack.)X
1467(The)X
1612(worm)X
1819(supplies)X
2101(the)X
2219(\256nger)X
2426(server)X
2643(with)X
2805(a)X
2861(request)X
3113(that)X
3253(is)X
3326(536)X
3466(bytes)X
3655(long;)X
3839(the)X
3957(bulk)X
4119(of)X
555 1228(the)N
673(request)X
925(is)X
998(some)X
1187(VAX)X
1381(machine)X
1673(code)X
1845(that)X
1985(asks)X
2143(the)X
2261(system)X
2503(to)X
2585(execute)X
2851(the)X
2969(command)X
3305(interpreter)X
2 f
3660(sh)X
1 f
3731(,)X
3771(and)X
3907(the)X
4025(extra)X
4206(24)X
555 1318(bytes)N
744(represent)X
1059(just)X
1194(enough)X
1450(data)X
1604(to)X
1686(write)X
1871(over)X
2034(the)X
2152(server's)X
2427(stack)X
2612(frame)X
2820(for)X
2934(the)X
3052(main)X
3232(routine.)X
3519(When)X
3731(the)X
3849(main)X
4029(routine)X
555 1408(of)N
642(the)X
760(server)X
977(exits,)X
1168(the)X
1286(calling)X
1524(function's)X
1869(program)X
2161(counter)X
2422(is)X
2495(supposed)X
2813(to)X
2895(be)X
2991(restored)X
3270(from)X
3446(the)X
3564(stack,)X
3769(but)X
3891(the)X
4009(worm)X
555 1498(wrote)N
758(over)X
921(this)X
1056(program)X
1348(counter)X
1609(with)X
1771(one)X
1907(that)X
2047(points)X
2262(to)X
2344(the)X
2462(VAX)X
2656(code)X
2828(in)X
2910(the)X
3028(request)X
3280(buffer.)X
3537(The)X
3682(program)X
3974(jumps)X
4189(to)X
555 1588(the)N
673(worm's)X
938(code)X
1110(and)X
1246(runs)X
1404(the)X
1522(command)X
1858(interpreter,)X
2233(which)X
2449(the)X
2567(worm)X
2774(uses)X
2932(to)X
3014(enter)X
3195(its)X
3290(bootstrap.)X
755 1711(Not)N
895(surprisingly,)X
1317(shortly)X
1559(after)X
1727(the)X
1845(worm)X
2052(was)X
2197(reported)X
2485(to)X
2567(use)X
2694(this)X
2829(feature)X
3073(of)X
2 f
3160(gets)X
1 f
3289(\(\),)X
3383(a)X
3439(number)X
3704(of)X
3791(people)X
4025(replaced)X
555 1801(all)N
655(instances)X
969(of)X
2 f
1056(gets)X
1 f
1185(\(\))X
1259(in)X
1341(system)X
1583(code)X
1755(with)X
1917(sensible)X
2195(code)X
2367(that)X
2507(checks)X
2746(the)X
2864(length)X
3084(of)X
3171(the)X
3289(buffer.)X
3546(Some)X
3748(even)X
3920(went)X
4096(so)X
4187(far)X
555 1891(as)N
642(to)X
724(remove)X
2 f
985(gets)X
1 f
1114(\(\))X
1188(from)X
1364(the)X
1482(library,)X
1736(although)X
2036(the)X
2154(function)X
2441(is)X
2514(apparently)X
2873(mandated)X
3205(by)X
3305(the)X
3423(forthcoming)X
3839(ANSI)X
4046(C)X
4119(stan-)X
555 1997(dard)N
7 s
698 1965(4)N
10 s
1997(.)Y
786(So)X
890(far)X
1000(no)X
1100(one)X
1236(has)X
1363(claimed)X
1637(to)X
1719(have)X
1891(exercised)X
2215(the)X
2333(\256nger)X
2540(server)X
2757(bug)X
2897(before)X
3123(the)X
3241(worm)X
3448(incident,)X
3746(but)X
3868(in)X
3950(May)X
4117(1988,)X
555 2087(students)N
837(at)X
915(UC)X
1046(Santa)X
1244(Cruz)X
1420(apparently)X
1779(penetrated)X
2134(security)X
2408(using)X
2601(a)X
2657(different)X
2954(\256nger)X
3161(server)X
3378(with)X
3540(a)X
3596(similar)X
3838(bug.)X
4018(The)X
4163(sys-)X
555 2177(tem)N
695(administrator)X
1142(at)X
1220(UCSC)X
1448(noticed)X
1704(that)X
1844(the)X
1962(Berkeley)X
2272(\256nger)X
2479(server)X
2696(had)X
2832(a)X
2888(similar)X
3130(bug)X
3270(and)X
3406(sent)X
3555(mail)X
3717(to)X
3799(Berkeley,)X
4129(but)X
555 2267(the)N
673(seriousness)X
1058(of)X
1145(the)X
1263(problem)X
1550(was)X
1695(not)X
1817(appreciated)X
2208(at)X
2286(the)X
2404(time)X
2566(\(Jim)X
2728(Haynes,)X
3009(private)X
3252(communication\).)X
755 2390(One)N
909(\256nal)X
1071(note:)X
1251(the)X
1369(worm)X
1576(is)X
1649(meticulous)X
2020(in)X
2102(some)X
2291(areas)X
2477(but)X
2599(not)X
2721(in)X
2803(others.)X
3059(From)X
3252(what)X
3428(we)X
3542(can)X
3674(tell,)X
3816(there)X
3997(was)X
4142(no)X
555 2480(Sun-3)N
766(version)X
1022(of)X
1109(the)X
2 f
1227(\256nger)X
1 f
1434(intrusion)X
1738(even)X
1910(though)X
2152(the)X
2270(Sun-3)X
2481(server)X
2698(was)X
2843(just)X
2978(as)X
3065(vulnerable)X
3424(as)X
3511(the)X
3629(VAX)X
3823(one.)X
3999(Perhaps)X
555 2570(the)N
673(author)X
898(had)X
1034(VAX)X
1228(sources)X
1489(available)X
1799(but)X
1921(not)X
2043(Sun)X
2187(sources?)X
3 f
555 2756(4.5.3.)N
775(Sendmail)X
1 f
9 s
715 2870([T]he)N
899(trap)X
1035(door)X
1191(resulted)X
1443(from)X
1607(two)X
1739(distinct)X
1975(`features')X
2275(that,)X
2425(although)X
2701(innocent)X
2973(by)X
3069(themselves,)X
3431(were)X
3595(deadly)X
3811(when)X
3991(com-)X
715 2951(bined)N
893(\(kind)X
1063(of)X
1141(like)X
1267(binary)X
1469(nerve)X
1647(gas\).)X
1821([Eric)X
1983(Allman,)X
2235(personal)X
2497(communication,)X
2981(11/22/88])X
10 s
755 3107(The)N
2 f
900(sendmail)X
1 f
1209(attack)X
1421(is)X
1494(perhaps)X
1764(the)X
1882(least)X
2049(preferred)X
2365(in)X
2447(the)X
2565(worm's)X
2830(arsenal,)X
3098(but)X
3220(in)X
3302(spite)X
3473(of)X
3560(that)X
3700(one)X
3836(site)X
3967(at)X
4045(Utah)X
555 3197(was)N
700(subjected)X
1023(to)X
1105(nearly)X
1326(150)X
2 f
1466(sendmail)X
1 f
1775(attacks)X
2018(on)X
2118(Black)X
2325(Thursday.)X
2 f
2688(Sendmail)X
1 f
3006(is)X
3079(the)X
3197(program)X
3489(that)X
3629(provides)X
3925(the)X
4043(SMTP)X
555 3287(mail)N
717(service)X
965(on)X
1065(TCP)X
1231(networks)X
1545(for)X
1659(Berkeley)X
1969(U)X
8 s
2027(NIX)X
10 s
2160(systems.)X
2473(It)X
2542(uses)X
2700(a)X
2756(simple)X
2989 0.2500(character-oriented)AX
3595(protocol)X
3882(to)X
3964(accept)X
555 3377(mail)N
717(from)X
893(remote)X
1136(sites.)X
1338(One)X
1492(feature)X
1736(of)X
2 f
1823(sendmail)X
1 f
2132(is)X
2205(that)X
2345(it)X
2409(permits)X
2669(mail)X
2831(to)X
2913(be)X
3009(delivered)X
3328(to)X
3410(processes)X
3738(instead)X
3985(of)X
4072(mail-)X
555 3467(box)N
695(\256les;)X
870(this)X
1005(can)X
1137(be)X
1233(used)X
1400(with)X
1562(\(say\))X
1743(the)X
2 f
1861(vacation)X
1 f
2157(program)X
2449(to)X
2531(notify)X
2742(senders)X
3003(that)X
3143(you)X
3283(are)X
3402(out)X
3524(of)X
3611(town)X
3791(and)X
3927(are)X
4046(tem-)X
555 3557(porarily)N
829(unable)X
1063(to)X
1145(respond)X
1419(to)X
1501(their)X
1668(mail.)X
1870(Normally)X
2197(this)X
2332(feature)X
2576(is)X
2649(only)X
2811(available)X
3121(to)X
3203(recipients.)X
3575(Unfortunately)X
4045(a)X
4101(little)X
555 3647(loophole)N
855(was)X
1000(accidentally)X
1408(created)X
1661(when)X
1855(a)X
1911(couple)X
2145(of)X
2232(earlier)X
2458(security)X
2732(bugs)X
2903(were)X
3080(being)X
3278(\256xed\320if)X
2 f
3587(sendmail)X
1 f
3896(is)X
3969(compiled)X
555 3737(with)N
717(the)X
2 f
835(DEBUG)X
1 f
1127(\257ag,)X
1287(and)X
1423(the)X
1541(sender)X
1771(at)X
1849(runtime)X
2118(asks)X
2276(that)X
2 f
2416(sendmail)X
1 f
2725(enter)X
2906(debug)X
3122(mode)X
3320(by)X
3420(sending)X
3689(the)X
2 f
3807(debug)X
1 f
4023(com-)X
555 3827(mand,)N
773(it)X
837(permits)X
1097(senders)X
1358(to)X
1440(pass)X
1598(in)X
1680(a)X
1736(command)X
2072(sequence)X
2387(instead)X
2634(of)X
2721(a)X
2777(user)X
2931(name)X
3125(for)X
3239(a)X
3295(recipient.)X
3636(Alas,)X
3823(most)X
3998(versions)X
555 3917(of)N
2 f
642(sendmail)X
1 f
951(are)X
1070(compiled)X
1388(with)X
2 f
1550(DEBUG)X
1 f
1822(,)X
1862(including)X
2184(the)X
2302(one)X
2438(that)X
2578(Sun)X
2722(sends)X
2920(out)X
3042(in)X
3124(its)X
3219(binary)X
3444(distribution.)X
3872(The)X
4017(worm)X
555 4007(mimics)N
810(a)X
866(remote)X
1109(SMTP)X
1337(connection,)X
1729(feeding)X
1990(in)X
2 f
2072(/dev/null)X
1 f
2372(as)X
2459(the)X
2577(name)X
2771(of)X
2858(the)X
2976(sender)X
3206(and)X
3342(a)X
3398(carefully)X
3704(crafted)X
3948(string)X
4150(as)X
555 4097(the)N
673(recipient.)X
1014(The)X
1159(string)X
1361(sets)X
1501(up)X
1601(a)X
1657(command)X
1993(that)X
2133(deletes)X
2376(the)X
2494(header)X
2729(of)X
2816(the)X
2934(message)X
3226(and)X
3362(passes)X
3587(the)X
3705(body)X
3885(to)X
3967(a)X
4023(com-)X
555 4187(mand)N
753(interpreter.)X
1148(The)X
1293(body)X
1473(contains)X
1760(a)X
1816(copy)X
1992(of)X
2079(the)X
2197(worm)X
2404(bootstrap)X
2722(source)X
2952(plus)X
3105(commands)X
3472(to)X
3554(compile)X
3832(and)X
3968(run)X
4095(it.)X
555 4277(After)N
745(the)X
863(worm)X
1070(\256nishes)X
1334(the)X
1452(protocol)X
1739(and)X
1875(closes)X
2091(the)X
2209(connection)X
2581(to)X
2 f
2663(sendmail)X
1 f
2952(,)X
2992(the)X
3110(bootstrap)X
3428(will)X
3572(be)X
3668(built)X
3834(on)X
3934(the)X
4052(remote)X
555 4367(host)N
708(and)X
844(the)X
962(local)X
1138(worm)X
1345(waits)X
1534(for)X
1648(its)X
1743(connection)X
2115(so)X
2206(that)X
2346(it)X
2410(can)X
2542(complete)X
2856(the)X
2974(process)X
3235(of)X
3322(building)X
3608(a)X
3664(new)X
3818(worm.)X
755 4490(Of)N
860(course)X
1090(this)X
1225(is)X
1298(not)X
1420(the)X
1538(\256rst)X
1682(time)X
1844(that)X
1984(an)X
2080(inadvertent)X
2461(loophole)X
2761(or)X
2848(``trap)X
3047(door'')X
3268(like)X
3408(this)X
3543(has)X
3670(been)X
3842(found)X
4049(in)X
555 4580(sendmail,)N
884(and)X
1020(it)X
1084(may)X
1242(not)X
1364(be)X
1460(the)X
1578(last.)X
1749(In)X
1836(his)X
1949(Turing)X
2187(Award)X
2426(lecture,)X
2685(Ken)X
2839(Thompson)X
3201(said:)X
3372(``You)X
3584(can't)X
3765(trust)X
3927(code)X
4099(that)X
555 4670(you)N
695(did)X
817(not)X
939(totally)X
1163(create)X
1376(yourself.)X
1699(\(Especially)X
2080(code)X
2252(from)X
2428(companies)X
2791(that)X
2931(employ)X
3191(people)X
3425(like)X
3565(me.\)'')X
3784(In)X
3871(fact,)X
4032(as)X
4119(Eric)X
555 4760(Allman)N
815(says,)X
993(``[Y]ou)X
1259(can't)X
1440(even)X
1612(trust)X
1774(code)X
1946(that)X
2086(you)X
2226(did)X
2348(totally)X
2572(create)X
2785(yourself.'')X
3142(The)X
3287(basic)X
3472(problem)X
3759(of)X
3846(trusting)X
4110(sys-)X
555 4850(tem)N
695(programs)X
1018(is)X
1091(not)X
1213(one)X
1349(that)X
1489(is)X
1562(easy)X
1725(to)X
1807(solve.)X
3 f
555 5036(4.6.)N
715(Infection)X
1 f
755 5159(The)N
900(worm)X
1107(uses)X
1265(two)X
1405(favorite)X
1675(routines)X
1953(when)X
2147(it)X
2211(decides)X
2472(that)X
2612(it)X
2676(wants)X
2883(to)X
2965(infect)X
3168(a)X
3224(host.)X
3417(One)X
3571(routine)X
3818(that)X
3958(we)X
4072(named)X
2 f
555 5249(infect)N
1 f
733(\(\))X
807(is)X
880(used)X
1047(from)X
1223(host)X
1376(scanning)X
1681(routines)X
1959(like)X
2 f
2099(hg)X
1 f
(\(\).)S
2 f
2293(infect)X
1 f
2471(\(\))X
2545(\256rst)X
2689(checks)X
2928(that)X
3068(it)X
3132(isn't)X
3294(infecting)X
3599(the)X
3717(local)X
3893(machine,)X
4205(an)X
555 5339(already)N
812(infected)X
1091(machine)X
1383(or)X
1470(a)X
1526(machine)X
1818(previously)X
2176(attacked)X
2464(but)X
2586(not)X
2708(successfully)X
3120(infected;)X
3421(the)X
3539(``infected'')X
3926(and)X
8 s
10 f
555 5411(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N
5 s
1 f
727 5489(3)N
8 s
765 5514(Actually,)N
1019(like)X
1133(much)X
1293(of)X
1363(the)X
1458(code)X
1595(in)X
1662(the)X
1757(Berkeley)X
2004(distribution,)X
2333(the)X
2 f
2428(\256nger)X
1 f
2594(server)X
2766(was)X
2882(contributed)X
3190(from)X
3331(elsewhere;)X
3620(in)X
3687(this)X
3797(case,)X
3939(it)X
3992(appears)X
4203(that)X
555 5586(MIT)N
688(was)X
803(the)X
897(source.)X
5 s
727 5664(4)N
8 s
763 5689(See)N
871(for)X
961(example)X
1193(Appendix)X
1461(B,)X
1536(section)X
1733(1.4)X
1829(of)X
1898(the)X
1992(second)X
2185(edition)X
2379(of)X
2 f
2448(The)X
2560(C)X
2619(Programming)X
2994(Language)X
1 f
3266(by)X
3346(Kernighan)X
3631(and)X
3739(Ritchie.)X

10 p
%%Page: 10 10
8 s 0 xH 0 xS 1 f
10 s
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(10)X
1 f
555 762(``immune'')N
945(states)X
1143(are)X
1262(marked)X
1523(by)X
1623(\257ags)X
1794(on)X
1894(a)X
1950(host)X
2103(structure)X
2404(when)X
2598(attacks)X
2841(succeed)X
3116(or)X
3203(fail,)X
3350(respectively.)X
3798(The)X
3943(worm)X
4150(then)X
555 852(makes)N
780(sure)X
934(that)X
1074(it)X
1138(can)X
1270(get)X
1388(an)X
1484(address)X
1745(for)X
1859(the)X
1977(target)X
2180(host,)X
2353(marking)X
2640(the)X
2758(host)X
2911(immune)X
3193(if)X
3262(it)X
3326(can't.)X
3547(Then)X
3732(comes)X
3957(a)X
4013(series)X
4216(of)X
555 942(attacks:)N
820(\256rst)X
964(by)X
2 f
1064(rsh)X
1 f
1186(from)X
1362(the)X
1480(account)X
1750(that)X
1890(the)X
2008(worm)X
2215(is)X
2288(running)X
2557(under,)X
2780(then)X
2938(through)X
2 f
3207(\256nger)X
1 f
3394(,)X
3434(then)X
3592(through)X
2 f
3861(sendmail)X
1 f
4150(.)X
4210(If)X
2 f
555 1032(infect)N
1 f
733(\(\))X
807(fails,)X
985(it)X
1049(marks)X
1265(the)X
1383(host)X
1536(as)X
1623(immune.)X
755 1155(The)N
900(other)X
1085(infection)X
1390(routine)X
1637(is)X
1710(named)X
2 f
1944(hu1)X
1 f
(\(\))S
2138(and)X
2274(it)X
2338(is)X
2411(run)X
2538(from)X
2714(the)X
2832(password)X
3155(cracking)X
3452(code)X
3624(after)X
3792(a)X
3848(password)X
4171(has)X
555 1245(been)N
727(guessed.)X
2 f
1041(hu1)X
1 f
(\(\),)S
1255(like)X
2 f
1395(infect)X
1 f
1573(\(\),)X
1667(makes)X
1892(sure)X
2046(that)X
2186(it's)X
2308(not)X
2430(re-infecting)X
2825(a)X
2881(host,)X
3054(then)X
3212(it)X
3276(checks)X
3515(for)X
3629(an)X
3725(address.)X
4026(If)X
4100(a)X
555 1335(potential)N
855(remote)X
1098(user)X
1252(name)X
1446(is)X
1519(available)X
1829(from)X
2005(a)X
2 f
2061(.forward)X
1 f
2358(or)X
2 f
2445(.rhosts)X
1 f
2680(\256le,)X
2822(the)X
2940(worm)X
3147(checks)X
3386(it)X
3450(to)X
3532(make)X
3726(sure)X
3880(it)X
3944(is)X
555 1425(reasonable\320it)N
1043(must)X
1218(contain)X
1474(no)X
1574(punctuation)X
1972(or)X
2059(control)X
2306(characters.)X
2693(If)X
2767(a)X
2823(remote)X
3066(user)X
3220(name)X
3414(is)X
3487(unavailable)X
3877(the)X
3995(worm)X
555 1515(uses)N
713(the)X
831(local)X
1007(user)X
1161(name.)X
1395(Once)X
1585(the)X
1703(worm)X
1910(has)X
2037(a)X
2093(user)X
2247(name)X
2441(and)X
2577(a)X
2633(password,)X
2976(it)X
3040(contacts)X
3323(the)X
2 f
3441(rexec)X
1 f
3636(server)X
3853(on)X
3953(the)X
4071(target)X
555 1605(host)N
708(and)X
844(tries)X
1002(to)X
1084(authenticate)X
1492(itself.)X
1712(If)X
1786(it)X
1850(can,)X
2002(it)X
2066(proceeds)X
2372(to)X
2454(the)X
2572(bootstrap)X
2890(phase;)X
3115(otherwise,)X
3467(it)X
3531(tries)X
3689(a)X
3745(slightly)X
4004(different)X
555 1695(approach\320it)N
994(connects)X
1295(to)X
1377(the)X
1495(local)X
2 f
1671(rexec)X
1 f
1866(server)X
2083(with)X
2245(the)X
2363(local)X
2539(user)X
2693(name)X
2887(and)X
3023(password,)X
3366(then)X
3524(uses)X
3682(this)X
3817(command)X
555 1785(interpreter)N
910(to)X
992(\256re)X
1119(off)X
1233(a)X
1289(command)X
1625(interpreter)X
1980(on)X
2080(the)X
2198(target)X
2401(machine)X
2693(with)X
2 f
2855(rsh)X
1 f
2957(.)X
3017(This)X
3179(will)X
3323(succeed)X
3598(if)X
3667(the)X
3785(remote)X
4028(host)X
555 1875(says)N
713(it)X
777(trusts)X
970(the)X
1088(local)X
1264(host)X
1417(in)X
1499(its)X
2 f
1594(/etc/hosts.equiv)X
1 f
2110(\256le,)X
2252(or)X
2339(the)X
2457(remote)X
2700(account)X
2970(says)X
3128(it)X
3192(trusts)X
3385(the)X
3503(local)X
3679(account)X
3949(in)X
4031(its)X
2 f
555 1965(.rhosts)N
1 f
790(\256le.)X
2 f
952(hu1)X
1 f
(\(\))S
1146(ignores)X
2 f
1402(infect)X
1 f
1580(\(\)'s)X
1712(``immune'')X
2102(\257ag)X
2242(and)X
2378(does)X
2545(not)X
2667(set)X
2776(this)X
2911(\257ag)X
3051(itself,)X
3251(since)X
2 f
3436(hu1)X
1 f
(\(\))S
3630(may)X
3788(\256nd)X
3932(success)X
4193(on)X
555 2055(a)N
611(per-account)X
1011(basis)X
1191(that)X
2 f
1331(infect)X
1 f
1509(\(\))X
1583(can't)X
1764(achieve)X
2030(on)X
2130(a)X
2186(per-host)X
2469(basis.)X
755 2194(Both)N
2 f
930(infect)X
1 f
1108(\(\))X
1182(and)X
2 f
1318(hu1)X
1 f
(\(\))S
1512(use)X
1639(a)X
1695(routine)X
1942(we)X
2056(call)X
2 f
2192(sendworm)X
1 f
2521(\(\))X
2595(to)X
2677(do)X
2777(their)X
2944(dirty)X
3115(work)X
7 s
3280 2162(5)N
10 s
2194(.)Y
2 f
3368(sendworm)X
1 f
3697(\(\))X
3771(looks)X
3964(for)X
4078(the)X
2 f
555 2284(l1.c)N
1 f
693(bootstrap)X
1011(source)X
1241(\256le)X
1363(in)X
1445(its)X
1540(objects)X
1787(list,)X
1924(then)X
2082(it)X
2146(uses)X
2304(the)X
2 f
2422(makemagic)X
1 f
2788(\(\))X
2862(routine)X
3109(to)X
3191(get)X
3309(a)X
3365(communication)X
3883(stream)X
4117(end-)X
555 2374(point)N
739(\(a)X
2 f
822(socket)X
1 f
1023(\),)X
1090(a)X
1146(random)X
1411(network)X
1694(port)X
1843(number)X
2108(to)X
2190(rendezvous)X
2576(at,)X
2674(and)X
2810(a)X
2866(magic)X
3082(number)X
3347(for)X
3461(authentication.)X
3975(\(There)X
4210(is)X
555 2464(an)N
651(interesting)X
1009(side)X
1158(effect)X
1362(to)X
2 f
1444(makemagic)X
1 f
1810(\(\)\320it)X
2008(looks)X
2201(for)X
2315(a)X
2371(usable)X
2596(address)X
2857(for)X
2971(the)X
3089(target)X
3292(host)X
3445(by)X
3545(trying)X
3756(to)X
3838(connect)X
4108(to)X
4190(its)X
555 2554(TCP)N
2 f
721(telnet)X
1 f
919(port;)X
1090(this)X
1225(produces)X
1535(a)X
1591(characteristic)X
2040(log)X
2162(message)X
2454(from)X
2630(the)X
2 f
2748(telnet)X
1 f
2946(server.\))X
3210(If)X
2 f
3284(makemagic)X
1 f
3650(\(\))X
3724(was)X
3869(successful,)X
555 2644(the)N
673(worm)X
880(begins)X
1109(to)X
1191(send)X
1358(commands)X
1725(to)X
1807(the)X
1925(remote)X
2168(command)X
2504(interpreter)X
2859(that)X
2999(was)X
3144(started)X
3378(up)X
3478(by)X
3578(the)X
3696(immediately)X
555 2734(preceding)N
892(attack.)X
1144(It)X
1213(changes)X
1492(its)X
1587(directory)X
1897(to)X
1979(an)X
2075(unprotected)X
2474(place)X
2664(\()X
2 f
2691(/usr/tmp)X
1 f
2957(\),)X
3024(then)X
3182(it)X
3246(sends)X
3444(across)X
3665(the)X
3783(bootstrap)X
555 2824(source,)N
805(using)X
998(the)X
1116(U)X
8 s
1174(NIX)X
10 s
1307(stream)X
1541(editor)X
2 f
1748(sed)X
1 f
1875(to)X
1957(parse)X
2147(the)X
2265(input)X
2449(stream.)X
2723(The)X
2868(bootstrap)X
3186(source)X
3416(is)X
3489(compiled)X
3807(and)X
3943(run)X
4070(on)X
4170(the)X
555 2914(remote)N
798(system,)X
1060(and)X
1196(the)X
1314(worm)X
1521(runs)X
1679(a)X
1735(routine)X
1982(named)X
2 f
2216(waithit)X
1 f
2437(\(\))X
2511(to)X
2593(wait)X
2751(for)X
2865(the)X
2983(remote)X
3226(bootstrap)X
3544(to)X
3626(call)X
3762(back)X
3934(on)X
4034(the)X
555 3004(selected)N
834(port.)X
755 3127(The)N
900(bootstrap)X
1218(is)X
1291(quite)X
1471(simple.)X
1744(It)X
1813(is)X
1886(supplied)X
2177(the)X
2295(address)X
2556(of)X
2643(the)X
2761(originating)X
3132(host,)X
3305(a)X
3361(TCP)X
3527(port)X
3676(number)X
3941(and)X
4077(a)X
555 3217(magic)N
771(number)X
1036(as)X
1123(arguments.)X
1517(When)X
1729(it)X
1793(starts,)X
2002(it)X
2066(unlinks)X
2321(itself)X
2501(so)X
2592(that)X
2732(it)X
2796(can't)X
2977(be)X
3073(detected)X
3361(in)X
3443(the)X
3561(\256lesystem,)X
3925(then)X
4083(it)X
4147(calls)X
2 f
555 3307(fork)N
1 f
684(\(\))X
758(to)X
840(create)X
1053(a)X
1109(new)X
1263(process)X
1524(with)X
1686(the)X
1804(same)X
1989(image.)X
2245(The)X
2390(old)X
2512(process)X
2773(exits,)X
2964(permitting)X
3317(the)X
3435(originating)X
3806(worm)X
4013(to)X
4095(con-)X
555 3397(tinue)N
735(with)X
897(its)X
992(business.)X
1323(The)X
1468(bootstrap)X
1786(reads)X
1976(its)X
2071(arguments)X
2425(then)X
2583(zeroes)X
2809(them)X
2989(out)X
3111(to)X
3193(hide)X
3351(them)X
3531(from)X
3707(the)X
3825(system)X
4067(status)X
555 3487(program;)N
869(then)X
1027(it)X
1091(is)X
1164(ready)X
1363(to)X
1445(connect)X
1715(over)X
1878(the)X
1996(network)X
2279(to)X
2361(the)X
2479(parent)X
2700(worm.)X
2947(When)X
3159(the)X
3277(connection)X
3649(is)X
3722(made,)X
3936(the)X
555 3577(bootstrap)N
873(sends)X
1071(over)X
1234(the)X
1352(magic)X
1568(number,)X
1853(which)X
2069(the)X
2187(parent)X
2408(will)X
2552(check)X
2760(against)X
3007(its)X
3102(own)X
3260(copy.)X
3476(If)X
3550(the)X
3668(parent)X
3889(accepts)X
4146(the)X
555 3667(number)N
820(\(which)X
1063(is)X
1136(carefully)X
1442(rendered)X
1744(to)X
1826(be)X
1922(independent)X
2334(of)X
2421(host)X
2574(byte)X
2732(order\),)X
2969(it)X
3033(will)X
3177(send)X
3344(over)X
3507(a)X
3563(series)X
3766(of)X
3853(\256lenames)X
4180(and)X
555 3757(\256les)N
708(which)X
924(the)X
1042(bootstrap)X
1360(writes)X
1576(to)X
1658(disk.)X
1851(If)X
1925(trouble)X
2172(occurs,)X
2422(the)X
2540(bootstrap)X
2858(removes)X
3150(all)X
3250(these)X
3435(\256les)X
3588(and)X
3724(exits.)X
3935(Eventually)X
555 3847(the)N
673(transaction)X
1045(completes,)X
1410(and)X
1546(the)X
1664(bootstrap)X
1982(calls)X
2149(up)X
2249(a)X
2305(command)X
2641(interpreter)X
2996(to)X
3078(\256nish)X
3275(the)X
3393(job.)X
755 3970(In)N
842(the)X
960(meantime,)X
1316(the)X
1434(parent)X
1655(in)X
2 f
1737(waithit)X
1 f
1958(\(\))X
2032(spends)X
2270(up)X
2370(to)X
2452(two)X
2592(minutes)X
2865(waiting)X
3125(for)X
3239(the)X
3357(bootstrap)X
3675(to)X
3757(call)X
3893(back;)X
4087(if)X
4156(the)X
555 4060(bootstrap)N
873(fails)X
1031(to)X
1113(call)X
1249(back,)X
1441(or)X
1528(the)X
1646(authentication)X
2120(fails,)X
2298(the)X
2416(worm)X
2623(decides)X
2884(to)X
2966(give)X
3124(up)X
3224(and)X
3360(reports)X
3603(a)X
3659(failure.)X
3929(When)X
4141(a)X
555 4150(connection)N
927(is)X
1000(successful,)X
1370(the)X
1488(worm)X
1695(ships)X
1879(all)X
1979(of)X
2066(its)X
2161(\256les)X
2314(across)X
2535(followed)X
2840(by)X
2940(an)X
3036(end-of-\256le)X
3395(indicator.)X
3740(It)X
3809(pauses)X
4043(four)X
555 4240(seconds)N
829(to)X
911(let)X
1011(a)X
1067(command)X
1403(interpreter)X
1758(start)X
1916(on)X
2016(the)X
2134(remote)X
2377(side,)X
2546(then)X
2704(it)X
2768(issues)X
2979(commands)X
3346(to)X
3428(create)X
3641(a)X
3697(new)X
3851(worm.)X
4098(For)X
555 4330(each)N
723(relocatable)X
1096(object)X
1312(\256le)X
1434(in)X
1516(the)X
1634(list)X
1751(of)X
1838(\256les,)X
2011(the)X
2129(worm)X
2336(tries)X
2494(to)X
2576(build)X
2760(an)X
2856(executable)X
3220(object;)X
3458(typically)X
3758(each)X
3926(\256le)X
4048(con-)X
555 4420(tains)N
726(code)X
898(for)X
1012(a)X
1068(particular)X
1396(make)X
1590(of)X
1677(computer,)X
2020(and)X
2156(the)X
2274(builds)X
2489(will)X
2633(fail)X
2760(until)X
2926(the)X
3044(worm)X
3251(tries)X
3409(the)X
3527(proper)X
3757(computer)X
4080(type.)X
555 4510(If)N
629(the)X
747(parent)X
968(worm)X
1175(\256nally)X
1399(gets)X
1548(an)X
1644(executable)X
2008(child)X
2188(worm)X
2395(built,)X
2581(it)X
2645(sets)X
2785(it)X
2849(loose)X
3038(with)X
3200(the)X
3 f
9 f
3318(-)X
3320(-)X
3 f
3364(p)X
1 f
3428(option)X
3652(to)X
3734(kill)X
3860(the)X
3978(command)X
555 4600(interpreter,)N
930(then)X
1088(shuts)X
1272(down)X
1470(the)X
1588(connection.)X
2000(The)X
2145(target)X
2348(host)X
2501(is)X
2574(marked)X
2835(``infected''.)X
3262(If)X
3336(none)X
3512(of)X
3599(the)X
3717(objects)X
3964(produces)X
555 4690(a)N
611(usable)X
836(child)X
1016(worm,)X
1243(the)X
1361(parent)X
1582(removes)X
1874(the)X
1992(detritus)X
2252(and)X
2 f
2388(waithit)X
1 f
2609(\(\))X
2683(returns)X
2926(an)X
3022(error)X
3199(indication.)X
755 4813(When)N
967(a)X
1023(system)X
1265(is)X
1338(being)X
1536(swamped)X
1859(by)X
1959(worms,)X
2217(the)X
2 f
2335(/usr/tmp)X
1 f
2621(directory)X
2931(can)X
3063(\256ll)X
3171(with)X
3333(leftover)X
3603(\256les)X
3756(as)X
3843(a)X
3899(conse-)X
555 4903(quence)N
803(of)X
890(a)X
946(bug)X
1086(in)X
2 f
1168(waithit)X
1 f
1389(\(\).)X
1503(If)X
1577(a)X
1633(worm)X
1840(compile)X
2118(takes)X
2303(more)X
2488(than)X
2646(30)X
2746(seconds,)X
3040(resynchronization)X
3635(code)X
3807(will)X
3951(report)X
4163(an)X
555 4993(error)N
732(but)X
2 f
854(waithit)X
1 f
1075(\(\))X
1149(will)X
1293(fail)X
1420(to)X
1502(remove)X
1763(the)X
1881(\256les)X
2034(it)X
2098(has)X
2225(created.)X
2518(On)X
2636(one)X
2772(of)X
2859(our)X
2986(machines,)X
3329(13)X
3429(MB)X
3573(of)X
3660(material)X
3943(represent-)X
555 5083(ing)N
677(86)X
777(sets)X
917(of)X
1004(\256les)X
1157(accumulated)X
1583(over)X
1746(5.5)X
1866(hours.)X
8 s
10 f
555 5378(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N
5 s
1 f
727 5456(5)N
8 s
764 5481(One)N
887(minor)X
1057(exception:)X
1340(the)X
2 f
1435(sendmail)X
1 f
1682(attack)X
1850(doesn't)X
2054(use)X
2 f
2155(sendworm)X
1 f
2418(\(\))X
2476(since)X
2623(it)X
2675(needs)X
2836(to)X
2902(handle)X
3088(the)X
3182(SMTP)X
3366(protocol)X
3595(in)X
3661(addition)X
3887(to)X
3953(the)X
4047(command)X
555 5553(interpreter)N
836(interface,)X
1090(but)X
1188(the)X
1282(principle)X
1525(is)X
1584(the)X
1678(same.)X

11 p
%%Page: 11 11
8 s 0 xH 0 xS 1 f
10 s
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(11)X
555 762(4.7.)N
715(Password)X
1064(cracking)X
1 f
755 885(A)N
833(password)X
1156(cracking)X
1453(algorithm)X
1784(seems)X
2000(like)X
2140(a)X
2196(slow)X
2367(and)X
2503(bulky)X
2705(item)X
2867(to)X
2949(put)X
3071(in)X
3153(a)X
3209(worm,)X
3436(but)X
3558(the)X
3676(worm)X
3883(makes)X
4108(this)X
555 975(work)N
740(by)X
840(being)X
1038(persistent)X
1365(and)X
1501(ef\256cient.)X
1824(The)X
1969(worm)X
2176(is)X
2249(aided)X
2443(by)X
2543(some)X
2732(unfortunate)X
3122(statistics)X
3417(about)X
3615(typical)X
3853(password)X
555 1065(choices.)N
856(Here)X
1033(we)X
1147(discuss)X
1398(how)X
1556(the)X
1674(worm)X
1881(goes)X
2048(about)X
2246(choosing)X
2555(passwords)X
2909(to)X
2991(test)X
3122(and)X
3258(how)X
3416(the)X
3534(U)X
8 s
3592(NIX)X
10 s
3725(password)X
4048(encryp-)X
555 1155(tion)N
699(routine)X
946(was)X
1091(modi\256ed.)X
3 f
555 1341(4.7.1.)N
775(Guessing)X
1105(passwords)X
1 f
9 s
715 1455(For)N
837(example,)X
1120(if)X
1185(the)X
1294(login)X
1463(name)X
1640(is)X
1709(``abc'',)X
1944(then)X
2089(``abc'',)X
2324(``cba'',)X
2559(and)X
2684(``abcabc'')X
3001(are)X
3110(excellent)X
3391(candidates)X
3716(for)X
3821(passwords.)X
715 1536([Grampp)N
993(and)X
1115(Morris,)X
1347(``U)X
7 s
(NIX)S
9 s
1564(Operating)X
1870(System)X
2100(Security''])X
10 s
755 1692(The)N
900(worm's)X
1165(password)X
1488(guessing)X
1788(is)X
1861(driven)X
2086(by)X
2186(a)X
2242(little)X
2408(4-state)X
2642(machine.)X
2974(The)X
3119(\256rst)X
3263(state)X
3430(gathers)X
3682(password)X
4005(data,)X
555 1782(while)N
753(the)X
871(remaining)X
1216(states)X
1414(represent)X
1729(increasingly)X
2141(less)X
2281(likely)X
2483(sources)X
2744(of)X
2831(potential)X
3131(passwords.)X
3525(The)X
3670(central)X
3909(cracking)X
555 1872(routine)N
802(is)X
875(called)X
2 f
1087(cracksome)X
1 f
1431(\(\),)X
1525(and)X
1661(it)X
1725(contains)X
2012(a)X
2068(switch)X
2297(on)X
2397(each)X
2565(of)X
2652(the)X
2770(four)X
2924(states.)X
755 1995(The)N
900(routine)X
1147(that)X
1287(implements)X
1680(the)X
1798(\256rst)X
1942(state)X
2109(we)X
2223(named)X
2 f
2457(crack_0)X
1 f
2716(\(\).)X
2830(This)X
2992(routine's)X
3297(job)X
3419(is)X
3492(to)X
3574(collect)X
3808(information)X
555 2085(about)N
753(hosts)X
937(and)X
1073(accounts.)X
1414(It)X
1483(is)X
1556(only)X
1718(run)X
1845(once;)X
2039(the)X
2157(information)X
2555(it)X
2619(gathers)X
2871(persists)X
3131(for)X
3245(the)X
3363(lifetime)X
3632(of)X
3719(the)X
3837(worm.)X
4084(Its)X
555 2175(implementation)N
1077(is)X
1150(straightforward:)X
1687(it)X
1751(reads)X
1941(the)X
2059(\256les)X
2 f
2212(/etc/hosts.equiv)X
1 f
2728(and)X
2 f
2864(/.rhosts)X
1 f
3121(for)X
3235(hosts)X
3419(to)X
3501(attack,)X
3733(then)X
3891(reads)X
4081(the)X
555 2265(password)N
878(\256le)X
1000(looking)X
1264(for)X
1378(accounts.)X
1719(For)X
1850(each)X
2018(account,)X
2308(the)X
2426(worm)X
2633(saves)X
2827(the)X
2945(name,)X
3159(the)X
3277(encrypted)X
3614(password,)X
3957(the)X
4075(home)X
555 2355(directory)N
865(and)X
1001(the)X
1119(user)X
1273(information)X
1671(\256elds.)X
1904(As)X
2013(a)X
2069(quick)X
2267(preliminary)X
2661(check,)X
2889(it)X
2953(looks)X
3146(for)X
3260(a)X
2 f
3316(.forward)X
1 f
3613(\256le)X
3735(in)X
3817(each)X
3985(user's)X
555 2445(home)N
753(directory)X
1063(and)X
1199(saves)X
1393(any)X
1529(host)X
1682(name)X
1876(it)X
1940(\256nds)X
2115(in)X
2197(that)X
2337(\256le,)X
2479(marking)X
2766(it)X
2830(like)X
2970(the)X
3088(previous)X
3384(ones.)X
755 2568(We)N
887(unimaginatively)X
1427(called)X
1639(the)X
1757(function)X
2044(for)X
2158(the)X
2276(next)X
2434(state)X
2 f
2601(crack_1)X
1 f
2860(\(\).)X
2 f
2974(crack_1)X
1 f
3233(\(\))X
3307(looks)X
3500(for)X
3614(trivially)X
3887(broken)X
4130(pass-)X
555 2658(words.)N
811(These)X
1023(are)X
1142(passwords)X
1496(which)X
1712(can)X
1844(be)X
1940(guessed)X
2214(merely)X
2457(on)X
2557(the)X
2675(basis)X
2855(of)X
2942(information)X
3340(already)X
3597(contained)X
3929(in)X
4011(the)X
4129(pass-)X
555 2748(word)N
740(\256le.)X
902(Grampp)X
1185(and)X
1321(Morris)X
1559(report)X
1771(a)X
1827(survey)X
2061(of)X
2148(over)X
2311(100)X
2451(password)X
2774(\256les)X
2927(where)X
3144(between)X
3432(8)X
3492(and)X
3628(30)X
3728(percent)X
3985(of)X
4072(all)X
555 2838(passwords)N
909(were)X
1086(guessed)X
1360(using)X
1553(just)X
1688(the)X
1806(literal)X
2013(account)X
2283(name)X
2477(and)X
2613(a)X
2669(couple)X
2903(of)X
2990(variations.)X
3366(The)X
3511(worm)X
3718(tries)X
3876(a)X
3932(little)X
555 2928(harder)N
781(than)X
939(this:)X
1096(it)X
1160(checks)X
1399(the)X
1517(null)X
1661(password,)X
2004(the)X
2122(account)X
2392(name,)X
2606(the)X
2724(account)X
2994(name)X
3188(concatenated)X
3628(with)X
3790(itself,)X
3990(the)X
4108(\256rst)X
555 3018(name)N
749(\(extracted)X
1091(from)X
1267(the)X
1385(user)X
1539(information)X
1937(\256eld,)X
2119(with)X
2281(the)X
2399(\256rst)X
2543(letter)X
2728(mapped)X
3002(to)X
3084(lower)X
3287(case\),)X
3493(the)X
3611(last)X
3742(name,)X
3956(and)X
4092(the)X
555 3108(account)N
825(name)X
1019(reversed.)X
1352(It)X
1421(runs)X
1579(through)X
1848(up)X
1948(to)X
2030(50)X
2130(accounts)X
2431(per)X
2554(call)X
2690(to)X
2 f
2772(cracksome)X
1 f
3116(\(\),)X
3210(saving)X
3439(its)X
3534(place)X
3724(in)X
3806(the)X
3924(list)X
4041(of)X
555 3198(accounts)N
856(and)X
992(advancing)X
1342(to)X
1424(the)X
1542(next)X
1700(state)X
1867(when)X
2061(it)X
2125(runs)X
2283(out)X
2405(of)X
2492(accounts)X
2793(to)X
2875(try.)X
755 3321(The)N
900(next)X
1058(state)X
1225(is)X
1298(handled)X
1572(by)X
2 f
1672(crack_2)X
1 f
1931(\(\).)X
2045(In)X
2132(this)X
2267(state)X
2434(the)X
2552(worm)X
2759(compares)X
3087(a)X
3143(list)X
3260(of)X
3347(favorite)X
3617(passwords,)X
3991(one)X
4127(pass-)X
555 3411(word)N
740(per)X
863(call,)X
1019(with)X
1181(all)X
1281(of)X
1368(the)X
1486(encrypted)X
1823(passwords)X
2177(in)X
2259(the)X
2377(password)X
2700(\256le.)X
2862(The)X
3007(list)X
3124(contains)X
3411(432)X
3551(words,)X
3787(most)X
3962(of)X
4049(which)X
555 3501(are)N
674(real)X
815(English)X
1079(words)X
1295(or)X
1382(proper)X
1612(names;)X
1859(it)X
1923(seems)X
2139(likely)X
2341(that)X
2481(this)X
2616(list)X
2733(was)X
2878(generated)X
3211(by)X
3311(stealing)X
3580(password)X
3903(\256les)X
4056(and)X
555 3591(cracking)N
852(them)X
1032(at)X
1110(leisure)X
1344(on)X
1444(the)X
1562(worm)X
1769(author's)X
2052(home)X
2250(machine.)X
2582(A)X
2660(global)X
2880(variable)X
2 f
3159(nextw)X
1 f
3366(is)X
3439(used)X
3606(to)X
3688(count)X
3886(the)X
4004(number)X
555 3681(of)N
642(passwords)X
996(tried,)X
1183(and)X
1319(it)X
1383(is)X
1456(this)X
1591(count)X
1789(\(plus)X
1969(a)X
2025(loss)X
2169(in)X
2251(the)X
2369(population)X
2731(control)X
2978(game\))X
3199(that)X
3339(controls)X
3617(whether)X
3896(the)X
4014(worm)X
555 3771(exits)N
726(at)X
804(the)X
922(end)X
1058(of)X
1145(the)X
1263(main)X
1443(loop\320)X
2 f
1665(nextw)X
1 f
1872(must)X
2047(be)X
2143(greater)X
2387(than)X
2545(10)X
2645(before)X
2871(the)X
2989(worm)X
3196(can)X
3328(exit.)X
3508(Since)X
3706(the)X
3824(worm)X
4031(nor-)X
555 3861(mally)N
757(spends)X
995(2.5)X
1115(minutes)X
1388(checking)X
1698(for)X
1812(clients)X
2041(over)X
2204(the)X
2322(course)X
2552(of)X
2639(the)X
2757(main)X
2937(loop)X
3099(and)X
3235(calls)X
2 f
3402(cracksome)X
1 f
3746(\(\))X
3820(twice)X
4014(in)X
4096(that)X
555 3951(period,)N
800(it)X
864(appears)X
1130(that)X
1270(the)X
1388(worm)X
1595(must)X
1770(make)X
1964(a)X
2020(minimum)X
2350(of)X
2437(7)X
2497(passes)X
2722(through)X
2991(the)X
3109(main)X
3289(loop,)X
3471(taking)X
3691(more)X
3876(than)X
4034(15)X
555 4057(minutes)N
7 s
808 4025(6)N
10 s
4057(.)Y
896(It)X
965(will)X
1109(take)X
1263(at)X
1341(least)X
1508(9)X
1568(hours)X
1766(for)X
1880(the)X
1998(worm)X
2205(to)X
2287(scan)X
2450(its)X
2545(built-in)X
2800(password)X
3123(list)X
3240(and)X
3376(proceed)X
3651(to)X
3733(the)X
3851(next)X
4009(state.)X
755 4180(The)N
900(last)X
1031(state)X
1198(is)X
1271(handled)X
1545(by)X
2 f
1645(crack_3)X
1 f
1904(\(\).)X
2018(It)X
2087(opens)X
2294(the)X
2412(U)X
8 s
2470(NIX)X
10 s
2603(online)X
2823(dictionary)X
2 f
3168(/usr/dict/words)X
1 f
3671(and)X
3807(goes)X
3974(through)X
4243(it)X
555 4270(one)N
691(word)X
876(at)X
954(a)X
1010(time.)X
1212(If)X
1286(a)X
1342(word)X
1527(is)X
1600(capitalized,)X
1988(the)X
2106(worm)X
2313(tries)X
2471(a)X
2527(lower-case)X
2896(version)X
3152(as)X
3239(well.)X
3437(This)X
3599(search)X
3825(can)X
3957(essentially)X
555 4360(go)N
655(on)X
755(forever:)X
1030(it)X
1094(would)X
1314(take)X
1468(something)X
1821(like)X
1961(four)X
2115(weeks)X
2336(for)X
2450(the)X
2568(worm)X
2775(to)X
2857(\256nish)X
3054(a)X
3110(typical)X
3348(dictionary)X
3693(like)X
3833(ours.)X
755 4483(When)N
967(the)X
1085(worm)X
1292(selects)X
1526(a)X
1582(potential)X
1882(password,)X
2225(it)X
2289(passes)X
2514(it)X
2578(to)X
2660(a)X
2716(routine)X
2963(we)X
3077(called)X
2 f
3289(try_password)X
1 f
3724(\(\).)X
3838(This)X
4000(function)X
555 4573(calls)N
722(the)X
840(worm's)X
1105(special)X
1348(version)X
1604(of)X
1691(the)X
1809(U)X
8 s
1867(NIX)X
10 s
2000(password)X
2323(encryption)X
2686(function)X
2 f
2973(crypt)X
1 f
3138(\(\))X
3212(and)X
3348(compares)X
3676(the)X
3794(result)X
3992(with)X
4154(the)X
555 4663(target)N
758(account's)X
1086(actual)X
1298(encrypted)X
1635(password.)X
1998(If)X
2072(they)X
2230(are)X
2349(equal,)X
2563(or)X
2650(if)X
2719(the)X
2837(password)X
3160(and)X
3296(guess)X
3494(are)X
3613(the)X
3731(null)X
3875(string)X
4077(\(no)X
555 4753(password\),)N
925(the)X
1043(worm)X
1250(saves)X
1444(the)X
1562(cleartext)X
1859(password)X
2182(and)X
2318(proceeds)X
2624(to)X
2706(attack)X
2918(hosts)X
3102(that)X
3242(are)X
3361(connected)X
3707(to)X
3789(this)X
3924(account.)X
4234(A)X
555 4843(routine)N
802(we)X
916(called)X
2 f
1128(try_forward_and_rhosts)X
1 f
1909(\(\))X
1983(reads)X
2173(the)X
2291(user's)X
2 f
2503(.forward)X
1 f
2800(and)X
2 f
2936(.rhosts)X
1 f
3171(\256les,)X
3344(calling)X
3582(the)X
3700(previously)X
555 4933(described)N
2 f
883(hu1)X
1 f
(\(\))S
1077(function)X
1364(for)X
1478(each)X
1646(remote)X
1889(account)X
2159(it)X
2223(\256nds.)X
8 s
10 f
555 5005(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh)N
5 s
1 f
727 5083(6)N
8 s
768 5108(For)N
878(those)X
1034(mindful)X
1258(of)X
1332(details:)X
1538(The)X
1658(\256rst)X
1779(call)X
1892(to)X
2 f
1963(cracksome)X
1 f
2235(\(\))X
2298(is)X
2362(consumed)X
2642(reading)X
2854(system)X
3053(\256les.)X
3213(The)X
3333(worm)X
3503(must)X
3649(spend)X
3819(at)X
3886(least)X
4024(one)X
4137(call)X
4249(to)X
2 f
555 5180(cracksome)N
1 f
827(\(\))X
889(in)X
959(the)X
1057(second)X
1254(state)X
1391(attacking)X
1645(trivial)X
1818(passwords.)X
2136(This)X
2270(accounts)X
2513(for)X
2607(at)X
2673(least)X
2809(one)X
2920(pass)X
3049(through)X
3267(the)X
3364(main)X
3511(loop.)X
3676(In)X
3748(the)X
3845(third)X
3985(state,)X
2 f
4137(crack-)X
555 5252(some)N
1 f
686(\(\))X
747(tests)X
880(one)X
990(password)X
1249(from)X
1391(its)X
1470(list)X
1567(of)X
1638(favorites)X
1879(on)X
1961(each)X
2095(call;)X
2223(the)X
2319(worm)X
2486(will)X
2604(exit)X
2718(if)X
2775(it)X
2829(lost)X
2940(a)X
2986(roll)X
3093(of)X
3164(the)X
3260(dice)X
3384(and)X
3494(more)X
3643(than)X
3771(ten)X
3867(words)X
4041(have)X
4179(been)X
555 5324(checked,)N
799(so)X
876(this)X
989(accounts)X
1232(for)X
1326(at)X
1392(least)X
1529(six)X
1623(loops,)X
1797(two)X
1912(words)X
2087(on)X
2170(each)X
2305(loop)X
2438(for)X
2531(\256ve)X
2646(loops)X
2804(to)X
2873(reach)X
3029(10)X
3112(words,)X
3303(then)X
3432(another)X
3642(loop)X
3775(to)X
3844(pass)X
3973(that)X
4088(number.)X
555 5396(Altogether)N
852(this)X
969(amounts)X
1210(to)X
1284(a)X
1335(minimum)X
1608(of)X
1684(7)X
1739(loops.)X
1933(If)X
1998(all)X
2085(7)X
2140(loops)X
2302(took)X
2439(the)X
2540(maximum)X
2823(amount)X
3038(of)X
3114(time)X
3251(waiting)X
3466(for)X
3563(clients,)X
3769(this)X
3885(would)X
4068(require)X
4271(a)X
555 5468(minimum)N
827(of)X
902(17.5)X
1036(minutes,)X
1277(but)X
1381(the)X
1481(2-minute)X
1734(check)X
1904(can)X
2014(exit)X
2132(early)X
2281(if)X
2342(a)X
2392(client)X
2556(connects)X
2801(and)X
2915(the)X
3015(server)X
3191(loses)X
3340(the)X
3439(challenge,)X
3720(hence)X
3889(15.5)X
4022(minutes)X
4246(of)X
555 5540(waiting)N
764(time)X
895(plus)X
1019(runtime)X
1235(overhead)X
1485(is)X
1545(the)X
1640(minimum)X
1907(lifetime.)X
2155(In)X
2225(this)X
2335(period)X
2515(a)X
2560(worm)X
2726(will)X
2843(attack)X
3011(at)X
3073(least)X
3206(8)X
3254(hosts)X
3402(through)X
3617(the)X
3711(host)X
3834(infection)X
4077(routines,)X
555 5612(and)N
663(will)X
779(try)X
866(about)X
1024(18)X
1104(passwords)X
1386(for)X
1476(each)X
1608(account,)X
1838(attacking)X
2088(more)X
2235(hosts)X
2383(if)X
2438(accounts)X
2677(are)X
2770(cracked.)X

12 p
%%Page: 12 12
8 s 0 xH 0 xS 1 f
10 s
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(12)X
555 762(4.7.2.)N
775(Faster)X
1014(password)X
1358(encryption)X
1 f
9 s
715 876(The)N
850(use)X
969(of)X
1052(encrypted)X
1359(passwords)X
1682(appears)X
1925(reasonably)X
2260(secure)X
2467(in)X
2546(the)X
2657(absence)X
2908(of)X
2991(serious)X
3218(attention)X
3493(of)X
3575(experts)X
3805(in)X
3883(the)X
3993(\256eld.)X
715 957([Morris)N
953(and)X
1075(Thompson,)X
1419(``Password)X
1761(Security:)X
2039(A)X
2109(Case)X
2267(History''])X
10 s
755 1113(Unfortunately)N
1225(some)X
1414(experts)X
1666(in)X
1748(the)X
1866(\256eld)X
2028(have)X
2200(been)X
2372(giving)X
2596(serious)X
2843(attention)X
3143(to)X
3225(fast)X
3361(implementations)X
3914(of)X
4001(the)X
4119(U)X
8 s
4177(NIX)X
10 s
555 1203(password)N
878(encryption)X
1241(algorithm.)X
1612(U)X
8 s
1670(NIX)X
10 s
1803(password)X
2126(authentication)X
2600(works)X
2816(without)X
3080(putting)X
3326(any)X
3462(readable)X
3755(version)X
4011(of)X
4098(the)X
555 1293(password)N
878(onto)X
1040(the)X
1158(system,)X
1420(and)X
1556(indeed)X
1790(works)X
2006(without)X
2270(protecting)X
2615(the)X
2733(encrypted)X
3070(password)X
3393(against)X
3640(reading)X
3901(by)X
4001(users)X
4186(on)X
555 1383(the)N
673(system.)X
955(When)X
1167(a)X
1223(user)X
1377(types)X
1566(a)X
1622(password)X
1945(in)X
2027(the)X
2145(clear,)X
2342(the)X
2460(system)X
2702(encrypts)X
2994(it)X
3058(using)X
3251(the)X
3369(standard)X
2 f
3661(crypt)X
1 f
3826(\(\))X
3900(library)X
4134(rou-)X
555 1473(tine,)N
715(then)X
873(compares)X
1201(it)X
1265(against)X
1512(a)X
1568(saved)X
1771(copy)X
1947(of)X
2034(the)X
2152(encrypted)X
2489(password.)X
2852(The)X
2997(encryption)X
3360(algorithm)X
3691(is)X
3764(meant)X
3980(to)X
4062(be)X
555 1563(basically)N
860(impossible)X
1226(to)X
1308(invert,)X
1535(preventing)X
1898(the)X
2016(retrieval)X
2304(of)X
2391(passwords)X
2745(by)X
2845(examining)X
3203(only)X
3365(the)X
3483(encrypted)X
3820(text,)X
3980(and)X
4116(it)X
4180(is)X
555 1653(meant)N
771(to)X
853(be)X
949(expensive)X
1290(to)X
1372(run,)X
1519(so)X
1610(that)X
1750(testing)X
1983(guesses)X
2248(will)X
2392(take)X
2546(a)X
2602(long)X
2764(time.)X
2966(The)X
3111(U)X
8 s
3169(NIX)X
10 s
3302(password)X
3625(encryption)X
3988(algorithm)X
555 1743(is)N
628(based)X
831(on)X
931(the)X
1049(Federal)X
1310(Data)X
1482(Encryption)X
1858(Standard)X
2163(\(DES\).)X
2428(Currently)X
2755(no)X
2855(one)X
2991(knows)X
3220(how)X
3378(to)X
3460(invert)X
3667(this)X
3802(algorithm)X
4133(in)X
4215(a)X
555 1833(reasonable)N
919(amount)X
1179(of)X
1266(time,)X
1448(and)X
1584(while)X
1782(fast)X
1918(DES)X
2089(encoding)X
2403(chips)X
2592(are)X
2711(available,)X
3041(the)X
3159(U)X
8 s
3217(NIX)X
10 s
3350(version)X
3606(of)X
3693(the)X
3811(algorithm)X
4142(is)X
555 1923(slightly)N
814(perturbed)X
1142(so)X
1233(that)X
1373(it)X
1437(is)X
1510(impossible)X
1876(to)X
1958(use)X
2085(a)X
2141(standard)X
2433(DES)X
2604(chip)X
2762(to)X
2844(implement)X
3206(it.)X
755 2046(Two)N
922(problems)X
1240(have)X
1412(been)X
1584(mitigating)X
1932(against)X
2179(the)X
2297(U)X
8 s
2355(NIX)X
10 s
2488(implementation)X
3010(of)X
3097(DES.)X
3308(Computers)X
3679(are)X
3798(continually)X
555 2136(increasing)N
905(in)X
987(speed\320current)X
1498(machines)X
1821(are)X
1940(typically)X
2240(several)X
2488(times)X
2681(faster)X
2880(than)X
3038(the)X
3156(machines)X
3479(that)X
3619(were)X
3796(available)X
4106(when)X
555 2226(the)N
673(current)X
921(password)X
1244(scheme)X
1505(was)X
1650(invented.)X
1986(At)X
2086(the)X
2204(same)X
2389(time,)X
2571(ways)X
2756(have)X
2928(been)X
3100(discovered)X
3468(to)X
3550(make)X
3744(software)X
4041(DES)X
555 2316(run)N
682(faster.)X
921(U)X
8 s
979(NIX)X
10 s
1112(passwords)X
1466(are)X
1585(now)X
1743(far)X
1853(more)X
2038(susceptible)X
2414(to)X
2496(persistent)X
2823(guessing,)X
3143(particularly)X
3533(if)X
3602(the)X
3720(encrypted)X
4057(pass-)X
555 2406(words)N
771(are)X
890(already)X
1147(known.)X
1425(The)X
1570(worm's)X
1835(version)X
2091(of)X
2178(the)X
2296(U)X
8 s
2354(NIX)X
2 f
10 s
2487(crypt)X
1 f
2652(\(\))X
2726(routine)X
2973(ran)X
3096(more)X
3281(than)X
3439(9)X
3499(times)X
3692(faster)X
3891(than)X
4049(the)X
555 2496(standard)N
847(version)X
1103(when)X
1297(we)X
1411(tested)X
1618(it)X
1682(on)X
1782(our)X
1909(VAX)X
2103(8600.)X
2323(While)X
2539(the)X
2657(standard)X
2 f
2949(crypt)X
1 f
3114(\(\))X
3188(takes)X
3373(54)X
3473(seconds)X
3747(to)X
3829(encrypt)X
4090(271)X
555 2586(passwords)N
909(on)X
1009(our)X
1136(8600)X
1316(\(the)X
1461(number)X
1726(of)X
1813(passwords)X
2167(actually)X
2441(contained)X
2773(in)X
2855(our)X
2982(password)X
3305(\256le\),)X
3474(the)X
3592(worm's)X
2 f
3857(crypt)X
1 f
4022(\(\))X
4096(takes)X
555 2676(less)N
695(than)X
853(6)X
913(seconds.)X
755 2799(The)N
900(worm's)X
2 f
1165(crypt)X
1 f
1330(\(\))X
1404(algorithm)X
1735(appears)X
2001(to)X
2083(be)X
2179(a)X
2235(compromise)X
2651(between)X
2939(time)X
3101(and)X
3237(space:)X
3458(the)X
3576(time)X
3738(needed)X
3986(to)X
555 2889(encrypt)N
816(one)X
952(password)X
1275(guess)X
1473(versus)X
1698(the)X
1816(substantial)X
2178(extra)X
2359(table)X
2535(space)X
2734(needed)X
2982(to)X
3064(squeeze)X
3339(performance)X
3766(out)X
3888(of)X
3975(the)X
4093(algo-)X
555 2979(rithm.)N
788(Curiously,)X
1143(one)X
1279(performance)X
1706(improvement)X
2153(actually)X
2427(saves)X
2621(a)X
2677(little)X
2843(space.)X
3082(The)X
3227(traditional)X
3576(U)X
8 s
3634(NIX)X
10 s
3767(algorithm)X
4098(stores)X
555 3069(each)N
723(bit)X
827(of)X
914(the)X
1032(password)X
1355(in)X
1437(a)X
1493(byte,)X
1671(while)X
1869(the)X
1987(worm's)X
2252(algorithm)X
2583(packs)X
2786(the)X
2904(bits)X
3039(into)X
3183(two)X
3323(32-bit)X
3534(words.)X
3790(This)X
3952(permits)X
555 3159(the)N
673(worm's)X
938(algorithm)X
1269(to)X
1351(use)X
1478(bit-\256eld)X
1751(and)X
1887(shift)X
2049(operations)X
2403(on)X
2503(the)X
2621(password)X
2944(data,)X
3118(which)X
3334(is)X
3407(immensely)X
3778(faster.)X
4017(Other)X
555 3249(speedups)N
869(include)X
1125(unrolling)X
1438(loops,)X
1651(combining)X
2013(tables,)X
2240(precomputing)X
2705(shifts)X
2898(and)X
3034(masks,)X
3274(and)X
3410(eliminating)X
3794(redundant)X
4135(ini-)X
555 3339(tial)N
677(and)X
813(\256nal)X
975(permutations)X
1413(when)X
1607(performing)X
1988(the)X
2106(25)X
2206(applications)X
2613(of)X
2700(modi\256ed)X
3004(DES)X
3175(that)X
3315(the)X
3433(password)X
3756(encryption)X
4119(algo-)X
555 3429(rithm)N
748(uses.)X
946(The)X
1091(biggest)X
1342(performance)X
1769(improvement)X
2216(comes)X
2441(as)X
2528(a)X
2584(result)X
2782(of)X
2869(combining)X
3231(permutations:)X
3691(the)X
3809(worm)X
4016(uses)X
555 3519(expanded)N
883(arrays)X
1100(which)X
1316(are)X
1435(indexed)X
1709(by)X
1809(groups)X
2047(of)X
2134(bits)X
2269(rather)X
2477(than)X
2635(the)X
2753(single)X
2964(bits)X
3099(used)X
3266(by)X
3366(the)X
3484(standard)X
3776(algorithm.)X
4147(Matt)X
555 3609(Bishop's)N
859(fast)X
995(version)X
1251(of)X
2 f
1338(crypt)X
1 f
1503(\(\))X
1577(does)X
1744(all)X
1844(of)X
1931(these)X
2116(things)X
2331(and)X
2467(also)X
2616(precomputes)X
3046(even)X
3218(more)X
3403(functions,)X
3741(yielding)X
4023(twice)X
555 3699(the)N
673(performance)X
1100(of)X
1187(the)X
1305(worm's)X
1570(algorithm)X
1901(but)X
2023(requiring)X
2337(nearly)X
2558(200)X
2698(KB)X
2829(of)X
2916(initialized)X
3256(data)X
3410(as)X
3497(opposed)X
3784(to)X
3866(the)X
3984(6)X
4044(KB)X
555 3789(used)N
722(by)X
822(the)X
940(worm)X
1147(and)X
1283(the)X
1401(less)X
1541(than)X
1699(2)X
1759(KB)X
1890(used)X
2057(by)X
2157(the)X
2275(normal)X
2 f
2522(crypt)X
1 f
2687(\(\).)X
755 3912(How)N
931(can)X
1063(system)X
1305(administrators)X
1783(defend)X
2022(against)X
2269(fast)X
2405(implementations)X
2958(of)X
2 f
3045(crypt)X
1 f
3210(\(\)?)X
3340(One)X
3494(suggestion)X
3856(that)X
3996(has)X
4123(been)X
555 4002(introduced)N
918(for)X
1032(foiling)X
1265(the)X
1383(bad)X
1519(guys)X
1690(is)X
1763(the)X
1881(idea)X
2035(of)X
2122(shadow)X
2387(password)X
2710(\256les.)X
2903(In)X
2990(this)X
3125(scheme,)X
3406(the)X
3524(encrypted)X
3861(passwords)X
555 4092(are)N
674(hidden)X
912(rather)X
1120(than)X
1278(public,)X
1518(forcing)X
1770(a)X
1826(cracker)X
2084(to)X
2166(either)X
2369(break)X
2568(a)X
2624(privileged)X
2969(account)X
3239(or)X
3326(use)X
3453(the)X
3571(host's)X
3782(CPU)X
3957(and)X
4093(\(slow\))X
555 4182(encryption)N
918(algorithm)X
1249(to)X
1331(attack,)X
1563(with)X
1725(the)X
1843(added)X
2055(danger)X
2294(that)X
2434(password)X
2757(test)X
2888(requests)X
3171(could)X
3369(be)X
3465(logged)X
3703(and)X
3839(password)X
555 4272(cracking)N
852(discovered.)X
1260(The)X
1405(disadvantage)X
1844(of)X
1931(shadow)X
2196(password)X
2519(\256les)X
2672(is)X
2745(that)X
2885(if)X
2954(the)X
3072(bad)X
3208(guys)X
3379(somehow)X
3706(get)X
3824(around)X
4067(the)X
555 4362(protections)N
931(for)X
1045(the)X
1163(\256le)X
1285(that)X
1425(contains)X
1712(the)X
1830(actual)X
2042(passwords,)X
2416(all)X
2516(of)X
2603(the)X
2721(passwords)X
3075(must)X
3250(be)X
3346(considered)X
3714(cracked)X
3985(and)X
4121(will)X
555 4452(need)N
727(to)X
809(be)X
905(replaced.)X
1238(Another)X
1521(suggestion)X
1883(has)X
2010(been)X
2182(to)X
2264(replace)X
2517(the)X
2635(U)X
8 s
2693(NIX)X
10 s
2826(DES)X
2997(implementation)X
3519(with)X
3681(the)X
3799(fastest)X
4024(avail-)X
555 4542(able)N
709(implementation,)X
1251(but)X
1373(run)X
1500(it)X
1564(1000)X
1744(times)X
1937(or)X
2024(more)X
2209(instead)X
2456(of)X
2543(the)X
2661(25)X
2761(times)X
2954(used)X
3121(in)X
3203(the)X
3321(U)X
8 s
3379(NIX)X
2 f
10 s
3512(crypt)X
1 f
3677(\(\))X
3751(code.)X
3963(Unless)X
4201(the)X
555 4632(repeat)N
772(count)X
970(is)X
1043(somehow)X
1370(pegged)X
1622(to)X
1704(the)X
1822(fastest)X
2047(available)X
2357(CPU)X
2532(speed,)X
2755(this)X
2890(approach)X
3205(merely)X
3448(postpones)X
3788(the)X
3906(day)X
4042(of)X
555 4722(reckoning)N
896(until)X
1062(the)X
1180(cracker)X
1438(\256nds)X
1613(a)X
1669(faster)X
1868(machine.)X
2200(It's)X
2327(interesting)X
2685(to)X
2767(note)X
2925(that)X
3065(Morris)X
3303(and)X
3439(Thompson)X
3801(measured)X
4129(the)X
555 4812(time)N
717(to)X
799(compute)X
1095(the)X
1213(old)X
1335(M-209)X
1573(\(non-DES\))X
1945(password)X
2268(encryption)X
2631(algorithm)X
2962(used)X
3129(in)X
3211(early)X
3392(versions)X
3679(of)X
3766(U)X
8 s
3824(NIX)X
10 s
3957(on)X
4057(the)X
555 4902(PDP-11/70)N
930(and)X
1066(found)X
1273(that)X
1413(a)X
1469(good)X
1649(implementation)X
2171(took)X
2333(only)X
2495(1.25)X
2655(milliseconds)X
3079(per)X
3202(encryption,)X
3585(which)X
3801(they)X
3959(deemed)X
555 4992(insuf\256cient;)N
957(currently)X
1267(the)X
1385(VAX)X
1579(8600)X
1759(using)X
1952(Matt)X
2123(Bishop's)X
2427(DES-based)X
2808(algorithm)X
3139(needs)X
3342(11.5)X
3502(milliseconds)X
3926(per)X
4049(encryp-)X
555 5082(tion,)N
719(and)X
855(machines)X
1178(10)X
1278(times)X
1471(faster)X
1670(than)X
1828(the)X
1946(VAX)X
2140(8600)X
2320(at)X
2398(a)X
2454(cheaper)X
2725(price)X
2906(will)X
3050(be)X
3146(available)X
3456(soon)X
3627(\(if)X
3723(they)X
3881(aren't)X
555 5172(already!\).)N
3 f
555 5358(5.)N
655(Opinions)X
1 f
9 s
715 5472(The)N
847(act)X
951(of)X
1031(breaking)X
1303(into)X
1435(a)X
1486(computer)X
1777(system)X
1996(has)X
2111(to)X
2186(have)X
2341(the)X
2448(same)X
2615(social)X
2802(stigma)X
3013(as)X
3092(breaking)X
3363(into)X
3494(a)X
3545(neighbor's)X
3872(house.)X
4095(It)X
715 5553(should)N
925(not)X
1035(matter)X
1237(that)X
1363(the)X
1469(neighbor's)X
1795(door)X
1945(is)X
2011(unlocked.)X
2329([Ken)X
2491(Thompson,)X
2835(1983)X
2997(Turing)X
3211(Award)X
3425(Lecture])X
715 5674([Creators)N
1002(of)X
1081(viruses)X
1304(are])X
1435(stealing)X
1678(a)X
1729(car)X
1836(for)X
1939(the)X
2046(purpose)X
2293(of)X
2372(joyriding.)X
2691([R)X
2781(H)X
2851(Morris,)X
3083(in)X
3157(1983)X
3319(Capitol)X
3549(Hill)X
3679(testimony,)X
3999(cited)X
715 5755(in)N
789(the)X
895(New)X
1049(York)X
1215(Times)X
1413(11/11/88])X

13 p
%%Page: 13 13
9 s 0 xH 0 xS 1 f
10 s
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(13)X
1 f
755 762(I)N
802(don't)X
991(propose)X
1265(to)X
1347(offer)X
1524(de\256nitive)X
1846(statements)X
2204(on)X
2304(the)X
2422(morality)X
2713(of)X
2800(the)X
2918(worm's)X
3183(author,)X
3428(the)X
3546(ethics)X
3753(of)X
3840(publishing)X
555 852(security)N
829(information)X
1227(or)X
1314(the)X
1432(security)X
1706(needs)X
1909(of)X
1996(the)X
2114(U)X
8 s
2172(NIX)X
10 s
2305(computing)X
2667(community,)X
3071(since)X
3256(people)X
3490(better)X
3693(\(and)X
3856(less\))X
555 942(quali\256ed)N
855(than)X
1013(I)X
1060(are)X
1179(still)X
1318(copiously)X
1649(\257aming)X
1913(on)X
2013(these)X
2198(topics)X
2409(in)X
2491(the)X
2609(various)X
2865(network)X
3148(newsgroups)X
3551(and)X
3687(mailing)X
3951(lists.)X
4139(For)X
555 1032(the)N
673(sake)X
836(of)X
923(the)X
1041(mythical)X
1341(ordinary)X
1633(system)X
1875(administrator)X
2322(who)X
2480(might)X
2686(have)X
2858(been)X
3030(confused)X
3340(by)X
3440(all)X
3540(the)X
3658(information)X
4056(and)X
555 1122(misinformation,)N
1088(I)X
1135(will)X
1279(try)X
1388(to)X
1470(answer)X
1718(a)X
1774(few)X
1915(of)X
2002(the)X
2120(most)X
2295(relevant)X
2574(questions)X
2896(in)X
2978(a)X
3034(narrow)X
3282(but)X
3404(useful)X
3620(way.)X
2 f
755 1245(Did)N
895(the)X
1013(worm)X
1215(cause)X
1418(damage?)X
1 f
1752(The)X
1897(worm)X
2104(did)X
2226(not)X
2348(destroy)X
2604(\256les,)X
2777(intercept)X
3078(private)X
3321(mail,)X
3503(reveal)X
3720(passwords,)X
4094(cor-)X
555 1335(rupt)N
704(databases)X
1032(or)X
1119(plant)X
1299(trojan)X
1506(horses.)X
1771(It)X
1840(did)X
1962(compete)X
2254(for)X
2368(CPU)X
2543(time)X
2705(with,)X
2887(and)X
3023(eventually)X
3377(overwhelm,)X
3778(ordinary)X
4070(user)X
555 1425(processes.)N
923(It)X
992(used)X
1159(up)X
1259(limited)X
1505(system)X
1747(resources)X
2071(such)X
2238(as)X
2325(the)X
2443(open)X
2619(\256le)X
2741(table)X
2917(and)X
3053(the)X
3171(process)X
3432(text)X
3572(table,)X
3768(causing)X
4033(user)X
555 1515(processes)N
883(to)X
965(fail)X
1092(for)X
1206(lack)X
1360(of)X
1447(same.)X
1672(It)X
1741(caused)X
1980(some)X
2169(machines)X
2492(to)X
2574(crash)X
2764(by)X
2864(operating)X
3187(them)X
3367(close)X
3552(to)X
3634(the)X
3752(limits)X
3953(of)X
4040(their)X
555 1605(capacity,)N
863(exercising)X
1213(bugs)X
1384(that)X
1524(do)X
1624(not)X
1746(appear)X
1981(under)X
2184(normal)X
2431(loads.)X
2660(It)X
2729(forced)X
2955(administrators)X
3433(to)X
3515(perform)X
3794(one)X
3930(or)X
4017(more)X
555 1695(reboots)N
811(to)X
893(clear)X
1070(worms)X
1308(from)X
1484(the)X
1602(system,)X
1864(terminating)X
2253(user)X
2407(sessions)X
2689(and)X
2825(long-running)X
3263(jobs.)X
3456(It)X
3525(forced)X
3751(administrators)X
4229(to)X
555 1785(shut)N
708(down)X
906(network)X
1189(gateways,)X
1528(including)X
1850(gateways)X
2169(between)X
2457(important)X
2788(nation-wide)X
3191(research)X
3480(networks,)X
3814(in)X
3896(an)X
3992(effort)X
4191(to)X
555 1875(isolate)N
784(the)X
902(worm;)X
1131(this)X
1266(led)X
1384(to)X
1466(delays)X
1691(of)X
1778(up)X
1878(to)X
1960(several)X
2208(days)X
2375(in)X
2457(the)X
2575(exchange)X
2899(of)X
2986(electronic)X
3323(mail,)X
3505(causing)X
3770(some)X
3959(projects)X
4233(to)X
555 1965(miss)N
721(deadlines)X
1044(and)X
1180(others)X
1396(to)X
1478(lose)X
1627(valuable)X
1919(research)X
2208(time.)X
2410(It)X
2479(made)X
2673(systems)X
2946(staff)X
3109(across)X
3330(the)X
3448(country)X
3713(drop)X
3880(their)X
4047(ongo-)X
555 2055(ing)N
677(hacks)X
880(and)X
1016(work)X
1201(24-hour)X
1475(days)X
1642(trying)X
1853(to)X
1935(corner)X
2161(and)X
2297(kill)X
2423(worms.)X
2701(It)X
2770(caused)X
3009(members)X
3323(of)X
3410(management)X
3840(in)X
3922(at)X
4000(least)X
4167(one)X
555 2145(institution)N
898(to)X
980(become)X
1250(so)X
1341(frightened)X
1691(that)X
1831(they)X
1989(scrubbed)X
2299(all)X
2399(the)X
2517(disks)X
2701(at)X
2779(their)X
2946(facility)X
3193(that)X
3333(were)X
3510(online)X
3730(at)X
3808(the)X
3926(time)X
4088(of)X
4175(the)X
555 2235(infection,)N
880(and)X
1016(limited)X
1262(reloading)X
1585(of)X
1672(\256les)X
1825(to)X
1907(data)X
2061(that)X
2201(was)X
2346(veri\256ably)X
2673(unmodi\256ed)X
3057(by)X
3157(a)X
3213(foreign)X
3465(agent.)X
3699(It)X
3768(caused)X
555 2325(bandwidth)N
913(through)X
1182(gateways)X
1501(that)X
1641(were)X
1818(still)X
1957(running)X
2226(after)X
2394(the)X
2512(infection)X
2817(started)X
3051(to)X
3133(become)X
3403(substantially)X
3827(degraded\320)X
555 2415(the)N
673(gateways)X
992(were)X
1169(using)X
1362(much)X
1560(of)X
1647(their)X
1814(capacity)X
2102(just)X
2237(shipping)X
2532(the)X
2650(worm)X
2857(from)X
3033(one)X
3169(network)X
3452(to)X
3534(another.)X
3835(It)X
3904(penetrated)X
555 2505(user)N
709(accounts)X
1010(and)X
1146(caused)X
1385(it)X
1449(to)X
1531(appear)X
1766(that)X
1906(a)X
1962(given)X
2160(user)X
2314(was)X
2459(disturbing)X
2803(a)X
2859(system)X
3101(when)X
3295(in)X
3377(fact)X
3518(they)X
3676(were)X
3853(not)X
3975(responsi-)X
555 2595(ble.)N
713(It's)X
840(true)X
985(that)X
1125(the)X
1243(worm)X
1450(could)X
1648(have)X
1820(been)X
1992(far)X
2102(more)X
2287(harmful)X
2561(that)X
2701(it)X
2765(actually)X
3039(turned)X
3264(out)X
3386(to)X
3468(be:)X
3586(in)X
3668(the)X
3786(last)X
3917(few)X
4058(weeks,)X
555 2685(several)N
803(security)X
1077(bugs)X
1248(have)X
1420(come)X
1614(to)X
1696(light)X
1862(which)X
2078(the)X
2196(worm)X
2403(could)X
2601(have)X
2773(used)X
2940(to)X
3022(thoroughly)X
3393(destroy)X
3649(a)X
3705(system.)X
3987(Perhaps)X
555 2775(we)N
669(should)X
902(be)X
998(grateful)X
1268(that)X
1408(we)X
1522(escaped)X
1797(incredibly)X
2142(awful)X
2345(consequences,)X
2827(and)X
2963(perhaps)X
3233(we)X
3347(should)X
3580(also)X
3729(be)X
3825(grateful)X
4095(that)X
555 2865(we)N
669(have)X
841(learned)X
1098(so)X
1189(much)X
1387(about)X
1585(the)X
1703(weaknesses)X
2098(in)X
2180(our)X
2307(systems')X
2607(defenses,)X
2924(but)X
3046(I)X
3093(think)X
3277(we)X
3391(should)X
3624(share)X
3814(our)X
3941(grateful-)X
555 2955(ness)N
713(with)X
875(someone)X
1180(other)X
1365(than)X
1523(the)X
1641(worm's)X
1906(author.)X
2 f
755 3078(Was)N
913(the)X
1031(worm)X
1233(malicious?)X
1 f
1624(Some)X
1826(people)X
2060(have)X
2232(suggested)X
2568(that)X
2708(the)X
2826(worm)X
3033(was)X
3178(an)X
3274(innocent)X
3570(experiment)X
3951(that)X
4091(got)X
555 3168(out)N
677(of)X
764(hand,)X
960(and)X
1096(that)X
1236(it)X
1300(was)X
1445(never)X
1644(intended)X
1940(to)X
2022(spread)X
2252(so)X
2343(fast)X
2479(or)X
2566(so)X
2657(widely.)X
2935(We)X
3067(can)X
3199(\256nd)X
3343(evidence)X
3649(in)X
3731(the)X
3849(worm)X
4056(to)X
4138(sup-)X
555 3258(port)N
704(and)X
840(to)X
922(contradict)X
1263(this)X
1398(hypothesis.)X
1800(There)X
2008(are)X
2127(a)X
2183(number)X
2448(of)X
2535(bugs)X
2706(in)X
2788(the)X
2906(worm)X
3113(that)X
3253(appear)X
3488(to)X
3570(be)X
3666(the)X
3784(result)X
3982(of)X
4069(hasty)X
555 3348(or)N
642(careless)X
917(programming.)X
1413(For)X
1544(example,)X
1856(in)X
1938(the)X
2056(worm's)X
2 f
2321(if_init)X
1 f
2511(\(\))X
2585(routine,)X
2852(there)X
3033(is)X
3106(a)X
3162(call)X
3298(to)X
3380(the)X
3498(block)X
3696(zero)X
3855(function)X
2 f
555 3438(bzero)N
1 f
733(\(\))X
807(that)X
947(incorrectly)X
1315(uses)X
1473(the)X
1591(block)X
1789(itself)X
1969(rather)X
2177(than)X
2335(the)X
2453(block's)X
2709(address)X
2970(as)X
3057(an)X
3153(argument.)X
3516(It's)X
3643(also)X
3792(possible)X
4074(that)X
4214(a)X
555 3528(bug)N
695(was)X
840(responsible)X
1225(for)X
1339(the)X
1457(ineffectiveness)X
1959(of)X
2046(the)X
2164(population)X
2526(control)X
2773(measures)X
3092(used)X
3259(by)X
3359(the)X
3477(worm.)X
3724(This)X
3886(could)X
4084(be)X
555 3618(seen)N
718(as)X
805(evidence)X
1111(that)X
1251(a)X
1307(development)X
1741(version)X
1997(of)X
2084(the)X
2202(worm)X
2409(``got)X
2585(loose'')X
2828(accidentally,)X
3256(and)X
3392(perhaps)X
3662(the)X
3780(author)X
4005(origi-)X
555 3708(nally)N
735(intended)X
1031(to)X
1113(test)X
1244(the)X
1362(\256nal)X
1524(version)X
1780(under)X
1983(controlled)X
2328(conditions,)X
2701(in)X
2783(an)X
2879(environment)X
3304(from)X
3480(which)X
3696(it)X
3760(would)X
3980(not)X
555 3798(escape.)N
830(On)X
948(the)X
1066(other)X
1251(hand,)X
1447(there)X
1628(is)X
1701(considerable)X
2127(evidence)X
2433(that)X
2573(the)X
2691(worm)X
2898(was)X
3043(designed)X
3348(to)X
3430(reproduce)X
3772(quickly)X
4032(and)X
555 3888(spread)N
785(itself)X
965(over)X
1128(great)X
1309(distances.)X
1663(It)X
1732(can)X
1864(be)X
1960(argued)X
2199(that)X
2339(the)X
2457(population)X
2819(control)X
3066(hacks)X
3269(in)X
3351(the)X
3469(worm)X
3676(are)X
3795(anemic)X
4047(by)X
555 3978(design:)N
806(they)X
964(are)X
1083(a)X
1139(compromise)X
1555(between)X
1843(spreading)X
2175(the)X
2293(worm)X
2500(as)X
2587(quickly)X
2847(as)X
2934(possible)X
3216(and)X
3352(raising)X
3590(the)X
3708(load)X
3866(enough)X
4122(to)X
4204(be)X
555 4068(detected)N
843(and)X
979(defeated.)X
1312(A)X
1390(worm)X
1597(will)X
1741(exist)X
1912(for)X
2026(a)X
2082(substantial)X
2444(amount)X
2704(of)X
2791(time)X
2953(and)X
3089(will)X
3233(perform)X
3512(a)X
3568(substantial)X
3930(amount)X
4190(of)X
555 4158(work)N
740(even)X
912(if)X
981(it)X
1045(loses)X
1225(the)X
1343(roll)X
1474(of)X
1561(the)X
1679(\(imaginary\))X
2078(dice;)X
2254(moreover,)X
2602(1)X
2662(in)X
2744(7)X
2804(worms)X
3042(become)X
3312(immortal)X
3625(and)X
3761(can't)X
3942(be)X
4038(killed)X
555 4248(by)N
655(dice)X
809(rolls.)X
1011(There)X
1219(is)X
1292(ample)X
1508(evidence)X
1814(that)X
1954(the)X
2072(worm)X
2279(was)X
2424(designed)X
2729(to)X
2811(hamper)X
3072(efforts)X
3302(to)X
3384(stop)X
3537(it)X
3601(even)X
3773(after)X
3941(it)X
4005(was)X
555 4338(identi\256ed)N
877(and)X
1013(captured.)X
1350(It)X
1419(certainly)X
1720(succeeded)X
2071(in)X
2153(this,)X
2308(since)X
2493(it)X
2557(took)X
2719(almost)X
2952(a)X
3008(day)X
3144(before)X
3370(the)X
3488(last)X
3619(mode)X
3817(of)X
3904(infection)X
555 4428(\(the)N
2 f
700(\256nger)X
1 f
907(server\))X
1151(was)X
1296(identi\256ed,)X
1638(analyzed)X
1944(and)X
2080(reported)X
2368(widely;)X
2628(the)X
2746(worm)X
2953(was)X
3098(very)X
3261(successful)X
3611(in)X
3693(propagating)X
4096(itself)X
555 4518(during)N
784(this)X
919(time)X
1081(even)X
1253(on)X
1353(systems)X
1626(which)X
1842(had)X
1978(\256xed)X
2158(the)X
2 f
2276(sendmail)X
1 f
2585(debug)X
2801(problem)X
3088(and)X
3224(had)X
3360(turned)X
3585(off)X
2 f
3699(rexec)X
1 f
3874(.)X
3934(Finally,)X
555 4608(there)N
736(is)X
809(evidence)X
1115(that)X
1255(the)X
1373(worm's)X
1638(author)X
1863(deliberately)X
2262(introduced)X
2625(the)X
2743(worm)X
2950(to)X
3032(a)X
3088(foreign)X
3340(site)X
3471(that)X
3611(was)X
3756(left)X
3883(open)X
4059(and)X
555 4698(welcome)N
865(to)X
947(casual)X
1168(outside)X
1419(users,)X
1624(rather)X
1832(ungraciously)X
2266(abusing)X
2535(this)X
2670(hospitality.)X
3067(He)X
3181(apparently)X
3540(further)X
3779(abused)X
4022(this)X
4157(trust)X
555 4788(by)N
655(deleting)X
933(a)X
989(log)X
1111(\256le)X
1233(that)X
1373(might)X
1579(have)X
1751(revealed)X
2044(information)X
2442(that)X
2582(could)X
2780(link)X
2924(his)X
3037(home)X
3235(site)X
3366(with)X
3528(the)X
3646(infection.)X
3991(I)X
4038(think)X
555 4878(the)N
673(innocence)X
1019(lies)X
1150(in)X
1232(the)X
1350(research)X
1639(community)X
2023(rather)X
2231(than)X
2389(with)X
2551(the)X
2669(worm's)X
2934(author.)X
2 f
755 5001(Will)N
908(publication)X
1292(of)X
1374(worm)X
1576(details)X
1809(further)X
2051(harm)X
2240(security?)X
1 f
2574(In)X
2661(a)X
2717(sense,)X
2931(the)X
3049(worm)X
3256(itself)X
3436(has)X
3563(solved)X
3792(that)X
3932(problem:)X
4241(it)X
555 5091(has)N
682(published)X
1013(itself)X
1193(by)X
1293(sending)X
1562(copies)X
1787(to)X
1869(hundreds)X
2183(or)X
2270(thousands)X
2610(of)X
2697(machines)X
3020(around)X
3263(the)X
3381(world.)X
3628(Of)X
3733(course)X
3963(a)X
4019(bad)X
4155(guy)X
555 5181(who)N
713(wants)X
920(to)X
1002(use)X
1129(the)X
1247(worm's)X
1512(tricks)X
1710(would)X
1930(have)X
2102(to)X
2184(go)X
2284(through)X
2553(the)X
2671(same)X
2856(effort)X
3055(that)X
3195(we)X
3309(went)X
3485(through)X
3754(in)X
3836(order)X
4026(to)X
555 5271(understand)N
927(the)X
1045(program,)X
1357(but)X
1479(then)X
1637(it)X
1701(only)X
1863(took)X
2025(us)X
2116(a)X
2172(week)X
2362(to)X
2444(completely)X
2820(decompile)X
3174(the)X
3292(program,)X
3604(so)X
3695(while)X
3893(it)X
3957(takes)X
4142(for-)X
555 5361(titude)N
757(to)X
839(hack)X
1011(the)X
1129(worm,)X
1356(it)X
1420(clearly)X
1659(is)X
1732(not)X
1854(greatly)X
2097(dif\256cult)X
2370(for)X
2484(a)X
2540(decent)X
2770(programmer.)X
3227(One)X
3381(of)X
3468(the)X
3586(worm's)X
3851(most)X
4026(effec-)X
555 5451(tive)N
695(tricks)X
893(was)X
1038(advertised)X
1388(when)X
1582(it)X
1646(entered\320the)X
2081(bulk)X
2243(of)X
2330(the)X
2 f
2448(sendmail)X
1 f
2757(hack)X
2929(is)X
3002(visible)X
3235(in)X
3317(the)X
3435(log)X
3557(\256le,)X
3699(and)X
3835(a)X
3891(few)X
555 5541(minutes')N
855(work)X
1040(with)X
1202(the)X
1320(sources)X
1581(will)X
1725(reveal)X
1942(the)X
2060(rest)X
2196(of)X
2283(the)X
2401(trick.)X
2608(The)X
2753(worm's)X
3018(fast)X
3154(password)X
3477(algorithm)X
3808(could)X
4006(be)X
4102(useful)X
555 5631(to)N
637(the)X
755(bad)X
891(guys,)X
1082(but)X
1204(at)X
1282(least)X
1449(two)X
1589(other)X
1774(faster)X
1973(implementations)X
2526(have)X
2698(been)X
2870(available)X
3180(for)X
3294(a)X
3350(year)X
3509(or)X
3596(more,)X
3801(so)X
3892(it)X
3956(isn't)X
4118(very)X
555 5721(secret,)N
783(or)X
870(even)X
1042(very)X
1205(original.)X
1514(Finally,)X
1780(the)X
1898(details)X
2127(of)X
2214(the)X
2332(worm)X
2539(have)X
2711(been)X
2883(well)X
3041(enough)X
3297(sketched)X
3598(out)X
3720(on)X
3820(various)X

14 p
%%Page: 14 14
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(14)X
1 f
555 762(newsgroups)N
958(and)X
1094(mailing)X
1358(lists)X
1506(that)X
1646(the)X
1764(principal)X
2069(hacks)X
2272(are)X
2391(common)X
2691(knowledge.)X
3103(I)X
3150(think)X
3334(it's)X
3456(more)X
3641(important)X
3972(that)X
4112(we)X
555 852(understand)N
927(what)X
1103(happened,)X
1451(so)X
1542(that)X
1682(we)X
1796(can)X
1928(make)X
2122(it)X
2186(less)X
2326(likely)X
2528(to)X
2610(happen)X
2862(again,)X
3076(than)X
3234(that)X
3374(we)X
3488(spend)X
3695(time)X
3857(in)X
3939(a)X
3995(futile)X
555 942(effort)N
754(to)X
836(cover)X
1035(up)X
1135(the)X
1253(issue)X
1433(from)X
1609(everyone)X
1924(but)X
2046(the)X
2164(bad)X
2300(guys.)X
2511(Fixes)X
2704(for)X
2818(both)X
2980(source)X
3210(and)X
3346(binary)X
3571(distributions)X
3990(are)X
555 1032(widely)N
793(available,)X
1123(and)X
1259(anyone)X
1511(who)X
1669(runs)X
1827(a)X
1883(system)X
2125(with)X
2287(these)X
2472(vulnerabilities)X
2950(needs)X
3153(to)X
3235(look)X
3397(into)X
3541(these)X
3726(\256xes)X
3897(immedi-)X
555 1122(ately,)N
751(if)X
820(they)X
978(haven't)X
1239(done)X
1415(so)X
1506(already.)X
3 f
555 1308(6.)N
655(Conclusion)X
1 f
9 s
715 1422(It)N
777(has)X
891(raised)X
1081(the)X
1187(public)X
1385(awareness)X
1699(to)X
1773(a)X
1823(considerable)X
2205(degree.)X
2451([R)X
2541(H)X
2611(Morris,)X
2843(quoted)X
3057(in)X
3131(the)X
3237(New)X
3391(York)X
3557(Times)X
3755(11/5/88])X
10 s
755 1578(This)N
917(quote)X
1115(is)X
1188(one)X
1324(of)X
1411(the)X
1529(understatements)X
2070(of)X
2157(the)X
2275(year.)X
2474(The)X
2619(worm)X
2826(story)X
3006(was)X
3151(on)X
3251(the)X
3369(front)X
3545(page)X
3717(of)X
3804(the)X
3922(New)X
4094(York)X
555 1668(Times)N
775(and)X
911(other)X
1096(newspapers)X
1491(for)X
1605(days.)X
1812(It)X
1881(was)X
2026(the)X
2144(subject)X
2391(of)X
2478(television)X
2809(and)X
2945(radio)X
3130(features.)X
3445(Even)X
3630(the)X
2 f
3748(Bloom)X
3977(County)X
1 f
555 1758(comic)N
771(strip)X
933(poked)X
1149(fun)X
1276(at)X
1354(it.)X
755 1881(Our)N
900(community)X
1284(has)X
1411(never)X
1610(before)X
1836(been)X
2008(in)X
2090(the)X
2208(limelight)X
2516(in)X
2598(this)X
2733(way,)X
2907(and)X
3043(judging)X
3307(by)X
3407(the)X
3525(response,)X
3846(it)X
3910(has)X
4037(scared)X
555 1971(us.)N
686(I)X
733(won't)X
940(offer)X
1117(any)X
1253(fancy)X
1452(platitudes)X
1783(about)X
1981(how)X
2139(the)X
2257(experience)X
2626(is)X
2699(going)X
2901(to)X
2983(change)X
3231(us,)X
3342(but)X
3464(I)X
3511(will)X
3655(say)X
3782(that)X
3922(I)X
3969(think)X
555 2061(these)N
740(issues)X
951(have)X
1123(been)X
1295(ignored)X
1560(for)X
1674(much)X
1872(longer)X
2097(than)X
2255(was)X
2400(safe,)X
2570(and)X
2706(I)X
2753(feel)X
2894(that)X
3034(a)X
3090(better)X
3293(understanding)X
3767(of)X
3854(the)X
3972(crisis)X
4161(just)X
555 2151(past)N
704(will)X
848(help)X
1006(us)X
1097(cope)X
1269(better)X
1472(with)X
1634(the)X
1752(next)X
1910(one.)X
2086(Let's)X
2271(hope)X
2447(we're)X
2651(as)X
2738(lucky)X
2936(next)X
3094(time)X
3256(as)X
3343(we)X
3457(were)X
3634(this)X
3769(time.)X
3 f
555 2337(Acknowledgments)N
1 f
755 2460(No)N
873(one)X
1009(is)X
1082(to)X
1164(blame)X
1380(for)X
1494(the)X
1612(inaccuracies)X
2030(herein)X
2251(except)X
2481(me,)X
2619(but)X
2741(there)X
2922(are)X
3041(plenty)X
3261(of)X
3348(people)X
3582(to)X
3664(thank)X
3862(for)X
3976(helping)X
4236(to)X
555 2550(decompile)N
909(the)X
1027(worm)X
1234(and)X
1370(for)X
1484(helping)X
1744(to)X
1826(document)X
2162(the)X
2280(epidemic.)X
2634(Dave)X
2824(Pare)X
2987(and)X
3123(Chris)X
3316(Torek)X
3528(were)X
3705(at)X
3783(the)X
3901(center)X
4118(of)X
555 2640(the)N
673(action)X
889(during)X
1118(the)X
1236(late)X
1372(night)X
1556(session)X
1807(at)X
1885(Berkeley,)X
2215(and)X
2351(they)X
2509(had)X
2645(help)X
2803(and)X
2939(kibitzing)X
3243(from)X
3419(Keith)X
3617(Bostic,)X
3861(Phil)X
4009(Lapsley,)X
555 2730(Peter)N
740(Yee,)X
910(Jay)X
1037(Lepreau)X
1321(and)X
1457(a)X
1513(cast)X
1658(of)X
1745(thousands.)X
2125(Glenn)X
2341(Adams)X
2588(and)X
2724(Dave)X
2914(Siegel)X
3134(provided)X
3439(good)X
3619(information)X
4017(on)X
4117(the)X
555 2820(MIT)N
722(AI)X
827(Lab)X
972(attack,)X
1204(while)X
1402(Steve)X
1600(Miller)X
1820(gave)X
1992(me)X
2110(details)X
2339(on)X
2439(Maryland,)X
2791(Jeff)X
2932(Forys)X
3134(on)X
3234(Utah,)X
3430(and)X
3566(Phil)X
3714(Lapsley,)X
4008(Peter)X
555 2910(Yee)N
705(and)X
841(Keith)X
1039(Bostic)X
1263(on)X
1363(Berkeley.)X
1713(Bill)X
1852(Cheswick)X
2188(sent)X
2337(me)X
2455(a)X
2511(couple)X
2745(of)X
2832(fun)X
2959(anecdotes)X
3296(from)X
3472(AT&T)X
3710(Bell)X
3863(Labs.)X
4079(Jim)X
555 3000(Haynes)N
816(gave)X
988(me)X
1106(the)X
1224(run-down)X
1556(on)X
1656(the)X
1774(security)X
2048(problems)X
2366(turned)X
2591(up)X
2691(by)X
2791(his)X
2904(busy)X
3075(little)X
3241(undergrads)X
3618(at)X
3696(UC)X
3827(Santa)X
4025(Cruz.)X
555 3090(Eric)N
709(Allman,)X
989(Keith)X
1187(Bostic,)X
1431(Bill)X
1570(Cheswick,)X
1926(Mike)X
2115(Hibler,)X
2360(Jay)X
2487(Lepreau,)X
2791(Chris)X
2984(Torek)X
3196(and)X
3332(Mike)X
3521(Zeleznik)X
3822(provided)X
555 3180(many)N
753(useful)X
969(review)X
1208(comments.)X
1597(Thank)X
1822(you)X
1962(all,)X
2082(and)X
2218(everyone)X
2533(else)X
2678(I)X
2725(forgot)X
2941(to)X
3023(mention.)X
755 3303(Matt)N
926(Bishop's)X
1230(paper)X
1429(``A)X
1561(Fast)X
1714(Version)X
1988(of)X
2075(the)X
2193(DES)X
2364(and)X
2500(a)X
2556(Password)X
2883(Encryption)X
3259(Algorithm'',)X
9 f
3686(\323)X
1 f
3749(1987)X
3929(by)X
4029(Matt)X
555 3393(Bishop)N
801(and)X
937(the)X
1055(Universities)X
1462(Space)X
1674(Research)X
1989(Association,)X
2407(was)X
2552(helpful)X
2799(in)X
2881(\(slightly\))X
3194(parting)X
3441(the)X
3559(mysteries)X
3886(of)X
3973(DES)X
4144(for)X
555 3483(me.)N
713(Anyone)X
987(wishing)X
1260(to)X
1342(understand)X
1714(the)X
1832(worm's)X
2097(DES)X
2268(hacking)X
2542(had)X
2678(better)X
2881(look)X
3043(here)X
3202(\256rst.)X
3386(The)X
3531(paper)X
3730(is)X
3803(available)X
4113(with)X
555 3573(Bishop's)N
2 f
859(deszip)X
1 f
1079(distribution)X
1467(of)X
1554(software)X
1851(for)X
1965(fast)X
2101(DES)X
2272(encryption.)X
2675(The)X
2820(latter)X
3005(was)X
3150(produced)X
3469(while)X
3667(Bishop)X
3913(was)X
4058(with)X
555 3663(the)N
673(Research)X
988(Institute)X
1270(for)X
1384(Advanced)X
1730(Computer)X
2070(Science)X
2340(at)X
2418(NASA)X
2656(Ames)X
2863(Research)X
3178(Center;)X
3434(Bishop)X
3680(is)X
3753(now)X
3911(at)X
3989(Dart-)X
555 3753(mouth)N
779(College)X
1048(\()X
2 f
1075(bishop@bear.dartmouth.edu)X
1 f
1998(\).)X
2085(He)X
2199(sent)X
2348(me)X
2466(a)X
2522(very)X
2685(helpful)X
2932(note)X
3090(on)X
3190(the)X
3308(worm's)X
3573(implementation)X
4095(of)X
2 f
555 3843(crypt)N
1 f
720(\(\))X
794(which)X
1010(I)X
1057(leaned)X
1287(on)X
1387(heavily)X
1643(when)X
1837(discussing)X
2190(the)X
2308(algorithm)X
2639(above.)X
755 3966(The)N
900(following)X
1231(documents)X
1598(were)X
1775(also)X
1924 0.4028(referenced)AX
2285(above)X
2497(for)X
2611(quotes)X
2840(or)X
2927(for)X
3041(other)X
3226(material:)X
2 f
555 4089(Data)N
735(Encryption)X
1111(Standard)X
1 f
1404(,)X
1444(FIPS)X
1623(PUB)X
1798(46,)X
1918(National)X
2214(Bureau)X
2466(of)X
2553(Standards,)X
2909(Washington)X
3316(D.C.,)X
3507(January)X
3777(15,)X
3897(1977.)X
555 4212(F.)N
639(T.)X
728(Grampp)X
1011(and)X
1147(R.)X
1240(H.)X
1338(Morris,)X
1596(``U)X
8 s
1708(NIX)X
10 s
1841(Operating)X
2182(System)X
2437(Security,'')X
2798(in)X
2880(the)X
2 f
2998(AT&T)X
3217(Bell)X
3366(Laboratories)X
3803(Technical)X
555 4302(Journal)N
1 f
804(,)X
844(October)X
1123(1984,)X
1323(Vol.)X
1483(63,)X
1603(No.)X
1741(8,)X
1821(Part)X
1970(2,)X
2050(p.)X
2130(1649.)X
555 4425(Brian)N
753(W.)X
869(Kernighan)X
1228(and)X
1364(Dennis)X
1611(Ritchie,)X
2 f
1882(The)X
2022(C)X
2095(Programming)X
2564(Language,)X
1 f
2924(Second)X
3180(Edition,)X
3455(Prentice)X
3738(Hall:)X
3918(Englewood)X
555 4515(Cliffs,)N
777(NJ,)X
9 f
906(\323)X
1 f
969(1988.)X
555 4638(John)N
726(Markoff,)X
1034(``Author)X
1335(of)X
1422(computer)X
1745(`virus')X
1979(is)X
2052(son)X
2183(of)X
2270(U.S.)X
2432(Electronic)X
2782(Security)X
3069(Expert,'')X
3377(p.)X
3457(1)X
3517(of)X
3604(the)X
2 f
3722(New)X
3884(York)X
4055(Times)X
1 f
4246(,)X
555 4728(November)N
914(5,)X
994(1988.)X
555 4851(John)N
726(Markoff,)X
1034(``A)X
1166(family's)X
1453(passion)X
1713(for)X
1827(computers,)X
2201(gone)X
2377(sour,'')X
2609(p.)X
2689(1)X
2749(of)X
2836(the)X
2 f
2954(New)X
3116(York)X
3287(Times)X
1 f
3478(,)X
3518(November)X
3877(11,)X
3997(1988.)X
555 4974(Robert)N
793(Morris)X
1031(and)X
1167(Ken)X
1321(Thompson,)X
1703(``Password)X
2084(Security:)X
2393(A)X
2471(Case)X
2647(History,'')X
2981(dated)X
3175(April)X
3364(3,)X
3444(1978,)X
3644(in)X
3726(the)X
2 f
3844(U)X
8 s
3902(NIX)X
10 s
555 5064(Programmer's)N
1047(Manual)X
1 f
1296(,)X
1336(in)X
1418(the)X
2 f
1536(Supplementary)X
2037(Documents)X
1 f
2418(or)X
2505(the)X
2 f
2623(System)X
2866(Manager's)X
3238(Manual)X
1 f
3487(,)X
3527(depending)X
3881(on)X
3981(where)X
555 5154(and)N
691(when)X
885(you)X
1025(got)X
1147(your)X
1314(manuals.)X
555 5277(Robert)N
793(T.)X
882(Morris,)X
1140(``A)X
1272(Weakness)X
1618(in)X
1700(the)X
1818(4.2BSD)X
2093(Unix)X
2273(TCP/IP)X
2532(Software,'')X
2916(AT&T)X
3154(Bell)X
3307(Laboratories)X
3733(Computing)X
4112(Sci-)X
555 5367(ence)N
723(Technical)X
1060(Report)X
1298(#117,)X
1498(February)X
1808(25,)X
1928(1985.)X
2148(This)X
2310(paper)X
2509(actually)X
2783(describes)X
3102(a)X
3158(way)X
3312(of)X
3399(spoo\256ng)X
3694(TCP/IP)X
3953(so)X
4044(that)X
4184(an)X
555 5457(untrusted)N
873(host)X
1026(can)X
1158(make)X
1352(use)X
1479(of)X
1566(the)X
2 f
1684(rsh)X
1 f
1806(server)X
2023(on)X
2123(any)X
2259(4.2)X
2379(BSD)X
2554(U)X
8 s
2612(NIX)X
10 s
2745(system,)X
3007(rather)X
3215(than)X
3373(an)X
3469(attack)X
3681(based)X
3884(on)X
3984(breaking)X
555 5547(into)N
699(accounts)X
1000(on)X
1100(trusted)X
1338(hosts,)X
1542(which)X
1758(is)X
1831(what)X
2007(the)X
2125(worm)X
2332(uses.)X
555 5670(Brian)N
753(Reid,)X
944(``Massive)X
1285(U)X
8 s
1343(NIX)X
10 s
1476(breakins)X
1768(at)X
1846(Stanford,'')X
2216(RISKS-FORUM)X
2773(Digest,)X
3022(Vol.)X
3182(3,)X
3262(Issue)X
3447(56,)X
3567(September)X
3930(16,)X
4050(1986.)X

15 p
%%Page: 15 15
10 s 0 xH 0 xS 1 f
3 f
555 474(Tour)N
748(of)X
835(the)X
962(Worm)X
4219(15)X
1 f
555 762(Dennis)N
802(Ritchie,)X
1073(``On)X
1245(the)X
1363(Security)X
1650(of)X
1737(U)X
8 s
1795(NIX)X
10 s
1908(,'')X
2002(dated)X
2196(June)X
2363(10,)X
2483(1977,)X
2683(in)X
2765(the)X
2883(same)X
3068(manual)X
3324(you)X
3464(found)X
3671(the)X
3789(Morris)X
4027(and)X
555 852(Thompson)N
917(paper)X
1116(in.)X
555 975(Ken)N
709(Thompson,)X
1091(``Re\257ections)X
1525(on)X
1625(Trusting)X
1916(Trust,'')X
2179(1983)X
2359(ACM)X
2561(Turing)X
2799(Award)X
3038(Lecture,)X
3324(in)X
3406(the)X
2 f
3524(Communications)X
4086(of)X
4168(the)X
555 1065(ACM)N
1 f
724(,)X
764(Vol.)X
924(27,)X
1044(No.)X
1182(8,)X
1262(p.)X
1342(761,)X
1502(August)X
1753(1984.)X

15 p
%%Trailer
xt

xs
DataMuseum.dk

DKUUG/EUUG Conference tapes

⟦75bb1df9b⟧ TextFile

Derivation

TextFile
