The Morris Worm: Lessons From the Bug That Slowed the Early Internet

Hackers & Hooks | Season 1, Episode 3

On the evening of November 2, 1988, a Cornell University graduate student named Robert Tappan Morris released a small program onto the early internet. By most accounts it was meant as a harmless experiment. Within about a day, it had hit an estimated 6,000 of the roughly 60,000 computers then connected, slowing many of them until they were unusable.

The Morris worm became one of the best-known events in computing history, and it is the subject of episode three of Hackers & Hooks. Nick Gipson and Isaac Reed explain how a few lines of code got away from their author, what it cost, and why the same kinds of mistakes still knock business systems offline today.

An Experiment That Got Away From Its Author

A worm is a program that copies itself from one computer to the next on its own, without anyone clicking anything. Morris’s worm spread by using weaknesses that already existed on the networked Unix computers of the day: a debugging feature left switched on in common email software, a flaw in a service that answered questions about users, trusted connections that let one machine log in to another without a password, and weak passwords it could guess using common words and simple patterns.

The real damage came from a single choice in the code. Instead of skipping computers it had already infected, the worm was set to copy itself again about one time in seven anyway. On a busy network, copies piled on top of copies, each one using up processing power, until machines slowed to a crawl or stopped. As Nick points out in the episode, one small number made the difference between a quiet experiment and a crisis.

Morris tried to undo it. He asked a friend to relay an anonymous message with an apology and instructions for removing the program, but with networks jammed, few people received it in time.

“Every time that you see this new cyber attack that’s happening, it’s not new. It’s just rehashed from everything else. There’s nothing new in cyber.”

Nick Gipson, Hackers & Hooks

Why One Small Mistake Reached Thousands of Machines

The early internet ran on trust. Computers trusted each other, users trusted the network, and known holes stayed open because few people imagined anyone would use them. Nick argues that this habit of trusting users and devices too much is still behind many breaches, which tend to be blamed on “advanced hackers” when the real cause is a basic mistake.

The second problem was testing. The worm was released onto live systems with no safe place to try it first. Isaac compared it to testing in production, which still happens in businesses all the time. Nick repeated an old IT rule: never push a change on a Friday and go home.

The fallout was serious. Estimates of the total cost ranged widely, from about $100,000 to $10 million. As Nick noted, even a program that only counted machines becomes expensive once someone adds up the lost time and productivity. In 1990, Morris became the first person convicted of a felony under the 1986 Computer Fraud and Abuse Act. He was sentenced to three years of probation, 400 hours of community service, and a fine of more than $10,000. The incident also pushed the government to act: DARPA funded the creation of the CERT Coordination Center at Carnegie Mellon University, an early model for organized incident response.

The modern parallel was hard to miss. As Nick and Isaac recorded the episode, a major Amazon Web Services outage was knocking popular apps and services offline. The cause was different, but the lesson is the same: when many businesses depend on one shared system, a single failure can ripple outward fast. For a small business, that means downtime, missed orders, frustrated customers, and staff who cannot work.

Nick paired the story with his daughter’s first fishing trip. She refused to touch worms, so he baited her hook with a piece of McDonald’s breakfast sausage, and she reeled in a sunfish within seconds. Isaac drew the connection: bait meant to be harmless ended up catching far more than expected.

“It caught on a lot more than he ever intended for it to catch on.”

Isaac Reed, Hackers & Hooks

Lessons for Small Businesses

• Test changes before they go live. Ask your IT team or MSP to try updates and new tools in a safe setting first, schedule changes when someone is around to watch, and keep a way to roll them back.
• Patch known weaknesses. The Morris worm used holes that were already known. Keep operating systems, software, and network equipment updated, and replace anything that no longer gets security fixes.
• Limit trust between systems and people. Give staff and accounts only the access they need, and do not let one machine automatically trust another without a good reason.
• Know your dependencies. List the cloud services and vendors your business cannot run without, and decide in advance how you would keep working if one went down.
• Get permission in writing for any security testing. Nick notes that the first rule of any hacking course is authorization. Anyone testing your systems should have a written scope signed by someone with the authority to approve it.
• Plan for something getting through. No set of controls stops everything. Know who you will call, and how you will reach them, before you need help.

How Gipson Cyber Helps

As Nick puts it, the defenders of 1988 went looking for answers instead of waiting for a tool to tell them what was wrong. That human approach is still at the center of a good managed SOC for small business. Gipson Cyber’s Business SOCaaS provides 24×7 monitoring with real human responders who investigate what your systems flag. We work with the technology you already have and alongside your existing IT team or MSP, and we report what we find in clear, plain language.

When something does go wrong, our Business DFIR team provides small business incident response: helping contain the problem, preserving evidence, and working out what happened so you can make informed decisions about recovery. If you think you are being hacked right now, go to 800cyber.com.