How a self-spreading program found its way in
In 1988, graduate student Robert Tappan Morris released a program that could move from one Unix computer to another without waiting for someone to copy it. It searched for machines it could reach over the network, then tried several routes into them: flaws in common network services, including the mail program and a tool for showing who was logged in, as well as guessable passwords.
Once inside, the worm ran another copy of itself and searched for more computers. That made each infected machine a potential launch point for further infections—a chain reaction rather than a single attack on a central target.
Why it kept making copies
Morris anticipated that a computer might already be infected. If the worm simply stopped whenever it found evidence of itself, an administrator could fool it by planting a fake sign of infection, preventing the worm from spreading further. So the program sometimes ignored that warning and installed another copy anyway.
That safeguard had a dangerous side effect. On some machines, repeated copies accumulated and competed for processor time and memory. The computer slowed or stopped responding, and its users and administrators had to work out what was happening while the worm continued probing other systems. A feature intended to make the program harder to contain helped turn a fast-spreading infection into a disruptive one.
The cost of a chain reaction
The episode showed how a network’s reach can magnify a small programming decision. Each machine that was compromised could help find more vulnerable machines, while each unnecessary copy added load where the worm had already arrived. The disruption spread across roughly a tenth of the internet, making clear that interconnected computers could not be treated as isolated experiments: a program released on one system could impose costs on many others.
