RFC 1135 (rfc1135) - Page 1 of 33

Helminthiasis of the Internet

Network Working Group                                        J. Reynolds
Request for Comments: 1135                                           ISI
                                                           December 1989


                   The Helminthiasis of the Internet

Status of this Memo

   This memo takes a look back at the helminthiasis (infestation with,
   or disease caused by parasitic worms) of the Internet that was
   unleashed the evening of 2 November 1988.  This RFC provides
   information about an event that occurred in the life of the Internet.
   This memo does not specify any standard.  Distribution of this memo
   is unlimited.

Introduction

         ----- "The obscure we see eventually, the completely
         apparent takes longer." ----- Edward R. Murrow

   The helminthiasis of the Internet was a self-replicating program that
   infected VAX computers and SUN-3 workstations running the 4.2 and 4.3
   Berkeley UNIX code.  It disrupted the operations of computers by
   accessing known security loopholes in applications closely associated
   with the operating system.  Despite system administrators efforts to
   eliminate the program, the infection continued to attack and spread
   to other sites across the United States.

   This RFC provides a glimpse at the infection, its festering, and
   cure.  The impact of the worm on the Internet community, ethics
   statements, the role of the news media, crime in the computer world,
   and future prevention will be discussed.  A documentation review
   presents four publications that describe in detail this particular
   parasitic computer program.  Reference and bibliography sections are
   also included in this memo.

1.  The Infection

         ----- "Sandworms, ya hate 'em, right??" ----- Michael
         Keaton, Beetlejuice

   Defining "worm" versus "virus"

      A "worm" is a program that can run independently, will consume the
      resources of its host from within in order to maintain itself, and
      can propagate a complete working version of itself on to other
      machines.



Reynolds