COMPUTER INTRUDER SPREADS THROUGH RESEARCH NETWORK; ENGINEERS RUSH TO CLOSE SECURITY GAPS

BERKELEY, 1988-11-03. — A self-propagating computer programme has spread through the nation’s research networks, forcing universities and scientific establishments to interrupt connections while programmers work urgently to block its passage. The trouble, first detected yesterday evening, has struck computers running versions of the Unix operating system, multiplying inside them until ordinary work becomes difficult or impossible. At the University of California here, and at other computing centres, specialists are examining the intruder and distributing instructions for closing the weaknesses it exploits. The immediate task is not merely to clear afflicted machines, but to prevent cleaned machines from being invaded again when they are returned to the network.

The affected system is the Internet, the interconnection of computer networks through which universities, government establishments and other research organisations exchange electronic mail, transfer files and use distant machines. Its usefulness rests on communication across institutional boundaries. That same openness is now carrying a programme which needs no operator to dispatch each successive copy. Reports of trouble have come from establishments including Berkeley, the Massachusetts Institute of Technology and Purdue University. The extent of the outbreak remains uncertain: machines cut off as a precaution cannot readily be distinguished, from elsewhere on the network, from those disabled by the intruder itself.

An electronic warning circulated from Harvard early today began, “There may be a virus loose on the internet.” It relayed a message containing the words “I'm sorry.” The warning also pointed towards methods of stopping the programme, but it was no substitute for an organised alarm reaching every installation in time. Electronic mail, normally the obvious means of consulting colleagues about a computer fault, is itself dependent on the machinery and connections now under strain. Telephone calls and exchanges between specialists have therefore assumed unusual importance. Each disconnected centre gains a measure of protection while becoming harder for other centres to reach with fresh instructions.

Although widely described as a virus, the intruder is more precisely a worm: a programme capable of making its way from one computer to another and establishing further copies of itself. A conventional computer virus attaches itself to another programme. This intruder instead takes advantage of network services and existing relationships between computers. Its targets include VAX machines and Sun workstations running particular Unix systems. Those machines are common tools of scientific and engineering departments. The outbreak is thus not a general affliction of every kind of computer; it is a concentrated attack on equipment whose owners have especially strong reasons to keep it connected.

One route of entry lies in sendmail, the programme which handles electronic post on many Unix installations. A debugging facility can be misused to cause a remote machine to execute commands. Another lies in the service which answers requests for information about a computer’s users, commonly invoked through the finger command. An improperly checked input can be used to seize control of that service. The worm also attempts to obtain access through passwords and through arrangements under which one machine accepts a user vouched for by another. These are different doors into the same establishment, and bolting only one may leave another open.

The resulting emergency has brought teams at Berkeley, MIT and Purdue into parallel efforts to understand the programme and defeat it. Administrators are being advised to disable vulnerable facilities, install corrections and inspect machines before restoring ordinary service. Removing the intruder is a more troublesome business than stopping a single unwanted job. Other copies may remain active, or another computer may promptly send the programme back. A machine which appears to have recovered can consequently slow down again. The work demands attention both to the individual computer and to its neighbours, making local housekeeping part of a much larger, improvised defensive operation.

The most conspicuous damage so far is the consumption of computing power. Repeated copies compete for processor time and memory, crowding out legitimate work. Reports thus far describe disruption rather than a campaign to erase scientific files, but that distinction offers limited comfort to a laboratory unable to use its equipment. Nor can every property of the programme safely be assumed before its examination is complete. There is no dependable total tonight for the number of machines affected, the working hours lost or the cost of interruption. Dramatic estimates must contend with an elementary difficulty: the network has no single control room with an immediate view of every participating computer.

The economic consequences begin with idle equipment and diverted skilled labour. Researchers and computing staff are spending time on recovery which would otherwise go to experiments, calculations and routine support. A decision to sever a connection also interrupts legitimate exchanges with institutions which may themselves be untouched. No reliable monetary assessment is yet available, and the evidence does not warrant treating this as a failure of the country’s computers at large. Nevertheless, for suppliers and users of networked Unix equipment, the outbreak poses an uncomfortable practical question: how quickly can a correction be carried from the people who devise it to every administrator whose machine requires it?

The governmental interest is equally direct. Research networking has developed with substantial federal support, including that of the Department of Defense, and government laboratories participate alongside universities. This is therefore more than a quarrel between an intruder and a handful of campus computer departments. At the same time, the presence of government-sponsored networks does not establish that classified information has been taken, and the disruption should not be confused with evidence of espionage. The immediate record is one of unauthorised entry and interference with service. Responsibility for launching the programme has not been publicly established, and its author’s purpose remains a separate question from the observable effects.

For the present, reopening the network safely is the governing concern. Connections cannot remain severed indefinitely without defeating the purpose for which these expensive systems were built. Yet a hasty return to normal may expose a repaired installation to another round of infection. The repairs now being circulated offer a way forward, provided they are understood and applied throughout the affected community. Tonight’s emergency has made the strength and weakness of that community equally apparent: its specialists can pool knowledge across great distances, but the software they share can also carry the same defect into many institutions at once. Until the vulnerable services are secured, recovery at one laboratory cannot be regarded as the end of the affair.