The 'Security Digest' Archives (TM)

Archive: About | Browse | Search | Contributions | Feedback
Site: Help | Index | Search | Contact | Notices | Changes

ARCHIVE: 'Phage List' - Archives (1988 - 1989)
DOCUMENT: phage #371 [MIT virus paper available for anonymous ftp] (1 message, 940 bytes)
SOURCE: http://securitydigest.org/exec/display?f=phage/archive/371.txt&t=text/plain
NOTICE: securitydigest.org recognises the rights of all third-party works.

START OF DOCUMENT

From: Jon Rochlis <jon@ATHENA.MIT.EDU>
To: phage
Date: Tue 18:12:36 14/02/1989 EST
Subject: MIT virus paper available for anonymous ftp
References: [Thread Prev: 369] [Thread Next: 370] [Message Prev: 369] [Message Next: 370]


The MIT paper on the Internet virus of last Novemember, "With
Microscope and Tweezers: An Analysis of the Internet Virus of November
1988", is now available via anonymous ftp from either bitsy.mit.edu
(18.72.0.3) or athena-dist.mit.edu (18.71.0.38) in the pub/virus
directory as mit.PS (and mit.PS.Z). A version of this paper will be
presented at the 1989 IEEE Symposium on Research in Security and
Privacy.

		-- Jon

Abstract:

In early November 1988 the Internet, a collection of networks
consisting of 60,000 host computers implementing the TCP/IP protocol
suite, was attacked by a virus, a program which broke into computers
on the network and which spread from one machine to another.  This
paper is a detailed analysis of the virus program itself, as well as
the reactions of the besieged Internet community.  We discuss the
structure of the actual program, as well as the strategies the virus
used to reproduce itself. We present the chronology of events as seen
by our team at MIT, one of a handful of groups around the country
working to take apart the virus, in an attempt to discover its secrets
and to learn the network's vulnerabilities.

We describe the lessons that this incident has taught the Internet
community and topics for future consideration and resolution.  A
detailed routine by routine description of the virus program including
the contents of its built in dictionary is provided.

END OF DOCUMENT