[Full-disclosure] 18th anniversary of Internet worm a.k.a. Morris worm

[Valdis.Kletnieks at vt.edu]

On Fri, 03 Nov 2006 15:26:27 +0200, Georgi Guninski said:
> aleph1's paper for the profit and the stack was quite after it, but nothing
> public about buffer overflows and/or worms before?

Depends how you define "public" - in that day, most good coders knew that
you should check arguments, because otherwise the semi-trained chimp at the
keyboard might manage to crash the program by making it go off the end of
an array.

http://www.morrisworm.com/worm-chronology.html

Andy Sudduth posted anonymously about an hour after the worm was first
spotted - because he didn't want to explain how he knew/understood.

5 hours after: (Wed morning)
"The fingerd attack was not even known, much less understood, at this point.
Phil Lapsley reported at the NCSC meeting that Ed Wang of Berkeley discovered
the fingerd mechanism around 8:00am and sent mail to Mike Karels, but this mail
went unread until after the crisis had passed."

The fact that it took until 6PM *Thursday* evening for *any* of the security
people working on this (and rest assured, *every* security person on the Net
at the time was working on it) indicates that the concept of leveraging
a buffer overflow into executing code was so foreign that it took well over
36 hours for it to sink in.

I have to conclude that before that, buffer overflows weren't even well
known *inside* the security community, much less outside in the wider
programming community.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20061103/44eeb82a/attachment.bin