A tour of the worm

On the evening of November 2, 1988, a self-replicating program was released upon the Internet 1. This program (a worm) invaded VAX and Sun-3 computers running versions of Berkeley UNIX, and used their sources to attack still more computers2. Within the space of hours this program had spread aacross the U.S., infecting hundreds or thousands of computers and making many of them unusable due to the burden of its activity. This paper provides a chronology for the outbreak and presents a detailed description of the internals of the worm, based on a C version produced by decompiling.