yes, this is a homework-type question but could you please help me out?
In a very short presentation on the topic of Morris Internet Worm I am supposed to list the steps taken to stop the worm from spreading. My pp slides are now approaching the final state, but before I go and say that this or that is how they stopped the worm, I would like to check with you. I heard that the worm hit the news big time, and caused quite a lot of stir in the US at that time, so I was hoping to find a few people from the field of computing who could provide some info.
Basically, I keep finding in various reports and articles, that the main weakness of the worm was the pleasequit variable which was not initialised properly and therefore it was sufficient to set this variable to -1 to stop the worm. Was this the final blow for the worm? Was this that effectually stopped it from spreading?
I found the following report, and others, mention the pleasequit var: (taken from this website):
The worm uses a variable called
‘pleasequit’ but doesn’t correctly
initialize it, so some folks added a
module called _worm.o to the C
library, which is produced from:int pleasequit = -1;the fact that this value is set to -1
will cause it to exit after one
iteration.
It used a vulnerability in older versions of sendmail, finger, and rsh (primarily sendmail though, IIRC). The fix was as simple as going out and getting yourself the latest versions of those servers.
What would have stopped the initial spread is precisely what stops the spread of human viruses: Lack of new uninfected vulnerable hosts reachable from the infected ones. It could only infect old Sun3 systems or Vaxen with one of the right versions of Unix (many if not most Vaxes at the time ran VMS instead) and unpatched versions of finger or sendmail or rsh servers.