full-disclosure - Re: 18th anniversary of Internet worm a.k.a. Morris worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 03 Nov 2006 09:48:08 -0500
From: Valdis.Kletnieks@...edu
To: Georgi Guninski <guninski@...inski.com>
Cc: full-disclosure@...ts.grok.org.uk, "morrisworm.com" <worm@...risworm.com>
Subject: Re: 18th anniversary of Internet worm a.k.a.
	Morris worm

On Fri, 03 Nov 2006 15:26:27 +0200, Georgi Guninski said:
> aleph1's paper for the profit and the stack was quite after it, but nothing
> public about buffer overflows and/or worms before?

Depends how you define "public" - in that day, most good coders knew that
you should check arguments, because otherwise the semi-trained chimp at the
keyboard might manage to crash the program by making it go off the end of
an array.

http://www.morrisworm.com/worm-chronology.html

Andy Sudduth posted anonymously about an hour after the worm was first
spotted - because he didn't want to explain how he knew/understood.

5 hours after: (Wed morning)
"The fingerd attack was not even known, much less understood, at this point.
Phil Lapsley reported at the NCSC meeting that Ed Wang of Berkeley discovered
the fingerd mechanism around 8:00am and sent mail to Mike Karels, but this mail
went unread until after the crisis had passed."

The fact that it took until 6PM *Thursday* evening for *any* of the security
people working on this (and rest assured, *every* security person on the Net
at the time was working on it) indicates that the concept of leveraging
a buffer overflow into executing code was so foreign that it took well over
36 hours for it to sink in.

I have to conclude that before that, buffer overflows weren't even well
known *inside* the security community, much less outside in the wider
programming community.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/