How did one student's experiment slow down the early internet?

In 1988 a graduate student's program slowed thousands of the early internet's computers to a standstill. Robert Tappan Morris of Cornell wrote a self-replicating program, a worm, and let it loose on the night of 2 November 1988. A friend said he made it simply to see if it could be done. To avoid the worm being traced directly back to Cornell, he released it from the MIT network.

The worm spread by exploiting several flaws: a hole in the debug mode of the Unix mail program sendmail, a buffer overflow in the finger service, and network logins that trusted other computers without asking for a password. It also guessed weak passwords, such as words from the spell checker or simple patterns like the username written backwards.

The damage came from a design choice. The worm was first programmed to check whether a computer was already infected, but Morris worried administrators would trick it by reporting a false "yes". So it copied itself 14 percent of the time regardless. Machines were infected many times over, each extra copy slowing them until they were unusable. Michael Rabin later said Morris "should have tried it on a simulator first".

Clifford Stoll, who helped fight the worm, found that two thousand computers were infected within fifteen hours, "dead in the water" until disinfected. Regional networks disconnected from each other for days. The aftermath created a standing response team, CERT at Carnegie Mellon, and Morris was the first person convicted of a felony under the 1986 Computer Fraud and Abuse Act.