More than thirteen years, the first Internet virus spread through network. This week's CSCI is a taken from videotape of a lecture given close to the first anniversary of the Internet worm. The lecture as part of a computer networking class at UNC-Chapel Hill and was transmitted to a small group of UNCA students who were taking the class remotely.
There have been many changes in the twelve years since this lecture was given. At that time, faculty and students in computer science departments did their work on Unix workstations and mini-computers. In these pre-MS Windows days, it would be hard to find a DOS-based PC in any university science department.
There are certain terms, common in 1989, used in the lecture that may require explanation to non-Unix gurus. Here's a explanation of four of them.
The shell is the unix command processor. This program reads user commands and executes them. If a virus can start a shell on a remote computer, it can execute commands on that computer.
The routines exec, execle,
and execve are Unix system calls that
start a new process running within an existing process.
A shell, under the control of a remote virus,
can execs another copy of the virus on the victim computer.
The Berkeley R-utilities are a collection of programs that duplicate, and extend, much of the functionality of telnet and ftp. The Internet worm used two of these: rsh, which executes a single command on a remote machine, and rlogin, which begins a remote login session. It computers "trust" each other, these commands can be used to start remote processes without a password.
The rsh and rlogin programs are implemented
using the routines rcmd and rexec.
Consequently, starting a process only a remote system using the
R-utilities is sometimes called rexecing a process.
The VAX was a minicomputer manufactured by Digital Equipment Corporation. It was the most widely used computer for university computer science departments throughout the 80's. The plural of "VAX" is "VAXen".
Read Eugene Spafford's 41-page paper The Internet Worm Program: An Analysis for more technical information about the Internet worm. A more nostalgic view can be found in MSNBC's recent report Remembering the net crash of '88.
You'll probably want to follow along with the "overheads" while viewing the lecture. They are available in three formats:
And now for our special feature,
You will need a copy of RealPlayer to view this video. A free copy of RealPlayer can be downloaded from the real.com web site.