Page 024

Undergound. Go to Table of Contents.

   the Father Christmas worm.


   At about 4 p.m., just a few days before Christmas 1988, McMahon's

   alarm-monitoring programs began going haywire. McMahon began trying to

   trace back the dozens of incoming connections which were tripping the

   warning bells. He quickly discovered there wasn't a human being at the

   other end of the line. After further investigation, he found an alien

   program in his system, called HI.COM. As he read the pages of HI.COM

   code spilling from his line printer, his eyes went wide. He thought,

   This is a worm! He had never seen a worm before.


   He rushed back to his console and began pulling his systems off the

   network as quickly as possible. Maybe he wasn't following protocol,

   but he figured people could yell at him after the fact if they thought

   it was a bad idea. After he had shut down his part of the network, he

   reported back to the local area networking office. With print-out in

   tow, he drove across the base to the network office, where he and

   several other managers developed a way to stop the worm by the end of

   the day. Eventually they traced the Father Christmas worm back to the

   system where they believed it had been released--in Switzerland. But

   they never discovered who created it.


   Father Christmas was not only a simple worm; it was not considered

   dangerous because it didn't hang around systems forever. It was a worm

   with a use-by date.


   By contrast, the SPAN project office didn't know what the WANK invader

   was capable of doing. They didn't know who had written or launched it.

   But they had a copy of the program. Could McMahon have a look at it?


   An affable computer programmer with the nickname Fuzzface, John

   McMahon liked a good challenge. Curious and cluey at the same time, he

   asked the SPAN Project Office, which was quickly becoming the crisis

   centre for the worm attack, to send over a copy of the strange

   intruder. He began pouring over the invader's seven printed pages of

   source code trying to figure out exactly what the thing did.


   The two previous rogue worms only worked on specific computer systems

   and networks. In this case, the WANK worm only attacked VMS computer

   systems. The source code, however, was unlike anything McMahon had

   ever seen. `It was like sifting through a pile of spaghetti,' he said.

   `You'd pull one strand out and figure, "OK, that is what that thing

   does." But then you'd be faced with the rest of the tangled mess in

   the bowl.'


   The program, in digital command language, or DCL, wasn't written like

   a normal program in a nice organised fashion. It was all over the

   place. John worked his way down ten or fifteen lines of computer code

   only to have to jump to the top of the program to figure out what the

   next section was trying to do. He took notes and slowly, patiently

   began to build up a picture of exactly what this worm was capable of

   doing to NASA's computer system.


                            [ ]


   It was a big day for the anti-nuclear groups at the Kennedy Space

   Center. They might have lost their bid in the US District Court, but

   they refused to throw in the towel and took their case to the US Court

   of Appeals.