Father Christmas (computer worm)

History

At around 17:00 EST on December 22, 1988, a worm was detected on the Space Physics Analysis Network (SPAN). This was a NASA network on the DECnet Internet with many connections to other networks such as HEPnet. The majority of the computers on SPAN were VAX computers running the VAX/VMS operating system. The worm originated from a computer on the DECnet in Switzerland by a person using the multi-user login name PHSOLIDE. The infection was thought to have spread to more than 6,000 computer nodes.

On December 23, an email went out to warn SPAN centre managers that a worm had been released onto SPAN. but it did not perform any other actions than sending that message. One recommended strategy to prevent infection at the time was to create an empty "Hi.com" file which would stop the worm from being able to create a new version of the same file. It was subsequently estimated that only 2% of infected devices launched the worm.

The Father Christmas worm had the effect of strengthening security measures on SPAN and the DECnet Internet. This was demonstrated on January 13, 1989, when a nearly identical worm was released into the Easynet intranet. The network manager was able to quickly prevent the spread of the worm because of the exposure of the Father Christmas worm from the previous month.

Notes

References

References

1. [[#green1989. Green & Sissons (1989)]]: p. 2
2. [[#green1989. Green & Sissons (1989)]]: p. 5
3. [[#green1989. Green & Sissons (1989)]]: p. 1
4. Nazario (2004)]]: p. 41
5. [[#nazario2004. Nazario (2004)]]: p. 42
6. [[#green1989. Green & Sissons (1989)]]: p. 7
7. [[#green1989. Green & Sissons (1989)]]: p. 8