donn@wasatch.UUCP (Donn Seeley) (12/10/88)
A first draft of this paper was finished by November 17 and has seen wide circulation. After receiving a number of helpful review comments over the last few weeks, I made some changes and a final draft is now available for anonymous FTP. To retrieve this paper: $ ftp cs.utah.edu Name (cs.utah.edu:someone): anonymous 331 Guest login ok, send ident as password. Password: anything 230 Guest login ok, access restrictions apply. ftp> cd pub 250 CWD command successful. ftp> get tour.n 200 PORT command successful. 150 Opening ASCII mode data connection for tour.n (70870 bytes). 226 Transfer complete. local: tour.n remote: tour.n 73134 bytes received in 1.1 seconds (67 Kbytes/s) ftp> get tour.crt 200 PORT command successful. 150 Opening ASCII mode data connection for tour.crt (77843 bytes). 226 Transfer complete. local: tour.crt remote: tour.crt 79545 bytes received in 1.2 seconds (67 Kbytes/s) ftp> quit 221 Goodbye. $ The file 'tour.n' should be formatted with 'troff -me'. For people who don't have 'troff' or the '-me' macro package, the file 'tour.crt' is a pre-formatted version of the document which can be viewed on an ordinary terminal (it's just 'tour.n' run through 'nroff -me'). Why might you be interested in this paper? The paper is written at a moderate level of detail and is intended for an audience of ordinary Unix users who want to know what the worm did but don't want to read code listings. The paper contains a concise chronology of the infection and a phase-by-phase analysis of the activities of the worm. My connection with the worm episode: I was a member of the decompiling team at Berkeley on November 3, and subsequently spent a substantial amount of time finishing the decompilation, analyzing the code and furnishing comments. I put in a number of long nights on this and I hope other people can benefit from it. I will make a presentation based on this paper at the upcoming winter Usenix conference, and a copy of the paper may appear in the proceedings. Donn Seeley University of Utah CS Dept donn@cs.utah.edu 40 46' 6"N 111 50' 34"W (801) 581-5668 utah-cs!donn