Overview

The Morris worm (November 1988) was one of the oldest computer worms distributed via the Internet. While it is old, the techniques used by most worms today are still the same. They involve two main parts: attack and self-duplication. The attack part exploits a vulnerability (or a few of them), so a worm can get an entry to another computer. The self-duplication part is to send a copy of itself to the compromised machine, and then launch the attack from there.

To help students gain a better understanding of the behavior of worms, we have developed this lab for students to write a simplified worm. We have broken down the technique into several tasks, so students can build the worm incrementally. For testing, we built two emulated Internets, a small one and a larger one. Students can release their worms in each of these Internets, and see how their worms spread across the entire emulated Internet.

Tasks (PDF)

• VM version: This lab has been tested on our SEED Ubuntu-20.04 VM
• Lab setup files
  • Labsetup.zip
  • Labsetup-arm.zip (for Apple Silicon machines)
• Manual:: Docker manual

Time (Suggested)

• Supervised (closely-guided lab session): 2-3 hours
• Unsupervised (take-home project): 1 week

SEED Videos

• YouTube: Lab demonstration

Additional Reading

• Spafford, Eugene, "An analysis of the worm", December 8, 1988, Purdue University.

Feedback and Help