A Visit From The Ghost of Christmas Viruses Past
- Dec 24, 2009 1:43 PM EST
- [num] Comments
Thanks to F-Secure for posting an anniversary article on the then-famous CHRISTMA EXEC worm of 1986.
The worm is written in REXX, a batch language popular on IBM systems, and is specifically designed for the VM/CMS mainframe OS. You can see the source code for it here. We'll trust you not to do bad things with it and, in any event, it probably doesn't do any damage these days.
When executed it displays an ASCII-art (actually, I suppose EBCDIC-art) Christmas tree and a happy holiday message on the terminal. (Click the nearby image to see a larger version.) But there's a bonus. It mails itself to everyone on the user's NAMES file and then deletes itself. Perhaps the author thought this would mean everyone got it once and then it would die out, but of course if I have you in my NAMES file, you may have me in yours. A worm like this therefore can go on forever, if unchecked.
The worm began as a prank, largely on academic networks, but apparently didn't really take off until it got into IBM's internal VM/CMS network. See this contemporary report on the worm for gritty detail. It says that the worm "...virtually paralyzed IBM's internal network for a day or two."
So, did we learn lessons from this worm? Yes, we did. 10 or 12 years later e-mail became all the rage on PCs too.