various worm questions

[Doug Gwyn]

In article <935 at vsi.COM> friedl at vsi.COM (Stephen J. Friedl) writes:
>     I've a couple of worm questions.  First, we all know that a
>bug in the program caused it to propagate wildly.  Does anybody
>know what the bug was?  No source code, just a general idea....

This wasn't characterized quite correctly in the media reports.
The biggest flaw in the design was that no provision was made
to avoid propagation back to an already-infested host.

>     Second, if Mr. Morris had decided to hide himself, and
>assuming nobody stumbled across his files on his home machine, is
>there any chance that this whole thing could have gone one
>without a clue as to where it came?

It should be noted that Morris is only the ALLEGED perpetrator.
I suggest that discussions should use "the perpetrator" until
the perpetrator's identity has been legally established.

Investigators made considerable progress in tracing the origin
of the attacks without help from any alleged confession.  I don't
think it would be wise to explain publicly how this could be done.