NASA Logo

NTRS

NTRS - NASA Technical Reports Server

Back to Results
The Father Christmas wormGiven here is an overview analysis of the Father Christmas Worm, a computer worm that was released onto the DECnet Internet three days before Christmas 1988. The purpose behind the worm was to send an electronic mail message to all users on the computer system running the worm. The message was a Christmas greeting and was signed 'Father Christmas'. From the investigation, it was determined that the worm was released from a computer (node number 20597::) at a university in Switzerland. The worm was designed to travel quickly. Estimates are that it was copied to over 6,000 computer nodes. However, it was believed to have executed on only a fraction of those computers. Within ten minutes after it was released, the worm was detected at the Space Physics Analysis Network (SPAN), NASA's largest space and Earth science network. Once the source program was captured, a procedural cure, using the existing functionality of the computer operating systems, was quickly devised and distributed. A combination of existing computer security measures, the quick and accurate procedures devised to stop copies of the worm from executing, and the network itself, were used to rapidly provide the cure. These were the main reasons why the worm executed on such a small percentage of nodes. This overview of the analysis of the events concerning the worm is based on an investigation made by the SPAN Security Team and provides some insight into future security measures that will be taken to handle computer worms and viruses that may hit similar networks.
Document ID
19920019024
Acquisition Source
Legacy CDMS
Document Type
Technical Memorandum (TM)
Authors
Green, James L.
(NASA Goddard Space Flight Center Greenbelt, MD, United States)
Sisson, Patricia L.
(Science Applications Research Lanham, MD., United States)
Date Acquired
September 6, 2013
Publication Date
June 1, 1989
Subject Category
Computer Programming And Software
Report/Patent Number
NASA-TM-107938
NAS 1.15:107938
Accession Number
92N28267
Distribution Limits
Public
Copyright
Work of the US Gov. Public Use Permitted.
No Preview Available