10, 9, 8, 7, 6, 5, 4, 3, 2, 1

able to change someone else's password. The people who ran computer systems or networks needed accounts with the highest level of privilege in order to keep the system running smoothly. The worm specifically sought out these sorts of accounts because its creator knew that was where the power lay.

The worm was smart, and it learned as it went along. As it traversed the network, it created a masterlist of commonly used account names. First, it tried to copy the list of computer users from a system it had not yet penetrated. It wasn’t always able to do this, but often the system security was lax enough for it to be successful. The worm then compared that list to the list of users on its current host. When it found a match – an account name common to both lists – the worm added that name to the masterlist it carried around inside it, making a note to try that account when breaking into a new system in future.

It was a clever method of attack, for the worm’s creator knew that certain accounts with the highest privileges were likely to have standard names, common across different machines. Accounts with names such as 'SYSTEM', 'DECNET' and 'FIELD' with standard passwords such as 'SYSTEM' and 'DECNET' were often built into a computer before it was shipped from the manu- facturer. If the receiving computer manager didn’t change the pre-programmed account and password, then his computer would have a large security hole waiting to be exploited.

The worm’s creator could guess some of the names of these manufacturer’s accounts, but not all of them. By endowing the worm with an ability to learn, he gave it far more power. As the worm spread, it became more and more intelligent. As it reproduced, its offspring evolved into ever more advanced creatures, increasingly successful at breaking into new systems.

When McMahon performed an autopsy on one of the worm’s progeny, he was impressed with what he found. Slicing the worm open and inspecting its entrails, he discovered an extensive col- lection of generic privileged accounts across the SPAN network. In fact, the worm wasn’t only picking up the standard VMS privileged accounts; it had learned accounts common to NASA