📸

APPROACHING ZERO

1,300 sites in the United States – and from there on to VNet, IBM's private worldwide electronic mail network, which links about 4,000 mainframe computers and many more smaller computers and workstations. The electronic chain letter reached VNet on 15 December, six days after it was launched.

IBM's corporate users typically carry more names and addresses in their files than university users. Soon thousands of copies of the file were circulating the world. It quickly reached Japan which, like all the addresses, was only seconds away by electronic mail. Within two days, the rampaging programs brought IBM's entire network to a standstill, just sending Christmas greetings round and round and round the network. The company spent an unfestive Christmas season killing all copies of the file.

The program was later dubbed the IBM Christmas Tree virus but because it needed some user interaction – in this case, typing in the word 'Christmas' – it isn't considered a true virus. User interaction implies inviting the intruder in behind your defences, rather like the Trojans did with the Greek horse.

The pervasive media coverage of the Internet worm was probably one reason for the next major incident that year. On 23 December 1988, just six weeks after Morris's Internet worm hit the front pages, a very different worm hit the NASA Space Physics Astronomy Network (SPAN) and the Department of Energy HEP computer networks.

Like the IBM Christmas Tree trojan, it brought a Christmas greeting. Like the Internet worm, it also targeted Digital Equipment's VAX computers. What later became known as the Father Christmas worm waited until midnight on 24 December before delivering its message to users on the network: 'Hi how are you? I had a hard time preparing all the presents. It isn't quite an easy job. I'm getting more and more letters . . . Now stop computing and have a good time at home!! Merry Christmas and a Happy New Year. Your Father Christmas.'

The Father Christmas worm was considered nothing more than a nuisance, and did no damage. But in October 1989 the SPAN network was hit again, with a worm delivering a protest message. The new worm was a variant of Father Christmas, but this time when users logged in to their systems they found that their normal opening page

📸