Hijacking the thread a little: one of the weird timeline things I'm a little obsessed with is the gap between the Morris Worm and the first "modern" stack overflow.

As near as I can tell, Thomas Lopatic kicked off the era of modern memory corruption exploits in February 1995 with his HPUX NCSA httpd overflow. That was followed shortly by 8lgm's Sendmail 8.6.12 syslog() stack overflow, which 8lgm created a small mania about by explaining roughly how the bug worked but not publishing the exploit, which meant every amateur vulnerability researcher at the time (myself included) spent a couple weeks figuring it out for ourselves.

1988 to 1995 is a long time! During that period, near as I can tell, nobody published or even referenced a modern memory corruption flaw ("modern" meaning "allowed you to upload code into a remote system"; there were overflows prior to 1995, but they worked by overwriting variables in memory to alter program logic). Why did Morris have this technique back in 1988? (Besides the obvious reason). Why did nobody extend the work between '88 and '95? The whole Internet was vulnerable to this bug! And that timeframe was the hacker renaissance; it corresponds to the Sun Devil raids and the LoD/MoD war.

I have read about LoD/MoD, 8lGm etc..it seemed that low hanging fruit was probably the reasoning right? I mean, there were probably so many systems you could access through stupid bugs, that delving deep into SO wasn't necessary?

Maybe. But there was low-hanging fruit well into the late '90s (and remember that SQL Injection, the "ultimate" low-hanging fruit, is also a late '90s bug) --- but after the 8lgm stack overflow mania, there was a decisive shift towards using memory corruption to take over machines directly, rather than (say) overwriting strategic files on target systems with NFS bugs.

Very True. Smashing the stack for fun and profit? That was the first interaction I had with more advanced techniques anyways. I read it as a soph/freshman in HS (97 or so I think)? Timing seems to be close. That could account for the explosion at least; I don't have any theories on the "dead" period.

I'm happy to give Elias credit for a big part of the shift, but the reality is that first x86 exploit was published well before that Phrack article, and people quickly repurposed it. (I'm a little biased here, since the author of that exploit is a partner of mine).

The vulnerability research community in 1995 was very close-knit (not tiny, but you could fit them in a hotel banquet hall for Summercon), and they worked pretty quickly to educate each other about the attack.

Interesting. Who published it prior to Aleph One?

I think it would be really cool if someone (perhaps you) interviewed Morris about his initial development of the worm and its exploit.

I'm sure the whole pirating of games during the C64 days would have touched upon memory corruption, so whilst not in the context we think of today it is certainly older area than we think.

Since nobody else is going to, I'll take the letters N, S, and I'd like to buy a vowel.