$cat morris88.txt
=========================================================================
USCN REGIONAL ARCHIVE SERVICE
INCIDENT REPORT
FILE: morris88.txt
DATE: 1988-11-07
AUTHOR: REGIONAL OPERATIONS STAFF
DISTRIBUTION: SYSTEM OPERATORS
=========================================================================

SUBJECT:
Network Service Disruption Affecting Archive Operations

SUMMARY:

During the evening hours of 02 November 1988 and continuing into
03 November 1988, several interconnected systems experienced severe
performance degradation resulting in interrupted archive services,
failed synchronization jobs, and intermittent loss of remote access.

The disruption appears related to a self-propagating software program
circulating among networked UNIX hosts.

At the time of writing, the precise mechanism of operation remains
under investigation.

--------------------------------------------------------------------------

OBSERVED EFFECTS

Affected systems exhibited the following behavior:

  * Rapid increase in system load averages.
  * Unexpected growth in active processes.
  * Failure of scheduled tasks.
  * Inability to establish new network connections.
  * Degraded terminal response times.
  * Exhaustion of available process table entries.

In several cases, operators reported systems becoming effectively
unusable despite no apparent hardware faults.

--------------------------------------------------------------------------

TIMELINE

1988-11-02 20:15 EST

  First reports received from external operators regarding unusual
  network activity affecting UNIX hosts connected to the Internet.

1988-11-02 22:40 EST

  Archive synchronization delays observed on regional systems.

1988-11-03 00:30 EST

  Multiple nodes report excessive processor utilization and repeated
  service failures.

1988-11-03 02:15 EST

  External network links disabled on affected systems.

1988-11-03 05:10 EST

  Archive synchronization suspended pending investigation.

1988-11-03 12:45 EST

  Manual recovery procedures initiated.

--------------------------------------------------------------------------

TECHNICAL NOTES

Available evidence suggests the software propagates through network
services commonly enabled on UNIX systems.

Repeated execution appears responsible for the observed resource
consumption.

Operators are advised that system compromise is not always accompanied
by visible changes to user files or account records.

Investigation remains ongoing.

--------------------------------------------------------------------------

RECOMMENDED ACTIONS

  1. Disconnect affected systems from external networks.

  2. Review trust relationships between hosts.

  3. Audit local account credentials.

  4. Disable unnecessary network services.

  5. Monitor system load and process counts.

  6. Preserve logs for subsequent analysis.

--------------------------------------------------------------------------

STATUS OF USCN ARCHIVE SERVICES

Archive services remain available in limited capacity.

Several historical collections remain inaccessible due to incomplete
recovery operations.

No evidence currently indicates loss of archive media.

Restoration efforts continue.

--------------------------------------------------------------------------

END OF REPORT
=========================================================================
$
$ cd..█