The 1988 Internet worm tried last names backward. Email debug mode did the rest.
A contemporary Internet memo separates the entry points from the resource exhaustion that made Unix machines crawl.
Your last name, spelled backward, still belonged to you. The worm could work that out without appreciating your creativity (sorry, Smith).
Joyce Reynolds’ RFC 1135 describes an attack that spread among Berkeley Unix VAX and Sun machines on November 2, 1988. Its password guesses included usernames, doubled usernames and reversed surnames, plus a built-in 432-word dictionary. The password had gone through a makeover; the attacker still recognized it.
Email supplied another route. Sendmail exposed a nonstandard debug command that the worm used to propagate. Fingerd offered a different weakness: excessive input overflowed storage and allowed code execution. The RFC limits that particular overflow attack to 4.3BSD VAX machines; it would be sloppy to hand every affected computer the same diagnosis.
Trusted-host logins provided more opportunities to move. Meanwhile, copies multiplied. Reynolds describes machines as “overloaded trying to run many copies” and reports temporary files consuming disk space. The visible problem could be your ordinary program slowing down, with the cause busy elsewhere.
An overloaded computer invites the usual household ritual: close something, try again, perhaps glare at it. That reaction changes when the extra work is another copy of the intruder. Killing one busy process provides an incomplete answer if another reachable machine can put it right back.
The useful distinction for anyone reading an incident report is between arrival, movement and damage. A password guess explains access to an account. It doesn’t, by itself, explain how another host becomes involved or why the machine runs out of resources. A report that collapses those into “we got hacked” leaves the repair team with a headline and a headache.
A modern review can borrow that separation without pretending that a 1988 patch belongs on today’s server. For each service, the questions concern what an unauthenticated visitor can request and what the resulting process can reach. For each trust relationship, the question concerns which other machine gets admitted on its reputation. A network that admits a neighboring machine on reputation needs a careful definition of which neighbors deserve that treatment.
There is also a practical limit to the backward-password joke. Readers don’t need to memorize every transformation an attacker might try. A scheme based on publicly available personal details gives the attacker a small, convenient starting point. Personal significance doesn’t add randomness, however fond you are of the person, pet or reversed surname involved.
Future incident reports will remain easier to act on when they name each crossing and its consequence. A mail server fix cannot answer a password question on its own, and an empty temporary directory cannot show that reinfection has stopped. Each repair needs evidence at the place where the attacker returned.
The surname had a return address.