Securityretroarpanetmalwarehistory
Creeper, the 'First Computer Virus,' Was a Worm, and Reaper, the Program Built to Kill It, Was a Worm Too
Ray Tomlinson says Bob Thomas's 1971 Creeper program hopped between cooperating TENEX machines as a resource-sharing demo, and the word 'virus' didn't exist for it until 1983.
The program was “created in 1971 by Bob Thomas” and ran on “computers running the TENEX operating system.” When it arrived on a machine, it would make it print “I’M THE CREEPER. CATCH ME IF YOU CAN.”
It wasn’t an attack. Tomlinson says “The contract that Bob was working on was to develop a resource-sharing capability,” and Creeper was a demonstration of moving a running program between machines. “The operators of these other machines were collaborators in this effort.” He also caps how far it could have gone: “no more that 28 machines could have been visited by Creeper.”
His own comparison: “Creeper was more like an allergy test than a common cold.” And on motive: “The motive was purely to get the satisfaction of having done it.”
The original didn’t spread so much as relocate. Jan Kopriva of the SANS Internet Storm Center writes that it “migrated from one system to another, always “removing” itself,” so “there was always only one copy of it on the entire network.” Tomlinson later changed it so it would sometimes copy itself instead of jumping, and copies raise a new problem. “This possibility led to Reaper, which went looking for instances of Creeper to terminate them.”
That makes the first program written to remove another program a worm as well. Kopriva says Reaper “almost certainly may be called the first “nematode”,” his term for a worm whose job is to hunt another worm.
The word didn’t exist yet either. Fred Cohen, who ran the first experiments with self-copying programs, writes in his own account that “On November 3, 1983, the first virus was conceived of as an experiment,” and that “the name ‘virus’ was thought of by Len Adleman.”
The origin story of malware gets told as an attack and a rescue. What the people who were there describe is a lab demo with a few dozen cooperating machines, a joke message and a cleanup script. Tomlinson’s verdict on the stakes: “The community was small and malicious activity was not tolerated so Creeper was at most a neat hack.” Asked why he made it copy itself at all, Tomlinson said he couldn’t recall what made replication seem interesting.