🚀 go-pugleaf

HISVIRI.CVP   921022
 
                    CHRISTMA EXEC - the effects
 
The exact number of copies made by any one reading of the CHRISTMA
EXEC would depend upon the number of listings in the NAMES file, and
the messages received by the NETLOG file.  However, for all intents
any nuclear physicist knows that it only needs to be, on average,
"greater than one".  The CHRISTMA EXEC would destroy itself, after
having been read, but more copies would be created than destroyed.
 
Some of the newly spawned messages would "die" a natural net death,
being outdated accounts, or directed at those who were on holiday
(or, perhaps, executives and managers, who, of course, never read
their email :-).  Most, however, would reach a working account, and
a mildly (but likely not sufficiently) curious user.  The user would
type "Christmas", see the tree, shrug and dismiss the message ...
while a number of new messages would be created and head off in all
directions.
 
Eventually, a large number of users would be reading, and
inadvertantly sending, copies of the message.  Therefore, a large
volume of mail would be being generated, using up a large chunk of
bandwidth.  Eventually, in some cases, all the available bandwidth. 
Some machines were essentially cut off from the net ... with the
exception of the CHRISTMA "cards".
 
In addition to bandwidth, CHRISTMA consumed disk space.  The
individual messages would not be large, but the numbers of them
would start to consume significant amounts of disk drive real
estate.  Mail spool entries would also be used up.  Not only would
they be used up on the system itself, but users' mail directories
would start to show repeating listings for the CHRISTMA EXEC,
crowding out other, more important messages.  (Most of this crowding
would be psychological, but occasionally it would be physical, as
system limits were reached.)
 
The general "disinfecting" action taken was to shut down the system,
and purge all copies of the message from the mail spool.  However,
since the transmission was "cross-system", users would have to be
warned to be on the alert for the message when received from an
outside source.  The major impact was mostly confined to the period
of December 9th, 1987, to December 14th.  IBM's internal network,
VNET, was more heavily hit than either EARN or Bitnet, and drastic
action, in the form of a general system shutdown, was felt to be
needed to clear up the mess.  (VNETers seemed to be more severely
affected because of larger NAMES files.)
 
copyright Robert M. Slade, 1992   HISVIRI.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "A ship in a harbour
Institute for  Robert_Slade@sfu.ca      |  is safe, but that is
Research into  rslade@cue.bc.ca         |  not what ships are
User           p1@CyberStore.ca         |  built for."
Security       Canada V7K 2G6           |           John Parks