A computer worm is a self-replicating program that spreads across networks to other systems on its own, without a host program or a user opening anything. A virus is code that inserts itself into a host and only runs when that host runs. Worms need weaknesses to spread through. Viruses need people.
What do the standards say?
NIST's glossary collects several definitions. One, from CNSSI 4009, calls a worm a self-contained program that can propagate itself through data processing systems or computer networks, and notes that worms are often designed to use up resources such as storage or processing time. Another, from NIST SP 800-28, says a worm propagates through a network onto other computer systems without requiring a host program or any user intervention to replicate.
The distinction predates all of this. RFC 1135, published in December 1989, separates the two terms: a worm can run independently and propagate a complete working version of itself to other machines, while a virus inserts itself into a host and cannot run unless that host is run. The RFC adds that early news coverage called the 1988 incident a virus, before anyone had a specimen to take apart.
How did the 1988 Internet worm spread?
RFC 1135 is a contemporary account, and it shows that the worm used several routes at once:
- A feature in the mail program sendmail: a non-standard debug command let the worm copy itself into remote hosts.
- A memory overflow in the finger daemon, triggered by sending more characters than the program expected, which let the worm run a small program. The RFC says only 4.3BSD VAX machines suffered from that one.
- Trusted host features used on local networks, through the remote execution tools rexec and rsh, plus lists of machines found in host and account files.
- Guessed passwords: obvious ones such as no password, the user name, or a word from a small built-in dictionary.
Most users noticed their machines slowing, because many copies of the worm were running at once. The RFC says the worm was careful to leave little evidence of itself. It was eliminated from most computers within 48 to 72 hours, mainly by university computer science staff who obtained a specimen, studied it, and shared patches for the sendmail and finger holes. Government and commercial sites were slower to react, according to the RFC.
The pattern is still familiar: known flaws, trust between machines and weak credentials.
Why do worms still matter?
The mechanics have not changed. A worm needs a network path to a vulnerable service, or credentials it can reuse. Anything that makes systems look alike, such as one shared admin password or one unpatched version everywhere, lets one infection fan out. The NIST note about resource exhaustion also explains the symptoms: slowdowns, full disks and noisy networks can be the first sign.
A constructed example
A company has 300 servers, and 40 of them run an old version of a file-sharing service with a known remote flaw. The service is reachable from the internal network on every server. One laptop is compromised through a phishing email, and a worm-style tool scans the network, finds the 40 servers and copies itself to each. A virus-style infection would have needed a user to open an infected file on each machine. The worm needed only the flaw and the network path.
How to check or apply this
- Keep an inventory of what runs and where, including software versions. You cannot patch what you cannot find.
- Patch services that accept network connections first, and track which flaws are known to be exploited.
- Segment the network so a compromised workstation cannot reach every server on every port. Treat trust relationships between hosts as attack paths.
- Remove default and shared credentials, use unique admin passwords and require multi-factor authentication where you can.
- Watch for sudden growth in scanning, outbound connections or resource use, which are early signs of self-replicating code.
- Practice a containment drill: isolate a subnet, share patches, confirm clean state. In 1988 the response depended on people trading information quickly.
Safeguard can help with the first two steps for your own software: dependency scanning builds an inventory of libraries, and reachability analysis shows which known vulnerabilities your code can actually trigger.
Quick check
Is a worm a type of virus?
Not in the strict sense. Both are malware, but a worm runs independently and replicates itself across networks. A virus attaches to a host program and needs it to run.
Does a worm need a user to click something?
By the NIST definition, no. It propagates without any user intervention, usually through a vulnerable service or reused credentials.
Sources
- NIST CSRC Glossary, worm
- RFC 1135, The Helminthiasis of the Internet (December 1989)
Last reviewed: 18 October 2026.
