The Secret History of the World's First Computer Virus: The Creeper

Creeper was written in 1971 by Bob Thomas, an engineer at BBN (Bolt Beranek and Newman), the company that helped build ARPANET, the precursor to the modern internet.

Creeper ran on ARPANET-connected DEC PDP-10 computers using TENEX, an operating system BBN developed for that hardware.

Thomas's original Creeper was an experiment in mobile computing, not malice: it demonstrated that a program could move itself from one networked machine to another.

When Creeper moved to a new machine, it displayed the message "I'M THE CREEPER, CATCH ME IF YOU CAN!" on the screen.

The original version of Creeper moved rather than copied itself: it would relocate to a new machine and then remove itself from the one it had just left.

Ray Tomlinson, the BBN engineer best known for inventing modern network email, later modified Creeper so it could copy itself and leave the original copy running as well.

Because Tomlinson's version could replicate and spread without deleting itself, it's this version that's generally credited as the first true self-replicating computer program, or computer worm.

Creeper relied on a resource-sharing capability called RSEXEC, which let programs move between and run on remote ARPANET machines with essentially no authentication.

TENEX and ARPANET were used mainly by research institutions in the early 1970s, including MIT, Stanford, Carnegie Mellon, and BBN itself.

Creeper didn't damage data or systems; it was mostly a curiosity that surprised users who saw its message pop up unexpectedly.

Ray Tomlinson wrote a program called Reaper specifically to hunt down and delete copies of Creeper across ARPANET machines.

Reaper spread the same way Creeper did, moving from machine to machine, but it only activated on systems that were already infected.

Reaper is widely considered the world's first antivirus program.

Whether Creeper counts as the "first computer virus" is still debated: some researchers reserve the term "virus" for programs that infect other files or executables, a definition that instead points to Elk Cloner as the first virus.

Elk Cloner was created in 1982 by 15-year-old Rich Skrenta and spread via floppy disks on Apple II computers, displaying a short poem on every 50th boot.

The Morris Worm, released in 1988 by Cornell graduate student Robert Tappan Morris, exploited flaws in Unix programs including sendmail and fingerd, and became the first major worm to disrupt the early internet, leading to Morris's conviction under U.S. computer fraud law.

The ILOVEYOU worm, released in 2000 by Onel de Guzman in the Philippines, spread through email attachments and is estimated to have caused billions of dollars in damage worldwide.

Stuxnet, discovered in 2010 and widely attributed to U.S. and Israeli intelligence agencies, targeted the industrial control systems running Iran's uranium enrichment centrifuges.

Creeper's legacy lives on in the basic building blocks of modern cybersecurity, including antivirus software, firewalls, encryption, and authentication systems, all developed in response to the kinds of network vulnerabilities Creeper first exposed.