Christmas Tree EXEC

This article needs additional citations for verification. Please help by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources:  –  ·  ·  · scholar · JSTOR (March 2021) (Learn how and when to remove this template message)

Christmas Tree EXEC was the first widely disruptive computer worm, which paralyzed several international computer networks in December 1987.^[1] The virus ran on the IBM VM/CMS operating system.

Written by a student at the Clausthal University of Technology in the REXX scripting language, it drew a crude Christmas tree as text graphics, then sent itself to each entry in the target's email contacts file. In this way it spread onto the European Academic Research Network (EARN), BITNET, and IBM's worldwide VNET. On all of these systems it caused massive disruption.

The core mechanism of the ILOVEYOU worm of 2000 was essentially the same as Christmas Tree, although it ran on PCs rather than mainframes, was spread over a different network, and was scripted using VBScript rather than REXX.

The name was actually "CHRISTMA EXEC" because the IBM VM systems originally required file names to be formatted as 8+space+8 characters. Additionally, IBM required REXX script files to have a file type of "EXEC". The name is sometimes written as "CHRISTMAS EXEC" (adding a 9th character) to make the name more readable. The user was prompted to: "...just type CHRISTMAS..."—and this in fact launched the "worm". The worm would read the user's CMS NAMES file, which contained a list of users at remote nodes to transmit the worm to. The worm would then use the SENDFILE command to transmit the worm to those remote users, who would presumably run it, repeating the cycle.

Some versions of the worm had concealed code. The actual executable part of the worm was contained in several overly long lines (more than 80 characters) that were not visible unless the user scrolled the screen to the right. The IBM 3279 color terminal would display the christmas tree with some blinking colored characters (asterisks) to represent tree lights.

It displays this message when the program is run and then forwards itself to mailbox addresses contained in the user's address file.^[2]

                *
                *
               ***
              *****
             *******
            *********
          *************                A
             *******
           ***********                VERY
         ***************
       *******************            HAPPY
           ***********
         ***************            CHRISTMAS
       *******************
     ***********************         AND MY
         ***************
       *******************         BEST WISHES
     ***********************
   ***************************     FOR THE NEXT
             ******
             ******                    YEAR
             ******

See also[]

• Trojan horse (computing)
• Timeline of computer viruses and worms
• ASCII art

References[]

Further reading[]

• Burger, Ralf (1988). Computer viruses – a high tech disease. Abacus/Data Becker GmbH. p. 276. ISBN 1-55755-043-3.
• Capek, P.G.; Chess, D.M.; White, S.R.; Fedeli, A. (2003). "Merry Christma: An Early Network Worm". Security & Privacy. 1 (5): 26–34. doi:10.1109/MSECP.2003.1236232.
• Martin, Will (March 4, 1988). "Re: BITNET Security". Security Digest (Mailing list). Archived from the original on September 25, 2006. Retrieved October 30, 2008.
• Patterson, Ross (December 21, 1987). "Re: IBM Christmas Virus". RISKS Digest (Mailing list). Retrieved October 30, 2008.
• "Viruses for the "Exotic" Platforms". VX Heaven. Archived from the original on September 17, 2008. Retrieved October 30, 2008.

External links[]

• Source code (archived)