Fork_bomb

A Fork bomb, sometimes also known as a Rabbit, Rabbit job or a Wabbit, is an extremely simple form of self-replicating malware. They may predate the Creeper worm by several years.

Structure

A fork bomb is extremely simple to code, often consisting of less than five lines. In some languages, it does not even require more than a few colons, parentheses, and can exclude all alphanumeric characters. They can be implemented in any language, though today most commonly are done in scripting languages.

The way the fork bomb works is even simpler than its coding. Once executed, the program loads itself into memory, then creates two or more copies of itself. These copies each make as many copies of themselves as the first one made. This repeats itself until all memory is full, sometimes causing the system to crash. Depending on the system, this could take several hours or a few seconds.

History

One of the earliest accounts of a fork bomb was at the University of Washington on a Burroughs 5500 in 1969. It is described as a "hack" named RABBITS that would make two copies of itself when it was run, and these two would generate two more copies each, and the copies would continue making more copies until memory was full, causing a system crash. Q The Misanthrope wrote a Rabbit-like program using BASIC in 1972 while in grade 7. Jerry Leichter of Yale University describes hearing of programs similar to rabbits or fork bombs at his Alma Mater of Princeton and says given his graduation date, they must be from 1973 or earlier. An account dating to 1974 describes a program actually named "rabbit" running on an IBM 360 system at a large firm and a young employee who was discharged for running it.

Sources

N ixCraft, Understanding Bash fork() bomb ~ :(){ :|:& };:

The Jargon File, Wabbit.

Bill Kennedy. The Risks Digest, Volume 6: Issue 53, Two old viruses. 1988.03.29

Jerry Leichter. The Risks Digest, Volume 6: Issue 54, Old viruses. 1988.04.04

Cicatrix Interview with Q The Misanthrope. 1997.09

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License