Creeper and Reaper: the first worm and the first antivirus

The story

In 1971, Bob Thomas, a researcher at BBN Technologies, wrote a program called Creeper to test whether software could move itself from one computer to another across ARPANET, the network that grew into the internet.

Creeper hopped between computers and printed a message on each screen it reached:

I’M THE CREEPER: CATCH ME IF YOU CAN.

It did no damage. It simply moved on.

Ray Tomlinson, the BBN engineer who had just invented network email, took up the challenge. He wrote a program called Reaper that travelled the same network looking for Creeper and deleting it wherever it found it. Reaper is often called the first antivirus program.

Why it mattered

Creeper and Reaper showed, at the very start of networked computing, that programs could travel between machines on their own, and that defenses would have to travel too. Every worm and every antivirus product since has followed the same pattern.

The lesson today

Creeper showed that a program could travel through a network without anyone carrying it. Reaper showed the answer: something that watches the network for that behavior and removes what it finds.

Fifty years later, security still works the same way at heart. Modern endpoint protection watches what programs do, where they go and what they touch, and stops them when they act like Creeper. The difference is that today’s creepers do not announce themselves.