ANIMAL trojan replicated across mainframes

ANIMAL began as a guessing game for UNIVAC 1100 systems. The game learned from players, corrected its own animal tree, and was popular enough that users asked John Walker for copies.

Walker added a general subroutine called PERVADE to solve distribution by automation. While the game ran, PERVADE examined directories writable by the current user and copied the current program into places where no copy, or only an older copy, existed.

That made ANIMAL less a prank than an early supply-chain lesson: the useful program was also the distribution mechanism. There was no separate installer, updater, or exploit kit; every trusted run could become a copy operation into another trusted location.

The code did not exploit an operating-system bug. It used normal access and shared directories. When a privileged user ran it, ANIMAL could reach system libraries; when users exchanged tapes, the program moved between installations.

The payload was benign, but the lesson was not. ANIMAL showed that a useful program could carry quiet replication logic, cross trust boundaries through ordinary use, and spread faster than policy could reason about it.

Motive

Experimentation Notoriety

Attribution

Maintainer

Cause

Sabotage

Transitive

No

Actor

Author

• The Animal Episodefourmilab.ch
• ANIMAL Source Codefourmilab.ch