What passwords did the 1988 internet worm try?

The ones a 1979 study had warned about, co-written by its author’s father.

On the evening of November 2, 1988, Robert Tappan Morris, a first-year PhD student at Cornell, released a worm: a program that copies itself from computer to computer on its own. He launched it from a computer at MIT to hide where it came from. He meant it to spread quietly, but it copied itself far more often than he expected. By the next morning it had clogged computers across the country, up to 6,000 of them by a government estimate.

One of its ways in was guessing passwords. On each computer it reached, it tried the easy ones first: no password, the account name, the name doubled or backward, and the person’s own first and last names. Then it worked through 432 favorites it carried with it, mostly English words and names, and finally the computer’s own dictionary. Each password it cracked became a way into other computers where the same person had an account.

Nine years earlier his father, also named Robert Morris, had co-written the Bell Labs study that found most passwords were names, words, or short strings. By 1988 the father was chief scientist at the National Security Agency’s computer security center. Asked about the worm, he called it “the work of a bored graduate student.” The son was convicted under a 1986 federal computer-crime law and sentenced to three years of probation, 400 hours of community service, and a $10,050 fine.