Writing Worms for Fun or Profit

This historical technical report documents the design and implementation of “Samhain,” a proof-of-concept autonomous, cross-platform worm (circa 1998–1999) that incorporates portability via source/binary distribution, process and file hiding (including kernel modules), polymorphic decryptors, anti-debugging, a wormnet for update and binary distribution, and a modular exploit system. The authors state the project was never publicly released and remains inactive, but the write-up details high-risk techniques and capabilities that illustrate the potential impact of a weaponized worm.