VMS systems have accounts with varying levels of privilege. A high-privilege account holder might, for example, be able to read the electronic mail of another computer user or delete files from that user's directory. He or she might also be allowed to create new computer accounts on the system, or reactivate disabled accounts. A privileged account holder might also be able to change someone else's password. The people who ran computer systems or networks needed accounts with the highest level of privilege in order to keep the system running smoothly. The worm specifically sought out these sorts of accounts because its creator knew that was where the power lay. The worm was smart, and it learned as it went along. As it traversed the network, it created a masterlist of commonly used account names. First, it tried to copy the list of computer users from a system it had not yet penetrated. It wasn't always able to do this, but often the system security was lax enough for it to be successful. The worm then compared that list to the list of users on its current host. When it found a match--an account name common to both lists--the worm added that name to the masterlist it carried around inside it, making a note to try that account when breaking into a new system in future. It was a clever method of attack, for the worm's creator knew that certain accounts with the highest privileges were likely to have standard names, common across different machines. Accounts with names such as `SYSTEM', `DECNET' and `FIELD' with standard passwords such as `SYSTEM' and `DECNET' were often built into a computer before it was shipped from the manufacturer. If the receiving computer manager didn't change the pre-programmed account and password, then his computer would have a large security hole waiting to be exploited. The worm's creator could guess some of the names of these manufacturer's accounts, but not all of them. By endowing the worm with an ability to learn, he gave it far more power. As the worm spread, it became more and more intelligent. As it reproduced, its offspring evolved into ever more advanced creatures, increasingly successful at breaking into new systems. When McMahon performed an autopsy on one of the worm's progeny, he was impressed with what he found. Slicing the worm open and inspecting its entrails, he discovered an extensive collection of generic privileged accounts across the SPAN network. In fact, the worm wasn't only picking up the standard VMS privileged accounts; it had learned accounts common to NASA but not necessarily to other VMS computers. For example, a lot of NASA sites which ran a type of TCP/IP mailer that needed either a POSTMASTER or a MAILER account. John saw those names turn up inside the worm's progeny.