How Would You Hack the World's First Computers?
No internet, no passwords and no ransomware. The earliest electronic computers operated in a very different world, but that didn't necessarily make them immune to interference. We look at three machines that helped start modern computing and ask how someone might have compromised them.
The rebuilt Colossus at The National Museum of Computing, Bletchley Park. Photo: Wikimedia Commons, CC0
Imagine you're a hacker in 1946. There's no internet to connect to, no malicious email attachments to send and no software vulnerabilities database to consult. Your target is a machine that fills an entire room, consumes an extraordinary amount of electricity and requires a team of specialists to operate.
You're going to need a different approach.
Today, cybersecurity tends to conjure up images of stolen passwords, ransomware attacks and criminals operating anonymously from the other side of the world. But the basic problem of computer security is considerably older than the internet. What happens when somebody interferes with the information a machine receives, changes the instructions it follows or gains access to something they shouldn't?
The earliest electronic computers weren't designed with modern cybersecurity in mind. They didn't need firewalls or antivirus software because the threats we associate with those technologies hadn't yet emerged. Nevertheless, their reliance on human operators, physical components and carefully prepared instructions created opportunities for interference.
So, how would you hack one?
First, there's a historical complication. The title of world's first computer is contested, largely because the answer depends on what qualifies as a computer. Mechanical or electronic? General-purpose or specialised? Programmable or stored-program?
Rather than try to settle that argument, we've chosen three machines that represent important milestones in computing history: Britain's Colossus, America's ENIAC and the Manchester Baby.
None is known to have suffered the hypothetical attacks we're about to describe. But examining how they worked reveals something rather interesting about the origins of computer security.
Colossus: Britain's wartime codebreaking machine
1944 | Bletchley Park, England
By 1944, Britain was operating one of the most remarkable machines of the Second World War.
Colossus was developed to help British codebreakers analyse encrypted German communications, particularly those produced by the Lorenz cipher system, used for high-level military messages.
Designed by engineer Tommy Flowers and built at the Post Office Research Station at Dollis Hill, Colossus was among the world's earliest programmable electronic digital computers.1
It was also a closely guarded secret.
The first Colossus was delivered to Bletchley Park around the turn of 1944 and was working by early February, with later machines helping accelerate the analysis of encrypted communications.1 Its contribution remained largely unknown to the public for decades after the war.
Unlike a modern computer, Colossus didn't load programs from a hard drive or run an operating system. It used thousands of electronic valves, read information from punched paper tape and performed specialised operations configured through switches and plug connections.
And that gives our hypothetical hacker a starting point.
How would you hack it?
You probably wouldn't attack Colossus itself. You'd attack the information going into it.
Colossus processed encoded data represented on punched paper tape. If someone with sufficient access could substitute or alter the tape before processing, the machine could be made to analyse incorrect information.
It wouldn't necessarily malfunction. In fact, that would be the point.
A computer that faithfully processes manipulated input can produce misleading results while appearing to operate normally.
Of course, this would have been exceptionally difficult in practice. Bletchley Park operated under strict wartime security, and getting close enough to interfere with sensitive materials would have required considerable access.
Another possibility would be to interfere with the machine's configuration. Colossus used switches and plug connections to establish the operations it performed. Altering those settings could affect its analysis.
But again, our attacker would need to understand the equipment and evade the people operating it.
This wasn't a machine that somebody could compromise from a bedroom thousands of miles away. The attack surface was physical, specialised and tightly controlled.
What does that teach us today?
Colossus illustrates two security problems that remain relevant: the integrity of input data and the trustworthiness of a system's configuration.
Modern computers process vastly more information than Colossus ever could, but the underlying principle hasn't changed. If someone manipulates the information entering a system, or changes how that system processes it, the resulting output may be unreliable.
It's also worth appreciating the historical irony.
One of the earliest electronic computers was developed to help defeat a sophisticated encryption system. Long before cybersecurity became an industry, computing and cryptography were already intimately connected.
ENIAC: America's electronic giant
1946 | University of Pennsylvania, United States
If Colossus was a wartime secret, ENIAC was a technological spectacle.
The Electronic Numerical Integrator and Computer was publicly unveiled in February 1946, attracting attention for its extraordinary speed and size.2
Developed by John Mauchly and J. Presper Eckert at the University of Pennsylvania for the US Army, ENIAC was originally intended to calculate artillery firing tables.
It contained approximately 18,000 vacuum tubes, occupied a substantial amount of floor space and consumed enormous quantities of electricity.2
Its computing power was remarkable for the period. Calculations that previously demanded extensive human effort could be performed electronically at unprecedented speeds.
But programming the original ENIAC was hardly straightforward.
Rather than typing instructions into a keyboard, its programmers configured the machine through a complex arrangement of cables, switches and function tables.
Among its pioneering programmers were Kathleen McNulty, Betty Jennings, Betty Snyder, Marlyn Wescoff, Fran Bilas and Ruth Lichterman.2 Their contributions were essential to making the machine work, although their achievements were not always given the recognition they deserved.
ENIAC demonstrated what electronic general-purpose computing could accomplish.
It also offers an unusually direct illustration of how someone might interfere with a computer's behaviour.
How would you hack it?
Imagine arriving at ENIAC with malicious intentions.
Your first challenge would be access. You couldn't send it a virus or remotely exploit a network service. You'd have to get physically close to the machine or interfere with materials being prepared for it.
But suppose you managed that.
ENIAC's original programming process involved connecting cables and setting switches to establish how calculations would proceed.
Changing those connections could change what the computer did.
You wouldn't need to destroy the machine. A carefully chosen alteration might cause it to perform the wrong calculation, execute operations in an unintended sequence or produce incorrect results.
The difficulty, naturally, would be knowing exactly what to change.
ENIAC was enormously complicated. Randomly pulling out cables would be more likely to create an obvious problem than a subtle compromise.
A knowledgeable insider, however, could potentially make changes that were harder to recognise immediately.
Another approach would be to manipulate the numerical data supplied to the computer. If the input values were wrong, ENIAC could produce an entirely accurate calculation of something that wasn't true.
For a machine originally intended to support military calculations, the consequences of incorrect information could have been significant.
These are hypothetical scenarios, not documented attacks on ENIAC. But the vulnerabilities they illustrate are familiar.
What does that teach us today?
Modern cybersecurity places considerable emphasis on software integrity, configuration management, access controls and audit trails.
ENIAC helps explain why.
A computer doesn't need to be connected to the internet to be compromised. Someone with sufficient access and technical understanding may be able to change its behaviour directly.
Today, that might involve modifying a configuration file, interfering with an industrial control system or changing a software deployment.
In 1946, it could have involved moving a cable.
The technology is radically different. The importance of knowing who changed what, and whether they were authorised to do so, is not.
Manchester Baby: When instructions moved inside the machine
1948 | University of Manchester, England
By the summer of 1948, computing was approaching another turning point.
On 21 June, a small experimental machine at the University of Manchester successfully executed a program stored electronically in its own memory.3
Known as the Manchester Baby, or Small-Scale Experimental Machine, it was designed and built by Frederic Williams and Tom Kilburn, with Geoff Tootill.3
The Baby wasn't built to become a commercially useful computer. Its purpose was to test a new form of electronic memory, now known as Williams-Kilburn tube storage.3
Nevertheless, its achievement was historic.
Unlike machines that relied on extensive external wiring or switch settings to define their operations, the Manchester Baby could hold program instructions in electronic memory and execute them.
That principle would become fundamental to modern computing.
It also changed the possibilities for interference.
How would you hack it?
With Colossus and the original ENIAC, our hypothetical attacks largely involved manipulating external data or physical configurations.
The Manchester Baby introduces another target: the program itself.
If someone could alter instructions held in the machine's electronic memory, they could change what the computer did without needing to redesign its circuitry.
Of course, there was no remote connection, no conventional operating system and no practical mechanism for distributing malicious software as we understand it today.
A would-be attacker would still need physical access and specialist knowledge. The Baby's programs were entered bit by bit using a simple keyboard of buttons, and its memory technology was experimental.3
But the distinction matters.
For the first time in an operating electronic stored-program computer, instructions could be held in memory alongside the data being processed.
That made computers dramatically more flexible. It also created the conceptual possibility of tampering with the instructions themselves.
Consider a simple hypothetical example.
A legitimate program is supposed to perform a mathematical operation and produce a result. Someone alters one of its stored instructions, changing the calculation.
The machine continues operating. It follows the modified instructions precisely.
From the computer's perspective, nothing necessarily distinguishes an authorised instruction from an unauthorised one.
That distinction depends on the people and processes controlling the machine.
It would be misleading to call this an early computer virus. There's no evidence of such an attack on the Manchester Baby, and the machine lacked the environment in which modern malware operates.
But the underlying security question is recognisable.
How do you know the instructions your computer is executing are the instructions you intended it to execute?
What does that teach us today?
Software integrity is now one of the foundations of cybersecurity.
Operating systems, applications, firmware and updates all depend on the assumption that the instructions being executed haven't been maliciously altered.
Modern protections such as code signing, secure boot and integrity verification are among the ways we try to establish that trust.
The Manchester Baby predates those technologies by decades. Its designers were trying to demonstrate electronic memory, not develop a secure computing platform.
Nevertheless, the stored-program approach that it helped establish would eventually make software-based attacks possible on a scale unimaginable in 1948.
The flexibility that made modern computing possible also introduced new things that needed protecting.
The first computers had a security problem. Just not the one we imagine.
Looking back at these machines, it's tempting to conclude that early computing was somehow more secure.
After all, they weren't connected to the internet. There were no phishing emails, malicious browser extensions or ransomware gangs demanding payment in cryptocurrency.
But isolation isn't the same thing as security.
Colossus depended on trustworthy inputs and configurations. ENIAC depended on the integrity of its physical programming and numerical data. The Manchester Baby introduced electronic storage of instructions, making the contents of memory central to what a computer actually did.
In every case, access and trust mattered.
What changed over the following decades wasn't simply the existence of vulnerabilities. It was the number of people who could reach a computer, the complexity of the systems involved and the speed at which interference could spread.
A hypothetical attacker in 1944 might have needed access to a highly restricted wartime installation. A modern attacker can sometimes attempt to compromise thousands of internet-connected systems without leaving home.
Yet some of the questions remain surprisingly similar.
Who is allowed to change the machine? Can we trust the information it receives? How do we know its instructions haven't been altered? And can we detect interference before it causes harm?
The engineers behind Colossus, ENIAC and the Manchester Baby weren't building cybersecurity products. They were solving urgent problems in cryptanalysis, mathematics and electronic memory.
But the systems they created help us understand why security became necessary.
Perhaps the most interesting lesson from trying to hack the world's first computers is that hacking doesn't begin with a computer network.
It begins with finding something a system trusts, and working out how to change it.
Editorial note: the attack scenarios in this article are hypothetical illustrations based on the machines' operating principles. They are not claims that these computers were historically hacked.
Corrections: none. If you spot an error, tell us and we will correct it openly.
