History and stories
Blaster: the worm that kept restarting computers
For many people, the first sign of Blaster was a countdown on the screen saying the computer would shut down in 60 seconds.
1 min readStory
The short version
In August 2003, a worm spread to computers that had not installed a month-old Windows update, making them shut down over and over.
The story
On August 11, 2003, a worm called Blaster began spreading between computers running Windows XP and Windows 2000. It did not need anyone to open an email or click anything. It reached computers directly over the network through a flaw Microsoft had fixed in July, a few weeks earlier.
On infected computers, a part of Windows crashed, and a message appeared saying the system would shut down in 60 seconds. The computer restarted, and then it happened again. Inside the code was a message for Microsoft’s founder, asking why he made it possible and telling him to fix his software.
Once Blaster got inside a company or university, it spread quickly from machine to machine, because firewalls at the time rarely blocked traffic between computers on the same network.
An 18-year-old in Minnesota was later sentenced for releasing a variant of the worm. The author of the original was never identified.
Why it mattered
Blaster showed that a worm could spread without anyone clicking anything, and that one infected laptop brought into an office could reach every other computer on the network, because firewalls of the time mostly guarded the edge. Security advisers began urging businesses to block that kind of traffic inside their networks too.
The lesson today
The fix existed before the worm did. Computers that had installed the July update were safe. Blaster is a reminder that the gap between a fix being released and being installed is when attacks happen, and that one unpatched machine inside a network puts the rest at risk.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.