History and stories
Nimda: the worm that came in through every door
Most worms used one way in. Nimda used five, and most of them were flaws that already had fixes.
1 min readStory
The short version
In September 2001, a worm spread through email, shared folders, websites and old server flaws all at once, and became the most widespread on the internet within hours.
The story
On September 18, 2001, a new worm started spreading across the internet. It was called Nimda, “admin” spelled backward, and within about 22 minutes it had become the most widespread worm on the internet.
Nimda spread faster than earlier worms because it used several ways in at the same time:
- Email, as an attachment that could run when the message was viewed.
- Shared network folders, copying itself onto any it could write to.
- Websites, by infecting web servers so that visitors’ computers caught it from the pages.
- Known flaws in web server software, which already had fixes available.
- Back doors left by earlier worms such as Code Red, on servers that had never been cleaned up.
Why it mattered
Defending against one route was not enough. A company that filtered email could still be infected through a shared folder or an unpatched server. Nimda pushed businesses to think about security in layers.
The lesson today
Attackers today combine methods the same way: a phishing email, then shared drives, then an old unpatched system. Each layer of protection covers gaps in the others, and leftover problems from past incidents make the next one easier.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.