History and stories
Sasser: the worm that grounded flights
Nobody had to click anything. A computer only had to be switched on, connected and missing one update.
1 min readStory
The short version
In May 2004, a worm spread on its own between Windows computers that had not installed an update, disrupting airlines, newsrooms and hospitals.
The story
At the end of April 2004, a worm called Sasser began spreading between computers running Windows XP and Windows 2000. Like Blaster the year before, it needed no help from the user. It scanned for other computers and got in through a flaw Microsoft had already fixed about two weeks earlier.
Infected computers crashed and restarted repeatedly. The damage spread to organizations that depended on those computers: the news agency Agence France-Presse lost satellite communications for hours, and Delta Air Lines canceled several transatlantic flights.
The author was Sven Jaschan, an 18-year-old in Germany, who was caught after a reward was offered for information. He had also written versions of another worm, Netsky.
Why it mattered
Two weeks was enough. Many organizations still waited months before installing updates, testing them first or simply not getting to it. Sasser made it clear that attackers could turn a published fix into a working attack faster than most companies applied it.
The lesson today
The window between a fix and an attack has only become shorter. Today, attackers often start using a flaw within days of the fix being published. Updates need to be installed on a schedule, and someone needs to check they actually went on.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.