The worm that spread around the world in ten minutes

The story

Early on January 25, 2003, a worm began attacking computers running Microsoft’s database software. The whole program was just 376 bytes, small enough to fit in a single network packet.

Each infected machine sent copies of the worm to random internet addresses as fast as it could. Researchers later calculated that the number of infected machines doubled about every eight and a half seconds, and that most of the vulnerable machines in the world were infected within about ten minutes.

The flood of traffic slowed large parts of the internet. Some bank ATM networks stopped working, an airline cancelled flights, and an emergency call center in Washington state was disrupted.

Microsoft had published a fix for the flaw six months earlier.

Why it mattered

Slammer was one of the fastest-spreading worms ever recorded, and it showed that a few hundred bytes of code could slow large parts of the internet and stop cash machines and emergency services. The fix had been available for six months. It became a standard example of why every server needs patching, including the ones nobody thinks about.

The lesson today

Slammer showed that people cannot react at the speed of an automated attack. By the time anyone noticed, it was over. The protection had to be in place beforehand: the fix installed, and database servers kept off the open internet.

The same is true today. Attacks on newly published flaws are automated, and the gap between a fix being released and attackers using the flaw keeps shrinking. Patching and keeping systems separated are what work, because there is no time to respond once it starts.