It's Alive! The Persistence of Slammer

On Monday after slammer hit, Microsoft re-released MS02-061 to cover up the memory leak and update ssnetlib.dll, and it was much easier to install. Of course, by then, Slammer was already pandemic. Microsoft itself was infected badly, prompting a moment of schadenfreude for many. ISP networks had collapsed; several root DNS servers were overwhelmed; airlines had cancelled flights; ATM machines refused to hand out money. In Canada, a national election was delayed.

The patches had, at best, a minuscule effect. What ended up preventing Slammer from worming its way into the workweek and causing even more damage, it turns out, was a rare and unusual gesture by ISPs. That same Monday, they agreed to block Internet traffic on UDP port 1434, the one Slammer used to propagate itself. "That's what allowed us to survive," says Cooper.

And surely, with ISPs blocking the door, companies would seize the opportunity to update, test and deploy the new patches. Or they could upgrade to Service Pack 3. They could locate and patch all their MSDE clients and, finally, kill Slammer dead.

But 10 days later, when ISPs opened port 1434 again, there was a spike in Slammer infections of SQL Servers. Six months later, in mid-July, the Wormwatch.org listener service showed Slammer remained the most prevalent worm in the wild, twice as common as any other worm. It was still trolling for, and finding, unpatched systems to infect.

SIDEBAR: SCARY PATCH STATS

Intel last year applied 2.4 million patches to its own network.

One analyst scanned 550 machines with patch management software, which told him to apply 10,000 patches.

Researching each of the 4200 vulnerabilities published by CERT last year for 10 minutes would have required one staffer to research for 17.5 full workweeks, or 700 hours.

A company with 100,000 IP addresses is subject to 2.3 million vulnerability probes per day.

SOURCES: INTEL WHITE PAPER, CIO REPORTING, CERT, ICSA LABS