SQL Slammer’s mysterious disappearance

http://blogs.iss.net/archive/sqlslam.html

by caf • 15 years ago

36 10 15 years ago

blogs.iss.net

_b8r02• 15 years ago

Slammer is a really old worm. It exploits this[1] vulnerability so it's not surprising that it's dying off. The entire worm is small enough to fit in a single UDP packet as it just generates random IP addresses, launches itself on UDP port 1434, and if the packets hit a vulnerable windows 2000 server, then the exploit kicks in and we have a new infected host to propogate the worm.

Bearing in mind that the vulnerability exploits a weakness in a very old no longer supported version of Windows, and that the patch came out 9 years ago it's not surprising that slammer activity has decreased.

There are a number of possible reasons for this - for example, maybe there were just a few infected servers and these have been taken offline, or that some form of filtering has been put in place at the ISP or country level so ISS' sensors no longer pick it up, but the reality is we just don't know.

All worms have a shelf life, perhaps slammer's just reached the end of it's one. 8 years isn't a bad run. After all, how many Morris worm infections does anyone see these days?

[1] http://www.microsoft.com/technet/security/bulletin/MS02-039....

ilcavero• 15 years ago

that doesn't justify the sudden silence in matter of months that the article shows in the graphic, I wonder if analyzing the worm's code shows if there is a time condition or bug that disables it after X date.

Natsu• 15 years ago

Maybe some independent hacker finally got sick of it and decided to send the hosts some kind of shutdown code?

trezor• 15 years ago

launches itself on UDP port 1434, and if the packets hit a vulnerable windows 2000 server

Technically speaking, UDP Port 1434 is a SQL Server service-discovery port and it would depend on SQL Server (2000) to be installed to have any affect.

My experience as a former SQL-Server consultant is that most organizations have been phasing out SQL Server 2000 for quite a while now, and only business-critical applications which for one reason or another are impossible to migrate to a newer version of SQL Server seems to be the only reason it is still around.

This doesn't explain the sudden drop, but just thought I'd clear up what I considered factually incorrect ;)

_b8r02• 15 years ago

Sorry, I meant SQL Server 2000 on Windows 2000. I can't remember whether the necessary bits for NT were included in the worm.

sucuri2• 15 years ago

Article from April 1st...

thorax• 15 years ago

I didn't download their full report, but other sources reported it as in their final report (not produced on April 1st).

romland• 15 years ago

This almost sounds as if it's a bug, say, an int that flipped over. Wouldn't an unsigned 16 bit int of milliseconds flip over after some 8-9 years?

On the other hand, it's a bit hard to believe that IBM Security Systems would miss that... So while perhaps plausible, doubtful.

hnfwerr• 15 years ago

Probably a bug, since I am still getting hit byt SQL slammer on our IDS.

*edit, maybe an April fools joke? Article is from april 1st.

caf• 15 years ago

After reading the article, I checked my own IDS logs and saw the same drop to zero after March 11.

SQL Slammer’s mysterious disappearance

Related Stories