Inside the Slammer Worm
Article published in IEEE Security and Privacy

David Moore
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center
University of California, San Diego

Vern Paxson
The ICSI Center for Internet Research - ICIR
and Lawrence Berkeley National Laboratory - LBNL

Stefan Savage
University of California, San Diego (CSE Department)

Colleen Shannon
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center
University of California, San Diego

Stuart Staniford
Silicon Defense

Nicholas Weaver
Silicon Defense
and University of California, Berkeley (EECS Department)

The Slammer worm spread so quickly that human response was ineffective. In January 2003, it packed a benign payload, but its disruptive capacity was surprising. Why was it so effective and what new challenges does this new breed of worm pose?

Slammer (sometimes called Sapphire) was the fastest computer worm in history. As it began spreading throughout the Internet, the worm infected more than 90 percent of vulnerable hosts within 10 minutes, causing significant disruption to financial, transportation, and government institutions and precluding any human-based response. In this article, we describe how it achieved its rapid growth, dissect portions of the worm to study some of its flaws, and look at our defensive effectiveness against it and its successors.

Slammer began to infect hosts slightly before 05:30 UTC on Saturday, 25 January 2003, by exploiting a buffer-overflow vulnerability in computers on the Internet running Microsoft's SQL Server or Microsoft SQL Server Desktop Engine (MSDE) 2000. David Litchfield of Next Generation Security Software discovered this underlying indexing service weakness in July 2002; Microsoft released a patch for the vulnerability before the vulnerability was publicly disclosed (www.microsoft.com/security/slammer.asp). Exploiting this vulnerability, the worm infected at least 75,000 hosts, perhaps considerably more, and caused network outages and unforeseen consequences such as canceled airline flights, interference with elections, and ATM failures.