SQL slammer (computer worm)

The SQL slammer worm is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic, starting at 05:30 UTC on January 25, 2003. It spread rapidly, infecting most of its 75,000 victims within ten minutes. So named by Christopher J. Rouland, the CTO of ISS, Slammer was first brought to the attention of the public by Michael Bacarella - see Notes. Although titled "SQL slammer worm", the program did not use the SQL language; it exploited a buffer overflow bug in Microsoft's flagship SQL Server and Desktop Engine database products, for which a patch had been released six months earlier in [http://www.microsoft.com/technet/security/bulletin/MS02-039.mspx MS02-039] . Other names include W32.SQLExp.Worm, DDOS.SQLP1434.A, the Sapphire Worm, SQL_HEL, W32/SQLSlammer and Helkern.

Effect

Sites monitoring the traffic of the Internet such as Internet Storm Center reported significant slowdowns globally, resembling the effects of the Code Red worm in the summer of 2001.

Yonhap news agency in South Korea reported that Internet services had been shut down for hours on Saturday, January 25, 2003 nationwide. The effects were mitigated by the fact that it occurred over the weekend.

The same attack was reported throughout most of Asia, Europe, and North America. Anti-virus software maker Symantec estimated that at least 22,000 systems were affected worldwide.

The Microsoft SQL Server Desktop Engine (MSDE) was affected by the worm and that increased the number of the systems affected. This, together with many home users unaware they have MSDE installed, worsened the effects of this worm. Also, if a computer running MSDE was infected with this worm via the Internet and then connected to a Virtual Private Network, the SQL Servers inside the NAT could be infected.

According to a CAIDA-coordinated analysis of the SQL Slammer outbreak, its growth followed an exponential curve with a doubling time of 8.5 seconds in the early phases of the attack, which was only slowed by the collapse of many networks because of the denial of service caused by SQL Slammer's traffic. 90% of all vulnerable machines were infected within 10 minutes, showing that the original estimate for infection speed was roughly correct.

Technical details

The worm was based on proof of concept code demonstrated at the Black Hat Briefings by David Litchfield, who had initially discovered the buffer overflow vulnerability that the worm exploited. [http://www.theregister.co.uk/2003/02/06/slammer_why_security_benefits/] It is a small piece of code that does little other than generate random IP addresses and send itself out to those addresses. If a selected address happens to belong to a host that is running an unpatched copy of Microsoft SQL Server Resolution Service, the host immediately becomes infected and begins spraying the Internet with more copies of the worm program.

Home PCs are generally not vulnerable to this worm unless they have MSDE installed. The worm is so small that it does not contain code to write itself to disk, so it only stays in memory, and it is easy to remove. For example, Symantec provides a free removal utility (see external link below), or it can even be removed by restarting SQL Server (although the machine would likely be immediately reinfected).

The worm was made possible by a software security vulnerability in SQL Server first reported by Microsoft on July 24, 2002. A patch had been available from Microsoft for six months prior to the worm's launch, but many installations had not been patched – including some at Microsoft.

The slowdown was caused by the collapse of numerous routers under the burden of extremely high bombardment traffic from infected servers. Normally, when traffic is too high for routers to handle, the routers are supposed to delay or temporarily stop network traffic. Instead, some routers "crashed" (became unusable), and the "neighbor" routers would notice that these routers had stopped and should not be contacted (aka "removed from the routing table"). Routers started sending notices to this effect to other routers they knew about. The flood of routing table update notices caused some additional routers to fail, compounding the problem. Eventually the crashed routers' maintainers restarted them, causing them to announce their status, leading to another wave of routing table updates. Soon a significant portion of Internet bandwidth was consumed by routers communicating with each other to update their routing tables, and ordinary data traffic slowed down or in some cases stopped altogether. Ironically because the SQL slammer worm was so small in size, sometimes it was able to get through and legitimate traffic was not.

SQL Slammer was the first observed example of a "Warhol worm" – a fast-propagating Internet infection of the sort first hypothesized in 2002 in a paper by Nicholas Weaver. Two key aspects contributed to SQL Slammer's rapid propagation. The worm infected new hosts over UDP, and the entire worm (only 376 bytes) fits inside a single packet. As a result, no connection was necessary for an infected host to attempt to infect another machine. Each infected host could instead simply "fire and forget" packets as rapidly as possible (generally hundreds per second).

Notes

There is contention as to who found "Slammer" first. This is nigh on impossible to determine. However, in terms of who first alerted the general public, this can be attributed to Michael Bacarella who posted a message to the Bugtraq security mailing list entitled "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!" [ [http://seclists.org/bugtraq/2003/Jan/0221.html Bugtraq: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434! ] ] . This was sent at 08:11:41 UTC on 25 January 2003. Ben Koshy is often credited as being the first; indeed the company he worked for put out a press statement to this effect. [http://www.w3media.com/images/news/W3_Identify_Slammer_Virus.pdf] However, his alert [ [http://archives.neohapsis.com/archives/ntbugtraq/2003-q1/0010.html NEOHAPSIS - Peace of Mind Through Integrity and Insight ] ] to the public, sent to the NTBugtraq mailing list was not sent until 10:28 UTC. Robert Boyle sent an alert to NTBugtraq at 08:35 UTC [ [http://archives.neohapsis.com/archives/ntbugtraq/2003-q1/0011.html NEOHAPSIS - Peace of Mind Through Integrity and Insight ] ] beating Koshy but lagging behind Bacarella. ISS, through Chris Rouland, sent out alerts at 11:54 UTC [ [http://lists.virus.org/issforum-0301/msg00099.html [ISSForum ISS Security Brief: Microsoft SQL Slammer Worm Propagation ] ] and 11:56 UTC [ [http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0038.html NEOHAPSIS - Peace of Mind Through Integrity and Insight ] ] to the ISSForum and Vulnwatch mailing lists respectively.

External links

News:
* [http://news.bbc.co.uk/2/hi/technology/2693925.stm BBC NEWS Technology Virus-like attack hits web traffic]
* [http://slashdot.org/article.pl?sid=03/01/25/1245206&mode=flat&tid=109 MS SQL Server Worm Wreaking Havoc]
* [http://www.wired.com/wired/archive/11.07/slammer.html Wired 11.07: Slammed!] A layman's explanation of the Slammer code.

Announcement:
* [http://www.microsoft.com/technet/security/bulletin/MS02-039.mspx Microsoft Security Bulletin MS02-039 and Patch]
* [http://www.cert.org/advisories/CA-2003-04.html CERT Advisory CA-2003-04]
* [http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html Symantec Security Response - W32.SQLExp.Worm]

Analysis
* [http://www.cs.ucsd.edu/~savage/papers/IEEESP03.pdf Inside the Slammer Worm] IEEE Security and Privacy Magazine, David Moore, Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford, and Nicholas Weaver

Technical details
* [http://www.eeye.com/html/Research/Flash/sapphire.txt Worm code disassembled]
* [http://www.cert.org/advisories/CA-2002-22.html Multiple Vulnerabilities in Microsoft SQL Server] - Carnegie-Mellon Software Engineering Institute
* [http://isc.incidents.org/ Internet Storm Center]