Blaster: the worm that hit 100,000 Windows PCs in a week

On August 11, 2003, a worm called Blaster, also known as MSBlast or Lovsan, began to spread through a flaw in Windows that Microsoft had fixed four weeks earlier. A worm is a program that spreads from computer to computer on its own. Blaster needed no click and no password: an unpatched Windows computer within its reach was enough. In its first week, it infected more than 100,000 Windows computers, according to a measurement study, and a year later it was still spreading.

How it worked

Windows uses a service called RPC, short for Remote Procedure Call, to let programs call functions on other computers. One part of it handles DCOM, a way for software components to work together across a network. According to Microsoft, the service runs by default in all versions of Windows. It listens on several network ports, numbered doors for network traffic, above all TCP port 135.

One DCOM function did not properly check incoming messages. A crafted message overflowed a memory area of fixed size, a buffer, and could run the attacker’s code with Local System privileges, the highest rights in Windows. Windows NT 4.0, 2000, XP and Server 2003 were all affected.

Blaster reused attack code that had been published on a public mailing list in July. Each infected computer picked a starting address, in 40 % of cases one close to its own, and tried 20 addresses at a time on port 135. A successful attack opened a backdoor, a hidden command line, on port 4444. Through it, the new victim was told to fetch the worm file, msblast.exe, from the attacking computer with TFTP, a simple file transfer method, and to run it. An entry in the registry, the central settings database of Windows, restarted the worm after every reboot.

Microsoft warned that Blaster could make infected PCs crash again and again. CERT/CC, the US computer emergency response center at Carnegie Mellon University, reported that some machines could not stay online long enough to download the patch. The worm also had a second task: on August 16, every infected computer was to flood windowsupdate.com, an address of Microsoft’s update website, with connection requests.

Reach and damage

The best measurements come from “The Blaster Worm: Then and Now”, a 2005 study by researchers at the University of Michigan and the security firm Arbor Networks. They watched a block of about 16 million unused internet addresses, one 256th of the internet. No real computers use them, so any traffic arriving there comes from scans, such as worms looking for victims.

After Microsoft’s warning in July, the number of computers probing port 135 on this block rose from 4–10 a day to 100–300 a day. When Blaster struck, the number of infected computers at first doubled about every nine minutes. At the peak, the researchers saw nearly 15,000 infected addresses in one hour and about 106,000 in 24 hours. After eight hours, activity began to fall, with a half-life of about 12 hours, as owners patched or disconnected computers and networks blocked the worm.

The infected networks included several consumer broadband providers. Other counts differ widely:

DShield, a service that collects firewall logs from tens of thousands of devices, saw at most 208,000 addresses scanning port 135, against about 7,000 before the worm. In February 2004, Microsoft said that its cleanup tool had helped more than 8 million internet users; the researchers note that this differs widely from both measurements.

No reliable total of the damage exists. A survey of 19 research universities, quoted in the study, found that each spent an average of USD 299,579 over five weeks to recover from Blaster and its variants.

On August 18, a second worm began to use the same flaw. Welchia, also called Nachi, was meant as an “antiworm”: according to the study, it tried to patch the flaw on the computers it infected. Before each attack, it sent a ping, a small test message, to see whether a computer was online. The network equipment maker Cisco reported that the high volumes of these packets caused many of the network problems, including overloaded routers. The study concludes that Welchia caused significant damage of its own.

The fix and the response

The research group The Last Stage of Delirium had reported the flaw to Microsoft. On July 16, 2003, Microsoft published security bulletin MS03-026 with a patch, rated the flaw critical for every affected version of Windows and advised: “Systems administrators should apply the patch immediately.” As a stopgap, it suggested blocking the RPC ports at the firewall or switching off DCOM. No public attack code existed yet. By July 26, working attack code was on a public mailing list, and on July 31, CERT/CC reported widespread scanning and exploitation.

After the outbreak, Microsoft went beyond its usual practice and provided its patch for Windows 2000 Service Pack 2 and Windows NT 4.0 Workstation as well, although their support had already ended. On September 10, 2003, its bulletin MS03-039 fixed three more flaws in the same service and replaced MS03-026; for the old versions, Microsoft made an exception “due to the nature of this vulnerability”.

Microsoft also defused the attack on windowsupdate.com. On August 15, the day before, it stopped resolving that address in the DNS, the address book of the internet, according to the SANS Internet Storm Center, which tracks internet attacks. Infected computers found nothing to attack, while Windows’ automatic updates, which used windowsupdate.microsoft.com, kept working.

On November 5, 2003, Microsoft, joined by the FBI, the US Secret Service and Interpol, offered USD 250,000 for information leading to the arrest and conviction of those behind the original worm. People behind two later variants had already been arrested; the author of the original was never caught, the study notes. Millions downloaded Microsoft’s cleanup tool in January 2004, but according to the study, the number of infections barely changed.

A year later, in August and September 2004, the researchers counted more than 200,000 different addresses still spreading the worm, up to 4,100 a day. Most were new: 99.5 % of the addresses, and 73 % of the surrounding blocks of 256 addresses, had not appeared during the outbreak. The researchers conclude that the worm moved on to new computers as old ones were cleaned or switched off.

The National Vulnerability Database rates the flaw 7.5 out of 10 on the older CVSS version 2, with no score on version 3. That score assumes only partial harm to confidentiality, integrity and availability, although Microsoft says an attacker could gain complete control of the computer.