SQL Slammer: the worm that hit 90 % of its targets in 10 minutes

Early on Saturday, January 25, 2003, a worm called SQL Slammer, also known as Sapphire, infected more than 90 % of the vulnerable computers on the internet within 10 minutes. A worm is a program that spreads from computer to computer on its own. Slammer attacked Microsoft’s database software SQL Server 2000 through a flaw that Microsoft had fixed six months earlier, and its traffic alone knocked networks and other systems offline.

How it worked

SQL Server 2000 can run several copies of the database server, called instances, on one machine. A small helper, the SQL Server Resolution Service, tells programs which network port, a kind of numbered door, each instance uses. The service itself listens on UDP port 1434. UDP is a way of sending single data packets without first setting up a connection.

One part of this service copied data from an incoming packet into a memory area of fixed size, a buffer, without checking the length. A single crafted packet could overflow the buffer and run code inside the database server. The same service is part of MSDE 2000, a database engine that Microsoft also shipped inside other products, such as Visual Studio.

Slammer was nothing more than such a packet: 376 bytes of code, 404 bytes as a complete packet. It carried no harmful payload, only the code to spread itself. Every infected computer sent copies to random addresses as fast as its network connection allowed. Because UDP needs no reply, only the bandwidth of the networks limited the speed. The worm lived only in memory and left no file behind. A restart removed it, but an unpatched server was infected again within minutes.

Speed and reach

Researchers from CAIDA and other institutes reconstructed the outbreak from traffic data and published their study, “Inside the Slammer Worm”, in 2003. A scan in the table below is one attempt to reach a random address.

For the Code Red outbreak of 2001, the study gives a doubling time of about 37 minutes. The study calls Slammer two orders of magnitude faster, about a hundred times. A single infected computer sent up to 26,000 scans per second; the average was about 4,000.

The researchers counted at least 75,000 infected computers, “perhaps considerably more”. The largest share was in the United States:

What the traffic hit

Slammer did not change or delete any data. The harm came from its traffic, which overloaded networks and took other systems offline with them.

The best-documented case is the Davis-Besse nuclear power plant in Ohio, in the United States. According to the US Nuclear Regulatory Commission (NRC), the worm got into the plant’s network on January 25. The plant’s safety parameter display system, which displays key safety readings, was unavailable for 4 hours and 50 minutes, and the plant process computer for 6 hours and 9 minutes. The NRC says that the plant’s control and protection functions were not affected.

Press reports at the time, cited in the study, also named cash machines, emergency call terminals and cancelled flights. There is no reliable figure for the total cost: only press and industry estimates exist.

The fix and the response

The British firm NGSSoftware had reported the flaw to Microsoft. On July 24, 2002, Microsoft published security bulletin MS02-039 with a patch and the advice: “System administrators should install the patch immediately.” A day later, it added MSDE 2000 to the bulletin, and the fix later became part of SQL Server 2000 Service Pack 3. Microsoft says the patch “is effective in protecting SQL Server 2000 and MSDE 2000 against the SQL Slammer worm”. Six months after its release, at least 75,000 computers still lacked it.

During the outbreak, many networks began within an hour to block all packets to UDP port 1434 in their routers and firewalls. By then, the worm had long reached almost all vulnerable computers.

The US National Vulnerability Database rates the flaw 7.5 out of 10 on the older CVSS version 2; it has no score on the newer version 3. The score is not higher because SQL Server normally runs with the rights of an ordinary user account, not with full system rights.