Slammer Worm Doubled In Seconds

Picture a single server sitting quietly in a rack somewhere, doing its job, asking for nothing. Then one tiny packet of data arrives, smaller than a short text message, and lands in exactly the wrong place. Nothing explodes. Nothing gets stolen. The server simply starts doing one new thing: firing copies of that same tiny packet back out into the internet, as fast as its connection allows, hunting for other machines with the same weakness. Now picture the second machine catching it. And the fourth. And the eighth. This is a stopwatch story, because from that first packet to a planet-sized traffic jam took about ten minutes. It happened on 25 January 2003, the worm was called SQL Slammer, also known as Sapphire, and people who study internet safety still speak of it the way weather experts speak of record-breaking storms.

What SQL Slammer actually was

A worm is a program that spreads by itself. A normal virus needs a person to open a file or click a link, but a worm knocks on door after door across the network on its own, looking for one specific unlocked door. SQL Slammer’s unlocked door was a flaw in Microsoft SQL Server, software that stores and manages databases for businesses. The same flaw also existed in a smaller desktop version of that engine, and here is the part that made Slammer so sneaky: that desktop engine was quietly bundled inside many other programs. Plenty of infected computers were running the vulnerable software without their owners ever knowing it was there.

The worm itself was astonishingly small, just 376 bytes of code. To feel how small that is, this paragraph you are reading is longer than the entire worm. That tiny size mattered, because the whole worm could fit inside a single network packet, one small bundle of data. It carried no tools for stealing passwords and no instructions to delete files. Its entire body was basically one command: land, copy yourself, and send yourself onward as fast as possible. There was no second stage and no waiting for instructions from anyone. A bigger malicious program has to arrive in pieces and be put together before it can start working, but Slammer arrived whole, in a single breath, and could begin spreading the instant it landed. That is a large part of why nothing before it had ever moved at this speed.

Minute zero, minute one, minute ten

Slammer doubled its numbers roughly every 8.5 seconds, and doubling is a trick that fools almost everyone. One infected server becomes two, two become four, four become eight, and for the first few rounds the numbers look harmless. Keep doubling, though, and the curve turns nearly vertical. Within about a minute the worm was already racing through hundreds of machines. Within about ten minutes it had infected around 75,000 servers, which experts believe was the great majority of every vulnerable machine on Earth. In ten minutes, the hunt was almost over, simply because there was almost nothing left to find.

The damage came from what all those machines did next. Every copy of Slammer fired out scans at full speed, each scan a fresh attempt to find the next victim. Multiply “full speed” by 75,000 servers and the result was a flood of junk traffic so heavy that networks choked on it. Honest data could not get through, the way cars cannot move when every road in a city is bumper to bumper. Slammer stole nothing and deleted nothing. The disaster was pure traffic.

The morning after: ATMs, airlines and a dark country

As the sun rose on the damage, the reports showed how deeply daily life already depended on those choked networks. Bank of America’s ATM network went down, it was reported at the time, leaving customers unable to use cash machines. Continental Airlines had to cancel and delay flights after its systems were hit. Seattle’s 911 emergency call service ran into problems. Most dramatic of all, South Korea suffered a near-total internet collapse that lasted for hours, in one of the most connected countries on the planet.

Notice what ties those stories together. The worm never touched the money inside the ATMs or the planes on the runway. It simply blocked the roads their computers needed to talk to each other, and that was enough. And behind the whole morning-after mess sat one uncomfortable fact: Microsoft had released a patch, a free repair for this exact flaw, back in July 2002, roughly six months before the worm appeared. The machines that fell were, almost without exception, the machines that had never installed it.

How a worm like Slammer reaches ordinary people and businesses

Most home computers never ran SQL Server, so Slammer mostly struck businesses, universities and service providers. But its real road into a machine is one every reader should recognise, because the same road exists today. Software hides inside other software. A program gets installed for one job, brings a database engine or some other helper along with it, and then everyone forgets the helper exists. Nobody updates what nobody remembers. Years later, that forgotten corner of the system is exactly where a worm walks in.

For an ordinary person, the modern version of this story is smaller but identical in shape: a phone, laptop, router or app with a known flaw and an update that keeps getting postponed. The worm does not need you to be important. It only needs you to be unpatched and reachable.

There is also an indirect road, and the morning-after stories prove it. A person can meet a worm like Slammer without owning a single infected machine, simply by using a service whose computers were hit. The bank customer standing at a dead cash machine and the traveller staring at a cancelled flight were victims of Slammer too. The worm reached them through the businesses they trusted, which is why one skipped update inside a company can land on thousands of strangers.

How to protect yourself from the next Slammer

Turn on automatic updates everywhere. On your phone, your computer and your apps, automatic updates close security holes while you sleep. Slammer’s victims had six months of warning; automatic updates would have used that warning on their own.

Install patches promptly, and restart when asked. An update that has downloaded but never installed protects nothing, because many repairs only lock into place after a restart. Treat the restart request as the final step of the repair, not as an interruption.

Know what is running on your machines. Once in a while, look through the programs on your computer and remove the ones you no longer use, since every leftover program is one more door to keep locked. Businesses should keep a simple list of their systems and who is responsible for patching each one, because the Slammer lesson is that the forgotten machine is the one that falls first.

Take “boring” security mail seriously. When a software maker announces an urgent security fix, that dull message is the sound of a door being offered a lock before the crowd arrives. I honestly think the saddest part of the Slammer story is that the cure sat there, free, for six months, and still was not enough on its own. A patch only works on the machines that actually install it.

Ten minutes was all it took for 376 bytes to circle the planet. The next Slammer will be faster. The good news hidden inside this old story is that its victims were not beaten by cleverness; they were beaten by one skipped update, and a skipped update is something anyone can fix today.

Common questions

What was SQL Slammer in simple words?

SQL Slammer was a tiny computer worm that appeared on 25 January 2003 and spread through a flaw in Microsoft’s SQL Server software. It was only 376 bytes, small enough to travel inside a single network packet. It did not steal or delete anything; it simply copied itself so fast that it flooded the internet with traffic.

How could something so small cause so much damage?

Because it doubled roughly every 8.5 seconds, it reached around 75,000 servers in about ten minutes, and every one of those servers began scanning for new victims at full speed. That mountain of junk traffic choked networks worldwide. The harm was a traffic jam, not a robbery.

Which famous services did Slammer affect?

Reports at the time linked Slammer to Bank of America’s ATM network going down and to Continental Airlines cancelling and delaying flights. Seattle’s 911 emergency call service also had problems. South Korea’s internet nearly collapsed completely for hours.

Why did Slammer succeed when a fix already existed?

Microsoft had released a patch for the flaw in July 2002, about six months earlier. The worm infected the machines whose owners had never installed that patch, including computers running a hidden desktop version of the software that came bundled with other programs. A fix cannot protect a machine it never reaches.

Could a worm spread that fast again today?

The same basic ingredients still exist: connected machines, newly discovered flaws and updates that people delay. Modern networks and automatic updates make a repeat harder, but the speed record Slammer set is a warning that still stands. Keeping automatic updates switched on is the simplest protection an ordinary person has.

Sources

• Wikipedia — SQL Slammer: https://en.wikipedia.org/wiki/SQL_Slammer