SQL Slammer
376 bytes, and the internet saturated in under ten minutes
On 25 January 2003 a worm of 376 bytes began exploiting a buffer overflow in Microsoft SQL Server. It required no file to be written to disk, existing only in memory, and it did not wait for responses before sending the next packet.
It doubled in size roughly every eight and a half seconds and saturated the public internet within about ten minutes. A patch had been available for six months. Cash machines went offline, airline check-in systems failed, and emergency call centres in Seattle lost service.
The fastest-spreading worm ever recorded, and the clearest evidence that patch latency is the real exposure window. Six months of available fix counted for nothing.
The Hacker Chronicles
Volume Two — Going Pro
This page is the summary. The chapter — ‘Slammer’ — follows the case properly: what was known at the time, who decided what, and how it actually unfolded rather than how it was later retold.
Two more volumes this year.
Going Geopolitical in October, Going Strategic in December.
Never shared, never sold. One-click unsubscribe.
Or email contact@ronanblake.co.uk
with ‘list’ in the subject.