75 %
25 %
Information about Slammer

Published on November 20, 2007

Author: Kiska


Analysis of the W32.Slammer Worm:  Analysis of the W32.Slammer Worm Mikhail Akhmeteli W32.Slammer Overview:  W32.Slammer Overview Aliases: SQL Slammer, Saphire, W32.SQLExp.Worm Released: January 25, 2003, at about 5:30 a.m. (GMT) Fastest worm in history Spread world-wide in under 10 minutes Doubled infections every 8.5 seconds 376 bytes long Overview (continued):  Overview (continued) Platform: Microsoft SQL Server 2000 Vulnerability: Buffer overflow Patch available for 6 months Propagation: Single UDP packet Features: Memory resident, hand-coded in assembly Direct Damage:  Direct Damage Infected between 75,000 and 160,000 systems Disabled SQL Server databases on infected machines Saturated world networks with traffic Disrupted Internet connectivity world-wide Effective Damage:  Effective Damage South Korea was taken off-line Disrupted financial institutions Airline delays and cancellations Affected many U.S. government and commercial websites Specific Damage:  Specific Damage 13,000 Bank of America ATMs stopped working Continental Airlines flights were cancelled and delayed; ticketing system was inundated with traffic. Airport self-check-in kiosks stopped working Activated Cisco router bugs at Internet backbones Propagation Technique:  Propagation Technique Single UDP packet Targets port 1434 (Microsoft-SQL-Monitor) Causes buffer overflow Continuously sends itself via UDP packets to pseudo-random IP addresses, including broadcast and multicast addresses Does not check whether target machines exist Recovery:  Recovery Disconnect from network Reboot the machine, or restart SQL Server Block port 1434 at external firewall Install patch Propagation Speed:  Propagation Speed Infected 90% of vulnerable machines within 10 minutes Doubled infections every 8.5 seconds Achieved 55 million scans per second Two orders of magnitude faster than Code Red Propagation Speed:  Propagation Speed Source: Infections 30 Minutes After Release:  Infections 30 Minutes After Release Source: Propagation Analysis:  Propagation Analysis Rapid spread made timely defense impossible Rapid spread caused worm copies to compete Bandwidth limited, not latency limited (doesn’t wait to establish connection) Easy to stop at firewall Possible Variations:  Possible Variations Could have attacked HTTP or DNS servers Could have gone dormant Could have forged source port to DNS resolution Worm Composition:  Worm Composition 376 bytes long Less than 300 bytes of executable code 404 byte UDP packets, including headers Composed of 4 functional sections Worm Functions:  Worm Functions Reconstructs session from buffer overflow Obtains (and verifies!) Windows API function addresses Initializes pseudo-random number generator and socket structures Continuously generates random IP addresses and sends UDP data-grams of itself Packet Capture:  Packet Capture Reconstruct session Get Windows API addresses Initialize PRNG and socket Send Packets Buffer Overflow References:  References eEye Digital Security. Cooperative Association for Internet Data Analysis (CAIDA) Internet Storm Center. The Washington Post. C|NET

Add a comment

Related presentations

Related pages

Poetry Slam – Wikipedia

Weitere Slammer und Slammerinnen traten in den vergangenen Jahren mit humoristischen (Julius Fischer, Lars Ruppel), lyrisch-performativen ...
Read more Wörterbuch :: slammer - Wörterbuch Englisch-Deutsch

Englisch-Deutsch-Übersetzung für slammer im Online-Wörterbuch (Deutschwörterbuch).
Read more

Poetry Slam – Was ist das? | Slammer Filet

“Ein Poetry Slam (sinngemäß: Dichterwettstreit oder Dichterschlacht) ist ein literarischer Vortragswettbewerb, bei dem selbstgeschriebene Texte ...
Read more | slammer | Wörterbuch Englisch-Deutsch

Übersetzung für slammer im Englisch-Deutsch-Wörterbuch
Read more

Slammers Basketball Agency - Slammers Basketball

Slammers Basketball FIBA player agency ... click here . FIBA certified Basketball Agency represents men and women in Europe
Read more

Slammers Basketball Player Agency - Slammers Basketball

Slammers Basketball - FIBA Player agency for men and women located in Germany.
Read more

SQL Slammer – Wikipedia

SQL-Slammer ist der Name eines Computerwurms, der einen ungepatchten Microsoft SQL Server 2000 befallen kann. Er begann am 25. Januar 2003, sich zu ...
Read more

Penn Slammer: Rollen / Spulen | eBay

Finden Sie tolle Angebote auf eBay für Penn Slammer in Stationärrollen. Verkäufer mit Top-Bewertung.
Read more

Penn Slammer 560: Stationärrollen | eBay

Finden Sie tolle Angebote auf eBay für Penn Slammer 560 in Stationärrollen. Verkäufer mit Top-Bewertung.
Read more

Slammer - definition of slammer by The Free Dictionary

slam·mer (slăm′ər) n. 1. One that slams: a slammer of doors. 2. Slang A jail. [From slam.] slammer (ˈslæmə) n (Law) the slammer slang prison slam ...
Read more