SQL Slammer: The 376-Byte Worm That Choked the Internet in 10 Minutes

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In January 2003, a worm called SQL Slammer, just 376 bytes long, compromised 75,000 database servers in exactly 10 minutes. It exploited a buffer overflow in Microsoft's SQL Server and its desktop engine, MSDE, arriving on UDP port 1434, the SQL Server Resolution Service. Slammer never wrote itself to disk. It lived only in RAM, looping endlessly: pick a random IP address, fire off a copy of itself in a single UDP packet, repeat. Some enterprise servers sent 30,000 infected packets per second, and because UDP needs no handshake, routers had no session to track or throttle.

The real damage came from the network itself. Core routers hit 100 percent CPU and crashed, and BGP updates announcing each crash, then each reboot, flooded the internet's routing tables until administrative traffic became the jam. Bank of America's ATM network went down, Continental Airlines canceled flights, and Seattle's 911 dispatch center fell back to pen and paper. The flaw was no secret: researcher David Litchfield had found it and demonstrated it at the Black Hat Briefings, and Microsoft had released patch MS02-039 on July 24, 2002, six months before the attack. Even Microsoft's own internal networks were infected.

• Rebooting an infected server wiped the worm from memory, but unpatched machines were reinfected within milliseconds of reconnecting.
• The whole payload fit inside one standard packet of about 1,500 bytes, so it never had to split and reassemble.
• Most home PCs were immune because they did not run Microsoft SQL Server, yet the internet still ground to a halt.
• MSDE was often installed silently by third-party software, so many administrators did not know they had a vulnerable server to patch.
• Researchers on the Bugtraq mailing list urged administrators to block UDP port 1434, but the 10-minute window had already closed.