Slammer virus. Computer virus that managed to infect tens of thousands of servers around the world
Summary
[ hide ]
- 1 History
- 2 Infection method
- 3 Propagation method
- 4 Effects
- 5 Sources
History
In January of the 2003 , Slammer proved so damaging that could be a worm for public and private services. The worm released a flood of network packets , and the amount of data it transmitted across the Internet caused several servers to suspend activities almost immediately. Among the victims of the worm were Bank of America, the US emergency service 911 and a plant.
The story of Slammer began the 25 of January of 2003 , when within just ten minutes managed to infect tens of thousands of servers around the world , collapsing Internet globally. The reappearance of this worm of just 376 bytes , which had been practically inactive since 2003 .
Detected attack attempts targeted a total of 172 countries , with 26% of offensives directed at US networks. Additionally, the IP addresses that initiated the highest number of SQL Slammer- related assaults are registered in China , Vietnam , Mexico, and Ukraine .
Infection method
Slammer carries out the following infection process :
- It reaches the computerfrom another SQL server and is memory resident .
- Loads three API functions from Winsock ( networkmanagement standard ):
- Socketand Sendto ( DLL ), for sending.
- GetTickCount (KERNELL32.DLL), to get the random IP of the server it will try to attack.
- Starts sending massive filesof 376 bytes with the code of the worm through the 1434 port.
Due to this continuous process and the multiple shipments, a DDoS (distributed denial of services) attack is generated on said port.
Slammer does not create or modify files. Nor does it modify the Windows registry .
Propagation method
It reaches the server from another SQL server. Once on the computer, it looks for other machines that act as SQL servers, to infect them. To do this, it takes advantage of a Buffer Overflow vulnerability, which exists on servers that do not have Service Pack 3 installed.
Effects edit
- Slammer causes the following effects on the affected server:
- Increase networktraffic through UDP port 1434 (SQL Server Resolution Service Port).
- It slows down and even crashes the server.
- It slows down the Internet.
- It may cause the emailservice to crash .
- It may cause the network tohang .
