Sapphire signals a new type of threat, experts say
- By William Jackson
- Feb 05, 2003
The Sapphire'or Slammer'worm that swamped the Internet on Jan. 25 exploded in a big bang, spreading faster than any previous worm, before almost burning itself out in 10 minutes, according to a report released yesterday.
'The Sapphire worm represents a major new threat in computer worm technology, demonstrating that lightning-fast computer worms are not just a theoretical threat but a reality,' said Stuart Staniford, president and founder of Silicon Defense of Eureka, Calif., and one of the report's authors. 'Although this worm did not carry a malicious payload, it did a lot of harm by spreading so aggressively and blocking networks.'
The report was produced by a team of computer scientists from the University of California at Berkeley and San Diego, the UCSD San Diego Supercomputer Center, Silicon Defense, and the International Computer Science Institute in Berkeley, Calif. They analyzed traffic data collected at Internet junctions around the world.
The worm exploited a vulnerability in Microsoft SQL Server and spread so quickly that some networks were overwhelmed by the traffic. It debuted at 12:30 a.m. ET on Jan. 25.
The possibility of such a fast worm was predicted by Silicon Defense in October, but Sapphire was the first example of it. With only 376 bytes, about one-tenth the size of Code Red, it was able to replicate itself with blinding speed and send copies in a single packet to randomly generated IP addresses, infecting vulnerable machines without waiting for a response.
Because of its small size and speed, it was able to double its population every 8.5 seconds in the first minute of its attack, and within 10 minutes had infected at least 75,000 servers worldwide. By comparison, last year's Code Red worm infected nearly 360,000 hosts, most of them over a 12-hour period. Sapphire basically choked on its own traffic, which quickly interfered with its ability to spread copies of itself.
Sapphire carried no payload and the damage it caused was collateral, with high traffic volumes resulting in a slowing or denial of service in many areas. Because it was resident in memory, it could be removed by rebooting infected machines. The greatest threat is that the worm could represent a prototype, and that future expanded versions could do greater damage.
'If the authors of Sapphire had desired, they could have made a slightly larger version that could have erased the hard drives of infected machines,' said Nicholas Weaver, a researcher in Berkeley's Computer Science Department.
The full report is available online at www.caida.org/analysis/security/sapphire
William Jackson is a Maryland-based freelance writer.