200 likes | 514 Views
Analysis of the W32.Slammer Worm. Mikhail Akhmeteli. W32.Slammer Overview. Aliases: SQL Slammer, Saphire, W32.SQLExp.Worm Released: January 25, 2003, at about 5:30 a.m. (GMT) Fastest worm in history Spread world-wide in under 10 minutes Doubled infections every 8.5 seconds
E N D
Analysis of the W32.Slammer Worm Mikhail Akhmeteli
W32.Slammer Overview • Aliases: SQL Slammer, Saphire, W32.SQLExp.Worm • Released: January 25, 2003, at about 5:30 a.m. (GMT) • Fastest worm in history • Spread world-wide in under 10 minutes • Doubled infections every 8.5 seconds • 376 bytes long
Overview (continued) • Platform: Microsoft SQL Server 2000 • Vulnerability: Buffer overflow • Patch available for 6 months • Propagation: Single UDP packet • Features: Memory resident, hand-coded in assembly
Direct Damage • Infected between 75,000 and 160,000 systems • Disabled SQL Server databases on infected machines • Saturated world networks with traffic • Disrupted Internet connectivity world-wide
Effective Damage • South Korea was taken off-line • Disrupted financial institutions • Airline delays and cancellations • Affected many U.S. government and commercial websites
Specific Damage • 13,000 Bank of America ATMs stopped working • Continental Airlines flights were cancelled and delayed; ticketing system was inundated with traffic. Airport self-check-in kiosks stopped working • Activated Cisco router bugs at Internet backbones
Propagation Technique • Single UDP packet • Targets port 1434 (Microsoft-SQL-Monitor) • Causes buffer overflow • Continuously sends itself via UDP packets to pseudo-random IP addresses, including broadcast and multicast addresses • Does not check whether target machines exist
Recovery • Disconnect from network • Reboot the machine, or restart SQL Server • Block port 1434 at external firewall • Install patch
Propagation Speed • Infected 90% of vulnerable machines within 10 minutes • Doubled infections every 8.5 seconds • Achieved 55 million scans per second • Two orders of magnitude faster than Code Red
Propagation Speed Source: http://www.caida.org/analysis/security/sapphire/
Infections 30 Minutes After Release Source: http://www.caida.org/analysis/security/sapphire/
Propagation Analysis • Rapid spread made timely defense impossible • Rapid spread caused worm copies to compete • Bandwidth limited, not latency limited (doesn’t wait to establish connection) • Easy to stop at firewall
Possible Variations • Could have attacked HTTP or DNS servers • Could have gone dormant • Could have forged source port to DNS resolution
Worm Composition • 376 bytes long • Less than 300 bytes of executable code • 404 byte UDP packets, including headers • Composed of 4 functional sections
Worm Functions • Reconstructs session from buffer overflow • Obtains (and verifies!) Windows API function addresses • Initializes pseudo-random number generator and socket structures • Continuously generates random IP addresses and sends UDP data-grams of itself
Packet Capture Buffer Overflow Reconstruct session Get Windows API addresses Initialize PRNG and socket Send Packets
References • eEye Digital Security. http://www.eeye.com/html/Research/Flash/sapphire.txt • Cooperative Association for Internet Data Analysis (CAIDA) http://www.caida.org/outreach/papers/2003/sapphire/sapphire.html • Internet Storm Center. http://isc.incidents.org/analysis.html?id=180 • The Washington Post. http://www.washingtonpost.com/wp-dyn/articles/A46928-2003Jan26.html • C|NET News.com. http://news.com.com/2100-1001-982135.html