SQL Slammer’s mysterious disappearance(blogs.iss.net)
blogs.iss.net
SQL Slammer’s mysterious disappearance
http://blogs.iss.net/archive/sqlslam.html
4 comments
that doesn't justify the sudden silence in matter of months that the article shows in the graphic, I wonder if analyzing the worm's code shows if there is a time condition or bug that disables it after X date.
Maybe some independent hacker finally got sick of it and decided to send the hosts some kind of shutdown code?
launches itself on UDP port 1434, and if the packets hit a vulnerable windows 2000 server
Technically speaking, UDP Port 1434 is a SQL Server service-discovery port and it would depend on SQL Server (2000) to be installed to have any affect.
My experience as a former SQL-Server consultant is that most organizations have been phasing out SQL Server 2000 for quite a while now, and only business-critical applications which for one reason or another are impossible to migrate to a newer version of SQL Server seems to be the only reason it is still around.
This doesn't explain the sudden drop, but just thought I'd clear up what I considered factually incorrect ;)
Technically speaking, UDP Port 1434 is a SQL Server service-discovery port and it would depend on SQL Server (2000) to be installed to have any affect.
My experience as a former SQL-Server consultant is that most organizations have been phasing out SQL Server 2000 for quite a while now, and only business-critical applications which for one reason or another are impossible to migrate to a newer version of SQL Server seems to be the only reason it is still around.
This doesn't explain the sudden drop, but just thought I'd clear up what I considered factually incorrect ;)
Sorry, I meant SQL Server 2000 on Windows 2000. I can't remember whether the necessary bits for NT were included in the worm.
This almost sounds as if it's a bug, say, an int that flipped over. Wouldn't an unsigned 16 bit int of milliseconds flip over after some 8-9 years?
On the other hand, it's a bit hard to believe that IBM Security Systems would miss that... So while perhaps plausible, doubtful.
On the other hand, it's a bit hard to believe that IBM Security Systems would miss that... So while perhaps plausible, doubtful.
Bearing in mind that the vulnerability exploits a weakness in a very old no longer supported version of Windows, and that the patch came out 9 years ago it's not surprising that slammer activity has decreased.
There are a number of possible reasons for this - for example, maybe there were just a few infected servers and these have been taken offline, or that some form of filtering has been put in place at the ISP or country level so ISS' sensors no longer pick it up, but the reality is we just don't know.
All worms have a shelf life, perhaps slammer's just reached the end of it's one. 8 years isn't a bad run. After all, how many Morris worm infections does anyone see these days?
[1] - http://www.microsoft.com/technet/security/bulletin/MS02-039....